docs: align governance files, ADRs, and the threat model with the standards #69

2026-10-09T15:07:57Z

KofTwentyTwo commented

2026-10-09 15:07:57 +00:00

(Migrated from github.com)

What

Workstream 2 of #62: README (badge, tier/standards table, "Verifying a release", "Support", main-only flow), SECURITY.md (contact, response-time table, support duration, advisories, EX-0002), CONTRIBUTING.md (GitHub Flow, Conventional Commits, DCO + signing, pre-commit, gate table, Kingsrook style), PR and issue templates, CODE_OF_CONDUCT.md, CLAUDE.md, six ADRs under docs/adr/, docs/security/threat-model.md, and a RELEASING.md that starts from the release checklist and never deletes a release.

Based on #68 so the diff stays clean; GitHub retargets it to main once #68 merges.

Why

K22-SDLC-02, 03, 10, 11, 13, 15; K22-REPO-02, 06, 07, 10, 11; K22-REL-07, 10, 20, 21; K22-AI-40. Closes #64.

How it was tested

The standards' conformance checker (tools/Test-RepoConformance.ps1 -LocalPath .) static rows for README, SECURITY, CONTRIBUTING, CODEOWNERS and lock files pass with these files.
Issue-template YAML parses; links checked by hand.
Documentation only: no code changes.

Checklist

Commits are signed and signed off (git commit -S -s)
Zero build warnings; format and lint are clean (no code changed)
Tests added or updated; the coverage gate still passes (no code changed)
Docs updated for user-visible changes
No secrets, credentials, or personal data
New dependencies are justified below, or none were added
Substantial AI assistance is noted: authored with Claude Code, reviewed by the maintainer

🤖 Generated with Claude Code

## What Workstream 2 of #62: README (badge, tier/standards table, "Verifying a release", "Support", main-only flow), SECURITY.md (contact, response-time table, support duration, advisories, EX-0002), CONTRIBUTING.md (GitHub Flow, Conventional Commits, DCO + signing, pre-commit, gate table, Kingsrook style), PR and issue templates, CODE_OF_CONDUCT.md, CLAUDE.md, six ADRs under `docs/adr/`, `docs/security/threat-model.md`, and a RELEASING.md that starts from the release checklist and never deletes a release. Based on #68 so the diff stays clean; GitHub retargets it to `main` once #68 merges. ## Why K22-SDLC-02, 03, 10, 11, 13, 15; K22-REPO-02, 06, 07, 10, 11; K22-REL-07, 10, 20, 21; K22-AI-40. Closes #64. ## How it was tested - The standards' conformance checker (`tools/Test-RepoConformance.ps1 -LocalPath .`) static rows for README, SECURITY, CONTRIBUTING, CODEOWNERS and lock files pass with these files. - Issue-template YAML parses; links checked by hand. - Documentation only: no code changes. ## Checklist - [x] Commits are signed and signed off (`git commit -S -s`) - [x] Zero build warnings; format and lint are clean (no code changed) - [x] Tests added or updated; the coverage gate still passes (no code changed) - [x] Docs updated for user-visible changes - [x] No secrets, credentials, or personal data - [x] New dependencies are justified below, or none were added - [x] Substantial AI assistance is noted: authored with Claude Code, reviewed by the maintainer 🤖 Generated with [Claude Code](https://claude.com/claude-code)

github-advanced-security[bot] commented

2026-10-09 15:08:39 +00:00

(Migrated from github.com)

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. ### What Enabling Code Scanning Means: - The 'Security' tab will display more code scanning analysis results (e.g., for the default branch). - Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. - You will be able to see the analysis results for the pull request's branch on this [overview](/KofTwentyTwo/gclo/security/code-scanning?query=pr%3A69+is%3Aopen) once the scans have completed and the checks have passed. For more information about GitHub Code Scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning).

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#69