docs: reorder architecture-role block, add SECURITY/CODE_OF_CONDUCT

CODE_OF_CONDUCT.md

@@ -0,0 +1,16 @@
+# Code of Conduct
+
+## Our Standards
+
+- Be respectful, direct, and evidence-oriented in issues, pull requests, reviews, and discussions.
+- Assume technical disagreement is about the work. Keep feedback specific to code, docs, data, evidence, reproducibility, or operational risk.
+- Avoid harassment, insults, discriminatory language, personal attacks, and repeated off-topic comments.
+- Do not pressure maintainers or contributors to disclose private account details, credentials, unpublished data, or personal information.
+
+## Project Scope
+
+This repository builds snapshot artifacts, manifests, and release evidence for A-share strategy research within QuantStrategyLab. Contributions should keep claims about data quality and artifact correctness conservative and verifiable, separate engineering evidence from investment decisions, and avoid presenting examples or outputs as investment advice.
+
+## Reporting and Enforcement
+
+Report conduct concerns to the maintainer on GitHub: `@Pigbibi`. Maintainers may edit or remove comments, close issues or pull requests, restrict participation, or take other reasonable steps to protect contributors and project integrity.

README.md

@@ -1,14 +1,5 @@
 # CnEquitySnapshotPipelines
 
-
-## QSL architecture role
-
-- **Layer**: `pipeline`.
-- **Responsibility**: A-share snapshot and evidence pipeline.
-- **Owns**: validated factor snapshots, manifests, ranking previews, release evidence.
-- **Consumes**: CnEquityStrategies metadata and upstream market inputs.
-- **Must not**: place broker orders or decide live enablement alone.
-
 [Chinese README](README.zh-CN.md)
 
 > Investing involves risk. This project does not provide investment advice and is for education, research, and engineering review only.
@@ -19,6 +10,14 @@
 
 This repository produces evidence and artifacts. It does not place broker orders, store broker credentials, or make a strategy live by itself.
 
+## QSL architecture role
+
+- **Layer**: `pipeline`.
+- **Responsibility**: A-share snapshot and evidence pipeline.
+- **Owns**: validated factor snapshots, manifests, ranking previews, release evidence.
+- **Consumes**: CnEquityStrategies metadata and upstream market inputs.
+- **Must not**: place broker orders or decide live enablement alone.
+
 ## Active snapshot profile
 
 | Profile | Display name | Contract | Builder |

README.zh-CN.md

@@ -1,14 +1,5 @@
 # CnEquitySnapshotPipelines
 
-
-## QSL 架构角色
-
-- **层级**：`快照/证据流水线`。
-- **职责**：A 股快照与证据流水线。
-- **事实源/归属**：已验证 factor snapshots、manifests、ranking previews、release evidence。
-- **消费对象**：CnEquityStrategies 元数据和上游市场输入。
-- **禁止事项**：下券商订单或单独决定 live enablement。
-
 [English README](README.md)
 
 > 投资有风险。本项目不构成投资建议，仅用于学习、研究和工程审阅。
@@ -19,6 +10,14 @@
 
 本仓库只产出证据与 artifact，不下单，不保存券商凭据，也不能单独决定某个策略是否 live。
 
+## QSL 架构角色
+
+- **层级**：`快照/证据流水线`。
+- **职责**：A 股快照与证据流水线。
+- **事实源/归属**：已验证 factor snapshots、manifests、ranking previews、release evidence。
+- **消费对象**：CnEquityStrategies 元数据和上游市场输入。
+- **禁止事项**：下券商订单或单独决定 live enablement。
+
 ## 当前 active snapshot profile
 
 | Profile | 名称 | 契约 | Builder |

SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+Thanks for helping keep `CnEquitySnapshotPipelines` safe.
+
+This repository builds A-share factor-snapshot artifacts, manifests, and release evidence; it does not place broker orders or store broker credentials. Please do **not** open a public issue for vulnerabilities involving CI/CD secrets, data-source credentials, or issues that could let an attacker tamper with published artifacts or manifests consumed by downstream strategy repositories.
+
+## Reporting a Vulnerability
+
+- Contact the maintainer directly at GitHub: `@Pigbibi`.
+- If private vulnerability reporting is enabled for this repository, prefer that channel.
+- Include the repository name, affected commit or branch, environment details, and exact reproduction steps.
+
+## Secret and Credential Exposure
+
+If you suspect tokens, API keys, or other CI/CD secrets were exposed:
+
+1. Rotate the exposed secrets immediately.
+2. Pause the affected scheduled workflow if the exposure could affect automated artifact publishing.
+3. Share only the minimum evidence needed to reproduce the issue.
+
+## Artifact Integrity
+
+If you find a way to make this pipeline produce a snapshot, manifest, or ranking preview that misrepresents its inputs (for example, bypassing point-in-time safety or validation checks described in [`docs/artifact_contract.md`](docs/artifact_contract.md)), please report it the same way as a security issue, since downstream repositories consume these artifacts without re-deriving them.
+
+## Scope Notes
+
+Security fixes should stay minimal and focused. Please avoid bundling unrelated refactors with a security report or patch.