torbscript/language
Watch
1
0
Fork
You've already forked language
 0
Code Issues 139 Pull requests 2 Projects Releases 18 Packages 3 Wiki Activity Actions

release: add a security policy and a code of conduct #15

New issue
Closed
opened 2026-10-05 21:07:10 +00:00 by orion · 10 comments
orion commented 2026-10-05 21:07:10 +00:00
Collaborator
Copy link

Context

The readiness list asks for a license, a security policy and a code of conduct. The license exists.

Source

Acceptance criteria

  • SECURITY.md with how to report a vulnerability and what is supported
  • CODE_OF_CONDUCT.md
  • Both linked from the README and RELEASE.md section 9

Dependencies

None known.

Moved from the planning lists of the docs; the design record stays the specification.

## Context The readiness list asks for a license, a security policy and a code of conduct. The license exists. ## Source - [RELEASE.md section 2, readiness](https://git.torb.dev/torbscript/language/src/commit/393ef2608e4a60b8ff76d8b6b408951b822d887d/docs/design/RELEASE.md#L88) ## Acceptance criteria - [ ] `SECURITY.md` with how to report a vulnerability and what is supported - [ ] `CODE_OF_CONDUCT.md` - [ ] Both linked from the README and RELEASE.md section 9 ## Dependencies None known. _Moved from the planning lists of the docs; the design record stays the specification._
orion commented 2026-10-06 16:10:16 +00:00
Author
Collaborator
Copy link

[loop:torbscript] intake: in scope (author orion, label loop). Release readiness item of RELEASE.md section 2; docs only, no seed impact. Owner question to settle in refine: the vulnerability reporting contact and the code of conduct text (a public statement of the project). Release freeze for 0.1.0 (2026-10-06) holds new PRs, next: refine (queued)

[loop:torbscript] intake: in scope (author orion, label loop). Release readiness item of RELEASE.md section 2; docs only, no seed impact. Owner question to settle in refine: the vulnerability reporting contact and the code of conduct text (a public statement of the project). Release freeze for 0.1.0 (2026-10-06) holds new PRs, next: refine (queued)
orion commented 2026-10-08 12:37:16 +00:00
Author
Collaborator
Copy link

[loop:torbscript] claim refine by session:loop-torbscript-20261008 until 2026-10-08T14:40:00Z

[loop:torbscript] claim refine by session:loop-torbscript-20261008 until 2026-10-08T14:40:00Z
orion commented 2026-10-08 12:39:11 +00:00
Author
Collaborator
Copy link

[loop:torbscript] refine: not ready, an owner decision is needed, next: waiting (owner decision)

owner decision: SECURITY.md and CODE_OF_CONDUCT.md are public statements of the project. RELEASE.md section 9 settles the form (RFC 9116 style policy with security@torb.dev, acknowledgement, coordinated disclosure; the Contributor Covenant, current version, with "the enforcement contact on torb.dev"), but not:

  1. Mail does not exist yet. RELEASE.md section 12, question 7 lists mail for torb.dev as the one cost that cannot wait for the preview; until it exists, a published security@torb.dev bounces. Creating the mailbox is the owner's action.
  2. Unnamed values: the code-of-conduct enforcement address, and the response times ("a stated number of days" in section 9).

Options:

  • mail-defaults: SECURITY.md: security@torb.dev, acknowledgement within 3 days, assessment within 7 days, coordinated disclosure up to 90 days; supported = the latest minor, plus the previous minor for security fixes for one more month (RELEASE.md section 3). CODE_OF_CONDUCT.md: Contributor Covenant 2.1 text, enforcement at conduct@torb.dev. The owner sets up both mailboxes before the PR lands.
  • forge-first: until mail exists, SECURITY.md points to a private (confidential) report on the forge and says security@torb.dev follows with the preview; the enforcement contact is the same channel. Times as above.
  • other: the owner names the addresses and times.

Recommendation: mail-defaults (it follows the design record literally; only the two mailboxes and three numbers are new).

Once decided, the issue is ready as: docs only, one PR, no seed impact, implementer sonnet/medium, acceptance criteria refined (files, content, links from README and RELEASE.md section 9, torb docs site --check and the skills/ regeneration green).

v: 1
id: q1
kind: decision
blocking: true
to: torben
asked_by: orion
asked_at: 2026-10-08T12:45:00Z
recommendation: mail-defaults
question: "Which contacts and response times should SECURITY.md and CODE_OF_CONDUCT.md publish? Mail for torb.dev does not exist yet, and the enforcement address and the times are not in a design record. Details in the comment above."
options:
  - id: mail-defaults
    label: "security@ and conduct@torb.dev, 3/7/90 days"
    detail: "Contributor Covenant 2.1, acknowledgement 3 days, assessment 7 days, disclosure up to 90 days; Torben creates both mailboxes before the PR lands."
  - id: forge-first
    label: "Forge private report first, mail later"
    detail: "SECURITY.md points to a confidential forge report until torb.dev mail exists, then adds security@torb.dev."
  - id: other
    label: "Other contacts or times"
    detail: "Answer in free text."

Worker usage: about 65k tokens (sonnet/medium).

[loop:torbscript] refine: not ready, an owner decision is needed, next: waiting (owner decision) **owner decision:** `SECURITY.md` and `CODE_OF_CONDUCT.md` are public statements of the project. [RELEASE.md section 9](https://git.torb.dev/torbscript/language/src/branch/main/docs/design/RELEASE.md#L1540) settles the *form* (RFC 9116 style policy with `security@torb.dev`, acknowledgement, coordinated disclosure; the Contributor Covenant, current version, with "the enforcement contact on torb.dev"), but not: 1. **Mail does not exist yet.** [RELEASE.md section 12, question 7](https://git.torb.dev/torbscript/language/src/branch/main/docs/design/RELEASE.md#L1616) lists mail for torb.dev as the one cost that cannot wait for the preview; until it exists, a published `security@torb.dev` bounces. Creating the mailbox is the owner's action. 2. **Unnamed values:** the code-of-conduct enforcement address, and the response times ("a stated number of days" in section 9). Options: - **mail-defaults:** `SECURITY.md`: `security@torb.dev`, acknowledgement within 3 days, assessment within 7 days, coordinated disclosure up to 90 days; supported = the latest minor, plus the previous minor for security fixes for one more month ([RELEASE.md section 3](https://git.torb.dev/torbscript/language/src/branch/main/docs/design/RELEASE.md)). `CODE_OF_CONDUCT.md`: Contributor Covenant 2.1 text, enforcement at `conduct@torb.dev`. The owner sets up both mailboxes before the PR lands. - **forge-first:** until mail exists, `SECURITY.md` points to a private (confidential) report on the forge and says `security@torb.dev` follows with the preview; the enforcement contact is the same channel. Times as above. - **other:** the owner names the addresses and times. Recommendation: **mail-defaults** (it follows the design record literally; only the two mailboxes and three numbers are new). Once decided, the issue is ready as: docs only, one PR, no seed impact, implementer sonnet/medium, acceptance criteria refined (files, content, links from README and RELEASE.md section 9, `torb docs site --check` and the `skills/` regeneration green). ```hos-question v: 1 id: q1 kind: decision blocking: true to: torben asked_by: orion asked_at: 2026-10-08T12:45:00Z recommendation: mail-defaults question: "Which contacts and response times should SECURITY.md and CODE_OF_CONDUCT.md publish? Mail for torb.dev does not exist yet, and the enforcement address and the times are not in a design record. Details in the comment above." options: - id: mail-defaults label: "security@ and conduct@torb.dev, 3/7/90 days" detail: "Contributor Covenant 2.1, acknowledgement 3 days, assessment 7 days, disclosure up to 90 days; Torben creates both mailboxes before the PR lands." - id: forge-first label: "Forge private report first, mail later" detail: "SECURITY.md points to a confidential forge report until torb.dev mail exists, then adds security@torb.dev." - id: other label: "Other contacts or times" detail: "Answer in free text." ``` Worker usage: about 65k tokens (sonnet/medium).
torben commented 2026-10-29 22:53:33 +00:00
Owner
Copy link

[owner-answer] q=q1 option=mail-defaults „security@ and conduct@torb.dev, 3/7/90 days“ 2026-10-29T22:53:33Z

[owner-answer] q=q1 option=mail-defaults „security@ and conduct@torb.dev, 3/7/90 days“ 2026-10-29T22:53:33Z
orion commented 2026-10-30 04:59:59 +00:00
Author
Collaborator
Copy link

[loop:torbscript] refine: ready. Owner decision q1 answered 2026-10-29 (mail-defaults): SECURITY.md with security@torb.dev, acknowledgement 3 days, assessment 7 days, coordinated disclosure up to 90 days, supported = latest minor plus previous minor for one more month; CODE_OF_CONDUCT.md = Contributor Covenant 2.1 with enforcement at conduct@torb.dev; both linked from the README and RELEASE.md section 9. Docs only, one PR, no seed impact, sonnet/medium. The PR body notes that the two mailboxes must exist before it lands (Torben's action).

[loop:torbscript] refine: ready. Owner decision q1 answered 2026-10-29 (mail-defaults): `SECURITY.md` with security@torb.dev, acknowledgement 3 days, assessment 7 days, coordinated disclosure up to 90 days, supported = latest minor plus previous minor for one more month; `CODE_OF_CONDUCT.md` = Contributor Covenant 2.1 with enforcement at conduct@torb.dev; both linked from the README and RELEASE.md section 9. Docs only, one PR, no seed impact, sonnet/medium. The PR body notes that the two mailboxes must exist before it lands (Torben's action).
orion commented 2026-10-30 04:59:59 +00:00
Author
Collaborator
Copy link

[loop:torbscript] claim implement by session:loop-torbscript-20261030 @anthropic:theorben until 2026-10-30T07:00Z

[loop:torbscript] claim implement by session:loop-torbscript-20261030 @anthropic:theorben until 2026-10-30T07:00Z
orion commented 2026-10-30 05:03:30 +00:00
Author
Collaborator
Copy link

[loop:torbscript] release: PR #677 open (head 5dc98c97). Open point: the supported-versions text follows the refine wording, but RELEASE.md section 3 says only the newest minor is maintained in 0.x (the one-month overlap starts at 1.0); the design record wins, so a fix aligns SECURITY.md with section 3. The mailboxes security@ and conduct@torb.dev must exist before the PR lands (owner action).

[loop:torbscript] release: PR #677 open (head 5dc98c97). Open point: the supported-versions text follows the refine wording, but RELEASE.md section 3 says only the newest minor is maintained in 0.x (the one-month overlap starts at 1.0); the design record wins, so a fix aligns SECURITY.md with section 3. The mailboxes security@ and conduct@torb.dev must exist before the PR lands (owner action).
orion commented 2026-10-30 05:03:31 +00:00
Author
Collaborator
Copy link

[loop:torbscript] claim implement (fix PR #677 supported versions) by session:loop-torbscript-20261030 @anthropic:theorben until 2026-10-30T07:00Z

[loop:torbscript] claim implement (fix PR #677 supported versions) by session:loop-torbscript-20261030 @anthropic:theorben until 2026-10-30T07:00Z
orion commented 2026-10-30 05:05:28 +00:00
Author
Collaborator
Copy link

[loop:torbscript] release: PR #677 fixed (head 66639a42): supported versions now follow RELEASE.md section 3 (0.x newest minor only, one-month overlap from 1.0), section 9 aligned, machine-readable contact phrased as in section 9. Next: CI and Argus review; the mailboxes security@ and conduct@torb.dev must exist before it lands (owner action).

[loop:torbscript] release: PR #677 fixed (head 66639a42): supported versions now follow RELEASE.md section 3 (0.x newest minor only, one-month overlap from 1.0), section 9 aligned, machine-readable contact phrased as in section 9. Next: CI and Argus review; the mailboxes security@ and conduct@torb.dev must exist before it lands (owner action).
orion commented 2026-11-02 05:21:41 +00:00
Author
Collaborator
Copy link

[loop:torbscript] review: PR #677 has Argus REQUEST_CHANGES on the current head 66639a42 (CI green, mergeable); the only blocker is the PR hold: torb.dev has no MX record (checked 2026-11-02 via DNS), so security@ and conduct@torb.dev cannot receive mail. No code change needed. The question is filed as a blocking question block at https://git.dmb.zone/orion/infra/issues/2006 (q1, the repo of this loop cannot hold it). After the answer: re-request review from argus on PR #677.
next: waiting (mailboxes security@ and conduct@torb.dev must receive mail, MX missing; q1 on orion/infra#2006) until 2026-11-09T12:00:00+01:00

[loop:torbscript] review: PR #677 has Argus REQUEST_CHANGES on the current head 66639a42 (CI green, mergeable); the only blocker is the PR hold: torb.dev has no MX record (checked 2026-11-02 via DNS), so security@ and conduct@torb.dev cannot receive mail. No code change needed. The question is filed as a blocking question block at https://git.dmb.zone/orion/infra/issues/2006 (q1, the repo of this loop cannot hold it). After the answer: re-request review from argus on PR #677. next: waiting (mailboxes security@ and conduct@torb.dev must receive mail, MX missing; q1 on orion/infra#2006) until 2026-11-09T12:00:00+01:00
argus closed this issue 2026-11-02 09:32:14 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
loop/705-default-shadow
loop/691-tensor-core
loop/705-fix-candidate
orion/456-tierb-probe
loop/164-measure2
loop/207-measure
loop/164-prototype
probe/207-count
loop/205-measure
loop/140-hide-staged
nightly-20261103
nightly-20261031
nightly-20261029
nightly-20261027
nightly-20261026
nightly-20261025
nightly-20261024
nightly-20261023
nightly-20261021
nightly-20261020
nightly-20261015
nightly-20261014
nightly-20261013
nightly-20261011
nightly-20261010
nightly-20261009
nightly-20261008
seeds
Labels
Clear labels   
loop
Backlog item of the project loop (Orion), see CONTRIBUTING

  
ready
Refined to the definition of ready

No labels
loop
ready
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
torbscript/language#15
No description provided.