Skip to content

Commit 918e48b

Browse files
author
jovanSAPFIONEER
committed
docs: add community standards (CoC, Security, Contributing, issue/PR templates)
1 parent c466df9 commit 918e48b

File tree

7 files changed

+318
-0
lines changed

7 files changed

+318
-0
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
name: Bug Report
3+
about: Report a bug in Network-AI
4+
title: "[BUG] "
5+
labels: bug
6+
assignees: jovanSAPFIONEER
7+
---
8+
9+
## Describe the Bug
10+
11+
A clear description of what the bug is.
12+
13+
## To Reproduce
14+
15+
Steps to reproduce the behavior:
16+
17+
1. Install version `...`
18+
2. Run this code:
19+
```typescript
20+
// Minimal reproduction
21+
```
22+
3. See error
23+
24+
## Expected Behavior
25+
26+
What you expected to happen.
27+
28+
## Actual Behavior
29+
30+
What actually happened. Include error messages or stack traces.
31+
32+
## Environment
33+
34+
- **Network-AI version**:
35+
- **Node.js version**:
36+
- **OS**:
37+
- **TypeScript version**:
38+
39+
## Additional Context
40+
41+
Any other context, screenshots, or logs.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
name: Feature Request
3+
about: Suggest a feature for Network-AI
4+
title: "[FEATURE] "
5+
labels: enhancement
6+
assignees: jovanSAPFIONEER
7+
---
8+
9+
## Problem Statement
10+
11+
Describe the problem this feature would solve. What are you trying to do that you can't do today?
12+
13+
## Proposed Solution
14+
15+
Describe how you'd like this to work. Include API examples if possible:
16+
17+
```typescript
18+
// How you'd expect to use this feature
19+
```
20+
21+
## Alternatives Considered
22+
23+
List any alternative solutions or workarounds you've considered.
24+
25+
## Use Case
26+
27+
Who benefits from this feature? What scenario does it enable?
28+
29+
## Implementation Notes
30+
31+
If you have thoughts on implementation approach, share them here. This is optional.
32+
33+
---
34+
35+
**Note:** Feature requests require maintainer approval before any PR is submitted. See [CONTRIBUTING.md](../../CONTRIBUTING.md).

‎.github/ISSUE_TEMPLATE/security.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
name: Security Vulnerability
3+
about: Report a security issue (use Security Advisories for private reports)
4+
title: "[SECURITY] "
5+
labels: security
6+
assignees: jovanSAPFIONEER
7+
---
8+
9+
**STOP -- Is this a sensitive security vulnerability?**
10+
11+
If yes, do NOT open this issue. Instead, report privately via [Security Advisories](https://github.com/jovanSAPFIONEER/Network-AI/security/advisories).
12+
13+
---
14+
15+
For non-sensitive security improvements (e.g., hardening suggestions, best practice recommendations):
16+
17+
## Description
18+
19+
What security improvement are you suggesting?
20+
21+
## Current Behavior
22+
23+
How does Network-AI currently handle this?
24+
25+
## Suggested Improvement
26+
27+
What should change?
28+
29+
## Impact
30+
31+
What is the risk level if this is not addressed?
32+
33+
- [ ] Critical -- active exploitation possible
34+
- [ ] High -- exploitable under specific conditions
35+
- [ ] Medium -- defense-in-depth improvement
36+
- [ ] Low -- best practice alignment

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
## Description
2+
3+
Brief description of what this PR does.
4+
5+
**Linked Issue:** Fixes #___
6+
7+
## Type of Change
8+
9+
- [ ] Bug fix (non-breaking change that fixes an issue)
10+
- [ ] New feature (non-breaking change that adds functionality)
11+
- [ ] Security fix
12+
- [ ] Documentation update
13+
- [ ] Performance improvement
14+
15+
## Checklist
16+
17+
- [ ] I have an **approved issue** linked above
18+
- [ ] All **251+ tests pass** (`npm test`)
19+
- [ ] **Zero compile errors** (`npx tsc --noEmit`)
20+
- [ ] I added **new tests** for my changes
21+
- [ ] I updated **JSDoc** on any new/changed exports
22+
- [ ] I updated **README.md** (if user-facing)
23+
- [ ] I updated **CHANGELOG.md** under `[Unreleased]`
24+
- [ ] No new **runtime dependencies** added
25+
- [ ] No **hardcoded secrets** or credentials
26+
- [ ] I have read [CONTRIBUTING.md](../CONTRIBUTING.md)
27+
28+
## Testing
29+
30+
Describe the tests you added or how you verified this change:
31+
32+
```bash
33+
# Commands used to test
34+
npm test
35+
```
36+
37+
## Screenshots / Output
38+
39+
If applicable, paste relevant output or screenshots.

‎CODE_OF_CONDUCT.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Code of Conduct
2+
3+
## Our Standards
4+
5+
Network-AI is a professional open-source project. All participants are expected to:
6+
7+
- Be respectful and constructive in all interactions
8+
- Focus on technical merit in discussions
9+
- Accept constructive criticism gracefully
10+
- Prioritize the project's quality and security
11+
12+
## Unacceptable Behavior
13+
14+
- Harassment, trolling, or personal attacks
15+
- Publishing others' private information
16+
- Spam, off-topic promotion, or low-effort contributions
17+
- Any conduct that would be inappropriate in a professional setting
18+
19+
## Scope
20+
21+
This Code of Conduct applies to all project spaces: issues, pull requests, discussions, and any public channel where you represent this project.
22+
23+
## Enforcement
24+
25+
Violations may result in comments being removed, issues being locked, or users being blocked from the repository.
26+
27+
Report issues to the maintainer via [GitHub Issues](https://github.com/jovanSAPFIONEER/Network-AI/issues) or email.
28+
29+
## Attribution
30+
31+
This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1.

‎CONTRIBUTING.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# Contributing to Network-AI
2+
3+
Network-AI is a solo-maintained project with high quality standards. Contributions are welcome but must meet strict requirements.
4+
5+
## Before You Start
6+
7+
**All contributions require prior discussion.** Do not open a pull request without an approved issue first.
8+
9+
1. **Open an issue** describing the problem or feature
10+
2. **Wait for maintainer approval** before writing code
11+
3. Only after approval, fork and implement
12+
13+
Unsolicited PRs without a linked, approved issue will be closed.
14+
15+
## Requirements for All Contributions
16+
17+
### Code Quality
18+
19+
- All 251+ existing tests must pass (`npm test`)
20+
- Zero TypeScript compile errors (`npx tsc --noEmit`)
21+
- New features must include tests with >90% branch coverage
22+
- Follow existing code style and patterns
23+
- No new runtime dependencies without prior approval
24+
25+
### Security
26+
27+
- No hardcoded secrets, keys, or credentials
28+
- No new network calls without explicit justification
29+
- Input validation required on all public API entry points
30+
- Path traversal and injection protections where applicable
31+
32+
### Documentation
33+
34+
- JSDoc on all exported functions and classes
35+
- Update README.md if adding user-facing features
36+
- Update CHANGELOG.md under `[Unreleased]`
37+
38+
## Pull Request Process
39+
40+
1. Fork the repository and create a branch from `main`
41+
2. Implement your change with tests
42+
3. Run the full test suite:
43+
```bash
44+
npm test
45+
npx tsc --noEmit
46+
```
47+
4. Open a PR referencing the approved issue
48+
5. Fill out the PR template completely
49+
6. Wait for review -- the maintainer reviews all PRs personally
50+
51+
### PR Review Criteria
52+
53+
- Does it solve the approved issue?
54+
- Are tests comprehensive?
55+
- Is the code clean and idiomatic TypeScript?
56+
- Does it maintain backward compatibility?
57+
- Does it introduce any security concerns?
58+
59+
## What We Accept
60+
61+
- Bug fixes with reproduction steps and tests
62+
- Security improvements
63+
- Performance optimizations with benchmarks
64+
- New adapter implementations (following `BaseAdapter` pattern)
65+
- Documentation improvements
66+
67+
## What We Do Not Accept
68+
69+
- Breaking API changes without a migration path
70+
- Features that add external runtime dependencies
71+
- Code that reduces test coverage
72+
- Cosmetic-only changes (formatting, renaming)
73+
- AI-generated code without human review and testing
74+
75+
## Development Setup
76+
77+
```bash
78+
git clone https://github.com/jovanSAPFIONEER/Network-AI.git
79+
cd Network-AI
80+
npm install
81+
npm test # Run all 251 tests
82+
npx tsc --noEmit # Type-check
83+
```
84+
85+
## License
86+
87+
By contributing, you agree that your contributions will be licensed under the [MIT License](LICENSE).

‎SECURITY.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
| Version | Supported |
6+
|---------|-----------|
7+
| 3.1.x | Yes |
8+
| 3.0.x | Security fixes only |
9+
| < 3.0 | No |
10+
11+
## Reporting a Vulnerability
12+
13+
**Do NOT open a public GitHub issue for security vulnerabilities.**
14+
15+
Instead, please report security issues privately:
16+
17+
1. Go to the [Security Advisories](https://github.com/jovanSAPFIONEER/Network-AI/security/advisories) page
18+
2. Click **"Report a vulnerability"**
19+
3. Provide a clear description, reproduction steps, and impact assessment
20+
21+
You will receive an acknowledgment within 48 hours and a detailed response within 7 days.
22+
23+
## Security Measures in Network-AI
24+
25+
Network-AI includes built-in security features:
26+
27+
- **AES-256-GCM encryption** for blackboard data at rest
28+
- **HMAC-SHA256 signed tokens** via AuthGuardian with trust levels and scope restrictions
29+
- **Rate limiting** to prevent abuse
30+
- **Path traversal protection** in the Python blackboard (regex + resolved-path boundary checks)
31+
- **Input validation** on all 20+ public API entry points
32+
- **Secure audit logging** with tamper-resistant event trails
33+
34+
## Security Scan Results
35+
36+
- **VirusTotal**: Benign (0/64 engines)
37+
- **OpenClaw Scanner**: Benign, HIGH CONFIDENCE
38+
- **Snyk**: All High/Medium findings resolved in v3.0.3
39+
40+
## Disclosure Policy
41+
42+
We follow coordinated disclosure. We will:
43+
44+
1. Confirm the vulnerability and determine its impact
45+
2. Develop and test a fix
46+
3. Release a patched version
47+
4. Credit the reporter (unless anonymity is requested)
48+
49+
We ask that you give us reasonable time to address the issue before any public disclosure.

0 commit comments

Comments
 (0)