docs: adopt Contributor Covenant 3.0 for the Code of Conduct

[JarryShaw]

Requested by the maintainer — "and for COC, let's use the latest version? i see it at 3.0 already". No issue tracks this.

CODE_OF_CONDUCT.md was Contributor Covenant 1.4. #613 repaired its rendering and deliberately left the version alone, because that was the maintainer's call; it has now been made.

The text is fetched, not transcribed

The base is the canonical 3.0 Markdown from https://www.contributor-covenant.org/version/3/0/code_of_conduct/code_of_conduct.md, diffed against what is committed here. Note the .md link the 3.0 page advertises is the nested one above — …/version/3/0/code_of_conduct.md 404s.

Our Pledge, Encouraged Behaviors, Restricted Behaviors (and Other Restrictions), and Scope are byte-identical to upstream, including two upstream typographic quirks left alone rather than tidied: the period outside the bold in **Violating confidentiality**. and **Promotional materials**., and the curly apostrophes in "anyone’s" and "Mozilla’s".

Everything that differs from canonical is one of the following, and nothing else:

#	Change	Why
1	Leading blank line and trailing blank line dropped	whitespace only
2	[NOTE #1 filled — reporting channel	see below
3	New paragraph sending security reports to SECURITY.md	see consistency check
4	Single-maintainer paragraph replacing the "Community Moderators take reports…" paragraph	see below
5	[NOTE #2 removed — it is an instruction to the adopter, not document text	see below
6	New paragraph stating the ladder is kept, and why one person can run it	see below
7	"Community Moderators" ×7 and "Community Managers" ×1 → singular maintainer	see below
8	Attribution: "Changes were made" paragraph	CC BY requires it
9	Attribution: share-alike confined to this document	see below

The two [NOTE placeholders

3.0 ships two, which the Contributor Covenant site tells adopters to find by searching for [NOTE. Shipping either one unfilled would have been worse than staying on 1.4.

Reporting channel. Upstream reads To report a possible violation, **[NOTE: describe your means of reporting here.]**. It now names jarryshaw@icloud.com — the same working contact 1.4 carried, and the one SECURITY.md already points at as its email fallback — asks for Code of Conduct in the subject and links to the material involved, and adds GitHub's report abuse form for the case a solo project structurally cannot cover: a report about the maintainer. 1.4 papered over that with "other members of the project's leadership", who do not exist.

Enforcement process. Upstream's second placeholder is a bracketed instruction to the adopter ("be sure to edit this section to describe your own policies"), not prose for readers. It is removed, and the section is edited as it invites.

"Community Moderators", and the four-rung ladder

3.0 assigns enforcement throughout to a plural moderation team that this repository does not have — and once, inconsistently in the upstream text itself, calls them "Community Managers". All eight occurrences are now the singular maintainer, and the reporting section says plainly that there is no moderation team and no rota and that response is best-effort rather than contractual, which matches what SECURITY.md already says. Upstream's investigation methods ("reviewing messages, logs, and recordings, or interviewing witnesses") are adapted to what a GitHub project actually has: the issue, pull request, commit and message history, and asking those involved for their account.

The four-rung ladder is kept, and the document now says why: each rung maps onto a lever one person genuinely holds on GitHub — a private message, a locked or limited thread, a temporary interaction limit or block, a permanent block reported to GitHub. Keeping it was the judgement call; a ladder a solo maintainer could not operate would have been the same kind of fiction as the committee.

CC BY-SA 4.0

This is a new obligation — 1.4's attribution paragraph in the old file carried no licence notice at all. The attribution now names Contributor Covenant 3.0, links the permanent https://www.contributor-covenant.org/version/3/0/ URL, carries the CC BY-SA 4.0 notice and link, and adds a "Changes were made" paragraph naming which sections were modified, which BY requires and upstream's template does not supply.

One sentence confines it: "That license covers this document only. The pcapkit source code is separately licensed under BSD-3-Clause; see LICENSE." LICENSE is not touched by this PR (it is #615's file, now merged), and nothing here changes the code's licence. A CC BY-SA governance document alongside BSD-3-Clause code is ordinary and is not a conflict.

Consistency with SECURITY.md

Checked, and they agree — but only just, so the seam is now explicit in both directions:

• SECURITY.md:34-36 tells a reporter who cannot use a private advisory to "email the project contact listed in CODE_OF_CONDUCT.md". That cross-reference depends on this file carrying an email address, which is an independent reason the contact had to survive the upgrade.
• The reverse direction was missing, so a conduct-report channel and a vulnerability channel could have looked interchangeable. The CoC now states that a security vulnerability is not a conduct report and points at SECURITY.md.

SECURITY.md is unmodified.

Stale 1.4 references

Swept the tree for conduct, covenant, version/1/4 and conduct.md. The only file naming version 1.4 or linking the 1/4 URL was CODE_OF_CONDUCT.md itself, so nothing outside it went stale. CONTRIBUTING.md:84 mentions CODE_OF_CONDUCT.md only as a filename in the list of root Markdown files, with no version reference; nothing under docs/source/, pyproject.toml, .github/ or the README mentions the Code of Conduct at all. No corrections were needed in any file another PR owns, docs/source/index.rst included.

Rendering

The 1.4 file's defect in #613 was structural — a stray 1. marker collapsing the whole document into one nested list item — so rendering was verified rather than assumed. Run through GitHub's own Markdown API (POST /markdown, mode=gfm): one <h1>, seven <h2>, and the ladder as a four-item <ol> each containing a nested three-item <ol> inside its <li>. The 1) delimiter and three-space continuation indent that canonical 3.0 uses are kept verbatim and render correctly.

Changelog

Bullet added to docs/source/changelog/1.5.0.rst; CHANGELOG.md regenerated with python util/changelog_md.py, never hand-edited, and --check exits 0.

Worth flagging: #613 argued the opposite for its own CoC change — "No changelog entry: contributor-facing documentation, not user-visible". A bullet is included here because a version change alters the governance terms and adds a licence notice a downstream inventory may care about, which the rendering repair did not. Reverse it if you disagree.

Not done

• No tests, no build, no pcapkit import — nothing here touches the package.
• The upstream "Community Managers" inconsistency is not reported upstream to the Organization for Ethical Source; it is only worked around locally.
• CONTRIBUTING.md still does not mention the Code of Conduct as something contributors agree to, only as a file that is exempt from the .rst rule. Out of scope for a version bump, and CONTRIBUTING.md was refreshed recently by docs: repair the Code of Conduct's rendering and refresh CONTRIBUTING #613.