Prepare for publication: licence, layout, and no host specifics

Adds the MIT licence at the root, which a public repository needs and this
one did not have.

The README claimed the repository holds everything and that this is
deliberate. Still true, and it is now also the source of truth for two
published extracts -- flamenet-e2e mirrors engine/, flamenet-relay mirrors
server/ -- which is worth saying plainly, because they are not forks and a
patch sent to one of them will be overwritten.

The relay's deployment notes named a specific box, its address and its
deploy directory. None of that is a credential and the address resolves
publicly anyway, but it is gratuitous in a repository about an iOS app.
Generic placeholders now. The earlier text is still in this repository's
history.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Extant 2000 LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -4,9 +4,11 @@ An end-to-end encrypted messenger: the apps, the server they talk to, and a
 specification complete enough that someone else could build a compatible
 client from it.
 
-This repository holds all of it. That is deliberate — a protocol and the thing
-that speaks it drifting apart in separate repositories is how "compatible"
-quietly stops being true.
+This repository holds all of it, and is the source of truth for every part. A
+protocol and the thing that speaks it drifting apart in separate repositories is
+how "compatible" quietly stops being true — so the interop harness here compiles
+the iOS engine and runs it against the JavaScript one on every change, which only
+works while they sit in the same checkout.
 
 ```
 engine/     the JavaScript engine, the specification, and the published vectors
@@ -16,6 +18,18 @@ android/    the Kotlin engine. No app yet; see android/README.md
 docs/       historical design notes
 ```
 
+Two of those are also published on their own, for people who want one piece
+rather than the whole project:
+
+| Repo | Mirrors | For |
+|---|---|---|
+| [flamenet-e2e](https://gitlab.com/paulhitt/flamenet-e2e) | `engine/` | The protocol, as a package |
+| [flamenet-relay](https://gitlab.com/paulhitt/flamenet-relay) | `server/` | Running your own relay |
+
+Those are **extracts, not forks**. Changes are made here and mirrored out; a
+patch sent to one of them has to land here or it will be overwritten. They have
+already drifted once, badly, which is why it is written down.
+
 ## The three engines
 
 The protocol is implemented three times, and that is the point rather than an

engine/scripts/secret-sweep.sh

@@ -18,7 +18,10 @@ ROOT="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
 cd "$ROOT"
 
 # Build products and vendored upstream are excluded: .build is compiler output,
-# and vendor/ is checked separately by the supply-chain digest test.
+# and vendor/ is checked separately by the supply-chain digest test. This script
+# excludes ITSELF by filename rather than by one hardcoded path -- it is the file
+# with every pattern in it, so a copy living anywhere else reports itself as a
+# find, and a repo with a `Scripts/` rather than a `scripts/` did exactly that.
 # `git ls-files .` and not plain `git ls-files`: this subtree may be untracked
 # in the repo that contains it, and an unscoped call there returns the WHOLE
 # repository. An empty result means untracked, not empty — fall back to find,
@@ -34,7 +37,7 @@ probe() {
   local label="$1" pattern="$2"
   local found
   found=$(printf '%s\n' "$FILES" \
-    | grep -vE '^(\./)?(vendor/|.*\.build/|scripts/secret-sweep\.sh$)' \
+    | grep -vE '(^|/)vendor/|\.build/|secret-sweep\.sh$' \
     | xargs -I{} grep -HnE "$pattern" {} 2>/dev/null || true)
   if [ -n "$found" ]; then
     echo "── $label"

engine/test/relay.mjs

@@ -18,13 +18,22 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-// The relay sits beside this package in the public repo (`<root>/server`) and
-// one level further up inside the app repo (`engine/` is a subtree there).
-// Resolve rather than assume: a hardcoded depth publishes a test that cannot
-// find the thing it tests, and this file SKIPS when the binary is missing, so
-// a wrong path reads as "no Swift toolchain" instead of as a broken harness.
-const RELAY = [join(HERE, '..', 'server'), join(HERE, '..', '..', 'server')]
-  .find((dir) => existsSync(join(dir, 'Package.swift'))) ?? join(HERE, '..', '..', 'server');
+// Where the relay is depends on which checkout this file is sitting in: a
+// subtree of the app repo, or the published engine repo with flamenet-relay
+// cloned beside it. Resolve rather than assume -- this file SKIPS when the
+// binary is missing, so a wrong path reads as "no Swift toolchain" rather than
+// as a broken harness, and would go unnoticed.
+//
+// FN_RELAY_DIR overrides, for a checkout somewhere else entirely.
+const RELAY_CANDIDATES = [
+  process.env.FN_RELAY_DIR,
+  join(HERE, '..', '..', 'server'),              // engine/ inside the app repo
+  join(HERE, '..', 'server'),                    // engine repo that still bundles it
+  join(HERE, '..', '..', 'flamenet-relay'),      // cloned beside the engine repo
+  join(HERE, '..', '..', '..', 'flamenet-relay'),
+].filter(Boolean);
+const RELAY = RELAY_CANDIDATES.find((dir) => existsSync(join(dir, 'Package.swift')))
+  ?? RELAY_CANDIDATES[RELAY_CANDIDATES.length - 1];
 const BIN = join(RELAY, '.build', 'debug', 'flamenet-relay');
 
 let pass = 0, fail = 0, skip = 0;