chore(repo): hygiene pass — gitignore, RFC dedupe, governance docs

[jlromeiro]

Summary

Repo-hygiene-only PR. No protocol changes, no behavior changes. 4 commits clean up risk and presentability gaps surfaced by an internal audit.

This PR is independent of #2 (RFC v0.2 spec) and the in-flight feat/trust-score-v0.2-impl PR (formula module). Order of merge does not matter.

What's in each commit

6abc328 — chore(repo): expand .gitignore + remove stale RFC duplicates

Two fixes in one:

• .gitignore expanded to exclude internal materials that were untracked but at risk of accidental commit via git add .:
  • docs/pitch/ (CEO teleprompter, slide notes, 2-pagers)
  • docs/outreach/LETTERS-BR-*.md, EMAIL-TEMPLATES.md, DEMO-FLOW.md, TRACKER.md
  • docs/superpowers/ (internal design specs + plans)
  • bench-options-pitches.json, .claude/, .agents/, skills-lock.json, prompt-assistente/
  • .playwright-mcp/, *-forced-visible.png, .vscode/, .idea/
• Removed legacy duplicate RFC files in docs/ that lived alongside canonical versions in docs/rfc/:
  • docs/TRUST-SCORE-RFC-DRAFT.md (v0.1, superseded by docs/rfc/x402-trust-score.md)
  • docs/QOS-COOPERATIVE-SPEC.md (superseded by docs/rfc/x402-qos-cooperative.md)
• Updated 3 external-facing references (README.md, docs/DEPLOY.md, public/docs.html) to point at the canonical paths.
• Fixed README typo: opening quote was duplicated on lines 8 and 10.

c660745 — docs: add SECURITY.md + CONTRIBUTING.md

Two governance files the project was missing:

• SECURITY.md — preferred reporting via GitHub Security Advisory + email fallback. 24h ack / 7d assessment / 30d patch target. 90-day responsible-disclosure window. In-scope (Shield, Broker, RFC, public site) vs out-of-scope.
• CONTRIBUTING.md — project context (reference impl + RFCs as source of truth), how to contribute, dev setup, PR checklist, code style, patent guidance.

3ad670c — chore(refs): point internal references to canonical RFC paths

Follow-up to commit 6abc328 updating remaining references that still pointed at deleted paths:

• index.js (5 comments) — companion-spec pointers + cooperative QoS fallback. Line 86 had a copy-paste error pointing at trust-score draft when surrounding context was about cooperative QoS; corrected.
• lib/detection.js header — 5-signal taxonomy citation.
• examples/operator-qos-reference.js — header doc pointer.
• tools/assistant/rag/09-referencias-links.md — RAG reference.
• docs/rfc/x402-qos-cooperative.md (3 inline links) — canonical RFC was linking to deleted trust-score legacy path.

No behavior change. Pure documentation pointers.

16d8f23 — chore(brand): remove legacy RPC logos

Three logo files (docs/Logo RPC.jpg, docs/Logo RPC.png, docs/Logo.jpeg) deleted from working tree but never committed. Brand identity moved to x402 favicon (commit b2dbafa, May 10) — these RPC Priority logos are no longer referenced.

Test plan

• git status after merge shows no leaked internal files (verify against the gitignore additions list)
• npm test still passes (no source code changed beyond comment text)
• README renders without broken links: npx markdown-link-check README.md
• find docs/ -name "TRUST-SCORE-RFC-DRAFT*" -o -name "QOS-COOPERATIVE-SPEC*" returns empty
• grep -r "TRUST-SCORE-RFC-DRAFT\|QOS-COOPERATIVE-SPEC" --include="*.{js,md,html}" returns only matches inside docs/ files that are about-to-be-moved internal docs (PENDENCIAS-ESTRATEGICAS, outreach/, REFERENCIA-TECNICA-DETALHADA — all flagged for migration to docs/context/ in a future doc-cleanup PR)

🤖 Generated with Claude Code

[kilo-code-bot]

Kilo Code Review could not run — your account is out of credits.

Add credits or switch to a free model to enable reviews on this change.