chore(sdlc): enforce open source governance and editorconfig

Author: Aitomates

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

CODE_OF_CONDUCT.md

@@ -0,0 +1,30 @@
+# Code of Conduct
+
+## Our Commitment
+
+We are committed to a professional, inclusive, and harassment-free community for
+everyone, regardless of background, identity, experience, or ability.
+
+## Expected Behavior
+
+- Communicate respectfully and focus criticism on technical work.
+- Be clear about uncertainty, limitations, and conflicts of interest.
+- Protect private information, credentials, and security-sensitive details.
+- Accept constructive feedback and correct mistakes transparently.
+- Use AI-assisted contributions responsibly and review generated output.
+
+## Unacceptable Behavior
+
+- Harassment, threats, discrimination, or personal attacks.
+- Publishing another person's private information without permission.
+- Knowingly submitting malicious, deceptive, plagiarized, or unsafe content.
+- Using community channels to disclose exploitable security details.
+
+## Enforcement
+
+Report conduct concerns privately to `OgeonX@gmail.com`. Maintainers will review
+reports promptly, protect confidentiality where practical, and may remove content or
+restrict participation when necessary.
+
+This policy applies in organization repositories, discussions, issues, pull requests,
+and other official community spaces.

CONTRIBUTING.md

@@ -0,0 +1,46 @@
+# Contributing
+
+Contributions are welcome when they improve the Coding Autopilot System portfolio
+without weakening its safety boundaries.
+
+## Before You Start
+
+1. Search existing issues and pull requests.
+2. Open an issue before making a cross-repository, architectural, or breaking change.
+3. Never include credentials, personal data, private prompts, or proprietary source.
+4. Keep autonomous changes bounded, reviewable, and reversible.
+
+## Development Workflow
+
+1. Fork or branch from the repository's default branch.
+2. Make the smallest coherent change.
+3. Add or update tests and documentation.
+4. Run the repository's documented validation commands.
+5. Open a pull request using the shared template.
+
+Use conventional commit subjects where practical, for example:
+
+```text
+feat(scope): add bounded capability
+fix(scope): handle failed validation
+docs(scope): clarify operator runbook
+```
+
+## Pull Request Standard
+
+A pull request must explain intent, risk, verification, and rollback. Changes to
+workflows, identities, permissions, dependencies, or autonomous behavior require
+explicit reviewer attention.
+
+Maintainers may close changes that are unsafe, untested, unrelated to the repository,
+or generated without meaningful human review.
+
+## Responsible AI Expectations
+
+- Treat model output as untrusted input.
+- Require human approval before consequential or destructive actions.
+- Apply least privilege to tools, identities, and repository permissions.
+- Preserve audit evidence for autonomous operations.
+- Document known limitations and failure modes.
+
+By participating, you agree to follow the [Code of Conduct](CODE_OF_CONDUCT.md).

SECURITY.md

@@ -0,0 +1,46 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Do not report vulnerabilities in public issues, discussions, pull requests, or logs.
+
+Use GitHub's private vulnerability reporting feature on the affected repository when
+available. Otherwise, email `OgeonX@gmail.com` with:
+
+- affected repository, version, branch, or commit;
+- impact and realistic attack scenario;
+- minimal reproduction steps or proof of concept;
+- suggested mitigation, if known;
+- whether the report may be shared publicly after remediation.
+
+Do not include active credentials, personal data, or unrelated private information.
+
+## Response Targets
+
+The project aims to:
+
+- acknowledge a report within 3 business days;
+- provide an initial assessment within 7 business days;
+- coordinate remediation and disclosure based on severity and exploitability.
+
+These are targets for a maintainer-led portfolio, not a commercial support agreement.
+
+## Scope
+
+Security reports are especially relevant for:
+
+- authentication, authorization, and identity boundaries;
+- prompt injection or tool-use escalation;
+- secret exposure and unsafe logging;
+- workflow permission or supply-chain weaknesses;
+- sandbox escape, arbitrary code execution, or unsafe autonomous actions.
+
+Unsupported branches, intentionally vulnerable demonstrations, social engineering, and
+denial-of-service testing against shared infrastructure are out of scope unless a
+repository states otherwise.
+
+## Safe Harbor
+
+Good-faith research that avoids privacy violations, data destruction, service
+degradation, and unauthorized persistence will be treated as authorized within the
+scope of this policy.