From b866959858beff677f07eefe8299897811ef92bf Mon Sep 17 00:00:00 2001 From: RollNuts Date: Sun, 19 Jul 2026 22:51:44 +0900 Subject: [PATCH] Align public organization policy and profile --- .github/workflows/public-policy.yml | 19 +++++++++++++++++ LICENSE | 21 ++++++++++++++++++ README.md | 8 +++++-- SUPPORT.md | 22 +++++++++++++------ profile/README.md | 17 ++++++--------- scripts/check_public_policy.py | 33 +++++++++++++++++++++++++++++ 6 files changed, 102 insertions(+), 18 deletions(-) create mode 100644 .github/workflows/public-policy.yml create mode 100644 LICENSE create mode 100644 scripts/check_public_policy.py diff --git a/.github/workflows/public-policy.yml b/.github/workflows/public-policy.yml new file mode 100644 index 0000000..5a61db8 --- /dev/null +++ b/.github/workflows/public-policy.yml @@ -0,0 +1,19 @@ +name: Public policy contract + +on: + pull_request: + push: + branches: [main] + +permissions: + contents: read + +jobs: + verify: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 + with: + python-version: "3.12" + - run: python scripts/check_public_policy.py diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..87ccbbf --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Veripsa + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index bbde3f8..7d2f0b9 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # GetVeripsa organization defaults -This public repository contains the GitHub-wide policy and profile files for -the [GetVeripsa](https://github.com/GetVeripsa) organization. It contains no +This public repository contains GitHub-wide policy and profile files for the +[GetVeripsa](https://github.com/GetVeripsa) organization. It contains no Veripsa product source code. ## Contents @@ -11,7 +11,11 @@ Veripsa product source code. - [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md) — contributor conduct. - [`profile/README.md`](./profile/README.md) — organization profile. - [`DISCOVERY.md`](./DISCOVERY.md) — canonical public links. +- [`LICENSE`](./LICENSE) — license for this repository's public documentation. Veripsa Core and the hosted platform are maintained in private repositories. The public repositories expose the integration contract, data boundary, and a small hands-on demo without publishing the private decision engine. + +`python scripts/check_public_policy.py` checks the policy phrases and canonical +routes that must stay aligned with veripsa.com. diff --git a/SUPPORT.md b/SUPPORT.md index 8422abf..e755a71 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -4,21 +4,31 @@ Thanks for using Veripsa. Here's where to go for help. ## Docs -Product documentation lives at **** — install, configuration, what the labels and check runs mean, and the limits of the free tier. +Product documentation lives at **** — installation, +configuration, check and label meanings, and current plan limits. ## Support -For installation issues, billing questions, account changes, and anything that is not a security vulnerability: +For installation issues, billing questions, account changes, and anything that +is not a security vulnerability: -- **** — support form. +- **** — canonical support guidance. - **support@veripsa.com** — email. -We try to reply within **2 business days**. If we need more time on a specific question we will tell you. +Veripsa does not offer a contractual support SLA today. We aim to reply to +email within a few business days, and prioritize suspected security issues and +service outages. The canonical wording is maintained at +. ## Security -If you believe you have found a security vulnerability, please do **not** open a public issue. Follow the org-default [SECURITY.md](./SECURITY.md) — short version, email **support@veripsa.com** with subject line `[SECURITY]`, full process at . +Do **not** open a public issue for a suspected vulnerability. Follow the +org-default [SECURITY.md](./SECURITY.md): email **support@veripsa.com** with the +subject line starting `[SECURITY]`. The full process is at +. ## What this repository is not -This `.github` repository is for org-wide GitHub defaults (security policy, code of conduct, profile). It is **not** a product support tracker. Please use the support channels above instead of opening issues here. +This `.github` repository is for organization-wide GitHub defaults. It is not a +product support tracker; use the support routes above instead of opening an +issue here. diff --git a/profile/README.md b/profile/README.md index 1daf627..5e928c9 100644 --- a/profile/README.md +++ b/profile/README.md @@ -1,9 +1,5 @@ # Veripsa -[![veripsa.com](https://img.shields.io/badge/veripsa.com-domain%20verified-blue)](https://veripsa.com) -[![Made in Japan](https://img.shields.io/badge/made%20in-Japan-red)](https://veripsa.com) -[![Status](https://img.shields.io/badge/status-veripsa.com%2Fstatus-lightgrey)](https://veripsa.com/status) - **GitHub-native pre-merge PR traffic control for parallel coding agents.** Veripsa helps teams notice when open pull requests may need collision or landing-order attention before `main` changes. @@ -11,7 +7,7 @@ landing-order attention before `main` changes. Install Veripsa Core once as a GitHub App. It keeps a native GitHub check—and, when useful, at most one managed PR comment—current automatically; humans and agents use the same repository installation. Veripsa is advisory by default— -your branch-protection policy decides what is required to merge. +branch protection or rulesets decide what is required to merge. ## Start here @@ -23,7 +19,8 @@ your branch-protection policy decides what is required to merge. | Product docs | | | Data handling and trust | | | Recent improvements | | -| Service status | | +| Live service status | | +| Support | | ## Public repositories @@ -31,8 +28,8 @@ There are three intentional public surfaces: | Repository | Purpose | | --- | --- | -| [`veripsa-webhook-spec`](https://github.com/GetVeripsa/veripsa-webhook-spec) | Public integration contract, permissions/events, output schemas, acknowledgement semantics, and data handling. | -| [`ai-pr-collision-lab`](https://github.com/GetVeripsa/ai-pr-collision-lab) | Small maintained repository for trying a two-PR landing-order scenario. | +| [`veripsa-webhook-spec`](https://github.com/GetVeripsa/veripsa-webhook-spec) | Versioned public integration contract, permissions/events, output schemas, acknowledgement semantics, and data handling. | +| [`ai-pr-collision-lab`](https://github.com/GetVeripsa/ai-pr-collision-lab) | Maintained repository for trying a two-PR landing-order scenario. | | [`.github`](https://github.com/GetVeripsa/.github) | Organization profile, security policy, support routes, and canonical links. | The Core engine and hosted platform remain private. The public surfaces explain @@ -49,5 +46,5 @@ decides internally. protection, and human review. - Source file and diff bodies are not retained or displayed by Veripsa Core. -Support: -Security reports: +- Support: +- Security reports: diff --git a/scripts/check_public_policy.py b/scripts/check_public_policy.py new file mode 100644 index 0000000..8248543 --- /dev/null +++ b/scripts/check_public_policy.py @@ -0,0 +1,33 @@ +#!/usr/bin/env python3 +"""Fail when the public organization policy drifts from canonical routes/copy.""" +from pathlib import Path + +ROOT = Path(__file__).resolve().parents[1] +profile = (ROOT / "profile" / "README.md").read_text(encoding="utf-8") +support = (ROOT / "SUPPORT.md").read_text(encoding="utf-8") +security = (ROOT / "SECURITY.md").read_text(encoding="utf-8") +readme = (ROOT / "README.md").read_text(encoding="utf-8") + +required = { + "profile support route": (profile, "https://veripsa.com/support"), + "profile security route": (profile, "https://veripsa.com/security/disclosure"), + "support no-SLA wording": (support, "does not offer a contractual support SLA today"), + "support target wording": (support, "within a few business days"), + "security subject prefix": (security, "[SECURITY]"), + "license index entry": (readme, "[`LICENSE`](./LICENSE)"), +} +for label, (body, needle) in required.items(): + if needle not in body: + raise SystemExit(f"missing invariant: {label}: {needle!r}") + +for forbidden in ( + "domain%20verified", + "img.shields.io/badge/status-", + "within **2 business days**", + "[security]", +): + corpus = "\n".join((profile, support, security)) + if forbidden in corpus: + raise SystemExit(f"stale or self-asserted public claim remains: {forbidden!r}") + +print("public organization policy invariants verified")