Complete public repository stewardship and security reporting surfaces

[jmcte]

Problem statement

The public Flow repository does not currently publish a repository license, security reporting policy, or code of conduct. This leaves legal reuse unclear and gives security reporters no repository-local channel despite Flow defining vulnerability response targets.

Desired outcome

Complete the public repository stewardship surface through the governed Bootstrap migration, with an explicit license decision and actionable security reporting instructions.

Scope

• Select and add the approved repository license.
• Add SECURITY.md with supported versions, private reporting route, acknowledgment/triage expectations, and disclosure policy.
• Add a code of conduct and enforcement/contact route.
• Ensure generated ownership records declare which stewardship files Bootstrap manages.
• Confirm GitHub recognizes the resulting community-health files.

Non-goals

• Publishing private contact details or credentials.
• Changing Flow's security response clocks without a versioned policy change.
• Applying stewardship changes fleet-wide before Flow dogfooding succeeds.

Acceptance criteria

• A maintainer-approved LICENSE is present and detected by GitHub.
• SECURITY.md provides a private reporting route without exposing secrets.
• Security response timing matches the versioned Flow policy.
• CODE_OF_CONDUCT.md and its enforcement/contact route are present.
• Generated-file ownership and Bootstrap conformance pass.
• GitHub's community profile recognizes the new files.

Test expectations

• Run Bootstrap plan/golden tests and repository conformance checks.
• Verify GitHub community-profile metadata after merge.

Security implications

The reporting route must not require public disclosure of vulnerabilities or embed a machine credential. Contact and escalation handling must be maintainable.

Documentation implications

Add links from README or CONTRIBUTING where appropriate and keep response targets sourced from the released policy.

Dependencies

• Dogfood Public Repository Standard v1 in Flow #13
• Publish and verify the first immutable Flow policy release #23

Human decision points

• License selection or change
• Public security contact and code-of-conduct enforcement authority

[jmcte]

Maintainer decision required

Repository and organization evidence refreshed on 2026-07-15:

• GitHub reports 13 OMT-Global repositories with an MIT license, including OMT-Global/bootstrap.
• OMT-Global/.github also publishes an MIT LICENSE.
• Flow's community profile currently recognizes CONTRIBUTING.md, but no license, security policy, or code of conduct.
• No organization-wide CODE_OF_CONDUCT.md is currently available for Flow to inherit.
• The released Flow policy requires private vulnerability reporting, a security contact/route, a security response policy, and response targets of 2 business days to acknowledge, 7 calendar days to triage, 7 calendar days to remediate or contain critical findings, and 30 calendar days to remediate high findings.

Recommended coherent decision:

1. Approve MIT for Flow, matching Bootstrap and the dominant OMT-Global licensed-repository convention.
2. Use GitHub private vulnerability reporting as the repository-local private security route, with OMT-Global maintainers as the accountable response authority.
3. Adopt Contributor Covenant 2.1, with OMT-Global maintainers as enforcement authority and the same private GitHub reporting route for confidential conduct reports.

Required human confirmation: approve or replace the license, private reporting route, and conduct-enforcement authority. No stewardship files or repository security setting will be changed until that decision is explicit.

[jmcte]

Maintainer decision approved

The stewardship package is approved with the following repository-specific license model:

• Flow uses the MIT License because it is a public policy/tooling repository intended for reuse.
• GitHub private vulnerability reporting is the repository-local confidential security route.
• Flow adopts Contributor Covenant 2.1.
• OMT-Global maintainers are the accountable security-response and conduct-enforcement authority.
• Bootstrap must additionally support an explicit private/proprietary licensing mode for closed-source products. That mode must not silently apply an open-source license and must preserve third-party license notices.

The proprietary addition does not change Flow's MIT selection. It is a Bootstrap projection requirement for repositories such as Button King and Pocket Parade.

The human decision point on this issue is resolved. Remaining work is dependency-blocked on Bootstrap's ownership-aware license/security/conduct projection and the Flow dogfood migration tracked by #13.