README: apply the image-led frame (RW-6b)

[jothimani-rajendran]

What this changes

Applies the image-led README frame (RW-6b): cover panel, then panel + "Text version" details per section, copied from the chock#234 reference. Only README.md changes. Merge after chock#234 (panel links 404 until then).

Claim check

• No capability claim is widened; matrix numbers re-derived below
• No MATRIX row changed
• No payload shapes touched

Checks

• pytest -q: 1894 passed, 4 skipped
• ruff check .: All checks passed; ruff format --check .: 163 files already formatted
• Runtime path untouched; commit signed off

Heading outline (frame order)

24 ## Application security for the code your agents write
57 ## Install
.. ### Two ways to adopt it
.. ## How it works   (layers + matrix panels; ### Supported agents, Beyond security guards, Verify a claim)
.. ## Quick start    (inside the How it works block, after it)
.. ## What it stops
.. ## Guardrails, not guarantees
.. ## FAQ for people and agents
.. ## For tools and agents
.. ## Part of open-coder-ai
.. ## Contributing
.. ## License

(grep -n '^## ' README.md run at the pushed head.)

README checks run

• python3 tools/quickstart_block.py rebuilt with the docs/quickstart.sh header, diff -u docs/quickstart.sh /tmp/qs.sh: empty (byte-identical)
• tests/test_quickstart_block.py, test_repo_standards.py (every Decision outcome in backticks), test_instructions.py: all in the 1894 passed
• figures job: cd docs/figures && for g in make_*.py; do python "$g"; done; git diff --exit-code -- docs/figures: exit 0

Self-check grep

grep -n "pip install chock\|free forever\|never leaves\|would have prevented\|\[stars\]\|rtk\|hallucinat\|100%\|removes the findings\|never sends\|not on PyPI" README.md: only hits are the 7 width="100%" image attributes (same as the reference). pip install agentseam is kept inside Text version blocks.

Numbers (HEAD 104da73)

• grep -rn "import socket\|urllib\|http.client\|requests" src/agentseam: empty (exit 1)
• Matrix, via matrix.enforcement_level(a, e) over all agents and events: 16 agents, 12 events, 192 cells: {'detect': 55, 'best-effort': 34, 'none': 101, 'enforceable': 2}, 0 enforced. At pre_tool: 11 best-effort, 1 enforceable (cursor), 4 none (copilot, replit, zed, aider).
• Catalog, yaml-loading chock-catalog registry.yaml at f25f5a3: 71 policies; enforces: 35 enforced-at-commit, 11 best-effort, 25 advisory; eval_cases sum 4280, eval_executed sum 4098; Claude Code keywords: block 39, advise 24, warn 5, ask 3.
• OWASP ASI 10 of 10 / 7 / 0: carried from the brief and the previous README, not re-derived here.

Deviations

• ## Quick start stays an H2 (not an H3) inside the How it works details, because tools/quickstart_block.py requires that exact heading. It sits after the How it works text.
• Old matrix <picture> SVGs dropped from the README (the matrix panel replaces them); docs/figures untouched.
• Old "c5d2a00" citations updated to 104da73; catalog numbers now cite f25f5a3 (policies unchanged since 9a64623).
• Guardrails paragraph adds the measured 0 of 192 and the OWASP counts.
• Contributing and License sit in the Part of open-coder-ai details (no contribute panel).

🤖 Generated with Claude Code

---

Generated by Claude Code