[leonardoaraujosantos]

Summary

The repository is public but had no license file, security policy or contribution guide. GitHub showed "no license", which legally means nobody may use the code. This adds the files a first public release needs.

• LICENSE: the official Apache-2.0 text (from apache.org). It matches what Cargo.toml, every crate, the TypeScript SDK and all package manifests (Homebrew, npm, Scoop, WinGet, AUR, Nix) already declare. NOTICE credits "The Cyber Code Authors".
• SECURITY.md:
  • Reports go through GitHub private vulnerability reporting (now enabled on the repository).
  • Response times: acknowledgement within 3 business days, first assessment within 10.
  • Supported versions: main until the first release.
  • In scope: sandbox escapes; permission, trust and policy bypasses; credential leaks including redaction failures; untrusted content causing unapproved actions; authentication of the server, dashboard, peers and hub; release supply chain.
  • Out of scope: explicit bypass or full access, model output quality, third-party providers, local denial of service.
• CONTRIBUTING.md:
  • Setup: Rust 1.89+, Node 22, bubblewrap, just.
  • The just tasks.
  • What CI checks, including how to regenerate the OpenAPI document, the SDK, docs/cli.md and the ROADMAP inventory.
  • Pull request rules: a regression test with every bug fix, docs and spec updates, the complexity limit, Unix-only test gating.
  • When an OpenSpec change is needed.
  • The clean-room rule (no copied code, prompts or docs from other agents).
  • Inbound contribution licensing (Apache-2.0 §5) and a short code of conduct.
• Issue templates: bug report and feature request forms. config.yml routes security reports to the private advisory form and links the feature reference.
• PR template: summary, testing, and a checklist covering regression tests, docs and specs, generated files and lint.
• CHANGELOG.md: Keep a Changelog format. An Unreleased section lists what the first release will contain, the experimental features and the known limits. Non-Git snapshots are left out until Add private non-Git snapshots and retained restore evidence #110 merges.
• README.md:
  • States that no release has been published yet, so the curl install line doesn't work, and points to building from source.
  • Adds a "Contributing and license" section.

Documentation and metadata only; no code changes.