The repository had no contributor or security guidance and no .github
directory, so a 1.0.0 public release would give reporters no private
channel and contributors no statement of the checks, the signed-commit
rule on main or the license their work falls under.
Modeled on QRun-IO/qqq but adapted: npm workspaces plus Bun for the TUI,
the qqq-orb cli profile, Apache-2.0 (no AGPL text copied), conventional
signed commits. CODEOWNERS requests @KofTwentyTwo on every change.
Dependabot groups weekly minor and patch updates for the npm workspaces
and, through its bun ecosystem, for packages/tui's bun.lock; the
throwaway tui-spike is left out on purpose. Issue templates ask for the
qqq doctor build line, and route server and security problems elsewhere.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
james.maesandClaude Fable 5.1
ac86860422