feat(site): put prices on the page, and fix three dead links (#38)

Site half of the Marketplace listing work. App half:
commit-check/commit-check-app#36.

> Two commits. The first put a four-plan ladder on the page; the second
cuts it to three. The diff against `main` is the thing to review.

## The dead links

`github.com/marketplace/commit-check` **returns 404** — the listing is
not published. Three places linked to it:

- `docs/index.md` — the Pricing section's "See the plan on the
Marketplace"
- `docs/guides/github-app.md` — the opening sentence, and the primary
Install button

All three now point at `github.com/apps/commit-check`, which resolves
today. They move back to the Marketplace URL as the last step of
publishing the listing.

## Pricing

| Plan | Price | Covers |
|---|---|---|
| Open Source | Free | Public repositories, on any account |
| Personal | Free | Private repositories on a personal account |
| Team | $19 / month | Private repositories in an organization, at any
size |

**Prices are on the page.** autofix.ci keeps every number on the
Marketplace and links out. Copying that would be wrong here: this
section already argues that GitHub charges $21 a seat and about $340 a
month for a twenty-person team, and that argument does not land unless
the number it is being compared against is sitting next to it. The
closing line now reads "Nineteen dollars is what the same twenty people
cost here — and the same twenty thousand", which is the
seat-independence doing work.

**No seat tiers.** The App cannot enforce a seat count — it holds no
organization permissions, and GitHub does not check seats on a flat-rate
plan. Publishing "up to 25 users" would be an honour system with a 5×
cliff at 25 and nothing above 200.

**Personal stays free.** It competes with our own GitHub Action, which
does the same job on a private personal repository inside GitHub's free
Actions allowance. `guides/github-app.md` had promised "and stay free";
that sentence is intact.

The MIT tools get their own lead sentence instead of being folded into a
card called "Free", since "Free" is now two plan names that each mean
something narrower.

## New: Terms of Service

`/terms` was a 404 and the Marketplace listing wants one as a resource.
Covers what the service does, billing (GitHub's, not ours),
availability, liability, and the exit — the Action reads the same
`cchk.toml`, so nothing you write is locked to the hosted App.

**This is a starting draft and wants a human read before the listing
goes in for review.** I am not a lawyer.

## New FAQ entry

"Who is behind this?" — the eight existing entries never say who runs
the hosted service. autofix.ci names its maintainer in its FAQ, and on a
paid App that is a real trust signal.

## Layout

Three cards fit the shared `.cc-cards` grid, so the `minmax` override
the four-card version needed is reverted. Measured, not assumed:

| Viewport | Layout |
|---|---|
| 1024px and up | one row of three |
| 700–820px | 2 + 1 |
| 600px and below | stacked |

## Testing

`mkdocs build --strict` clean (0 warnings, `SOCIAL_CARDS=false` locally
since `cairosvg` is not in my env). Rendered and eyeballed the Pricing
section, the App guide's Plans table and the new Terms page.

`tests/docs_sync_test.py` could not run locally — it imports
`commit_check.rules_catalog`, not installed in this interpreter.
Untouched by this PR; CI passes it.

Also caught: `commit-check/commit-check-app` is private, so links into
it 404 for the public. The Terms page's security and issue-tracker links
point at `commit-check/commit-check` instead.

Author: shenxianpeng

docs/guides/github-app.md

@@ -1,13 +1,13 @@
 # GitHub App
 
-The hosted [Commit Check App](https://github.com/marketplace/commit-check)
+The hosted [Commit Check App](https://github.com/apps/commit-check)
 runs the same rule engine as the CLI, against the same config file, with no
 workflow file and no CI minutes. Install it once, push, and every commit gets
 a **Commit Check** result that says what failed, the value that failed, and
 how to fix it. Not every rule applies where the App runs; the
 [list](#which-rules) is below.
 
-[Install from the GitHub Marketplace](https://github.com/marketplace/commit-check){ .md-button .md-button--primary }
+[Install the App](https://github.com/apps/commit-check){ .md-button .md-button--primary }
 
 Choosing between the App and the [GitHub Action](github-actions.md): see
 [Where to run it](integrations.md#app-or-action). Both read the same config and
@@ -178,11 +178,29 @@ without a wall of red.
 
 ## Plans
 
-Public repositories and everything on personal accounts are free, and stay
-free. Today that is every repository: private repositories in organizations
-are checked at no charge while the App is new, and a paid **Team** plan for
-them is planned. When it arrives, a repository it applies to gets a neutral
-check saying so — nothing is blocked — and this page will say so first.
+Public repositories are free on any account, and everything on a personal
+account is free, and both stay free. Only an organization's private
+repositories are paid:
+
+| Plan | Price | Covers |
+|---|---|---|
+| Open Source | Free | Public repositories, on any account |
+| Personal | Free | Private repositories on a personal account |
+| Team | $19 / month | Private repositories in an organization, 14-day free trial |
+
+The Team plan is not tiered by seat count. Twenty of you and twenty thousand of
+you pay the same, so growing the team never changes the bill.
+
+Today none of this is enforced: every repository is checked at no charge while
+the App is new. When the plan goes live, a private organization repository
+without it gets a neutral check saying so — nothing is blocked, nothing is
+rejected — and this page will say so before it happens.
+
+The [CLI](../getting-started.md), the [pre-commit hook](pre-commit.md),
+the [GitHub Action](github-actions.md) and the [MCP server](mcp.md) are MIT
+licensed and always free. If you would rather not pay for the App on an
+organization's private repositories, the Action reads the same config and
+reports the same rule IDs — it just costs you CI minutes instead.
 
 ## Privacy
 

docs/index.md

@@ -275,29 +275,35 @@ One policy engine, five places to enforce it. Every one of them reads the same
 
 ## Pricing
 
+The CLI, the pre-commit hook, the GitHub Action and the MCP server are MIT
+licensed — no account, no limits, nothing to buy. The plans below are for the
+hosted GitHub App, the one surface we run for you.
+
 <div class="cc-pricing" markdown>
 
--   __Free__
+-   __Open Source__ · Free
 
     ---
 
-    The CLI, the pre-commit hook, the GitHub Action and the MCP server. MIT
-    licensed, no account, no limits.
+    Public repositories, on any account.
+
+-   __Personal__ · Free
+
+    ---
 
-    The hosted GitHub App is free too on public repositories and personal
-    accounts.
+    Private repositories on a personal account.
 
--   __Team__
+-   __Team__ · $19 / month
 
     ---
 
-    The hosted GitHub App on an organization's private repositories, with a
+    Private repositories in an organization, however many of you there are.
     14-day free trial.
 
-    [:octicons-arrow-right-24: See the plan on the Marketplace](https://github.com/marketplace/commit-check)
-
 </div>
 
+[:octicons-arrow-right-24: Install the App](https://github.com/apps/commit-check)
+
 Nothing is blocked while you try it. Without a config file the App reports its
 findings but leaves the check run neutral, and it never rejects a push — the
 only way Commit Check blocks a merge is if you make it a required check
@@ -307,7 +313,9 @@ GitHub can enforce some of the same policies natively, but the commit-metadata
 rules sit behind its Enterprise plan. For a twenty-person team that is the
 difference between $4 and $21 a seat — about $340 a month for a regular
 expression, which reports a bare mismatch where Commit Check reports a rule ID,
-a suggestion and a link. [The arithmetic and the honest caveats](compare/github-rules.md).
+a suggestion and a link. Nineteen dollars is what the same twenty people cost
+here — and the same twenty thousand.
+[The arithmetic and the honest caveats](compare/github-rules.md).
 
 ## Questions
 
@@ -357,6 +365,15 @@ a suggestion and a link. [The arithmetic and the honest caveats](compare/github-
     GitHub Action verifies the attestation with `gh attestation verify` before
     it installs anything, and fails the step if verification does not pass.
 
+??? question "Who is behind this?"
+
+    Commit Check is written and maintained by
+    [Xianpeng Shen](https://github.com/shenxianpeng), who also runs the hosted
+    App. The engine, the Action, the App and the MCP server are open source
+    under the [commit-check](https://github.com/commit-check) organization —
+    if the hosted App ever stops, the [GitHub Action](guides/github-actions.md)
+    reads the same config and reports the same rule IDs.
+
 <div class="cc-community" markdown>
 
 ## Questions, bugs, contributions

docs/terms.md

@@ -0,0 +1,100 @@
+# Terms of Service
+
+These terms cover the **Commit Check GitHub App** — the hosted service we run,
+which you install onto your GitHub account. The command-line tool, the
+pre-commit hooks, the GitHub Action and the MCP server are not covered here:
+they run inside your own environment and are governed by the [MIT
+licence](https://github.com/commit-check/commit-check/blob/main/LICENSE) of the
+repository you got them from.
+
+Installing the App means you accept these terms.
+
+## What the service does
+
+The App reads the commits of a push or pull request and the repository's
+configuration file, evaluates them against the rules that file turns on, and
+posts the result as a GitHub check run. That is all it does. It never writes to
+your repository, never rejects a push, and never blocks a merge on its own — a
+failing check only blocks a merge if you make it a
+[required status check](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging)
+yourself.
+
+What it reads and what it stores is set out on the [privacy page](privacy.md).
+
+## Your side
+
+You are responsible for the repositories you install the App on, for the rules
+you turn on, and for having the right to install it on an organization's
+repositories. Do not attempt to disrupt the service — for instance by sending
+traffic designed to exhaust it, or by probing it for vulnerabilities without
+telling us first. If you find a security problem, please
+[report it](https://github.com/commit-check/commit-check/security/policy) rather
+than exploiting it.
+
+## Plans, billing and trials
+
+**Nothing is charged today.** The Marketplace listing is not published yet, so
+there is no plan to buy and every repository is checked at no charge. This
+section describes what will apply once it is; the
+[pricing section](index.md#pricing) and the
+[App guide](guides/github-app.md#plans) say the same, and will say so before
+anything changes.
+
+Public repositories are free on any account, and so is everything on a personal
+account. An organization's private repositories will be covered by the Team
+plan, at the price shown in the pricing section.
+
+Billing, trials, renewals, cancellations and refunds will be handled by GitHub
+under the [GitHub Marketplace Terms of
+Service](https://docs.github.com/en/site-policy/github-terms/github-marketplace-terms-of-service),
+not by us — we never see your payment details. The Team plan comes with a
+14-day free trial; cancelling is done from your GitHub account's billing
+settings and takes effect at the end of the current period.
+
+If the price changes, the change applies to your account from the next
+renewal, and GitHub notifies you.
+
+## Availability
+
+The App is offered as is. We aim to keep it running and to fix what breaks, but
+we do not promise a level of uptime, and there is no support commitment beyond
+the [issue tracker](https://github.com/commit-check/commit-check/issues).
+We may change how the service works, or stop running it, with notice on this
+site and on the Marketplace listing.
+
+If the hosted App stops being available to you, the
+[GitHub Action](guides/github-actions.md) reads the same configuration file and
+reports the same rule IDs. Nothing you write in `cchk.toml` is locked to the
+hosted service.
+
+## Liability
+
+To the extent the law allows, the App is provided without warranty of any kind,
+and we are not liable for indirect or consequential loss arising from using it
+— including anything that follows from a check run that passed when you think
+it should have failed, or failed when you think it should have passed. Commit
+Check validates commit metadata; it is not a review, a test suite or a security
+control, and it is not a substitute for any of them.
+
+Where liability cannot be excluded, it is limited to what you paid for the
+service in the twelve months before the claim.
+
+## Ending it
+
+You can end these terms at any time by uninstalling the App from your account.
+We may suspend or end an installation that breaches these terms, or that is
+being used to disrupt the service.
+
+## Changes to these terms
+
+Changes are published on this page, and the date below changes with them.
+Continuing to use the App after a change means you accept it. If a change
+matters materially to paying accounts, we will also note it on the Marketplace
+listing.
+
+## Contact
+
+[Open an issue](https://github.com/commit-check/commit-check/issues) for
+anything about these terms or the service.
+
+_Last updated: 2026-09-07._

mkdocs.yml

@@ -175,6 +175,7 @@ nav:
       - Configuration: configuration.md
       - Changelog: changelog.md
       - Privacy: privacy.md
+      - Terms of Service: terms.md
   - Compare:
       - GitHub's built-in rules: compare/github-rules.md
       - Other tools: compare/tools.md