From 2c033126b673e7a5b14f6f80daf35bf56617bc3a Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Wed, 7 Oct 2026 02:14:14 +0800 Subject: [PATCH] docs: add missing governance files (CONTRIBUTING, SECURITY, CODE_OF_CONDUCT, LICENSE) Fills gaps confirmed missing (404) during the org-wide docs cleanup pass. Verification commands in CONTRIBUTING.md are pulled from the real CI workflow (.github/workflows/ci.yml: ruff check . / pytest -q) rather than copied from BinancePlatform. SECURITY.md reflects that private vulnerability reporting is NOT enabled for this repo (verified via `gh api repos/QuantStrategyLab/AlpacaPlatform/private-vulnerability-reporting`) and scopes risk language to the repo's actual current surface (P5 SHADOW only, no broker connectivity/credentials yet; future P4 PAPER_DRY_RUN). LICENSE text matches BinancePlatform's merged MIT license verbatim. README.md was intentionally left untouched per task scope. README.zh-CN.md was intentionally NOT created in this pass -- see PR description for why. Co-Authored-By: Claude Sonnet 5 --- CODE_OF_CONDUCT.md | 16 ++++++++++++++++ CONTRIBUTING.md | 28 ++++++++++++++++++++++++++++ LICENSE | 21 +++++++++++++++++++++ SECURITY.md | 23 +++++++++++++++++++++++ 4 files changed, 88 insertions(+) create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 LICENSE create mode 100644 SECURITY.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..dd3805c --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,16 @@ +# Code of Conduct + +## Our Standards + +- Be respectful, direct, and evidence-oriented in issues, pull requests, reviews, and discussions. +- Assume technical disagreement is about the work. Keep feedback specific to code, docs, data, evidence, reproducibility, or operational risk. +- Avoid harassment, insults, discriminatory language, personal attacks, and repeated off-topic comments. +- Do not pressure maintainers or contributors to disclose private account details, credentials, trading records, unpublished data, or personal information. + +## Project Scope + +QuantStrategyLab repositories involve research, automation, strategy artifacts, and trading-support systems. `AlpacaPlatform` is a bounded Alpaca paper and shadow execution gateway — contributions should keep financial claims conservative and verifiable, separate shadow/paper-stage research evidence from any future live-trading decision, and avoid presenting examples as investment advice. Discussions touching credentials, risk-gate decisions, receipt stores, or any future broker connectivity should stay measured, reproducible, and evidence-based rather than speculative. + +## Reporting and Enforcement + +Report conduct concerns to the maintainer on GitHub: `@Pigbibi`. Maintainers may edit or remove comments, close issues or pull requests, restrict participation, or take other reasonable steps to protect contributors and project integrity. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..37dd404 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,28 @@ +# Contributing + +Thanks for contributing to `AlpacaPlatform`. + +## Ground Rules + +- Prefer small, low-risk pull requests. +- Keep refactors separate from behavior changes. +- Add or update tests when changing runtime behavior. +- Do not use deployment or scheduled workflows as a substitute for local verification. +- Changes touching paper/live admission, credentials, risk-gate decisions, receipt stores, or any future broker-facing adapter must be verified with the existing contract tests first; a passing CI run does not by itself authorize enabling a new execution path. + +## Branching and Pull Requests + +- Create a topic branch for each change. +- Open a pull request with a short summary and a concrete test plan. +- Wait for CI to pass before merging. + +## Local Verification + +Run the checks CI uses before opening a pull request: + +```bash +python -m pip install --upgrade pip +python -m pip install -e ".[dev]" +ruff check . +pytest -q +``` diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..b116a36 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 QuantStrategyLab + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..4cec0b4 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,23 @@ +# Security Policy + +Thanks for helping keep `AlpacaPlatform` safe. + +This repository is a bounded Alpaca paper and shadow execution gateway. Please do **not** open a public issue for vulnerabilities involving credentials, broker access, cloud resources (artifact or receipt stores), risk-gate or policy-gate receipts, or other secret material. + +## Reporting a Vulnerability + +- Contact the maintainer directly at GitHub: `@Pigbibi`. +- Private vulnerability reporting is not currently enabled for this repository, so please report directly to the maintainer rather than opening a public issue. +- Include the repository name, affected commit or branch, environment details, and exact reproduction steps. + +## Secret and Credential Exposure + +If you suspect Alpaca API keys/secrets, GCP service-account keys, or other broker/cloud credentials were exposed: + +1. Rotate the exposed secrets immediately. +2. Pause any scheduled jobs or deployments that could be affected. +3. Share only the minimum evidence needed to reproduce the issue. + +## Scope Notes + +Security fixes should stay minimal and focused. Please avoid bundling unrelated refactors with a security report or patch. This repository currently implements only the P5 `SHADOW` stage (no broker connectivity, no credentials, no order submission); P4 `PAPER_DRY_RUN` will use separate paper-only credentials and endpoints once implemented — scope any report or fix to the stage actually affected.