Add MIT license and public-repo community docs

CODE_OF_CONDUCT.md

@@ -0,0 +1,62 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes
+- Focusing on what is best for the community
+
+Examples of unacceptable behavior:
+
+- The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces and also applies when
+an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+**[email protected]**.
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
+
+[homepage]: https://www.contributor-covenant.org

CONTRIBUTING.md

@@ -0,0 +1,52 @@
+# Contributing
+
+Thanks for helping with Performance Review Manager. This repo is a pnpm monorepo for a local solo-EM workbench.
+
+## Prerequisites
+
+- Node.js ≥ 20
+- **pnpm 10.33.3** (Corepack often resolves pnpm 11, which rejects this lockfile and skips `onlyBuiltDependencies` needed for `better-sqlite3`)
+
+```bash
+corepack prepare [email protected] --activate
+pnpm install
+pnpm rebuild better-sqlite3   # if the native module is missing
+pnpm dev                      # API :8787 + UI :5173
+```
+
+Default demo unlock password after seeding: `workbench`. Do not put real employee data in a demo vault.
+
+## Layout
+
+| Path | Package |
+|------|---------|
+| `apps/api` | Hono + better-sqlite3 API |
+| `apps/ui` | React + Vite UI |
+| `apps/desktop` | Tauri shell (needs Rust + WebView) |
+| `packages/db` | Schema / openDatabase |
+| `packages/shared` | Shared DTOs |
+| `packages/mcp` | Stdio MCP bulk-loader |
+
+Product context lives under `docs/`. Cloud-agent notes: `AGENTS.md`.
+
+## Before you open a PR
+
+1. Keep diffs surgical — touch only what the change needs
+2. Run `pnpm test` (API unit tests; this is what CI gates on `main`)
+3. For API behavior changes, add or extend tests under `apps/api/src/*.test.ts`
+4. Do not commit `data/`, `.env`, secrets, or real PII
+5. Align docs with shipped behavior (prefer honesty over aspirational claims)
+
+`pnpm -r typecheck` / production `pnpm build` may still fail on residual strictness issues; prefer fixing types you touch rather than widening `any`.
+
+## Desktop
+
+Desktop installers are **not** built on every merge. Use Actions → **CI** → **Run workflow**. See `apps/desktop/README.md`.
+
+## Security
+
+Report vulnerabilities privately per [`SECURITY.md`](./SECURITY.md). Do not file public issues that include exploit detail for unfixed flaws.
+
+## Code of conduct
+
+Participation is governed by [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Damon van der Linde and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -227,3 +227,10 @@ Regenerate with `pnpm screenshots` (UI + API running; default password `workbenc
 ## Docs
 
 Product and architecture live under [`/docs`](./docs). Start with [`docs/PRODUCT_BRIEF.md`](./docs/PRODUCT_BRIEF.md). Core loop evaluation: [`docs/CORE_LOOP_EVAL.md`](./docs/CORE_LOOP_EVAL.md). Cursor cloud notes: [`AGENTS.md`](./AGENTS.md).
+
+## License & community
+
+- License: [`LICENSE`](./LICENSE) (MIT)
+- Security reports: [`SECURITY.md`](./SECURITY.md)
+- Contributing: [`CONTRIBUTING.md`](./CONTRIBUTING.md)
+- Code of conduct: [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md)

SECURITY.md

@@ -0,0 +1,54 @@
+# Security Policy
+
+Performance Review Manager (PRM) is a **local, single-user** Engineering Manager workbench. Treat employee performance data as highly sensitive.
+
+## Supported versions
+
+| Version | Supported |
+|---------|-----------|
+| `0.1.x` (main) | Yes |
+| Older tags / forks | Best-effort only |
+
+## Threat model (honest)
+
+PRM protects a vault on **one machine** for **one OS user**. It is not a multi-tenant SaaS boundary.
+
+| Assumption | Implication |
+|------------|-------------|
+| Loopback API (`127.0.0.1`) | Remote network attackers should not reach the API. Shared OS accounts, malware, or other local processes can. |
+| Workspace password | Encrypts SQLite + files **when locked**. While unlocked, data is plaintext on disk under the data directory. |
+| Session token | Held in memory on the API and in the browser `localStorage`. Any XSS on the UI origin can steal it until lock / restart. |
+| Demo password `workbench` | For exploration only. **Never** store real employee data behind the demo password. |
+| Cloud AI / integrations | Explicit egress. Keys leave the machine under your provider contract when features are enabled and used. |
+
+What PRM does **not** claim today:
+
+- OS keychain custody for API keys (keys are encrypted with the workspace secret inside SQLite)
+- Automatic refusal of Dropbox / iCloud / OneDrive data directories (warn when detected; sync folders remain risky)
+- Cryptographic anonymity for peer feedback
+- Tamper-proof legal custody of the activity log (hash-chained and HMAC-exportable, but the EM can re-sign after unlock)
+- Signed auto-update for desktop installers (manual CI artifacts; verify checksums yourself)
+
+Details: [`docs/architecture/TRUST_MODEL.md`](./docs/architecture/TRUST_MODEL.md).
+
+## Reporting a vulnerability
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Email **[email protected]** with:
+
+1. A clear description of the issue and impact
+2. Steps to reproduce (PoC welcome; keep payloads minimal)
+3. Affected commit / tag if known
+4. Whether you plan to disclose publicly and on what timeline
+
+We aim to acknowledge within **7 days** and to provide a remediation plan or fix timeline within **30 days** for confirmed issues in supported versions.
+
+If the report involves real employee PII from a deployed vault, say so up front and redact identifiers in screenshots/logs.
+
+## Safe handling for contributors
+
+- Never commit real vault data (`data/`), `.session`, API keys, or integration tokens
+- Prefer synthetic fixtures (`@example.com`, demo seed people)
+- Do not weaken password checks, CORS, launch-token gates, or encryption for convenience without an explicit security review
+- Demo defaults (`workbench`) must remain labeled as demo-only and must not silently apply to empty / production workspaces

package.json

@@ -2,6 +2,8 @@
   "name": "performance-review-manager",
   "private": true,
   "version": "0.1.0",
+  "license": "MIT",
+  "description": "Local solo EM workbench for evidence-backed performance reviews",
   "scripts": {
     "dev": "pnpm --parallel --filter @prm/api --filter @prm/ui dev",
     "dev:api": "pnpm --filter @prm/api dev",