Add community health files (CoC, contributing, security)

CODE_OF_CONDUCT.md

@@ -0,0 +1,134 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at:
+
+**revenantpulse@gmail.com**
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

CONTRIBUTING.md

@@ -0,0 +1,103 @@
+# Contributing to Sploosh
+
+Thanks for helping build an AI-native programming language. Sploosh is
+**spec-first**: the docs define the language; the compiler implements them.
+When the two disagree, either the compiler is wrong or a spec amendment lands
+first — never a silent behavior change.
+
+## Before you start
+
+1. Read [VISION.md](VISION.md) for product context and non-goals.
+2. Read [AGENTS.md](AGENTS.md) for conventions, git rules, and the definition of done.
+   Nearest-wins: subtrees under `docs/` and `crates/` have their own `AGENTS.md`.
+3. Skim the authoritative spec:
+   [`docs/spec-plans/LANGUAGE_SPEC.md`](docs/spec-plans/LANGUAGE_SPEC.md)
+   (currently v0.5.14-draft).
+4. Follow the [Code of Conduct](CODE_OF_CONDUCT.md).
+
+## Ways to contribute
+
+| Kind | Where to start |
+|------|----------------|
+| Compiler / parser work | [Milestone 1](https://github.com/StreamDemon/sploosh/milestone/1) and labeled issues under `compiler/parser` |
+| Spec amendments | [.github/ISSUE_TEMPLATE/spec_change.md](.github/ISSUE_TEMPLATE/spec_change.md) — open an issue before a large design change |
+| Docs, guides, examples | `docs/` tree; keep mirrors in sync with the spec |
+| Bugs | [Bug report template](.github/ISSUE_TEMPLATE/bug_report.md) |
+| Questions | [GitHub Discussions](https://github.com/StreamDemon/sploosh/discussions) |
+
+Issues are labeled by area (`compiler/parser`, `spec`, `web3`, `documentation`),
+priority, and effort (`effort/small` …). Prefer an existing issue over opening a
+duplicate; comment if you intend to take it.
+
+## Development setup
+
+Requires **stable Rust 1.91+**.
+
+```bash
+git clone https://github.com/StreamDemon/sploosh.git
+cd sploosh
+
+cargo fmt --all -- --check
+cargo clippy --workspace --all-targets -- -D warnings
+cargo test --workspace
+```
+
+On Windows, prefer the Ubuntu Docker check so local validation matches GitHub
+Actions:
+
+```powershell
+.\scripts\docker-check.ps1 -Build
+```
+
+Docs need no build step. Sploosh source fixtures use the `.sp` extension under
+`tests/corpus/`.
+
+## Pull request process
+
+- **Never commit to `main`.** Open a PR from a topic branch.
+- **Branch names:** `spec/<topic>`, `docs/<topic>`, `feature/<topic>`, `fix/<topic>`.
+- **Commits:** short descriptive title (no `feat:` / `fix:` prefixes); body explains *why*.
+  No AI footers, `Co-Authored-By` trailers, or "Generated with" lines in commits,
+  PR bodies, or issues.
+- **Fill the PR template** (`.github/pull_request_template.md`): Summary, Spec
+  Sections Affected, Build Targets Tested, Test Plan.
+- Keep the branch up to date with `main` via **rebase**, not merge commits of `main`.
+- Address `cubic-dev-ai` review comments or refute them with reasoning against the spec.
+
+### Definition of done
+
+- [ ] `LANGUAGE_SPEC.md` updated if behavior changed.
+- [ ] Mirror docs synced when affected (`LANGUAGE_SPEC_PROMPT_CORE.md`,
+      `LANGUAGE_SPEC_PROMPT_WEB3.md`, `docs/reference/`, `docs/stdlib/`, etc.).
+- [ ] Examples still type-check by inspection until compiler coverage exists;
+      add or update corpus tests when parser behavior is involved.
+- [ ] Appendix D changelog entry for material spec changes.
+- [ ] PR template sections filled.
+- [ ] CI green (Rust fmt/clippy/test and prompt-budget where applicable).
+
+## Spec-first rule (non-negotiable)
+
+Behavioral language changes update
+`docs/spec-plans/LANGUAGE_SPEC.md` **in the same PR** as any compiler or
+mirror-doc change. Stale or contradictory docs are bugs.
+
+Prompt-sized mirrors are CI-enforced:
+
+- Core ≤ 5,600 `cl100k_base` tokens — `docs/spec-plans/LANGUAGE_SPEC_PROMPT_CORE.md`
+- Web3 ≤ 1,500 tokens — `docs/spec-plans/LANGUAGE_SPEC_PROMPT_WEB3.md`
+
+Run locally:
+
+```bash
+pip install -r scripts/requirements.txt
+python scripts/check_prompt_budget.py
+```
+
+## Security
+
+Do not open public issues for vulnerabilities. See [SECURITY.md](SECURITY.md).
+
+## License
+
+By contributing, you agree that your contributions are licensed under the
+[MIT License](LICENSE) that covers this repository.

README.md

@@ -125,9 +125,13 @@ The `docs/` tree is the language — a complete, internally consistent definitio
 
 The spec is authoritative: when compiler behavior and the spec disagree, the compiler is wrong — or a spec amendment lands first. Every behavioral change updates the spec and its mirrors in the same PR.
 
-- Start with [AGENTS.md](AGENTS.md) for conventions (it's written for AI agents and humans alike — this repo practices what the language preaches).
-- Open parser work is tracked in [milestone 1](https://github.com/StreamDemon/sploosh/milestone/1); issues are scoped and labeled by effort.
-- Language change proposals go through the [spec-change issue template](.github/ISSUE_TEMPLATE/spec_change.md).
+- **[CONTRIBUTING.md](CONTRIBUTING.md)** — setup, PR process, and definition of done
+- **[AGENTS.md](AGENTS.md)** — conventions for humans and coding agents (nearest-wins under `docs/` and `crates/`)
+- **[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)** — community standards
+- **[SECURITY.md](SECURITY.md)** — how to report vulnerabilities privately
+- Open parser work: [milestone 1](https://github.com/StreamDemon/sploosh/milestone/1)
+- Language change proposals: [spec-change issue template](.github/ISSUE_TEMPLATE/spec_change.md)
+- Questions: [GitHub Discussions](https://github.com/StreamDemon/sploosh/discussions)
 
 Building for the toolchain requires stable Rust 1.91+:
 

SECURITY.md

@@ -0,0 +1,99 @@
+# Security Policy
+
+## Supported versions
+
+Sploosh is **pre-1.0 and spec-first**. There is no shipped language runtime or
+released compiler toolchain yet. Security handling covers:
+
+| Surface | Status | Notes |
+|---------|--------|--------|
+| Language specification (`docs/`) | Active | Design-level issues (unsound rules, on-chain footguns) |
+| Compiler bootstrap crates (`crates/`) | Active | Lexer, parser, AST and future pipeline stages |
+| CI / repo automation | Active | Workflows, scripts, supply chain |
+| Generated or deployed on-chain artifacts | N/A until backends ship | EVM / Solana targets are specified, not emitted |
+
+When stable releases exist, this table will list supported version lines.
+
+## What to report
+
+Please report anything that could harm users, maintainers, or future deployers:
+
+- Memory safety, injection, or sandbox-escape issues in compiler crates or tooling
+- Spec rules that enable unsound programs, silent data loss, or undefined behavior
+- On-chain design flaws in the documented model (reentrancy, storage layout,
+  cross-contract calls, payable handling, privilege confusion)
+- Secrets exposure, unsafe defaults in scripts or GitHub Actions
+- Supply-chain issues (malicious dependencies, workflow privilege escalation)
+
+**Out of scope for private report** (use a normal issue or discussion instead):
+
+- Feature requests and roadmap questions
+- Style nits and non-security docs typos
+- Parser bugs that only reject valid programs or accept invalid ones **without**
+  a security consequence (still valuable — file a public bug)
+
+## How to report a vulnerability
+
+**Do not open a public GitHub issue for security reports.**
+
+1. Email **revenantpulse@gmail.com** with subject line:
+   `[SECURITY] sploosh — short description`
+2. Include:
+   - Affected path (spec section, crate, workflow, or script)
+   - Impact (who can exploit it, what they gain)
+   - Reproduction steps or a minimal proof of concept
+   - Whether you have a suggested fix
+3. Optional: open a draft GitHub Security Advisory on
+   [StreamDemon/sploosh](https://github.com/StreamDemon/sploosh) if you prefer
+   coordinated disclosure through GitHub (private fork / advisory workflow).
+
+You should receive an acknowledgment within **72 hours**. If you do not, ping
+again or try the same address with a different subject prefix.
+
+## Our commitments
+
+- We will confirm receipt and give an initial severity assessment when possible.
+- We will work with you on a fix and a disclosure timeline before any public
+  write-up.
+- We will credit reporters who want credit (and omit names for those who do not).
+- We will not take legal action against good-faith research conducted without
+  privacy violations, data destruction, or service disruption.
+
+## Disclosure timeline (target)
+
+| Step | Target |
+|------|--------|
+| Acknowledgment | ≤ 72 hours |
+| Initial triage | ≤ 7 days |
+| Fix or mitigation plan | ≤ 30 days for high/critical in shipped code; longer for pre-release design issues when redesign is required |
+| Public disclosure | After a fix is available, or by mutual agreement |
+
+These are targets, not SLAs. Pre-1.0 design issues may require a spec amendment
+PR before any code change; that work still happens under private coordination
+when impact is security-relevant.
+
+## On-chain and dual-target notes
+
+Sploosh's web3 surface is part of the language design:
+
+- Reentrancy is **guarded by default**; `@reentrant` is opt-in
+- Storage layout aims at Solidity compatibility
+- `onchain mod` rejects non-deterministic and host IO surfaces at compile time
+  (as specified)
+
+Until code generation backends ship, treat on-chain examples in `docs/` as
+**specification**, not audited production contracts. Do not deploy "Sploosh"
+contracts from this repo today — there is no supported compiler release.
+
+Security reviews of the **spec** (especially §11 and related web3 docs) are
+welcome and valuable before backends land.
+
+## Bug bounties
+
+There is **no paid bug bounty** at this time. Sponsorships that fund compiler
+and security work are welcome via
+[GitHub Sponsors](https://github.com/sponsors/StreamDemon).
+
+## Preferred languages
+
+English. Clear technical writing beats perfect grammar.