Hygiene: SECURITY.md, CODE_OF_CONDUCT.md (and LICENSE where missing), emitted from flashyos

CODE_OF_CONDUCT.md

@@ -1,31 +1,138 @@
-# Code of Conduct
+# Contributor Covenant Code of Conduct
 
-This is a small repository with a narrow purpose, and its conduct rules are
-correspondingly short.
+## Our Pledge
 
-## The standard
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
 
-- Be direct and be kind. Disagree with the work, not the person.
-- Measure before you assert. Most disputes here are about whether a value is
-  true; the answer is a reading, not an opinion, and the person who measured
-  says what they measured and when.
-- Report what happened, including when it is worse than expected. A wrong
-  entry corrected loudly is worth more than a right one nobody checked.
-- No harassment, no discrimination, no personal attacks, no publishing of
-  anyone's private information. None of that is up for discussion.
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
 
 ## Scope
 
-Issues, pull requests, discussions and any other space where this repository
-is being worked on, and any public space where someone is representing it.
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
 
 ## Enforcement
 
-Maintainers may edit, remove or refuse contributions and comments that break
-this standard, and may block repeat offenders. Report a concern privately to
-the address in `SECURITY.md`; it reaches the same people.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+michael@flashygroup.com.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
 
 ## Attribution
 
-Written for this repository; it borrows the spirit of the Contributor Covenant
-without adopting its text.
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations
+
+---
+
+This file is emitted by `tools/estate-hygiene-files.mjs` in
+[AgenteLabs/flashyos](https://github.com/AgenteLabs/flashyos/blob/main/tools/estate-hygiene-files.mjs) for AgenteLabs/stack.json; `--check` fails
+when it drifts. Regenerate it; never edit it here.

SECURITY.md

@@ -1,22 +1,59 @@
+<!-- estate-hygiene:begin — emitted by tools/estate-hygiene-files.mjs in AgenteLabs/flashyos; regenerate, never edit -->
 # Security
 
-This repository holds a public index document, a JSON Schema and a
-dependency-free checker. It runs no service, stores no data about anyone and
-holds no credentials. The attack surface is the checker itself and the
-truthfulness of the index.
+## Reporting a vulnerability
 
-## Reporting
+Report it privately, never in a public issue, pull request or chat channel.
+Two routes, and both reach the same people:
 
-Please report a vulnerability privately, not in a public issue.
+- **Email michael@flashygroup.com** — the estate's one disclosure address, the same one
+  published at https://flashynetwork.com/security/
+  and in https://flashynetwork.com/.well-known/security.txt.
+  One route across every repository is deliberate: a researcher who finds two
+  addresses and picks the worse one has been failed by us, not by their choice.
+- **GitHub → Security → Report a vulnerability** on this repository, which
+  opens a private advisory only the maintainers can read. If that button is
+  missing, private vulnerability reporting has not been enabled on this
+  repository yet; use the email route and say so in the report.
 
-- Email: **security@flashylabs** — *to be confirmed at launch; until the
-  address is confirmed, a private report to the maintainers through GitHub's
-  "Report a vulnerability" on this repository reaches the same people.*
-- Include what you found, how to reproduce it, and which commit or branch you
-  measured against.
+Include what you found, how to reproduce it and what you believe the impact
+is. Do not include real credentials, private keys or production data: nothing
+here needs them to reproduce a finding.
 
-You will get an acknowledgement, and we will say what we did — including when
-it is worse than you reported.
+## What to expect
+
+| | |
+|---|---|
+| Acknowledgement | within 72 hours |
+| An assessment, and what we are doing | agreed with you, in writing |
+| Publication | a window agreed with you, never imposed |
+
+If we miss the acknowledgement window, say so publicly. A window nobody is
+held to is worse than none, because it asks a reporter to wait on a promise
+that was never load-bearing.
+
+## Supported versions
+
+The default branch only. There is no maintained release line behind it: a
+finding against the default branch is in scope, a finding against an older
+tag or a fork is a reason to update.
+
+## A committed credential is rotated, never removed
+
+If a report is that a secret reached this repository, the fix is rotation at
+the issuer. Deleting the file, rewriting history or force-pushing is not a
+fix: the value is burned the moment it lands and stays burned, because
+history, forks, caches and mirrors keep it. Say which secret, and we rotate
+it before anything else.
+
+## About this document
+
+The sections above are emitted by [`tools/estate-hygiene-files.mjs`](https://github.com/AgenteLabs/flashyos/blob/main/tools/estate-hygiene-files.mjs)
+in AgenteLabs/flashyos from one template the whole estate shares, and
+`--check` fails when they drift.
+Regenerate them; never edit them here. Anything below the marker is this
+repository's own and is kept as written.
+<!-- estate-hygiene:end — everything below is this repository’s own -->
 
 ## What counts