docs: rebuild org landing page, add LICENSE and SECURITY.md

The README of this repo renders as the org front page on
git.fromaitochitta.com/open. It was 5 lines and 209 bytes: a category
label, and a single navigation link that pointed away from the instance.
A visitor arriving from LinkedIn had no way into the 23 repos without
leaving the site they had just reached.

- README: a thesis (work that can be checked), navigation by purpose in
  five groups covering all 22 other repos, a maturity column read from
  the status-* topics that already exist on 22 of 23 repos, a verified
  two-line install block, and links that go INTO the instance. The link
  to fromaitochitta.com stays, last, as additional context.
- LICENSE: MIT, matching the other repos in the org (closes A8).
- SECURITY.md: org-level contact at the address already published on
  four other repos, with a realistic best-effort response process.

Absolute URLs rather than relative paths: how Forgejo resolves relative
links when rendering .profile/README.md on the org page is not measured,
and a pretty relative path that renders to 404 is worse than a long
absolute one that works. 25 links checked, 24 resolve 200 pre-push; the
25th is SECURITY.md itself. Known-negative control returns 404.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N1mHqwhG7BgaiUkaZ5PC7i

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kjell Tore Guttormsen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,5 +1,89 @@
-# fromaitochitta / open
+# From AI to Chitta — open
 
-Companion repos, plugins, and tools for [From AI to Chitta](https://fromaitochitta.com).
+Tools for working with AI in a way that can be checked.
 
-Browse all repos at [fromaitochitta.com/open-source](https://fromaitochitta.com/open-source).
+Everything here comes out of daily practice as an AI advisor: plugins that make
+Claude Code sessions disciplined and reproducible, security scanners that
+compute rather than guess, and frameworks for the parts of AI work that are
+usually asserted instead of measured. Built in the open, used every day.
+
+**New here?** Start with
+[voyage](https://git.fromaitochitta.com/open/voyage) — brief, research, plan,
+execute, review — or
+[llm-security](https://git.fromaitochitta.com/open/llm-security), OWASP-aligned
+scanning for Claude Code projects.
+
+## Workflow and discipline for Claude Code
+
+| Repo | What it does | Maturity |
+|---|---|---|
+| [voyage](https://git.fromaitochitta.com/open/voyage) | Contract-driven pipeline: brief, research, plan, execute, review | stable |
+| [config-audit](https://git.fromaitochitta.com/open/config-audit) | Multi-agent analysis and optimisation of Claude Code configuration | stable |
+| [graceful-handoff](https://git.fromaitochitta.com/open/graceful-handoff) | One-command session handoff into the STATE.md continuity system | stable |
+| [repo-mailbox](https://git.fromaitochitta.com/open/repo-mailbox) | Local mailbox for coordination between sessions in different repos | beta |
+| [repo-standard](https://git.fromaitochitta.com/open/repo-standard) | Per-repo gate for this org's presentation standard | experimental |
+| [app-creator](https://git.fromaitochitta.com/open/app-creator) | Pre-design pipeline from app concept to Voyage-ready briefs | experimental |
+| [ktg-plugin-marketplace](https://git.fromaitochitta.com/open/ktg-plugin-marketplace) | The plugin catalog — install any of the above from here | stable |
+
+## Security
+
+| Repo | What it does | Maturity |
+|---|---|---|
+| [llm-security](https://git.fromaitochitta.com/open/llm-security) | Scanning, auditing and threat modeling for Claude Code projects | stable |
+| [llm-security-commons](https://git.fromaitochitta.com/open/llm-security-commons) | Runtime-neutral core: detector data and normative contracts | beta |
+| [llm-ingestion-pipeline-security](https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security) | Write-time defence for Python pipelines that persist LLM output | beta |
+
+## Architecture, cost and data
+
+| Repo | What it does | Maturity |
+|---|---|---|
+| [ms-ai-architect](https://git.fromaitochitta.com/open/ms-ai-architect) | Structured architecture guidance for the Microsoft AI stack | stable |
+| [portfolio-optimiser](https://git.fromaitochitta.com/open/portfolio-optimiser) | Multi-agent cost optimisation on Microsoft Agent Framework, gated by a deterministic validator | experimental |
+| [portfolio-optimiser-claude](https://git.fromaitochitta.com/open/portfolio-optimiser-claude) | The same method on the Claude Agent SDK | experimental |
+| [portfolio-optimiser-commons](https://git.fromaitochitta.com/open/portfolio-optimiser-commons) | Framework-neutral shared core: normative specs and golden fixtures | experimental |
+| [llm-ingestion-okf](https://git.fromaitochitta.com/open/llm-ingestion-okf) | Open Knowledge Format ingestion library: connectors and bundle inbox | alpha |
+
+## Leadership and practice
+
+| Repo | What it does | Maturity |
+|---|---|---|
+| [okr](https://git.fromaitochitta.com/open/okr) | OKR guidance for Norwegian public sector, on 4-month tertial cycles | stable |
+| [ki-produktivitetsmodell](https://git.fromaitochitta.com/open/ki-produktivitetsmodell) | Three levels of organisational AI productivity, for public-sector leaders (Norwegian) | — |
+| [ai-psychosis](https://git.fromaitochitta.com/open/ai-psychosis) | Meta-awareness tools for healthy AI interaction patterns | stable |
+
+## Content and design
+
+| Repo | What it does | Maturity |
+|---|---|---|
+| [linkedin-studio](https://git.fromaitochitta.com/open/linkedin-studio) | Content engine for Claude Code: posts, carousels, video, newsletters | beta |
+| [claude-design](https://git.fromaitochitta.com/open/claude-design) | Facilitator for prompting Claude Design, from idea to ready prompt | alpha |
+| [playground-design-system](https://git.fromaitochitta.com/open/playground-design-system) | Framework-free CSS design system for plugin playgrounds | beta |
+| [human-friendly-style](https://git.fromaitochitta.com/open/human-friendly-style) | Shared plain-language output style for the marketplace | stable |
+
+## Maturity labels
+
+Every repo carries a `status-*` topic, and the tables above read from it.
+`stable` is in daily use and safe to depend on. `beta` works and is in use,
+with an interface that may still move. `alpha` is early and will change.
+`experimental` is research — read it, do not build on it yet.
+
+## Install
+
+Most of the Claude Code work here ships as plugins. Add the marketplace once,
+then install what you want:
+
+```bash
+claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git
+claude plugin install voyage@ktg-plugin-marketplace
+```
+
+The first line only registers the catalog — it installs nothing on its own.
+The Python and framework repos are cloned and used directly; each has its own
+README.
+
+## License and security
+
+MIT unless a repo says otherwise — `ki-produktivitetsmodell` is CC BY 4.0.
+Security contact: [SECURITY.md](https://git.fromaitochitta.com/open/.profile/src/branch/main/SECURITY.md).
+
+More context and writing at [fromaitochitta.com](https://fromaitochitta.com).

SECURITY.md

@@ -0,0 +1,39 @@
+# Security policy
+
+This repository holds the landing page for the `open` organisation. It
+contains no code. The policy below is the security contact for the
+organisation as a whole; each repo also carries its own `SECURITY.md`
+with its version and disclosure details.
+
+## Reporting a vulnerability
+
+Report privately to <security@fromaitochitta.com> — do not open a public
+issue. If the vulnerability is in a specific repo, say which one.
+
+Please include the affected version or commit, a minimal reproduction,
+and the impact you see.
+
+## Response process
+
+This is a solo, best-effort project. There is no SLA and no paid support.
+What is committed to:
+
+1. Acknowledge within 5 working days.
+2. Triage and confirm severity within 10 working days.
+3. Develop and test a fix in the affected repo.
+4. Credit the reporter in the advisory unless they prefer to stay anonymous.
+
+Aim is to disclose within 90 days of the initial report, with the timeline
+agreed with the reporter.
+
+## Supported versions
+
+Every repo here is pre-1.0. Only the latest tagged release of a given repo
+receives security fixes; upgrade before reporting. Security-relevant fixes
+are recorded in each repo's `CHANGELOG.md`.
+
+## Out of scope
+
+Vulnerabilities in Claude Code itself, in the Claude API, or in third-party
+dependencies belong with their own maintainers. Report Claude Code issues to
+Anthropic.