diff --git a/NOTICE.md b/NOTICE.md new file mode 100644 index 0000000..f817592 --- /dev/null +++ b/NOTICE.md @@ -0,0 +1,63 @@ + + +# NOTICE + +## Project Posture + +Spacecraft Software is a **personal hobby project** maintained by Mohamed Hammad. Its +primary purpose is to serve the maintainer's own use case — a Rust-first +systems software stack, tooling, and rewrites that the maintainer wants to +run on his own machines. Most subprojects are developed at hobby pace and +shaped around that workflow. + +A handful of subprojects (e.g., **Anvil-SSH**) are intentionally designed and +maintained with general use in mind. Where this applies, it is stated +explicitly in that subproject's `README.md`. The umbrella as a whole is not. + +## No Warranty + +Spacecraft Software and every subproject under it are provided **AS IS**, without +warranty of any kind, express or implied. This includes — but is not limited +to — implied warranties of merchantability, fitness for a particular purpose, +non-infringement, and the absence of latent defects. The entire risk as to +quality and performance lies with the user. + +## No Liability + +In no event shall the maintainer be liable for any claim, damages, or other +liability — whether in an action of contract, tort, or otherwise — arising +from, out of, or in connection with this software, its use, or its inability +to be used. This includes, without limitation, data loss, hardware damage, +business interruption, security incidents, and any direct, indirect, +incidental, special, exemplary, or consequential damages of any kind. + +## Authoritative Terms + +The statements above describe the maintainer's posture in plain language. The +formal, legally binding terms are those of the **GNU General Public License, +version 3 or later** (`GPL-3.0-or-later`). In any conflict between this +notice and the license text, the license text governs. + +The full license is available at +and in the project's `LICENSE` file. + +## Contributions, Suggestions, and Forks + +- Contributions and suggestions are welcome — see [`CONTRIBUTING.md`](./CONTRIBUTING.md). +- PR acceptance is at the maintainer's sole discretion. +- Forking under GPL-3.0-or-later is always available and encouraged when + goals diverge. + +## Maintainer + +Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org> +Copyright (c) 2026 Mohamed Hammad +License: GPL-3.0-or-later +Website: + +--- + +*--- Forged in Spacecraft Software ---* diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..71bae35 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,57 @@ + + +# Security Policy + +Standard §26.1 requires every Spacecraft Software repository to state where a +vulnerability report goes and what happens to it. + +## Scope + +This repository holds **agent skills** — instructions a language model loads and +acts on — plus `construct-cli`, the Rust tool that packages and installs them. +That shapes what a vulnerability looks like here, and two classes matter more +than they would elsewhere: + +- **A skill that instructs an agent to do something unsafe.** A skill is + executed by a model with tool access. Text that tells it to run a destructive + command, disable a safety gate, exfiltrate a file, or trust an untrusted input + is a vulnerability in this repository, not a documentation bug — and it + reaches every session that loads the skill. +- **Injection through skill content.** Skills carry reference files, code + samples, and quoted upstream material. Content that smuggles instructions into + a context where a model will read them as directives is in scope. + +Also in scope: `construct-cli` itself (it writes to `~/.claude/skills/` and +unpacks archives), the CI gates, and any credential or private path committed by +mistake. + +Out of scope: a vulnerability in a *project governed by* a skill here belongs to +that project's own repository. + +## Reporting + +Email `Mohamed.Hammad [at] SpacecraftSoftware.org`. Do not open a public issue +for anything that should not be public. + +For a skill-content report, quote the passage and say what an agent would do +having read it. That is the whole of the report — no proof-of-concept is needed, +and we would rather not have one. + +## What to expect + +| | | +|---|---| +| Acknowledgement | within 7 days | +| Assessment | within 30 days | +| Supported versions | `main`, and the most recently published bundle of the affected skill | +| Disclosure | coordinated; the fix lands before any public description | +| Credit | offered by default, declined on request | + +A fix to skill content ships as a new bundle; installed copies are stale until +reinstalled, so an advisory will say which skill and which version. + +This is a personal hobby project (§5.1). There is no SLA, and the targets above +are intentions rather than commitments.