docs: prepare code of conduct pending private reporting contact

[sharadvc]

Summary

Prepares Contributor Covenant 2.1 as a draft pending a maintainer-designated private conduct-reporting contact. The proposal explicitly distinguishes GitHub Support's abuse-reporting process from a private route to project maintainers.

Current main already contains SECURITY.md, SUPPORT.md's security-reporting link, and CODEOWNERS. The branch now incorporates main and retains those files exactly, resolving the stale conflicts and removing the earlier proposed security-response deadlines. The original contribution and commit history are preserved.

Private vulnerability reporting is enabled. The remaining blocker is the private conduct-reporting contact and policy-adoption decision. This PR must remain open and unmerged until those are settled.

Related to #255; this draft does not close it.

Validation

• npm test: 20 suites passed, zero failed.
• npm run self-scan:check passed.
• Scoped git diff --check passed; no unresolved merge conflicts.
• SECURITY.md, SUPPORT.md, and CODEOWNERS match current main.
• Contributor-guidance-only draft; changelog-exempt under CONTRIBUTING.md.

Before merge

• Designate and publish a working private conduct-reporting contact.
• Confirm policy adoption and the proposed enforcement/response commitments.
• Replace the missing-contact paragraph (currently lines 64-66), remove the draft banner (lines 3-4), and revise conditional commitments (lines 73-77) when adoption is approved.
• Review the resulting exact commit again before merging.

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can start a comment with 'qodo' or '@qodo' to chat about any finding

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Add repository governance and security reporting policies

📝 Documentation ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Adds private vulnerability reporting guidance, supported versions, and response timelines.
• Adopts Contributor Covenant 2.1 with maintainer-led enforcement procedures.
• Assigns critical-path ownership while separating security requests from public support.

Diagram

graph TD
  Contributor(["Contributor"]) --> Support["SUPPORT.md"] -->|"General support"| Issues["Public issues"]
  Support -->|"Vulnerability"| Security["SECURITY.md"] --> Advisories["Private advisories"] --> Maintainer(["Maintainer"])
  Conduct["Code of Conduct"] -->|"Conduct report"| Maintainer
  Owners["CODEOWNERS"] -->|"Review request"| Maintainer

Loading

High-Level Assessment

The PR uses GitHub-recognized community health files and the standard Contributor Covenant, which is the most interoperable approach. Custom policy locations or a separate reporting system would reduce discoverability and add operational overhead; private vulnerability reporting should be enabled to support the documented advisory URL.

Files changed (4) +167 / -0

Documentation (3) +160 / -0

CODE_OF_CONDUCT.mdAdopt Contributor Covenant 2.1 +135/-0

Adopt Contributor Covenant 2.1

• Adds community behavior standards, enforcement responsibilities, reporting guidance, and a four-level enforcement framework based on Contributor Covenant 2.1.

CODE_OF_CONDUCT.md

SECURITY.mdDefine private vulnerability reporting policy +23/-0

Define private vulnerability reporting policy

• Documents supported versions, directs vulnerabilities to GitHub private advisories, specifies required report details, and establishes response and disclosure expectations.

SECURITY.md

SUPPORT.mdRoute security reports away from public issues +2/-0

Route security reports away from public issues

• Adds explicit guidance directing vulnerability reporters to SECURITY.md and private reporting channels instead of the public issue tracker.

SUPPORT.md

Other (1) +7 / -0

CODEOWNERSAssign default and critical-path review ownership +7/-0

Assign default and critical-path review ownership

• Adds the maintainer as the default owner for all changes and explicitly covers the canonical skill, pattern reference, and detector paths.

.github/CODEOWNERS

[conorbronsdon]

Codex review, with a GPT-5.6 Sol reviewer, at Conor's request.

Thanks, @sharadvc, for filling out the governance files and review ownership. CODEOWNERS is well scoped, and the SUPPORT linkage is sensible. The private reporting paths need to be concrete before #255 can close:

• The private-advisory route has not been confirmed enabled; the PR's own checkbox is still open.
• GitHub 'private communication options' and a private channel supplied later are not usable confidential contacts for security or conduct reports.
• The acknowledgment/update deadlines and disclosure commitments need a maintainer decision; no such decision is recorded on the issue.

Please keep this open until those contacts and commitments are settled. CODEOWNERS could be split into its own small PR and landed independently. SUPPORT should link SECURITY only once a working reporting path exists. The files merge cleanly and integrated tests pass; the blocker is an actionable reporting policy, not formatting.

[conorbronsdon]

Follow-up from Codex: the independently usable CODEOWNERS file is included in #287 with explicit Sharad co-credit. That lets the review-ownership part land now while this PR remains open for confirmed confidential contacts and response expectations. Thanks for providing that separable improvement; the security/conduct policies and SUPPORT linkage are not included in #287.

[conorbronsdon]

Triage update: I checked the repository setting directly through GitHub's private-vulnerability-reporting endpoint; it currently reports that the feature is disabled.

That confirms the PR's unchecked setup item is a real maintainer-side blocker, not something the contributor can resolve in this branch. I'm leaving the PR open and changes-requested. I have not changed the repository setting. Once a maintainer enables a working confidential route and decides the response/disclosure commitments, the policy text can be revised against those facts.

[conorbronsdon]

Reviewed the requested comment and pushed verified repairs, preserving the original contribution:

• Starting head: 2b9392a60fc7d0914f5fb2576d6ecf6afcc736b9.
• Final reviewed head: cfd32868d4ff1e05696aa7a0d980681ce9aba441.
• Incorporated current main (989af1997f5534becf817ebdb6d955d8e101f497) and resolved stale governance conflicts. SECURITY.md, SUPPORT.md, and CODEOWNERS now exactly match main; the cumulative PR diff is only CODE_OF_CONDUCT.md.
• Private vulnerability reporting is already enabled, so that portion of the earlier finding is stale. No repository setting was changed.
• Removed the unsupported GitHub direct-message route, distinguished GitHub Support from maintainer reporting, and made the proposed conduct commitments explicitly conditional on adoption. No private address or response SLA was invented.

Changes still required before merge: CODE_OF_CONDUCT.md lines 64-66 correctly records that no private maintainer contact has been designated. A maintainer must supply that contact and approve adoption/commitments, then remove the draft-only wording and obtain a review of the resulting commit. This PR remains open and must not merge yet.

Validation: npm test passed all 20 suites on the integrated tree (the subsequent final change only clarified four conduct-policy lines); npm run self-scan:check, scoped git diff --check, and exact main-policy byte comparisons passed.

Independent, tool-isolated reviews of the final SHA completed through authenticated claude-opus-5, free thinkingmachines/inkling:free via Hermes/OpenRouter, and free opencode/mimo-v2.5-free. They found no additional blocking defects beyond the missing contact/adoption decision. The initial Claude complaint-route ambiguity was fixed and re-reviewed. An earlier opencode/nemotron-3.5-lightning-free attempt timed out and was not counted as a review.

The PR description now includes the remaining adoption checklist and no longer claims to close #255.

[conorbronsdon]

Deferring this proposal for now. We are not adopting the Code of Conduct or establishing a private conduct-reporting process at this time. The existing security-reporting policy remains in place. Thank you for preparing the draft; this can be reopened when we are ready to take on the reporting and enforcement commitments.