[AUTHENSOR]

Light presentation touch-up for the README. No functional/code changes.

Changes

Original commit (dead link + badges)

• Remove dead SiteSitter link. The "Authensor Safety Stack" list (README ~line 15) linked github.com/AUTHENSOR/SiteSitter, which is now private and returns a 404. Removed that one entry. Confirmed no other references to now-private repos remain.
• Add a small badge row. Added node-engine (>=20) and license (MIT) badges. (The npm version badge originally added here has since been removed — see below.)

Follow-up commit (first-run legibility + badge fix)

• Drop the npm version badge. It rendered a stale orange 1.0.0-beta.1 (the repo/README report beta.2, but only beta.1 is published to npm), which reads as "old/unmaintained" — the opposite of intent. Removed only that line; node + license badges kept (both verified accurate). Reversible once a beta.2 publish reconciles the versions.
• Add a "First run (no control plane yet)" section. A newcomer with no control plane running previously had nothing telling them the fail-closed denials and connectivity warnings are expected. The new section points them at the zero-friction action and sets expectations:
  • safeclaw run --dry-run "Summarize README.md" works standalone and exits 0 once the wizard/init has saved a provider API key.
  • Write/exec/network actions fail closed by design until a control plane is up.
  • safeclaw doctor connectivity is an expected [WARN]; safeclaw health reporting "unreachable" and exiting non-zero is the expected fail-closed probe result.

Verification (run from a fresh clone of this branch)

• safeclaw run --dry-run "..." (provider key set) → prints provider/policy simulation, exit 0.
• safeclaw doctor (provider key set, no control plane) → connectivity [WARN], overall exit 0.
• safeclaw health (no control plane) → "Control plane unreachable", exit 1 (fail-closed by design).
• npm test → 446 tests. In a normal local environment all pass (control plane absent ⇒ connectivity check returns instantly). Note: in a network-restricted sandbox the 14 tests/doctor.test.js cases that call runDiagnostics() can exceed vitest's default 5000ms timeout because the connectivity probe to localhost:3000 hangs+retries instead of refusing instantly — that is an environment timing artifact, not a code change in this PR.

Notes for maintainer (out of scope for this presentation PR — raise separately)

• npx authensor up is referenced but not published to npm (README, docs/install.md, src/doctor.js connectivity hint, etc.). It currently 404s, so the advertised path to stand up a control plane is a dead end. Fix needs a maintainer decision (publish authensor, or replace every reference with the real setup). Not guessed here.
• safeclaw init --demo (docs/quickstart.md step 3) claims it provisions a demo Authensor token, but empirically prints "Auto-provisioning failed: fetch failed" and drops to a Google Form. Needs the demo provisioning made real, or the step rewritten. Left untouched.
• Publish reconciliation: npm has @authensor/safeclaw@1.0.0-beta.1; repo/README are 1.0.0-beta.2. Publishing beta.2 would let the npm version badge be restored accurately.

---

Follow-up commit 4eb40c1 — control-plane setup is now real (no dead commands)

npx authensor up removed everywhere (it 404'd — the package never existed). Replaced with the real, public setup that serves the control plane on SafeClaw's default port (http://localhost:3000):

git clone https://github.com/AUTHENSOR/AUTHENSOR && cd AUTHENSOR && docker compose up -d

Verified against the flagship's main branch (has docker-compose.yml + a Quickstart mapping the control plane to :3000). Fixed in: README (×2), docs/install.md (×2), src/cli.js (×2), src/doctor.js, src/server.js, ui/dashboard/app.js.

safeclaw init --demo de-advertised — demo token auto-provisioning has no working backend (it degrades to a Google Form), so it's removed from the README command list, docs/quickstart.md, and docs/cli.md. The --demo flag and provisionDemo code path are kept (they fail gracefully); all tests unchanged.

Result: 446/446 tests pass, zero npx authensor up remains repo-wide, and a newcomer following any doc reaches a real, working control-plane setup.