Policies

• AI covenant confirmed by a person, 2026-10-13
  Community norms for AI use - contributors own what they submit regardless of tooling, AI systems must not be used to autonomously post comments, replies, or messages, AI co-authorship in commit messages is discouraged, and a repository-owned agent (e.g. ktl-librarian) must commit under a bot or maintainer identity with no trailer either way and land only as a human-reviewed PR.

• Code of conduct checked by automation only, still a draft
  Contributor Covenant v2.1: its scope over issues, pull requests and discussions, and how to report unacceptable behaviour.

• Security policy edited since a person last confirmed it (confirmed 2026-10-19, edited 2026-10-28), reopened
  How to report a vulnerability privately, supported versions, and a surface table (what executes here, what guards it) that links to the shared threat model instead of restating it.

• Threat model edited since a person last confirmed it (confirmed 2026-10-13, edited 2026-10-28), reopened
  The security design the three KTL repositories share, kept in one place so each SECURITY.md can link to it: repository hardening, the human:-attribution gate on a verified event, and the prompt-injection guard for each input path that reads content it did not author.

• Versioning policy edited since a person last confirmed it (confirmed 2026-10-03, edited 2026-10-28), reopened
  One repository-level semantic version covering all six skills, released together under a single tag, with patch, minor and major decided by Conventional Commits.