chore: add open-source policy files (NOTICE, SECURITY, CONTRIBUTING)

Merged
KJ
13h ago
+1538-3

What

Open-source readiness prep (part of the self-host open-source review, 2026-11-03). This PR changes no runtime code.

  • SECURITY.md: private disclosure through GitHub private vulnerability reporting or security@agentrelay.com, response targets, scope.

  • CONTRIBUTING.md: how to build and test, PR expectations (no secrets, customer data or production identifiers in fixtures), and the inbound=outbound Apache-2.0 contribution terms.

  • package.json license fields: "license": "Apache-2.0" on each workspace package and the matching `package-lock.json` workspace entries (no dependency changes). The published npm packages currently carry no license metadata.

  • CI hardening: contract.yml gets an explicit top-level permissions: contents: read, so it no longer inherits the default token scope on pull requests.

  • NOTICE: not added. This repo has no third-party attributions, and a NOTICE would oblige every redistributor to carry it. Published packages instead ship a LICENSE copy (canonical Apache-2.0 text).

Not in this PR (needs an admin)

Branch protection / rulesets on main, environment protection rules, and enabling private vulnerability reporting are repository settings; they are listed in the open-source readiness report for Khaliq.

🤖 Generated with Claude Code

Autofix with [code]smith
Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.