docs: establish project documentation baseline

Provide installation, security, contribution, licensing, and release guidance while removing user-specific service configuration.
2026-07-27 15:15:56 +02:00
parent b7fea83ed6
commit 7cc15cca92
11 changed files with 529 additions and 5 deletions
@@ -0,0 +1,41 @@
+# Security Policy
+
+## Reason for existence
+
+Pi Status Bridge controls local coding-agent sessions. Security reports and changes must preserve the same-user, local-only boundary.
+
+## Supported versions
+
+| Version | Supported |
+| --- | --- |
+| `0.1.x` | Yes |
+| Earlier versions | No |
+
+## Reporting a vulnerability
+
+Do **not** open a public issue for a suspected vulnerability. Report it privately to the repository maintainers through the hosting forge, including:
+
+- affected commit or version;
+- reproduction steps and prerequisites;
+- impact, especially cross-user access, cross-worktree routing, or approval bypass; and
+- a proposed mitigation when available.
+
+Maintainers will acknowledge the report, reproduce it, and coordinate disclosure before publishing details.
+
+## Security boundaries
+
+- The bridge listens only on a Unix-domain socket under `XDG_RUNTIME_DIR`.
+- The socket directory and socket are owner-only resources.
+- Agents are keyed by canonical worktree paths; requests cannot silently cross worktree boundaries.
+- Pi extensions retain ownership of confirmations and approvals.
+- Prompts and tool payloads must not be emitted in routine lifecycle logs.
+
+A change that weakens any boundary above requires an explicit design update and security review before merge.
+
+## Verification
+
+```bash
+npm test
+```
+
+The test suite covers socket ownership, malformed protocol messages, agent isolation, recovery, and adapter behavior.