chore: add NOTICE.md and SECURITY.md (§5.2, §26.1)

NOTICE.md

@@ -0,0 +1,63 @@
+<!--
+SPDX-FileCopyrightText: 2026 Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org>
+SPDX-License-Identifier: CC-BY-SA-4.0
+-->
+
+# NOTICE
+
+## Project Posture
+
+Spacecraft Software is a **personal hobby project** maintained by Mohamed Hammad. Its
+primary purpose is to serve the maintainer's own use case — a Rust-first
+systems software stack, tooling, and rewrites that the maintainer wants to
+run on his own machines. Most subprojects are developed at hobby pace and
+shaped around that workflow.
+
+A handful of subprojects (e.g., **Anvil-SSH**) are intentionally designed and
+maintained with general use in mind. Where this applies, it is stated
+explicitly in that subproject's `README.md`. The umbrella as a whole is not.
+
+## No Warranty
+
+Spacecraft Software and every subproject under it are provided **AS IS**, without
+warranty of any kind, express or implied. This includes — but is not limited
+to — implied warranties of merchantability, fitness for a particular purpose,
+non-infringement, and the absence of latent defects. The entire risk as to
+quality and performance lies with the user.
+
+## No Liability
+
+In no event shall the maintainer be liable for any claim, damages, or other
+liability — whether in an action of contract, tort, or otherwise — arising
+from, out of, or in connection with this software, its use, or its inability
+to be used. This includes, without limitation, data loss, hardware damage,
+business interruption, security incidents, and any direct, indirect,
+incidental, special, exemplary, or consequential damages of any kind.
+
+## Authoritative Terms
+
+The statements above describe the maintainer's posture in plain language. The
+formal, legally binding terms are those of the **GNU General Public License,
+version 3 or later** (`GPL-3.0-or-later`). In any conflict between this
+notice and the license text, the license text governs.
+
+The full license is available at <https://www.gnu.org/licenses/gpl-3.0.html>
+and in the project's `LICENSE` file.
+
+## Contributions, Suggestions, and Forks
+
+- Contributions and suggestions are welcome — see [`CONTRIBUTING.md`](./CONTRIBUTING.md).
+- PR acceptance is at the maintainer's sole discretion.
+- Forking under GPL-3.0-or-later is always available and encouraged when
+  goals diverge.
+
+## Maintainer
+
+Mohamed Hammad &lt;Mohamed.Hammad@SpacecraftSoftware.org&gt;
+Copyright (c) 2026 Mohamed Hammad
+License: GPL-3.0-or-later
+Website: <https://SpacecraftSoftware.org/>
+
+---
+
+*--- Forged in Spacecraft Software ---*

SECURITY.md

@@ -0,0 +1,57 @@
+<!--
+SPDX-FileCopyrightText: 2026 Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org>
+SPDX-License-Identifier: CC-BY-SA-4.0
+-->
+
+# Security Policy
+
+Standard §26.1 requires every Spacecraft Software repository to state where a
+vulnerability report goes and what happens to it.
+
+## Scope
+
+This repository holds **agent skills** — instructions a language model loads and
+acts on — plus `construct-cli`, the Rust tool that packages and installs them.
+That shapes what a vulnerability looks like here, and two classes matter more
+than they would elsewhere:
+
+- **A skill that instructs an agent to do something unsafe.** A skill is
+  executed by a model with tool access. Text that tells it to run a destructive
+  command, disable a safety gate, exfiltrate a file, or trust an untrusted input
+  is a vulnerability in this repository, not a documentation bug — and it
+  reaches every session that loads the skill.
+- **Injection through skill content.** Skills carry reference files, code
+  samples, and quoted upstream material. Content that smuggles instructions into
+  a context where a model will read them as directives is in scope.
+
+Also in scope: `construct-cli` itself (it writes to `~/.claude/skills/` and
+unpacks archives), the CI gates, and any credential or private path committed by
+mistake.
+
+Out of scope: a vulnerability in a *project governed by* a skill here belongs to
+that project's own repository.
+
+## Reporting
+
+Email `Mohamed.Hammad [at] SpacecraftSoftware.org`. Do not open a public issue
+for anything that should not be public.
+
+For a skill-content report, quote the passage and say what an agent would do
+having read it. That is the whole of the report — no proof-of-concept is needed,
+and we would rather not have one.
+
+## What to expect
+
+| | |
+|---|---|
+| Acknowledgement | within 7 days |
+| Assessment | within 30 days |
+| Supported versions | `main`, and the most recently published bundle of the affected skill |
+| Disclosure | coordinated; the fix lands before any public description |
+| Credit | offered by default, declined on request |
+
+A fix to skill content ships as a new bundle; installed copies are stale until
+reinstalled, so an advisory will say which skill and which version.
+
+This is a personal hobby project (§5.1). There is no SLA, and the targets above
+are intentions rather than commitments.