docs(oss-prep): add CODE_OF_CONDUCT.md + CONTRIBUTING.md (community-profile completion)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

CODE_OF_CONDUCT.md

@@ -0,0 +1,24 @@
+# Code of conduct
+
+InstaNode is a small, focused engineering community. We want everyone who participates — issue reporters, PR authors, reviewers, maintainers — to feel safe and respected.
+
+## Expectations
+
+- Be respectful in code review and issues. Critique code, not people.
+- Assume good intent. Ask questions before making accusations.
+- Keep discussions on topic. Off-topic and inflammatory threads will be closed.
+- No harassment, personal attacks, discriminatory language, or unwelcome sexual attention.
+
+## Enforcement
+
+Maintainers may close issues, lock threads, edit comments, or block accounts that violate these expectations.
+
+## Reporting
+
+Email security@instanode.dev to report a concern. We treat reports confidentially. We aim to respond within 72 hours.
+
+## Scope
+
+These expectations apply to all project spaces — issues, pull requests, discussions, and any official InstaNode communication channel — and to public spaces when someone is representing the project.
+
+This policy is intentionally short; we will lengthen it as the community grows.

CONTRIBUTING.md

@@ -0,0 +1,44 @@
+# Contributing to the InstaNode CLI
+
+## Filing issues
+
+Bugs and feature requests welcome at https://github.com/InstaNode-dev/cli/issues.
+
+## Workflow
+
+```
+git clone https://github.com/InstaNode-dev/cli
+cd cli
+go build ./...
+go vet ./...
+go test ./... -short -p 1
+```
+
+All three must pass before opening a PR.
+
+## Local testing
+
+```
+go run ./cmd/instanode --help
+go run ./cmd/instanode up
+```
+
+Set `INSTANODE_API_URL=http://localhost:8080` to point at a local api instance.
+
+## Style
+
+- Follow existing patterns. Help strings are user-visible — keep them tight.
+- New flags get a one-line `--help` description and a test that exercises the success + error path.
+- Errors returned to the user should include a one-line agent_action hint matching the api's structured error envelope (see api/internal/handlers/helpers.go for the registry).
+
+## PR checklist
+
+- `go build ./...` green
+- `go vet ./...` green
+- `go test ./... -short -p 1` green
+- Help-text changes mirrored in README if user-visible
+- New command added: include a unit test + a README example
+
+## License
+
+MIT. By contributing, you agree your contributions are licensed under the same.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 InstaNode
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -5,7 +5,7 @@ Zero-friction infrastructure CLI for [instanode.dev](https://instanode.dev).
 ## Install
 
 ```bash
-go install github.com/instant-dev/cli@latest
+go install github.com/InstaNode-dev/cli@latest
 ```
 
 ## Usage

SECURITY.md

@@ -0,0 +1,53 @@
+# Security Policy
+
+We take the security of the InstaNode CLI seriously. Thank you for helping
+keep our users and infrastructure safe.
+
+## Reporting a Vulnerability
+
+Please report suspected security issues by email to **security@instanode.dev**.
+
+Include as much of the following as you can:
+
+- A description of the vulnerability and its impact.
+- Steps to reproduce, ideally a minimal proof of concept.
+- The affected version, commit SHA, or release tag.
+- Any suggested remediation.
+
+We aim to acknowledge new reports within **2 business days** and to provide
+a substantive response (triage outcome, severity, expected timeline) within
+**7 business days**.
+
+Please do **not** open a public GitHub issue, pull request, or discussion
+for suspected vulnerabilities until a fix is available and we have agreed
+on a coordinated disclosure date.
+
+## Scope
+
+In scope:
+
+- The CLI binary and source in this repository (`github.com/InstaNode-dev/cli`).
+- Authentication flows used by the CLI (device-code login, token storage,
+  keyring integration).
+- Any code path that handles user credentials, API tokens, or secrets.
+
+Out of scope:
+
+- Vulnerabilities in third-party dependencies (please report upstream; we
+  will pick up patched versions promptly).
+- Issues that require a pre-compromised local machine (full local user
+  account compromise, malicious OS packages, etc.).
+- Findings that depend on running custom or modified builds of the CLI.
+- Social engineering of InstaNode staff or users.
+
+## Safe Harbor
+
+We will not pursue or support legal action against researchers who:
+
+- Make a good-faith effort to comply with this policy.
+- Avoid privacy violations, destruction of data, and disruption of service.
+- Only interact with accounts they own or have explicit permission to access.
+- Give us a reasonable opportunity to remediate before public disclosure.
+
+If in doubt, email **security@instanode.dev** before testing — we are happy
+to scope a test plan with you.