From 847e28b262865f7db84f3a23db7cf30b3ac45a70 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 9 Aug 2026 11:46:28 +0000 Subject: [PATCH 1/2] Add MIT license and public-repo community docs Ship LICENSE, SECURITY.md, CONTRIBUTING.md, and CODE_OF_CONDUCT.md so the repo has clear legal, vulnerability-reporting, and contribution baselines before going public. Point README and package.json at the MIT license. Co-authored-by: Damon --- CODE_OF_CONDUCT.md | 62 ++++++++++++++++++++++++++++++++++++++++++++++ CONTRIBUTING.md | 52 ++++++++++++++++++++++++++++++++++++++ LICENSE | 21 ++++++++++++++++ SECURITY.md | 54 ++++++++++++++++++++++++++++++++++++++++ package.json | 2 ++ 5 files changed, 191 insertions(+) create mode 100644 CODE_OF_CONDUCT.md create mode 100644 CONTRIBUTING.md create mode 100644 LICENSE create mode 100644 SECURITY.md diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..349b277 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,62 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, caste, color, religion, or sexual +identity and orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment: + +- Demonstrating empathy and kindness toward other people +- Being respectful of differing opinions, viewpoints, and experiences +- Giving and gracefully accepting constructive feedback +- Accepting responsibility and apologizing to those affected by our mistakes +- Focusing on what is best for the community + +Examples of unacceptable behavior: + +- The use of sexualized language or imagery, and sexual attention or advances of + any kind +- Trolling, insulting or derogatory comments, and personal or political attacks +- Public or private harassment +- Publishing others' private information, such as a physical or email address, + without their explicit permission +- Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +## Scope + +This Code of Conduct applies within all community spaces and also applies when +an individual is officially representing the community in public spaces. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the community leaders responsible for enforcement at +**zord.lack.net@gmail.com**. + +All complaints will be reviewed and investigated promptly and fairly. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.1, available at +https://www.contributor-covenant.org/version/2/1/code_of_conduct.html. + +[homepage]: https://www.contributor-covenant.org diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..48732a3 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,52 @@ +# Contributing + +Thanks for helping with Performance Review Manager. This repo is a pnpm monorepo for a local solo-EM workbench. + +## Prerequisites + +- Node.js ≥ 20 +- **pnpm 10.33.3** (Corepack often resolves pnpm 11, which rejects this lockfile and skips `onlyBuiltDependencies` needed for `better-sqlite3`) + +```bash +corepack prepare pnpm@10.33.3 --activate +pnpm install +pnpm rebuild better-sqlite3 # if the native module is missing +pnpm dev # API :8787 + UI :5173 +``` + +Default demo unlock password after seeding: `workbench`. Do not put real employee data in a demo vault. + +## Layout + +| Path | Package | +|------|---------| +| `apps/api` | Hono + better-sqlite3 API | +| `apps/ui` | React + Vite UI | +| `apps/desktop` | Tauri shell (needs Rust + WebView) | +| `packages/db` | Schema / openDatabase | +| `packages/shared` | Shared DTOs | +| `packages/mcp` | Stdio MCP bulk-loader | + +Product context lives under `docs/`. Cloud-agent notes: `AGENTS.md`. + +## Before you open a PR + +1. Keep diffs surgical — touch only what the change needs +2. Run `pnpm test` (API unit tests; this is what CI gates on `main`) +3. For API behavior changes, add or extend tests under `apps/api/src/*.test.ts` +4. Do not commit `data/`, `.env`, secrets, or real PII +5. Align docs with shipped behavior (prefer honesty over aspirational claims) + +`pnpm -r typecheck` / production `pnpm build` may still fail on residual strictness issues; prefer fixing types you touch rather than widening `any`. + +## Desktop + +Desktop installers are **not** built on every merge. Use Actions → **CI** → **Run workflow**. See `apps/desktop/README.md`. + +## Security + +Report vulnerabilities privately per [`SECURITY.md`](./SECURITY.md). Do not file public issues that include exploit detail for unfixed flaws. + +## Code of conduct + +Participation is governed by [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md). diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..b694dae --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Damon van der Linde and contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..f838edd --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,54 @@ +# Security Policy + +Performance Review Manager (PRM) is a **local, single-user** Engineering Manager workbench. Treat employee performance data as highly sensitive. + +## Supported versions + +| Version | Supported | +|---------|-----------| +| `0.1.x` (main) | Yes | +| Older tags / forks | Best-effort only | + +## Threat model (honest) + +PRM protects a vault on **one machine** for **one OS user**. It is not a multi-tenant SaaS boundary. + +| Assumption | Implication | +|------------|-------------| +| Loopback API (`127.0.0.1`) | Remote network attackers should not reach the API. Shared OS accounts, malware, or other local processes can. | +| Workspace password | Encrypts SQLite + files **when locked**. While unlocked, data is plaintext on disk under the data directory. | +| Session token | Held in memory on the API and in the browser `localStorage`. Any XSS on the UI origin can steal it until lock / restart. | +| Demo password `workbench` | For exploration only. **Never** store real employee data behind the demo password. | +| Cloud AI / integrations | Explicit egress. Keys leave the machine under your provider contract when features are enabled and used. | + +What PRM does **not** claim today: + +- OS keychain custody for API keys (keys are encrypted with the workspace secret inside SQLite) +- Automatic refusal of Dropbox / iCloud / OneDrive data directories (warn when detected; sync folders remain risky) +- Cryptographic anonymity for peer feedback +- Tamper-proof legal custody of the activity log (hash-chained and HMAC-exportable, but the EM can re-sign after unlock) +- Signed auto-update for desktop installers (manual CI artifacts; verify checksums yourself) + +Details: [`docs/architecture/TRUST_MODEL.md`](./docs/architecture/TRUST_MODEL.md). + +## Reporting a vulnerability + +**Do not open a public GitHub issue for security vulnerabilities.** + +Email **zord.lack.net@gmail.com** with: + +1. A clear description of the issue and impact +2. Steps to reproduce (PoC welcome; keep payloads minimal) +3. Affected commit / tag if known +4. Whether you plan to disclose publicly and on what timeline + +We aim to acknowledge within **7 days** and to provide a remediation plan or fix timeline within **30 days** for confirmed issues in supported versions. + +If the report involves real employee PII from a deployed vault, say so up front and redact identifiers in screenshots/logs. + +## Safe handling for contributors + +- Never commit real vault data (`data/`), `.session`, API keys, or integration tokens +- Prefer synthetic fixtures (`@example.com`, demo seed people) +- Do not weaken password checks, CORS, launch-token gates, or encryption for convenience without an explicit security review +- Demo defaults (`workbench`) must remain labeled as demo-only and must not silently apply to empty / production workspaces diff --git a/package.json b/package.json index c28f356..ab86b23 100644 --- a/package.json +++ b/package.json @@ -2,6 +2,8 @@ "name": "performance-review-manager", "private": true, "version": "0.1.0", + "license": "MIT", + "description": "Local solo EM workbench for evidence-backed performance reviews", "scripts": { "dev": "pnpm --parallel --filter @prm/api --filter @prm/ui dev", "dev:api": "pnpm --filter @prm/api dev", From c777e7f0fe3d4544e0ae6ef78c33bd52a706b3da Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 9 Aug 2026 11:46:37 +0000 Subject: [PATCH 2/2] Link LICENSE and community docs from README Co-authored-by: Damon --- README.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/README.md b/README.md index bef9b08..3c8fe27 100644 --- a/README.md +++ b/README.md @@ -227,3 +227,10 @@ Regenerate with `pnpm screenshots` (UI + API running; default password `workbenc ## Docs Product and architecture live under [`/docs`](./docs). Start with [`docs/PRODUCT_BRIEF.md`](./docs/PRODUCT_BRIEF.md). Core loop evaluation: [`docs/CORE_LOOP_EVAL.md`](./docs/CORE_LOOP_EVAL.md). Cursor cloud notes: [`AGENTS.md`](./AGENTS.md). + +## License & community + +- License: [`LICENSE`](./LICENSE) (MIT) +- Security reports: [`SECURITY.md`](./SECURITY.md) +- Contributing: [`CONTRIBUTING.md`](./CONTRIBUTING.md) +- Code of conduct: [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md)