Skip to content

org_policies.md

Latest commit

 

History

History
96 lines (57 loc) · 3.48 KB

org_policies.md

File metadata and controls

96 lines (57 loc) · 3.48 KB
Raw

Organization Policies

This document describes the governance, standards, and expectations that apply across all Echolace DI repositories.

Guiding Principles

All Echolace DI repositories operate under these foundational principles:

Principle Description
Local-First Systems should run without cloud dependency by default. Data belongs to the user.
Transparency Behavior must be inspectable. Logs must be readable. No silent automation.
Human Agency Software assists decisions; it does not replace the decision-maker.
Continuity Systems are designed to maintain context and identity over time, not just across a session.
Ethical Design Systems that affect memory, understanding, or emotional state carry responsibility and must be designed accordingly.

Repository Standards

Naming

  • Repository names should be lowercase, hyphen-separated, and descriptive.
  • Experimental or prototype repos should include a note in the README identifying their status.

Branching

  • The default branch is main.
  • Feature work should be developed in named branches (feature/<name>, fix/<name>, docs/<name>).
  • Direct commits to main are discouraged except for documentation-only changes.

Versioning

  • Repositories that ship releases should follow Semantic Versioning (MAJOR.MINOR.PATCH).
  • Breaking changes must increment the major version.

Documentation

Every repository should include:

  • README.md — project overview, purpose, and setup instructions
  • CONTRIBUTING.md — how to contribute (may link to this org's root CONTRIBUTING.md)
  • SECURITY.md — vulnerability reporting instructions (may link to this org's root SECURITY.md)

CI/CD Standards

  • All Python repositories should use the CI workflow from workflows/ci.yml as a baseline.
  • Security scanning via bandit and safety should run on every merge to main.
  • Failing security scans should be reviewed before merging; they may be accepted with documented justification.

Required Status Checks (for repositories with CI enabled)

  • Lint (flake8 syntax errors)
  • Unit tests (at minimum on Python 3.11)

Dependency Management

  • Dependencies should be pinned to a minimum version in requirements.txt.
  • Dependabot is configured organization-wide for weekly pip and GitHub Actions updates.
  • Major version bumps must be reviewed manually before merging.

Security Policy

The organization-level security policy is documented in SECURITY.md.

All security vulnerabilities must be reported privately to echolacedi@gmail.com. Do not open public issues for security concerns.

Code of Conduct

All contributors and community members are expected to follow the CODE_OF_CONDUCT.md in all project spaces.

Licensing

Unless a repository specifies otherwise, all Echolace DI repositories are intended for open research use. Check the LICENSE file (if present) in each repository for the specific terms that apply.

Exceptions and Amendments

These policies reflect current best practices for the organization and will evolve as the project matures.

Exceptions to any policy should be documented in the affected repository's README or in an ARCHITECTURE.md or DECISIONS.md file explaining the rationale.

Proposed amendments to these policies should be submitted as pull requests to this repository.