Add community health files (CoC, contributing, security)

[StreamDemon]

Summary

• Add root CODE_OF_CONDUCT.md (Contributor Covenant 2.1)
• Add root CONTRIBUTING.md (setup, PR process, definition of done; points at AGENTS.md)
• Add root SECURITY.md (private reporting, pre-1.0/on-chain scope, no bounty yet)
• Link all three from the README Contributing section, plus Discussions
• Enable GitHub Discussions so .github/ISSUE_TEMPLATE/config.yml contact link is live

Related Issue

N/A — sponsorship / OSS-program readiness hygiene

Spec Sections Affected

None

Checklist

• Code follows the Sploosh design principles (one way to do it, explicit over implicit, etc.)
• Documentation updated in relevant docs/ pages
• Tests added or updated
• Spec-only PR (skip Build Targets section if checked)

Build Targets Tested

• N/A (docs/spec only)

Test Plan

• Confirm GitHub community profile picks up CoC / contributing / security after merge
• Confirm Discussions is enabled and /discussions loads
• Spot-check README links resolve on the PR branch

---

Summary by cubic

Add community health files to set clear contributor guidelines and security reporting, and link them from the README. Enable GitHub Discussions for questions and community support.

• New Features
  • Add CODE_OF_CONDUCT.md (Contributor Covenant 2.1).
  • Add CONTRIBUTING.md (setup, PR process, definition of done; points to AGENTS.md).
  • Add SECURITY.md (private reporting, pre-1.0/on-chain scope, no bounty yet).
  • Update README.md to link the above and Discussions.
  • Enable GitHub Discussions.

^{Written for commit 20260f9. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant User as Open Source Contributor
    participant GitHub as GitHub Platform
    participant Repo as Sploosh Repository
    participant CoC as CODE_OF_CONDUCT.md
    participant Contrib as CONTRIBUTING.md
    participant Security as SECURITY.md
    participant README as README.md
    participant Discuss as GitHub Discussions
    participant AGENTS as AGENTS.md
    participant Vision as VISION.md
    participant Spec as LANGUAGE_SPEC.md

    Note over User,Discuss: Community Health Files — Runtime Interactions

    User->>GitHub: Navigate to repository
    GitHub->>Repo: Check community profile
    alt CoC detected
        GitHub->>CoC: Read CODE_OF_CONDUCT.md
        CoC-->>GitHub: Contributor Covenant 2.1
    else Contributing detected
        GitHub->>Contrib: Read CONTRIBUTING.md
        Contrib->>AGENTS: Refer to AGENTS.md
        Contrib->>Vision: Refer to VISION.md
        Contrib->>Spec: Refer to LANGUAGE_SPEC.md
        Contrib-->>GitHub: Setup, PR process, definition of done
    else Security detected
        GitHub->>Security: Read SECURITY.md
        Security-->>GitHub: Private reporting, pre-1.0 scope, email contact
    end

    User->>GitHub: Visit README.md
    README->>Contrib: Link to CONTRIBUTING.md
    README->>CoC: Link to CODE_OF_CONDUCT.md
    README->>Security: Link to SECURITY.md
    README->>Discuss: Link to GitHub Discussions
    README-->>User: Full contributing section

    User->>Discuss: Open new discussion
    Discuss->>Discuss: Community Q&A enabled
    Discuss-->>User: Discussion thread

    User->>GitHub: Open new issue
    GitHub->>Repo: Use issue templates
    alt Bug report
        Repo->>Security: Check if vulnerability
        opt Security issue
            User->>Security: Follow SECURITY.md reporting
            Security-->>User: Private email: revenantpulse@gmail.com
        end
    end

    User->>Contrib: Read contributing guidelines
    Contrib->>Contrib: Branch naming, PR process, rebase policy
    Contrib-->>User: Development setup instructions

    alt Vulnerability reported via email
        User->>Security: Email security report
        Security->>Security: Acknowledge within 72 hours
        Security-->>User: Coordination and fix timeline
    end

Loading

<sub>Requires human review: Docs-only change, but SECURITY.md sets vulnerability-handling/disclosure policy and legal commitments (timelines, no legal action), and CoC names an enforcement contact; these community/security policy choices need human sign-off.

Re-trigger cubic</sub>