Arena open-source boundary

Public repository: Charlex123/mirrormingo-arena.

The Apache-2.0 release includes the TypeScript client, public types, WebSocket helper, framework-independent player, OpenAPI description, examples, tests and local demonstration server. It includes no production backend, databases, question banks, learner data, uploaded photos, recorded voices, branded media or MirrorMingo application scene. The licence applies only to the public repository and the explicitly licensed Arena SDK source. Hosted service access and trademarks are separate.

Canonical client source lives in sdks/typescript/src/arena. Export with sdks/export_arena_repo.py, which copies an explicit allowlist into a new directory. It does not copy the parent repository or its Git history. Check mode detects drift.

The demonstration server runs on localhost with synthetic questions and in-memory state. It is not a self-hosted production service. Never expose it to the internet.

Contributions require regression tests and synthetic fixtures. Report security issues privately. Before publishing, run type checks, tests, build, demo smoke tests and npm pack --dry-run. GitHub publication, npm publication and hosted API deployment are distinct steps and must be reported separately.