docs: add missing governance files (CONTRIBUTING, SECURITY, CODE_OF_CONDUCT, LICENSE)

CODE_OF_CONDUCT.md

@@ -0,0 +1,16 @@
+# Code of Conduct
+
+## Our Standards
+
+- Be respectful, direct, and evidence-oriented in issues, pull requests, reviews, and discussions.
+- Assume technical disagreement is about the work. Keep feedback specific to code, docs, data, evidence, reproducibility, or operational risk.
+- Avoid harassment, insults, discriminatory language, personal attacks, and repeated off-topic comments.
+- Do not pressure maintainers or contributors to disclose private account details, credentials, trading records, unpublished data, or personal information.
+
+## Project Scope
+
+QuantStrategyLab repositories involve research, automation, strategy artifacts, and trading-support systems. `AlpacaPlatform` is a bounded Alpaca paper and shadow execution gateway — contributions should keep financial claims conservative and verifiable, separate shadow/paper-stage research evidence from any future live-trading decision, and avoid presenting examples as investment advice. Discussions touching credentials, risk-gate decisions, receipt stores, or any future broker connectivity should stay measured, reproducible, and evidence-based rather than speculative.
+
+## Reporting and Enforcement
+
+Report conduct concerns to the maintainer on GitHub: `@Pigbibi`. Maintainers may edit or remove comments, close issues or pull requests, restrict participation, or take other reasonable steps to protect contributors and project integrity.

CONTRIBUTING.md

@@ -0,0 +1,28 @@
+# Contributing
+
+Thanks for contributing to `AlpacaPlatform`.
+
+## Ground Rules
+
+- Prefer small, low-risk pull requests.
+- Keep refactors separate from behavior changes.
+- Add or update tests when changing runtime behavior.
+- Do not use deployment or scheduled workflows as a substitute for local verification.
+- Changes touching paper/live admission, credentials, risk-gate decisions, receipt stores, or any future broker-facing adapter must be verified with the existing contract tests first; a passing CI run does not by itself authorize enabling a new execution path.
+
+## Branching and Pull Requests
+
+- Create a topic branch for each change.
+- Open a pull request with a short summary and a concrete test plan.
+- Wait for CI to pass before merging.
+
+## Local Verification
+
+Run the checks CI uses before opening a pull request:
+
+```bash
+python -m pip install --upgrade pip
+python -m pip install -e ".[dev]"
+ruff check .
+pytest -q
+```

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 QuantStrategyLab
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+Thanks for helping keep `AlpacaPlatform` safe.
+
+This repository is a bounded Alpaca paper and shadow execution gateway. Please do **not** open a public issue for vulnerabilities involving credentials, broker access, cloud resources (artifact or receipt stores), risk-gate or policy-gate receipts, or other secret material.
+
+## Reporting a Vulnerability
+
+- Contact the maintainer directly at GitHub: `@Pigbibi`.
+- Private vulnerability reporting is not currently enabled for this repository, so please report directly to the maintainer rather than opening a public issue.
+- Include the repository name, affected commit or branch, environment details, and exact reproduction steps.
+
+## Secret and Credential Exposure
+
+If you suspect Alpaca API keys/secrets, GCP service-account keys, or other broker/cloud credentials were exposed:
+
+1. Rotate the exposed secrets immediately.
+2. Pause any scheduled jobs or deployments that could be affected.
+3. Share only the minimum evidence needed to reproduce the issue.
+
+## Scope Notes
+
+Security fixes should stay minimal and focused. Please avoid bundling unrelated refactors with a security report or patch. This repository currently implements only the P5 `SHADOW` stage (no broker connectivity, no credentials, no order submission); P4 `PAPER_DRY_RUN` will use separate paper-only credentials and endpoints once implemented — scope any report or fix to the stage actually affected.