Polish README and add SECURITY.md for launch readiness

- Remove Claude Code plugin promo (spam on Reddit/HN)
- Fix Python badge URL (was pointing to nonexistent pypi.org/project/ai-trace)
- Rewrite Why section with real pain story (3AM bad trade postmortem)
- Add SECURITY.md for consistency with other stack repos

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Your Name

README.md

@@ -3,7 +3,7 @@
 [![PyPI version](https://badge.fury.io/py/ai-decision-tracer.svg)](https://pypi.org/project/ai-decision-tracer/)
 [![Downloads](https://img.shields.io/pypi/dm/ai-decision-tracer)](https://pypi.org/project/ai-decision-tracer/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://pypi.org/project/ai-trace/)
+[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/)
 
 **Zero-dependency local AI agent decision tracer.**
 
@@ -14,11 +14,6 @@ Part of the **AI Agent Infrastructure Stack**:
 - [ai-injection-guard](https://github.com/LuciferForge/prompt-shield) — prompt injection scanner
 - **ai-trace** — local decision tracer ← you are here
 
-**Claude Code users** — install the whole stack in one command:
-```
-/plugin marketplace add LuciferForge/lucifer-skills
-```
-
 ---
 
 ## Install
@@ -53,17 +48,13 @@ tracer.save_markdown()    # → traces/trading_agent_20240301_143022.md
 
 ---
 
-## Why
+## Why this exists
 
-When you run an autonomous AI agent in production — trading bot, document processor, customer service agent — you need to know *why* it made every decision.
+My trading bot made a bad trade at 3AM. Lost money. I had logs — thousands of lines of `print()` spam — but I couldn't answer the basic question: **what did the agent see at the moment it decided to enter that position?**
 
-Not just the final output. The full chain:
-- What data it saw
-- What it computed
-- What it decided
-- What happened next
+Was it a bad signal? A stale data feed? A prompt injection that slipped past the scanner? Without a structured decision trace, postmortems are guesswork.
 
-`ai-trace` gives you that. Locally. No external service.
+`ai-trace` records every step an AI agent takes — what it saw, what it decided, why, and how long it took. JSONL auto-save (survives crashes), Markdown reports (human-readable), and a CLI for quick inspection. No cloud. No external service. Everything stays local.
 
 ---
 

SECURITY.md

@@ -0,0 +1,37 @@
+# Security Policy
+
+## What this library protects against
+
+`ai-decision-tracer` was built for production autonomous AI systems where
+understanding agent behavior is critical for security and compliance.
+
+### 1. Crash-safe trace persistence
+All steps are auto-saved to JSONL as they complete. If your agent crashes
+mid-execution, you still have a full trace up to the failure point.
+Uses atomic writes (temp file + rename) to prevent partial/corrupt output.
+
+### 2. No data exfiltration
+All trace data stays local. No network calls. No telemetry. No cloud sync.
+Your agent decisions, inputs, and outputs never leave your machine.
+
+### 3. Safe error capture
+Stack traces from exceptions are captured in the trace file for postmortems,
+but the library never logs raw prompts or full model responses unless you
+explicitly pass them to `step.log()`. You control what gets recorded.
+
+### 4. No runtime dependencies
+Zero third-party dependencies — nothing to supply-chain attack.
+Pure Python stdlib only.
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 0.1.x   | ✅        |
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities via GitHub Issues (mark as "security").
+Do NOT include sensitive data (API keys, prompts) in public issues.
+
+Expected response time: 48 hours.