Add MIT LICENSE and a per-file as-is notice

The repo is public and files are fetched by raw URL, so a reader who lands
on one runbook never sees the README -- the repo's context does not travel
with the file. Each .md now carries two lines under the title, each .ps1 the
equivalent at the end of its .NOTES block.

Deliberately two lines, not a paragraph. These files are read through `| more`
on a client console mid-incident, and the top of the file is where the
procedure-specific warnings live -- never a live chart, stop the service
before copying, confirm authorization before acting. A legal preamble above
those competes with them and trains people to skip past.

Wording aims at a stranger who found the repo, not at the quality of the
procedure: these double as documented-procedure evidence for E&O, and
language implying the content is unreliable works against that.

MIT rather than no license: the warranty and liability disclaimer is the part
that does the work, and leaving it unlicensed makes reuse ambiguous rather
than disclaimed.

Also fixes 5 stale ops/rb URLs in scripts/*.ps1 that the previous commit
missed -- it only swept the .md files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7

CONTRIBUTING.md

@@ -51,3 +51,22 @@ Scripts live under `scripts/`. Follow [`scripts/_template.ps1`](scripts/_templat
 - Safe to run via `irm <url> | iex` from our own server.
 - Confirm before anything destructive or that reboots.
 - Check for admin explicitly (`#Requires` is not enforced under `iex`).
+
+## The as-is notice
+
+Every runbook and script carries a short as-is notice — two lines under the `#`
+title in a `.md`, or at the end of the `.NOTES` block in a `.ps1`. Copy it when
+you add a file.
+
+It is per-file rather than README-only for one reason: these are fetched by raw
+URL, so a reader who lands on a single runbook never sees the README or the
+LICENSE. The repo's context does not travel with the file.
+
+Keep it to those two lines. It sits above genuinely important, procedure-specific
+warnings — never a live chart, stop the service before copying, confirm
+authorization before acting — and a longer legal preamble would train people to
+skip the top of the file, which is exactly where those warnings live.
+
+Aim it at a stranger who found the repo, not at the quality of the procedure.
+These runbooks double as documented-procedure evidence; wording that implies the
+content is unreliable works against that.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Godwin Systems LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -9,8 +9,11 @@ client workstations during on-site work with short, hand-typeable commands.
 > screenshots. Procedures with placeholders **only**. See
 > [CONTRIBUTING.md](CONTRIBUTING.md) for the sanitization rule.
 
-> Provided as-is, no warranty. Running any script is at your own risk. Contains
+> For qualified IT professionals, on systems they are authorized to administer.
-> no client-identifying data by policy.
+> Provided as-is, without warranty — verify anything here fits your environment
+> before running it. Scripts execute in your own session via `iex`; read them
+> first. Licensed under [MIT](LICENSE). Contains no client-identifying data by
+> policy.
 
 ## Using a runbook
 

od-backup-schedule.md

@@ -1,5 +1,8 @@
 # Runbook: Open Dental — Schedule & monitor backups (Windows)
 
+> For qualified IT professionals, on systems they are authorized to administer.
+> Provided as-is, without warranty — verify it fits your environment. See LICENSE.
+
 **Applies to:** The Open Dental database server, once [`od-db-backup.md`](od-db-backup.md) is proven to run by hand.
 **Goal:** Make the backup run **automatically every day**, replicate it **off-site**, and **monitor** it so a silent failure gets noticed within a day — not the day you need a restore.
 

od-backup-verify.md

@@ -1,5 +1,8 @@
 # Runbook: Open Dental — Verify a backup by test-restoring into an isolated Hyper-V VM
 
+> For qualified IT professionals, on systems they are authorized to administer.
+> Provided as-is, without warranty — verify it fits your environment. See LICENSE.
+
 **Applies to:** Any Open Dental cold backup produced by [`od-db-backup.md`](od-db-backup.md) (an `od-backup-<timestamp>` folder holding `data\`, `OpenDentImages\`, `FreeDentalConfig.xml`, `MANIFEST.txt`).
 **Goal:** Prove a backup is actually restorable and complete by restoring it into a **throwaway, network-isolated Hyper-V virtual machine** and running a short health checklist. A backup you have never restored is a guess.
 

od-cfg-persist.md

@@ -1,5 +1,8 @@
 # Runbook: Open Dental — Persist "Do not show this window on startup"
 
+> For qualified IT professionals, on systems they are authorized to administer.
+> Provided as-is, without warranty — verify it fits your environment. See LICENSE.
+
 **Applies to:** Windows workstation where Open Dental is run by a standard (non-admin) user.
 **Symptom:** The **Choose Database** window appears on every launch even though **"Do not show this window on startup (this computer only)"** is checked. The checkbox appears to take but does not survive a restart.
 **Root cause:** The setting is stored in `FreeDentalConfig.xml` in the Open Dental install directory. Standard users lack write permission to that directory, so the change is never saved. Per Open Dental's docs, saving this window's settings requires the process to write that file.

od-db-backup.md

@@ -1,5 +1,8 @@
 # Runbook: Open Dental — Rock-solid database + images backup (Windows)
 
+> For qualified IT professionals, on systems they are authorized to administer.
+> Provided as-is, without warranty — verify it fits your environment. See LICENSE.
+
 **Applies to:** The Windows machine hosting the Open Dental MySQL/MariaDB database (the "server").
 **Goal:** A fully consistent, restorable backup of both halves of an Open Dental practice — the **database** and the **A-to-Z images folder** — following Open Dental and MySQL/MariaDB best practice, including cleanly **stopping the database during the copy and restarting it after**.
 

od-scan-duplex.md

@@ -1,5 +1,8 @@
 # Runbook: Open Dental — Duplex ADF scanner captures only one side
 
+> For qualified IT professionals, on systems they are authorized to administer.
+> Provided as-is, without warranty — verify it fits your environment. See LICENSE.
+
 **Applies to:** Any single-pass duplex ADF scanner feeding Open Dental over **TWAIN** on a Windows 11 workstation (standalone / self-enrolled is common). Written against a Canon imageFORMULA DR-series with the combined ISIS/TWAIN/WIA driver package, but the diagnostic tree is model-agnostic.
 **Symptom:** A double-sided document run through the ADF into the Open Dental **Imaging** module lands as front-only — the back side is missing, blank, or pages come out in the wrong order.
 **Most likely cause:** Duplex is not enabled on whichever setting is *authoritative*, and which one is authoritative depends on the **Show TWAIN UI** toggle. The classic miss is a checked-but-inert control on the branch that isn't in charge.

od-smb-cred.md

@@ -1,5 +1,8 @@
 # Runbook: Open Dental SMB Share Access — Stored Credential Fix
 
+> For qualified IT professionals, on systems they are authorized to administer.
+> Provided as-is, without warranty — verify it fits your environment. See LICENSE.
+
 **Applies to:** Entra-joined Windows workstation accessing an Open Dental A-to-Z share on a standalone (non-domain, non-Entra) server via local SAM credentials.
 **Symptom:** Open Dental cannot reach `\\<SERVER>\<SHARE>` after workstation restart; works after manually connecting via File Explorer.
 **Root causes covered:** missing/stale stored Windows credential; Credential Guard blocking saved credential replay; elevated process not seeing user-session credentials.

scripts/_template.ps1

@@ -7,7 +7,7 @@
 
 .NOTES
   Convention for scripts in this repo — designed to run via:
-      irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/<file>.ps1 | iex
+      irm rb.godwinsystems.com/scripts/<file>.ps1 | iex
 
   Because `irm | iex` runs in the caller's session:
     - No param() block — you can't pass args through the pipe. Prompt with
@@ -17,6 +17,10 @@
 
   PUBLIC REPO: placeholders only. Never hard-code a client, host, user, or
   secret. Prompt for them at run time.
+
+  Provided as-is, without warranty. This runs in your session via `iex` —
+  read it before you run it. You are responsible for the systems you run
+  it on. See LICENSE.
 #>
 
 $ErrorActionPreference = 'Stop'

scripts/cg-disable.ps1

@@ -11,13 +11,17 @@
   Business), not plain Pro.
 
 .NOTES
-  Run via:  irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/cg-disable.ps1 | iex
+  Run via:  irm rb.godwinsystems.com/scripts/cg-disable.ps1 | iex
   Referenced by od-smb-cred.md, Step 3.
 
   If Credential Guard is still running after reboot, it was enabled with a
   UEFI lock (needs the bcdedit / physical-presence removal), or MDM policy is
   re-enabling it — align with the environment baseline instead of fighting it
   locally.
+
+  Provided as-is, without warranty. This runs in your session via `iex` —
+  read it before you run it. You are responsible for the systems you run
+  it on. See LICENSE.
 #>
 
 $ErrorActionPreference = 'Stop'

scripts/od-backup-check.ps1

@@ -22,7 +22,7 @@
 
 .NOTES
   Manual spot-check:
-      irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/od-backup-check.ps1 | iex
+      irm rb.godwinsystems.com/scripts/od-backup-check.ps1 | iex
 
   For unattended monitoring, schedule a filled-in LOCAL copy (with <DEST> and the
   heartbeat URL baked in) — keep that copy in the private tier, not here. See
@@ -30,6 +30,10 @@
 
   iex-safe: uses `return`, never `exit` (which would close an interactive
   session). PUBLIC REPO: no client specifics hard-coded; prompt at run time.
+
+  Provided as-is, without warranty. This runs in your session via `iex` —
+  read it before you run it. You are responsible for the systems you run
+  it on. See LICENSE.
 #>
 
 $ErrorActionPreference = 'Stop'

scripts/od-cfg-acl.ps1

@@ -15,7 +15,7 @@
   fails clearly if FreeDentalConfig.xml isn't found in either.
 
 .NOTES
-  Run via:  irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/od-cfg-acl.ps1 | iex
+  Run via:  irm rb.godwinsystems.com/scripts/od-cfg-acl.ps1 | iex
   Referenced by od-cfg-persist.md, Option B.
 
   SECURITY: on direct-connection setups FreeDentalConfig.xml also holds the
@@ -23,6 +23,10 @@
   not change that exposure, but prefer a limited MySQL user over root for
   workstation connections, and Middle Tier as the long-term fix that removes
   per-workstation DB credentials entirely. See the runbook's security note.
+
+  Provided as-is, without warranty. This runs in your session via `iex` —
+  read it before you run it. You are responsible for the systems you run
+  it on. See LICENSE.
 #>
 
 $ErrorActionPreference = 'Stop'

scripts/od-db-backup.ps1

@@ -28,7 +28,7 @@
 
 .NOTES
   Run ON THE DATABASE SERVER, elevated, when no one is using Open Dental:
-      irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/od-db-backup.ps1 | iex
+      irm rb.godwinsystems.com/scripts/od-db-backup.ps1 | iex
 
   Because `irm | iex` runs in the caller's session: no param() block (prompts via
   Read-Host), and #Requires is not enforced (admin is checked manually).
@@ -38,6 +38,10 @@
 
   PUBLIC REPO: no client specifics hard-coded. All paths are auto-detected or
   prompted at run time.
+
+  Provided as-is, without warranty. This runs in your session via `iex` —
+  read it before you run it. You are responsible for the systems you run
+  it on. See LICENSE.
 #>
 
 $ErrorActionPreference = 'Stop'

sec-google-compromise.md

@@ -1,5 +1,8 @@
 # Runbook: Incident response — suspected compromise of a consumer Google (Gmail) account
 
+> For qualified IT professionals, on systems they are authorized to administer.
+> Provided as-is, without warranty — verify it fits your environment. See LICENSE.
+
 **Applies to:** A **personal `@gmail.com` account** used for practice business at `<CLIENT>`. **Not Google Workspace.** There is no Admin console, no Admin SDK, no GAM, no audit-log export, and no vendor phone support for this account type. Every recovery path is Google's automated self-service flow.
 **Goal:** Evict an attacker who holds a stolen **session cookie** (not just a password), preserve evidence while doing it, and hand a clean factual record to the people who make the legal calls.
 **Assume:** the mailbox contains PHI, a breach risk assessment may follow, and **this document may become evidence.**

sec-google-evidence.md

@@ -1,5 +1,8 @@
 # Runbook: Google account — evidence capture + re-entry check
 
+> For qualified IT professionals, on systems they are authorized to administer.
+> Provided as-is, without warranty — verify it fits your environment. See LICENSE.
+
 **Applies to:** A consumer Google/Gmail account, before or after containment. No Workspace admin console required.
 **Use it for:** (a) capturing account state **before** you change anything, and (b) checking whether anyone got back in **after** a password reset.
 **Companion:** [`sec-google-compromise.md`](sec-google-compromise.md) — full containment procedure.