diff --git a/CHANGELOG.md b/CHANGELOG.md
index fcb3dee..f9d0498 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,7 +11,7 @@ on the default branch using [git-cliff](https://git-cliff.org/).
 
 ### Bug Fixes
 
-- **docs:** Correct template threat model in SECURITY [cc872a5](https://github.com/platformrelay/kollect-render/commit/cc872a58f202af893a03970ebdbe64304f59bb11)
+- **docs:** Correct template threat model in SECURITY [98df359](https://github.com/platformrelay/kollect-render/commit/98df359493e3b5b6c453bfaacb8e06743b85330b)
 
 - **ci:** SHA-pin workflow actions and HTTPS-harden gitleaks fetch [134399b](https://github.com/platformrelay/kollect-render/commit/134399bf8275be0acc308b3ee9bf2264c5e44b84)
 
diff --git a/README.md b/README.md
index 84f92ba..bba49ce 100644
--- a/README.md
+++ b/README.md
@@ -1,27 +1,34 @@
-# kollect-render
+<p align="center">
+<a href="https://github.com/platformrelay/kollect-render/actions/workflows/ci.yaml"><img src="https://github.com/platformrelay/kollect-render/actions/workflows/ci.yaml/badge.svg" alt="CI"></a>
+<a href="https://github.com/platformrelay/kollect-render/actions/workflows/codeql.yaml"><img src="https://github.com/platformrelay/kollect-render/actions/workflows/codeql.yaml/badge.svg" alt="CodeQL"></a>
+<a href="https://securityscorecards.dev/viewer/?uri=github.com/PlatformRelay/kollect-render"><img src="https://api.securityscorecards.dev/projects/github.com/PlatformRelay/kollect-render/badge" alt="OpenSSF Scorecard"></a>
+<a href="https://github.com/platformrelay/kollect-render/actions/workflows/docs.yaml"><img src="https://github.com/platformrelay/kollect-render/actions/workflows/docs.yaml/badge.svg" alt="Docs CI"></a>
+<a href="https://platformrelay.github.io/kollect-render/"><img src="https://img.shields.io/badge/documentation-GitHub%20Pages-2ea44f?logo=readthedocs&logoColor=white" alt="Documentation"></a>
+<a href="https://github.com/platformrelay/kollect-render/blob/main/LICENSE"><img src="https://img.shields.io/github/license/platformrelay/kollect-render" alt="License: MIT"></a>
+<a href="https://github.com/platformrelay/kollect-render/releases"><img src="https://img.shields.io/github/v/release/platformrelay/kollect-render" alt="Release"></a>
+<a href="https://codecov.io/gh/platformrelay/kollect-render"><img src="https://codecov.io/gh/platformrelay/kollect-render/graph/badge.svg" alt="codecov"></a>
+<a href="https://github.com/platformrelay/kollect-render/blob/main/go.mod"><img src="https://img.shields.io/github/go-mod/go-version/platformrelay/kollect-render" alt="Go"></a>
+<a href="https://github.com/platformrelay/kollect-render/pkgs/container/kollect-render"><img src="https://img.shields.io/badge/ghcr.io-platformrelay%2Fkollect--render-2496ED?logo=docker&logoColor=white" alt="Container"></a>
+</p>
 
-Credential-free CLI that validates versioned inventory documents and renders them to
-deterministic artifacts (markdown, confluence-storage, and more as the format registry grows).
-File outputs include a `.meta.json` digest/metadata sidecar for private publishers; this tool
-never opens network connections or holds publish credentials.
+# kollect-render
 
-This repository is the public Open Source renderer for the PlatformRelay inventory protocol.
-Collection, scheduling, credentials, and publishing stay in private callers; this tool only
-transforms documents you already have.
+**Credential-free inventory renderer.** Validate versioned inventory documents and render them
+to deterministic artifacts (`markdown`, `confluence-storage`, …). File outputs include a
+`.meta.json` digest/metadata sidecar for private publishers. This tool never opens network
+connections or holds publish credentials.
 
-## Status
+Collection, scheduling, credentials, and publishing stay in private callers; this repository is
+the public Open Source renderer for the PlatformRelay inventory protocol.
 
-OSS renderer with kollect-parity quality gates (lint, arch-lint, coverage ≥90%, gitleaks,
-REWE-trace). SonarCloud analysis runs in CI on every push/PR (badge deferred). Tagged releases
-(`vX.Y.Z`) publish multi-platform binaries and a GHCR container image via GoReleaser.
-`validate` and `render` are available; output formats register at compile time
-(`markdown`, `confluence-storage`). Writing `--output <file>` emits `<file>.meta.json`
-(content digest + generation metadata) for the private publisher contract.
+**Docs:** **[platformrelay.github.io/kollect-render](https://platformrelay.github.io/kollect-render/)** —
+getting started, CLI reference, formats, schema, and development. This README is the front door;
+the site is the map.
 
 ## Quick start
 
 ```bash
-task check          # fmt, vet, lint, arch-lint, coverage≥90%, gitleaks, build, REWE-trace
+task check          # fmt, vet, lint, arch-lint, coverage≥90%, gitleaks, build, REWE-trace, pinned-actions
 go run ./cmd/kollect-render version
 # Built-in Model → encoder (any registered format):
 go run ./cmd/kollect-render render --format markdown --context test/golden/env-inventory-md/context.yaml
@@ -46,20 +53,29 @@ docker pull ghcr.io/platformrelay/kollect-render:v0.1.0
 
 Pin the image or release asset by version; Renovate can track the GitHub Releases / GHCR datasources.
 
-## CLI
-
-Command and flag reference: [docs/cli-reference.md](docs/cli-reference.md).
+## Documentation
 
-## Golden tests
+- Site: [platformrelay.github.io/kollect-render](https://platformrelay.github.io/kollect-render/)
+- [Getting started](docs/getting-started.md) · [CLI reference](docs/cli-reference.md) ·
+  [Formats](docs/formats.md) · [Schema](docs/schema.md) ·
+  [Development](docs/development.md) · [Security](docs/security.md)
 
-Fixture → expected output suites live under `test/golden/`. To regenerate committed goldens after an
-intentional render change:
+Golden fixtures live under `test/golden/`. Regenerate after an intentional render change with
+`UPDATE_GOLDEN=1 go test ./internal/format/ ./internal/render/`, then review the diff like code.
 
-```bash
-UPDATE_GOLDEN=1 go test ./internal/format/ ./internal/render/
-```
+## Status
 
-Review the golden diff like code before committing.
+Gate-verified facts (not aspirational):
+
+- Local gate `task check`: fmt, vet, lint, arch-lint, module coverage ≥90%, gitleaks, build,
+  REWE-trace, pinned Actions.
+- CI runs the same gate; Codecov publishes coverage; CodeQL and OpenSSF Scorecard are published.
+- Docs build and deploy to GitHub Pages from `.github/workflows/docs.yaml`.
+- Tagged releases (`vX.Y.Z`) publish multi-platform binaries and a GHCR image via GoReleaser.
+- `validate` and `render` are available; formats register at compile time (`markdown`,
+  `confluence-storage`). Writing `--output <file>` emits `<file>.meta.json`.
+- SonarCloud analysis runs in CI on every push/PR. The Quality Gate badge is **deferred**: QG is
+  still ERROR on `new_duplicated_lines_density` (OD-3 revisit — do not advertise a failing gate).
 
 ## License