docs: repository governance, license, and backlog↔issue sync - #55
Merged
Conversation
Brings the repository up to the standard the product claims. Nothing here changes shipped behaviour. Governance and legal: - LICENSE — MIT, preserving the upstream Antiwork copyright from the chromeless project this was forked from. The repository was public with no license file at all, which left redistribution rights undefined and did not satisfy the upstream notice requirement. - SECURITY.md — private reporting route plus the boundary table a report is measured against, and the documented limitations that are not vulnerabilities. - CODE_OF_CONDUCT.md — Contributor Covenant 2.1. - CONTRIBUTING.md — setup, the bar for a PR, style, and the rule that contract changes need an architecture-decision entry first. Tracker plumbing: - Issue forms for bugs and feature proposals, a config that routes security reports to private advisories, and a pull-request template whose checklist is the host-enforced contract list. - CODEOWNERS covering the security-critical sources and the roadmap docs. - Dependabot for the web app, root tooling, Actions, and the Linux image. The Swift package has no third-party dependencies by design, so it is excluded. - CHANGELOG.md, including an Unreleased section — context pruning, capture formats, the docs set, and CI have all landed since v1.0.2. Backlog sync: - All 42 open backlog items now link to their GitHub issue inline, and §G links to its tracking issue. AGENTS.md and README explain how to pick work up from either surface and to keep both in sync. - Corrected §F1: the site is in fact deployed on Vercel. What is missing is repo-visible config, deploy documentation, and a real domain.
This was referenced Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the repository up to the standard the product itself claims. No shipped behaviour changes.
Legal — the one that actually mattered
The repository was public with no LICENSE file. It is a fork of antiwork/chromeless, which is MIT, so two things were wrong: redistribution rights here were undefined, and the upstream copyright notice was not being carried as MIT requires. Added
LICENSE(MIT) preservingCopyright (c) 2026 Antiwork, Inc.alongside the LockInTime notice.If the intended license is anything other than MIT, say so — but note the upstream notice has to stay regardless.
Governance
SECURITY.mdCONTRIBUTING.mdCODE_OF_CONDUCT.mdCHANGELOG.mdTracker plumbing
config.ymlroutes security reports to private advisories rather than public issues.Protocol,Transport,Artifacts,AgentRuntime, both hosts) and the roadmap docs.Backlog ↔ issues
All 42 open backlog items are now GitHub issues (#12–#53), plus a tracking issue for the ten §G ideas (#54). Each issue body is extracted from the backlog text itself, so the two cannot drift, and each carries type/area/priority labels and the milestone for its roadmap phase. This PR adds the reverse links inline in the backlog file, and explains the workflow in
AGENTS.mdandREADME.md.Correction included: §F1 claimed no deploy pipeline exists. It does — the site is live at
headless-web-pi.vercel.appvia Vercel's GitHub integration. Rewrote the item to describe what is actually missing: repo-visible config, deploy docs, and a real domain.Also configured outside this PR
Labels (type/area/priority/status taxonomy), six milestones matching the roadmap phases, repo description and topics,
delete_branch_on_merge, and branch protection onmainrequiring the six CI checks plus one review.A GitHub project board could not be created — the CLI token lacks the
projectscope. Milestones cover the same ground; add the board manually if you want a kanban view.