Docs/contributing maintainers agents - #136
Conversation
|
Warning Review limit reached
Next review available in: 33 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
WalkthroughThe PR adds contribution, security, project guidance, best-practices, maintainer, and brand documentation. It also updates contributor contact links and adds a contributor entry. ChangesProject Documentation
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested labels: Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 11
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@agent.md`:
- Line 19: Update the test-file naming guidance in agent.md so it is internally
consistent: change the minichain/chain.py example to tests/test_chain.py, unless
the text explicitly states that related modules may share a test file.
- Line 1: Rename the repository guidance file from agent.md to AGENTS.md and
update every reference or link to use the case-sensitive filename. In the
testing guidance, correct the 1:1 test naming rule so minichain/chain.py is
mapped to tests/test_core.py.
In `@brand/Brand.md`:
- Around line 57-63: Specify the `text` or `plaintext` language on the fenced
repository-tree block in Brand.md so markdownlint-cli2 no longer reports MD040.
- Around line 39-41: Update the brand guidance around `#228B22` to prohibit its
use for normal-size text on white backgrounds and specify WCAG AA-compliant
approved text/background pairings. Revise the link recommendation in the
documented color usage so links use an approved background or a compliant
alternative while preserving the existing accent guidance.
In `@CONTRIBUTING.md`:
- Around line 7-13: Update the contribution workflow in CONTRIBUTING.md to add a
security exception: direct security reports and fixes must follow SECURITY.md,
and vulnerability details must not be shared in public Discord channels or
GitHub Issues. Apply the same exception to the direct-contact guidance around
the related contribution instructions.
- Line 42: Make contributor roster participation optional in CONTRIBUTING.md:42
by removing the requirement to add oneself and stating that contact details may
be shared publicly only with explicit consent. In Contributors.md:12-15, remove
the email column or replace it with an opt-in public contact link, preserving
the roster’s existing contributor information otherwise.
In `@docs/BestPracticesChecklist.md`:
- Around line 120-121: Update the vulnerability_report_process evidence in
BestPracticesChecklist.md to match SECURITY.md by removing the unsupported
email-reporting claim, unless a verified monitored email channel is added to
SECURITY.md; preserve the documented GitHub Private Vulnerability Reporting and
Discord DM channels.
- Around line 91-95: Change the N/A checklist entries identified by
release_notes, release_notes_vulns, and the other referenced criteria from [x]
to [~] to match the legend and their justifications. Recalculate and update the
checklist’s overall 36/49 summary so it reflects the revised N/A statuses.
- Line 21: Update the completion date in the checklist note to August 10, 2026,
replacing the future-dated 2026-08-11 value while preserving the rest of the
note.
In `@docs/brand.md`:
- Line 1: Add a top-level Markdown heading at the beginning of docs/brand.md
before the existing logo paragraph, ensuring the document satisfies markdownlint
MD041 while preserving the current content.
In `@SECURITY.md`:
- Around line 13-14: Remove the Discord DM vulnerability-detail submission path
from SECURITY.md lines 13-14, retaining only the approved controlled private
intake channel. Update docs/BestPracticesChecklist.md lines 123-124 to reference
only that approved private intake channel and limit Discord to non-sensitive
coordination.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 60a5ce2c-1c46-4420-ad8f-94dab41715be
⛔ Files ignored due to path filters (3)
brand/favicon.svgis excluded by!**/*.svgbrand/logo.svgis excluded by!**/*.svgbrand/org-logo.svgis excluded by!**/*.svg
📒 Files selected for processing (8)
CONTRIBUTING.mdContributors.mdSECURITY.mdagent.mdbrand/Brand.mddocs/BestPracticesChecklist.mddocs/brand.mddocs/maintainer.md
| @@ -0,0 +1,37 @@ | |||
| # AGENTS.md | |||
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Tracked agent instruction files:"
git ls-files | grep -E '(^|/)(AGENTS|agent)\.md$' || true
echo "Repository references:"
rg -n '(^|/)(AGENTS|agent)\.md' CONTRIBUTING.md docs/BestPracticesChecklist.md agent.mdRepository: StabilityNexus/MiniChain
Length of output: 850
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Instruction file contents:"
sed -n '1,220p' agent.md
echo
echo "Agent-related discovery and documentation references:"
rg -n -i --hidden --glob '!*.git*' \
'AGENTS\.md|agent\.md|agents? instruction|agent loader|discover' .
echo
echo "Repository root files:"
git ls-files | sed -n '1,120p'Repository: StabilityNexus/MiniChain
Length of output: 5170
🌐 Web query:
Official documentation for AGENTS.md instruction-file discovery and case-sensitive filename requirements
💡 Result:
AGENTS.md is an open, community-driven format used to provide context and instructions to AI coding agents [1][2][3]. Filename Requirements The filename must be exactly AGENTS.md, using uppercase letters [4][5][6]. This requirement is strictly case-sensitive; lowercase variants such as agents.md are generally ignored [5]. Some implementations may support alternative or fallback filenames (such as AGENTS.override.md or project-specific alternatives) depending on the specific tool's configuration [7][6][8], but AGENTS.md is the standard, widely recognized name [1][3]. Discovery and Precedence Discovery rules can vary by implementation, though there are two primary models: 1. Nearest-Ancestor-Only: The agent searches from the current working directory upward until it finds the first AGENTS.md file in the directory tree. It uses only that file and ignores any others found higher up [9][6]. 2. Root-Down Concatenation: The agent walks from the project root down to the current working directory, collecting every AGENTS.md file it encounters along the path. These files are then concatenated (often joined by blank lines) to form the final instruction set. In this model, files closer to the current directory typically override earlier, more global guidance [7][6][10]. Because the original format specification is high-level, developers should verify the specific discovery behavior of their chosen agent tool [10]. The files are standard Markdown and are typically placed in the repository root or the root of subprojects within a monorepo to provide tailored, localized instructions [1][9][5].
Citations:
- 1: https://agents.md/
- 2: https://github.com/openai/agents.md/
- 3: https://github.com/agentsmd/agents.md
- 4: https://kilo.ai/docs/customize/agents-md
- 5: https://deepwiki.com/openai/agents.md/5.1-format-overview-and-specification
- 6: https://agentconfig.ing/files/agents-md/
- 7: https://developers.openai.com/codex/guides/agents-md
- 8: https://docs.factory.ai/cli/configuration/agents-md
- 9: https://code.visualstudio.com/docs/agent-customization/custom-instructions
- 10: https://getknack.ai/blog/agents-md-monorepo
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Test files and module-to-test references:"
rg -n 'minichain/[A-Za-z0-9_]+\.py|tests/test_[A-Za-z0-9_]+\.py|mirror module|1:1' agent.md CONTRIBUTING.md README.md tests minichain
echo
echo "Relevant test file names:"
git ls-files 'tests/*.py' | sortRepository: StabilityNexus/MiniChain
Length of output: 16350
Rename agent.md to AGENTS.md and update all links.
Standard agent discovery uses the case-sensitive filename AGENTS.md; agent.md can be ignored. Also correct the “1:1” test naming rule because it maps minichain/chain.py to tests/test_core.py.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@agent.md` at line 1, Rename the repository guidance file from agent.md to
AGENTS.md and update every reference or link to use the case-sensitive filename.
In the testing guidance, correct the 1:1 test naming rule so minichain/chain.py
is mapped to tests/test_core.py.
|
|
||
| - Core blockchain logic lives under `minichain/` as one module per concern (`block.py`, `chain.py`, `state.py`, `p2p.py`, `mempool.py`, `pow.py`, `rpc.py`, `persistence.py`, `contract.py`). Add new functionality to the matching module rather than creating a new top-level file for a small feature. | ||
| - Smart contracts run under `sys.settrace` for gas metering and `multiprocessing` for sandboxing (see `contract.py`). Any change to contract execution must preserve both the gas-per-opcode accounting and the process-level sandbox boundary. | ||
| - Tests mirror module names 1:1 (`minichain/chain.py` -> `tests/test_core.py` or a dedicated `tests/test_<feature>.py`). Follow the existing file when extending coverage for a module rather than adding a new ad-hoc test file. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use one test-file naming rule.
The text says test names mirror module names 1:1, but the example maps minichain/chain.py to tests/test_core.py. Change the example to tests/test_chain.py, or state that related modules may share a test file.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@agent.md` at line 19, Update the test-file naming guidance in agent.md so it
is internally consistent: change the minichain/chain.py example to
tests/test_chain.py, unless the text explicitly states that related modules may
share a test file.
| - `#228B22` is the primary brand color — use it for the dominant accent in any MiniChain-branded surface (badges, links, headings). | ||
| - `#FFC517` / `#FFBF00` are gold accents — use sparingly, for highlights and call-to-action elements, not body text or large fills. | ||
| - Maintain WCAG AA contrast (4.5:1 for body text) when pairing these colors with text; the greens and golds above are tuned for use on dark or neutral backgrounds, not as text-on-white body copy. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Restrict #228B22 text usage to approved backgrounds.
#228B22 provides approximately 4.4:1 contrast against white, which is below 4.5:1 for normal-size text. Lines 39-41 recommend this color for links but do not define a compliant background. Document approved text/background pairs, or prohibit this color for normal-size text on white.
Proposed clarification
-- `#228B22` is the primary brand color — use it for the dominant accent in any MiniChain-branded surface (badges, links, headings).
+- `#228B22` is the primary brand color — use it for accents on approved backgrounds. Do not use it for normal-size text on white.
+- Define approved text/background pairs that meet WCAG AA contrast.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - `#228B22` is the primary brand color — use it for the dominant accent in any MiniChain-branded surface (badges, links, headings). | |
| - `#FFC517` / `#FFBF00` are gold accents — use sparingly, for highlights and call-to-action elements, not body text or large fills. | |
| - Maintain WCAG AA contrast (4.5:1 for body text) when pairing these colors with text; the greens and golds above are tuned for use on dark or neutral backgrounds, not as text-on-white body copy. | |
| - `#228B22` is the primary brand color — use it for accents on approved backgrounds. Do not use it for normal-size text on white. | |
| - `#FFC517` / `#FFBF00` are gold accents — use sparingly, for highlights and call-to-action elements, not body text or large fills. | |
| - Maintain WCAG AA contrast (4.5:1 for body text) when pairing these colors with text; the greens and golds above are tuned for use on dark or neutral backgrounds, not as text-on-white body copy. | |
| - Define approved text/background pairs that meet WCAG AA contrast. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@brand/Brand.md` around lines 39 - 41, Update the brand guidance around
`#228B22` to prohibit its use for normal-size text on white backgrounds and
specify WCAG AA-compliant approved text/background pairings. Revise the link
recommendation in the documented color usage so links use an approved background
or a compliant alternative while preserving the existing accent guidance.
| ``` | ||
| brand/ | ||
| ├── Brand.md # this file | ||
| ├── logo.svg # primary MiniChain mark | ||
| ├── org-logo.svg # Stability Nexus organization mark | ||
| └── favicon.svg # favicon-ready MiniChain mark | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Specify a language for the fenced code block.
markdownlint-cli2 reports MD040 for this fence. Use text or plaintext so Markdown lint can classify the repository tree correctly.
Proposed fix
-```
+```text📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ``` | |
| brand/ | |
| ├── Brand.md # this file | |
| ├── logo.svg # primary MiniChain mark | |
| ├── org-logo.svg # Stability Nexus organization mark | |
| └── favicon.svg # favicon-ready MiniChain mark | |
| ``` |
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 57-57: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@brand/Brand.md` around lines 57 - 63, Specify the `text` or `plaintext`
language on the fenced repository-tree block in Brand.md so markdownlint-cli2 no
longer reports MD040.
Source: Linters/SAST tools
| > - 🔵 SUGGESTED — Optional but recommended | ||
| > - ⚪ N/A — Mark `[~]` if not applicable, add justification | ||
| > | ||
| > Filled in 2026-08-11 by walking the criteria against the current state of this repo (source, CI workflows, docs). Items that require live GitHub/Discord activity data (response times) could not be verified from the code and are left unmet pending manual confirmation. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use the actual checklist completion date.
Line [21] states 2026-08-11, but the current date is August 10, 2026. Replace it with the actual completion date so the evidence is not future-dated.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/BestPracticesChecklist.md` at line 21, Update the completion date in the
checklist note to August 10, 2026, replacing the future-dated 2026-08-11 value
while preserving the rest of the note.
| - [x] 🔴 **release_notes** — Each release includes human-readable release notes summarizing major changes. Raw `git log` output is NOT acceptable. | ||
| - *Evidence URL:* `[x]` N/A — *Justification: project has not cut any releases yet; it is developed via continuous commits to `main`. Revisit once the first tagged release is planned.* | ||
|
|
||
| - [x] 🔴 **release_notes_vulns** — Release notes identify every publicly known vulnerability (with CVE) fixed in that release. | ||
| - *Evidence URL:* `[x]` N/A — *Justification: no releases exist yet, and no publicly known CVEs affect the project.* |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Use [~] for N/A criteria.
The legend defines [x] as Met and [~] as N/A. The listed criteria use [x] while their notes say N/A. This makes the 36/49 score appear higher than the documented results. Change these checkboxes to [~] and regenerate the summary.
Also applies to: 126-127, 135-136, 200-201, 206-207, 232-236
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/BestPracticesChecklist.md` around lines 91 - 95, Change the N/A
checklist entries identified by release_notes, release_notes_vulns, and the
other referenced criteria from [x] to [~] to match the legend and their
justifications. Recalculate and update the checklist’s overall 36/49 summary so
it reflects the revised N/A statuses.
| @@ -0,0 +1,11 @@ | |||
| The project has a logo in svg format ([`logo.svg`](../brand/logo.svg)). | |||
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add a top-level heading.
markdownlint-cli2 reports MD041 because docs/brand.md starts with paragraph text. Add a heading before the index content.
Proposed fix
+# Brand
+
The project has a logo in svg format ([`logo.svg`](../brand/logo.svg)).📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| The project has a logo in svg format ([`logo.svg`](../brand/logo.svg)). | |
| # Brand | |
| The project has a logo in svg format ([`logo.svg`](../brand/logo.svg)). |
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 1-1: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/brand.md` at line 1, Add a top-level Markdown heading at the beginning
of docs/brand.md before the existing logo paragraph, ensuring the document
satisfies markdownlint MD041 while preserving the current content.
Source: Linters/SAST tools
| 1. **GitHub Private Vulnerability Reporting** (preferred): open a report using the "Security" tab on the [MiniChain repository](https://github.com/StabilityNexus/MiniChain/security/advisories/new). | ||
| 2. **Discord DM:** send a direct message to one of the maintainers listed in [docs/maintainer.md](docs/maintainer.md)— do not post details in a public channel. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
The vulnerability-reporting guidance treats Discord DM as a private security channel. Use a controlled private intake channel instead. Keep Discord limited to non-sensitive coordination.
SECURITY.md#L13-L14: remove Discord DM as a vulnerability-detail submission path.docs/BestPracticesChecklist.md#L123-L124: update the evidence to reference only the approved private intake channel.
📍 Affects 2 files
SECURITY.md#L13-L14(this comment)docs/BestPracticesChecklist.md#L123-L124
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SECURITY.md` around lines 13 - 14, Remove the Discord DM vulnerability-detail
submission path from SECURITY.md lines 13-14, retaining only the approved
controlled private intake channel. Update docs/BestPracticesChecklist.md lines
123-124 to reference only that approved private intake channel and limit Discord
to non-sensitive coordination.
|
|
||
| ## Logo | ||
|
|
||
| MiniChain's mark is an octahedron-style wireframe: eight triangular edges radiating from a central point, each vertex marked with a glowing node. It's meant to evoke a network graph — nodes connected by edges — rather than a literal chain, which fits a project about distributed state rather than links in a chain. |
There was a problem hiding this comment.
It is a 4D-Hypercube projected onto 2 dimensions.
| ## Boundaries | ||
|
|
||
| - Never modify `genesis.json` or files under a node's `--datadir` (persisted chain/state data) as part of a code change. | ||
| - `bore_bin/` and `bore.zip` are vendored binaries — do not edit or regenerate them by hand. |
There was a problem hiding this comment.
"vendored" => "vendor"
| | -------------------------------- | ------------------ | ------------------ | ---------------------------- | | ||
| | Bruno Woltzenlogel Paleo | @Zahnentferner | @b.wp | zahnentferner@gmail.com | | ||
| | Siddhant | @siddhant | @siddhantcookie | siddhantkk27@gmail.com | | ||
| | TODO | TODO | TODO | TODO | |
|
|
||
| ## Supported Versions | ||
|
|
||
| MiniChain does not yet have tagged releases or a formal versioning scheme. Security fixes are applied to the latest commit on `main`, which is the only version supported. |
There was a problem hiding this comment.
Improve this. Lets's have tagged releases.
Adds brand.md (brand asset locations), maintainer.md (AOSSIE maintainer/mentor/ideator roster template), and agent.md (AGENTS.md-style project instructions for AI coding agents).
Adds a PR checklist covering code placement, testing, docs, git hygiene, and security specific to MiniChain's module layout and contract sandboxing model.
Adds Bruno as ideator/mentor/maintainer and Siddhant as maintainer, drops the placeholder note, and removes the Area/Focus column from every table.
Moves agent.md, maintainer.md, BestPracticesChecklist.md, and brand.md into docs/, fixing their relative links to Contributors.md/DCO.md. Adds a brand/ folder (logo.svg, org-logo.svg, favicon.svg copied from public/) plus brand/Brand.md, a real brand guide covering logo usage, the color palette pulled from the logo's own gradient, and a recommended typography pairing. docs/brand.md now hyperlinks into brand/ instead of just asserting it exists.
AGENTS.md-style files are only auto-discovered by AI coding tools when placed at the repository root, unlike CONTRIBUTING-style community health files which GitHub also recognizes under docs/ or .github/. maintainer.md, BestPracticesChecklist.md, and brand.md stay in docs/ since they have no such discovery requirement.
Matches GitHub's recognized community-health filename so it surfaces automatically in the contribute/new-issue/new-PR UI. Updates references in agent.md and docs/BestPracticesChecklist.md accordingly.
CONTRIBUTING.md now leads with "discuss it first" in the project's Discord (linking the channel from maintainer.md and the Stability Nexus server invite), followed by a Must/Should/Suggested contribution checklist and a step-by-step workflow. The original contributor table is preserved at the bottom. Replaces docs/BestPracticesChecklist.md with the AOSSIE Best Practices Checklist template (adapted from the OpenSSF Best Practices Badge), covering criteria not auto-detected by OpenSSF Scorecard.
CONTRIBUTING.md is a guideline, not a roster; keeps the DCO reference without the table.
Walked every criterion against the codebase, CI workflows, and existing docs: description/interaction/contribution basics are met via README + CONTRIBUTING.md; crypto criteria are met (PyNaCl Ed25519 + SHA-256 only, CSPRNG key generation); memory-safety and password-storage items are N/A (pure Python, no passwords). Gaps found and left unmet with evidence: no SECURITY.md (vulnerability_report_process), no linter configured in CI (all warnings_* items), no static/dynamic analysis tooling beyond CodeRabbit's AI review (Analysis category), no tagged releases (Change Control version/release items), and uneven test coverage (test_most, 67% overall per the coverage badge). Issue response-time criteria are left unmet as not verifiable from repo contents alone. Score summary updated to 35/49 (71%).
Adds a SECURITY.md with private reporting channels (GitHub Security Advisories, email), response-time expectations, and vulnerability scope specific to MiniChain (signature forgery, contract sandbox escape, consensus manipulation, P2P DoS, RPC abuse). Flips vulnerability_report_process and vulnerability_report_private to Met in docs/BestPracticesChecklist.md now that the process is documented. Score updated to 36/49 (73%).
Keeps GitHub Private Vulnerability Reporting as the sole private channel instead of publishing a personal email address.
Points reporters to the maintainers listed in docs/maintainer.md for a private Discord DM, alongside GitHub Private Vulnerability Reporting.
Contributors.md was folded into CONTRIBUTING.md's rename; restores it as a standalone contributor roster (original content) with Siddhant added, and points CONTRIBUTING.md at it as the place to add yourself after opening a PR.
Replaces the old invite link and TODO channel placeholder with the Stability Nexus Discord invite and MiniChain discussion channel already used in maintainer.md/CONTRIBUTING.md.
- brand/Brand.md: logo is a 4D hypercube (tesseract) projection, not an octahedron. - agent.md: "vendored" -> "vendor". - Contributors.md: drop the leftover TODO row. - SECURITY.md: Supported Versions now reflects the tag-triggered release workflow (SemVer vX.Y.Z tags, pyproject.toml version) instead of claiming no releases exist. Also updates docs/BestPracticesChecklist.md's Change Control section to Met now that tagged SemVer releases with auto-generated release notes exist. Score: 39/49 (80%).
bcae6ce to
aba16aa
Compare
2 participants
Addressed Issues:
This pr updates the repo quality adds all the necessary documentation
Screenshots/Recordings:
TODO: If applicable, add screenshots or recordings that demonstrate the interface before and after the changes.
Additional Notes:
AI Usage Disclosure:
We encourage contributors to use AI tools responsibly when creating Pull Requests. While AI can be a valuable aid, it is essential to ensure that your contributions meet the task requirements, build successfully, include relevant tests, and pass all linters. Submissions that do not meet these standards may be closed without warning to maintain the quality and integrity of the project. Please take the time to understand the changes you are proposing and their impact. AI slop is strongly discouraged and may lead to banning and blocking. Do not spam our repos with AI slop.
Check one of the checkboxes below:
I have used the following AI models and tools: TODO
Checklist
Summary by CodeRabbit