From bf48a0f1c9c53131a2db4bda97f0ec5702870161 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Fri, 28 Aug 2026 22:03:16 +0200 Subject: [PATCH 01/14] Add repository governance baseline --- .claude/CLAUDE.md | 1 + .gitattributes | 11 +++++++++++ .github/CODEOWNERS | 1 + .github/copilot-instructions.md | 1 + .github/dependabot.yml | 10 ++++++++++ .github/pull_request_template.md | 18 ++++++++++++++++++ .gitignore | 11 +++++++++++ AGENTS.md | 14 ++++++++++++++ LICENSE | 21 +++++++++++++++++++++ README.md | 20 ++++++++++++++++++-- 10 files changed, 106 insertions(+), 2 deletions(-) create mode 100644 .claude/CLAUDE.md create mode 100644 .gitattributes create mode 100644 .github/CODEOWNERS create mode 100644 .github/copilot-instructions.md create mode 100644 .github/dependabot.yml create mode 100644 .github/pull_request_template.md create mode 100644 .gitignore create mode 100644 AGENTS.md create mode 100644 LICENSE diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md new file mode 100644 index 0000000..dba71e9 --- /dev/null +++ b/.claude/CLAUDE.md @@ -0,0 +1 @@ +@../AGENTS.md diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..f14e05c --- /dev/null +++ b/.gitattributes @@ -0,0 +1,11 @@ +* text=auto eol=lf + +*.bat text eol=crlf +*.cmd text eol=crlf + +*.gif binary +*.ico binary +*.jpeg binary +*.jpg binary +*.pdf binary +*.png binary diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..e474975 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @MariusStorhaug diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md new file mode 100644 index 0000000..3884664 --- /dev/null +++ b/.github/copilot-instructions.md @@ -0,0 +1 @@ +Follow the instructions in [AGENTS.md](../AGENTS.md). diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..4f05ea7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,10 @@ +--- +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + labels: + - dependencies + - github-actions + schedule: + interval: weekly diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..13e45de --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,18 @@ + + + + +--- +
+Technical details + + + +
+ +
+Relevant issues (or links) + + + +
diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..0d5ccaf --- /dev/null +++ b/.gitignore @@ -0,0 +1,11 @@ +# Operating system files +.DS_Store +Thumbs.db + +# Editors +.history/ +.idea/ +.vscode/ +*.code-workspace +*.swp +*~ diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..a81e831 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,14 @@ +# Agent instructions + +This repository is `github.com/MSXOrg/.github`. Read in this order: + +1. [README.md](README.md) — what this repository provides and how its defaults + are enforced. +2. [.github/CONTRIBUTING.md](.github/CONTRIBUTING.md) — how a change is made + and reviewed. +3. `~/.msx/docs/src/docs/index.md` — the organization standards. Follow the + index inward. +4. `~/.msx/memory/index.md` — durable lessons from earlier work, read last. + +Read nearest first. A local file never overrides a standard, and memory never +overrides documentation. diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..58e5360 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 MSX + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index a997701..2d442f4 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,18 @@ -# .github -Organization profile and default community health files for MSX. +# MSX organization defaults + +`MSXOrg/.github` is GitHub's special public repository for organization-wide +community health defaults. GitHub uses these files when an MSX repository does +not define its own corresponding file. This repository must remain public for +the fallback behavior to work. + +## Precedence and enforcement + +A repository-local community health file takes precedence over the fallback +stored here. Repository-local files also remain the enforceable MSX surface for +people, agents, and automation; these defaults are a convenience, not a +replacement. + +See GitHub's guide to +[default community health files](https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file) +and the MSX +[Organization Standard](https://msx.no/docs/Ways-of-Working/Organization-Standard/). From b2a54cf4bcbe9e2cb745c3297a76eaf40495fd24 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Fri, 28 Aug 2026 22:05:18 +0200 Subject: [PATCH 02/14] Add organization-wide community defaults --- .github/CODE_OF_CONDUCT.md | 55 ++++++++++++++++++++++++++++++++++++++ .github/CONTRIBUTING.md | 30 +++++++++++++++++++++ .github/SECURITY.md | 22 +++++++++++++++ .github/SUPPORT.md | 25 +++++++++++++++++ 4 files changed, 132 insertions(+) create mode 100644 .github/CODE_OF_CONDUCT.md create mode 100644 .github/CONTRIBUTING.md create mode 100644 .github/SECURITY.md create mode 100644 .github/SUPPORT.md diff --git a/.github/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..9c6a2bf --- /dev/null +++ b/.github/CODE_OF_CONDUCT.md @@ -0,0 +1,55 @@ +# Code of conduct + +## Our commitment + +MSX is committed to a welcoming, safe, and equitable community. Everyone who +participates in good faith receives the same respect regardless of identity, +background, experience, or ability. + +## Expected behavior + +Community members are expected to: + +- Communicate with respect and empathy. +- Welcome different viewpoints and experiences. +- Give and accept constructive feedback. +- Take responsibility for mistakes and repair harm where possible. +- Protect confidential and personal information. +- Focus disagreement on the work, not the person. + +## Unacceptable behavior + +The following behavior is not accepted: + +- Harassment, discrimination, threats, or intimidation. +- Sexualized language, imagery, or attention. +- Personal attacks, insults, or sustained disruption. +- Publishing another person's private information without permission. +- Retaliation against someone who reports a concern. +- Conduct that would reasonably make participation unsafe. + +## Scope + +This code applies in MSX repositories and community spaces. It also applies +when someone represents MSX in public, including through an official account, +event, or communication channel. + +## Reporting and enforcement + +Report a possible violation privately to +[msx@msx.no](mailto:msx@msx.no). Include links, dates, context, and any +supporting material that can help the investigation. Do not publish sensitive +details in an issue, pull request, or discussion. + +Maintainers handle reports as confidentially as practical, disclose +information only to those needed for a fair investigation, and avoid handling +reports where they have a conflict of interest. They may remove content, issue +a warning, restrict participation, or impose a temporary or permanent ban +based on the severity and pattern of the behavior. + +## Attribution + +This code draws on the +[Contributor Covenant, version 3.0](https://www.contributor-covenant.org/version/3/0/), +which is licensed under +[CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/). diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md new file mode 100644 index 0000000..9278151 --- /dev/null +++ b/.github/CONTRIBUTING.md @@ -0,0 +1,30 @@ +# Contributing + +Thank you for contributing to an MSX repository. Follow the affected +repository's README and repository-local contribution guidance first; local +files provide the project-specific build, test, and validation steps. + +## Before making a change + +- Review the repository's open issues and use the MSX + [issue process](https://msx.no/docs/Ways-of-Working/Issues/) to propose or + claim substantial work. +- Read the repository's code of conduct and applicable MSX standards. +- Keep each change focused on one deliverable. + +## Submit the change + +1. Create a short-lived branch from the repository's default branch. +2. Make the smallest complete change and run the repository's relevant checks. +3. Open a draft pull request and follow the MSX + [PR Format](https://msx.no/docs/Ways-of-Working/PR-Format/). +4. Self-review the diff, request Copilot review explicitly, and address + in-scope feedback. +5. Mark the pull request ready only after it satisfies the repository's review + gate. + +The canonical +[Contribution Workflow](https://msx.no/docs/Ways-of-Working/Contribution-Workflow/) +defines the complete delivery loop. Use the MSX +[Review Etiquette](https://msx.no/docs/Ways-of-Working/Review-Etiquette/) when +giving or responding to feedback. diff --git a/.github/SECURITY.md b/.github/SECURITY.md new file mode 100644 index 0000000..20807cc --- /dev/null +++ b/.github/SECURITY.md @@ -0,0 +1,22 @@ +# Security policy + +## Supported versions + +Security fixes target the affected repository's latest supported release or, +for an unreleased project, its default branch. A repository-specific security +policy may define additional supported versions and takes precedence over this +fallback. + +## Reporting a vulnerability + +Do not disclose a suspected or confirmed vulnerability through a public issue, +pull request, discussion, or other public channel. + +Use the affected repository's **Security** tab to report the vulnerability +privately when private vulnerability reporting is available. If that option is +unavailable, email [msx@msx.no](mailto:msx@msx.no). + +Include the affected repository and version or commit, the vulnerability and +its impact, steps to reproduce it, and any proof of concept or suggested +mitigation. MSX handles reports privately, investigates them, and coordinates +remediation and disclosure with the reporter where practical. diff --git a/.github/SUPPORT.md b/.github/SUPPORT.md new file mode 100644 index 0000000..1b11744 --- /dev/null +++ b/.github/SUPPORT.md @@ -0,0 +1,25 @@ +# Support + +For help with an MSX repository: + +1. Read that repository's README and documentation. +2. Search its existing issues for a known answer. +3. Open an issue in the affected repository if the question can be discussed + publicly. + +Include the repository and version, relevant environment details, expected and +actual behavior, reproduction steps, and sanitized logs. Remove credentials, +personal information, and other secrets before posting. + +For a matter that cannot be shared publicly, email +[msx@msx.no](mailto:msx@msx.no). + +## Sensitive reports + +Never report a security vulnerability through a public issue. Follow the +[security policy](SECURITY.md) instead. + +Report community conduct concerns through the private route in the +[code of conduct](CODE_OF_CONDUCT.md). + +To propose a change, follow the [contribution guide](CONTRIBUTING.md). From 195a53f61b419d6d26cdd5f087e4fe46dd91b580 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 29 Aug 2026 09:44:40 +0200 Subject: [PATCH 03/14] Use full Contributor Covenant 3.0 text --- .github/CODE_OF_CONDUCT.md | 106 +++++++++++++++++++++++-------------- 1 file changed, 67 insertions(+), 39 deletions(-) diff --git a/.github/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md index 9c6a2bf..ec43ca6 100644 --- a/.github/CODE_OF_CONDUCT.md +++ b/.github/CODE_OF_CONDUCT.md @@ -1,55 +1,83 @@ -# Code of conduct +# Contributor Covenant 3.0 Code of Conduct -## Our commitment +## Our Pledge -MSX is committed to a welcoming, safe, and equitable community. Everyone who -participates in good faith receives the same respect regardless of identity, -background, experience, or ability. +We pledge to make our community welcoming, safe, and equitable for all. -## Expected behavior +We are committed to fostering an environment that respects and promotes the dignity, rights, and contributions of all individuals, regardless of characteristics including race, ethnicity, caste, color, age, physical characteristics, neurodiversity, disability, sex or gender, gender identity or expression, sexual orientation, language, philosophy or religion, national or social origin, socio-economic position, level of education, or other status. The same privileges of participation are extended to everyone who participates in good faith and in accordance with this Covenant. -Community members are expected to: +## Encouraged Behaviors -- Communicate with respect and empathy. -- Welcome different viewpoints and experiences. -- Give and accept constructive feedback. -- Take responsibility for mistakes and repair harm where possible. -- Protect confidential and personal information. -- Focus disagreement on the work, not the person. +While acknowledging differences in social norms, we all strive to meet our community's expectations for positive behavior. We also understand that our words and actions may be interpreted differently than we intend based on culture, background, or native language. -## Unacceptable behavior +With these considerations in mind, we agree to behave mindfully toward each other and act in ways that center our shared values, including: -The following behavior is not accepted: +1. Respecting the **purpose of our community**, our activities, and our ways of gathering. +2. Engaging **kindly and honestly** with others. +3. Respecting **different viewpoints** and experiences. +4. **Taking responsibility** for our actions and contributions. +5. Gracefully giving and accepting **constructive feedback**. +6. Committing to **repairing harm** when it occurs. +7. Behaving in other ways that promote and sustain the **well-being of our community**. -- Harassment, discrimination, threats, or intimidation. -- Sexualized language, imagery, or attention. -- Personal attacks, insults, or sustained disruption. -- Publishing another person's private information without permission. -- Retaliation against someone who reports a concern. -- Conduct that would reasonably make participation unsafe. +## Restricted Behaviors -## Scope +We agree to restrict the following behaviors in our community. Instances, threats, and promotion of these behaviors are violations of this Code of Conduct. + +1. **Harassment.** Violating explicitly expressed boundaries or engaging in unnecessary personal attention after any clear request to stop. +2. **Character attacks.** Making insulting, demeaning, or pejorative comments directed at a community member or group of people. +3. **Stereotyping or discrimination.** Characterizing anyone’s personality or behavior on the basis of immutable identities or traits. +4. **Sexualization.** Behaving in a way that would generally be considered inappropriately intimate in the context or purpose of the community. +5. **Violating confidentiality**. Sharing or acting on someone's personal or private information without their permission. +6. **Endangerment.** Causing, encouraging, or threatening violence or other harm toward any person or group. +7. Behaving in other ways that **threaten the well-being** of our community. + +### Other Restrictions + +1. **Misleading identity.** Impersonating someone else for any reason, or pretending to be someone else to evade enforcement actions. +2. **Failing to credit sources.** Not properly crediting the sources of content you contribute. +3. **Promotional materials**. Sharing marketing or other commercial content in a way that is outside the norms of the community. +4. **Irresponsible communication.** Failing to responsibly present content which includes, links or describes any other restricted behaviors. + +## Reporting an Issue + +Tensions can occur between community members even when they are trying their best to collaborate. Not every conflict represents a code of conduct violation, and this Code of Conduct reinforces encouraged behaviors and norms that can help avoid conflicts and minimize harm. + +When an incident does occur, it is important to report it promptly. To report a possible violation, email [msx@msx.no](mailto:msx@msx.no). -This code applies in MSX repositories and community spaces. It also applies -when someone represents MSX in public, including through an official account, -event, or communication channel. +Community Moderators take reports of violations seriously and will make every effort to respond in a timely manner. They will investigate all reports of code of conduct violations, reviewing messages, logs, and recordings, or interviewing witnesses and other participants. Community Moderators will keep investigation and enforcement actions as transparent as possible while prioritizing safety and confidentiality. In order to honor these values, enforcement actions are carried out in private with the involved parties, but communicating to the whole community may be part of a mutually agreed upon resolution. -## Reporting and enforcement +## Addressing and Repairing Harm -Report a possible violation privately to -[msx@msx.no](mailto:msx@msx.no). Include links, dates, context, and any -supporting material that can help the investigation. Do not publish sensitive -details in an issue, pull request, or discussion. +If an investigation by the Community Moderators finds that this Code of Conduct has been violated, the following enforcement ladder may be used to determine how best to repair harm, based on the incident's impact on the individuals involved and the community as a whole. Depending on the severity of a violation, lower rungs on the ladder may be skipped. -Maintainers handle reports as confidentially as practical, disclose -information only to those needed for a fair investigation, and avoid handling -reports where they have a conflict of interest. They may remove content, issue -a warning, restrict participation, or impose a temporary or permanent ban -based on the severity and pattern of the behavior. +1) Warning + 1) Event: A violation involving a single incident or series of incidents. + 2) Consequence: A private, written warning from the Community Moderators. + 3) Repair: Examples of repair include a private written apology, acknowledgement of responsibility, and seeking clarification on expectations. +2) Temporarily Limited Activities + 1) Event: A repeated incidence of a violation that previously resulted in a warning, or the first incidence of a more serious violation. + 2) Consequence: A private, written warning with a time-limited cooldown period designed to underscore the seriousness of the situation and give the community members involved time to process the incident. The cooldown period may be limited to particular communication channels or interactions with particular community members. + 3) Repair: Examples of repair may include making an apology, using the cooldown period to reflect on actions and impact, and being thoughtful about re-entering community spaces after the period is over. +3) Temporary Suspension + 1) Event: A pattern of repeated violation which the Community Moderators have tried to address with warnings, or a single serious violation. + 2) Consequence: A private written warning with conditions for return from suspension. In general, temporary suspensions give the person being suspended time to reflect upon their behavior and possible corrective actions. + 3) Repair: Examples of repair include respecting the spirit of the suspension, meeting the specified conditions for return, and being thoughtful about how to reintegrate with the community when the suspension is lifted. +4) Permanent Ban + 1) Event: A pattern of repeated code of conduct violations that other steps on the ladder have failed to resolve, or a violation so serious that the Community Moderators determine there is no way to keep the community safe with this person as a member. + 2) Consequence: Access to all community spaces, tools, and communication channels is removed. In general, permanent bans should be rarely used, should have strong reasoning behind them, and should only be resorted to if working through other remedies has failed to change the behavior. + 3) Repair: There is no possible repair in cases of this severity. + +This enforcement ladder is intended as a guideline. It does not limit the ability of Community Managers to use their discretion and judgment, in keeping with the best interests of our community. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public or other spaces. Examples of representing our community include using an official email address, posting via an official social media account, or acting as an appointed representative at an online or offline event. ## Attribution -This code draws on the -[Contributor Covenant, version 3.0](https://www.contributor-covenant.org/version/3/0/), -which is licensed under -[CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/). +This Code of Conduct is adapted from the Contributor Covenant, version 3.0, permanently available at [https://www.contributor-covenant.org/version/3/0/](https://www.contributor-covenant.org/version/3/0/). + +Contributor Covenant is stewarded by the Organization for Ethical Source and licensed under CC BY-SA 4.0. To view a copy of this license, visit [https://creativecommons.org/licenses/by-sa/4.0/](https://creativecommons.org/licenses/by-sa/4.0/) + +For answers to common questions about Contributor Covenant, see the FAQ at [https://www.contributor-covenant.org/faq](https://www.contributor-covenant.org/faq). Translations are provided at [https://www.contributor-covenant.org/translations](https://www.contributor-covenant.org/translations). Additional enforcement and community guideline resources can be found at [https://www.contributor-covenant.org/resources](https://www.contributor-covenant.org/resources). The enforcement ladder was inspired by the work of [Mozilla’s code of conduct team](https://github.com/mozilla/inclusion). From 1825ae634e37a246468d588e1651278d63cf5ab0 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 29 Aug 2026 09:57:21 +0200 Subject: [PATCH 04/14] Clarify private security concern reporting --- .github/SECURITY.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 20807cc..6419b5e 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -16,6 +16,10 @@ Use the affected repository's **Security** tab to report the vulnerability privately when private vulnerability reporting is available. If that option is unavailable, email [msx@msx.no](mailto:msx@msx.no). +Use the same private routes to report accidentally exposed sensitive +information, credentials or secrets, and security controls or configurations +that appear weak or unsafe. + Include the affected repository and version or commit, the vulnerability and its impact, steps to reproduce it, and any proof of concept or suggested mitigation. MSX handles reports privately, investigates them, and coordinates From d02af39a2b7128267904e4a73c33f820601e1d64 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 29 Aug 2026 10:00:45 +0200 Subject: [PATCH 05/14] Clarify code of conduct licensing --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index 2d442f4..b8ba85c 100644 --- a/README.md +++ b/README.md @@ -16,3 +16,9 @@ See GitHub's guide to [default community health files](https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file) and the MSX [Organization Standard](https://msx.no/docs/Ways-of-Working/Organization-Standard/). + +## Licensing + +Repository content is licensed under the [MIT License](LICENSE), except +[the code of conduct](.github/CODE_OF_CONDUCT.md), which retains the +Contributor Covenant's CC BY-SA 4.0 license. From f06cc5d2beb562831cdc075845b8b2cd3b7cfe85 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 29 Aug 2026 10:04:03 +0200 Subject: [PATCH 06/14] Route organization contacts by purpose --- .github/CODE_OF_CONDUCT.md | 2 +- .github/SECURITY.md | 2 +- .github/SUPPORT.md | 4 +++- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md index ec43ca6..42ac347 100644 --- a/.github/CODE_OF_CONDUCT.md +++ b/.github/CODE_OF_CONDUCT.md @@ -43,7 +43,7 @@ We agree to restrict the following behaviors in our community. Instances, threat Tensions can occur between community members even when they are trying their best to collaborate. Not every conflict represents a code of conduct violation, and this Code of Conduct reinforces encouraged behaviors and norms that can help avoid conflicts and minimize harm. -When an incident does occur, it is important to report it promptly. To report a possible violation, email [msx@msx.no](mailto:msx@msx.no). +When an incident does occur, it is important to report it promptly. To report a possible violation, email [support@msx.no](mailto:support@msx.no). Community Moderators take reports of violations seriously and will make every effort to respond in a timely manner. They will investigate all reports of code of conduct violations, reviewing messages, logs, and recordings, or interviewing witnesses and other participants. Community Moderators will keep investigation and enforcement actions as transparent as possible while prioritizing safety and confidentiality. In order to honor these values, enforcement actions are carried out in private with the involved parties, but communicating to the whole community may be part of a mutually agreed upon resolution. diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 6419b5e..2a57906 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -14,7 +14,7 @@ pull request, discussion, or other public channel. Use the affected repository's **Security** tab to report the vulnerability privately when private vulnerability reporting is available. If that option is -unavailable, email [msx@msx.no](mailto:msx@msx.no). +unavailable, email [security@msx.no](mailto:security@msx.no). Use the same private routes to report accidentally exposed sensitive information, credentials or secrets, and security controls or configurations diff --git a/.github/SUPPORT.md b/.github/SUPPORT.md index 1b11744..32987e4 100644 --- a/.github/SUPPORT.md +++ b/.github/SUPPORT.md @@ -12,7 +12,9 @@ actual behavior, reproduction steps, and sanitized logs. Remove credentials, personal information, and other secrets before posting. For a matter that cannot be shared publicly, email -[msx@msx.no](mailto:msx@msx.no). +[support@msx.no](mailto:support@msx.no). + +For billing questions, email [billing@msx.no](mailto:billing@msx.no). ## Sensitive reports From 782f53d52378db81db6ad47f0dd67b81de4ead6a Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 29 Aug 2026 10:04:56 +0200 Subject: [PATCH 07/14] Use evergreen support and security guidance --- .github/CONTRIBUTING.md | 6 +++--- .github/SECURITY.md | 10 +++++----- .github/SUPPORT.md | 8 ++------ 3 files changed, 10 insertions(+), 14 deletions(-) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 9278151..56e74e7 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -1,8 +1,8 @@ # Contributing -Thank you for contributing to an MSX repository. Follow the affected -repository's README and repository-local contribution guidance first; local -files provide the project-specific build, test, and validation steps. +The affected repository's README and repository-local contribution guidance +define its build, test, and validation steps. Follow those local instructions +before this organization-wide fallback. ## Before making a change diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 2a57906..b485c37 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -3,8 +3,8 @@ ## Supported versions Security fixes target the affected repository's latest supported release or, -for an unreleased project, its default branch. A repository-specific security -policy may define additional supported versions and takes precedence over this +for an unreleased project, its default branch. Repository-specific security +policies define any additional supported versions and take precedence over this fallback. ## Reporting a vulnerability @@ -17,10 +17,10 @@ privately when private vulnerability reporting is available. If that option is unavailable, email [security@msx.no](mailto:security@msx.no). Use the same private routes to report accidentally exposed sensitive -information, credentials or secrets, and security controls or configurations -that appear weak or unsafe. +information, credentials or secrets, and weak or unsafe security controls or +configurations. Include the affected repository and version or commit, the vulnerability and its impact, steps to reproduce it, and any proof of concept or suggested mitigation. MSX handles reports privately, investigates them, and coordinates -remediation and disclosure with the reporter where practical. +remediation and disclosure with the reporter. diff --git a/.github/SUPPORT.md b/.github/SUPPORT.md index 32987e4..19b5d37 100644 --- a/.github/SUPPORT.md +++ b/.github/SUPPORT.md @@ -4,17 +4,13 @@ For help with an MSX repository: 1. Read that repository's README and documentation. 2. Search its existing issues for a known answer. -3. Open an issue in the affected repository if the question can be discussed - publicly. +3. Open an issue in the affected repository for a public question. Include the repository and version, relevant environment details, expected and actual behavior, reproduction steps, and sanitized logs. Remove credentials, personal information, and other secrets before posting. -For a matter that cannot be shared publicly, email -[support@msx.no](mailto:support@msx.no). - -For billing questions, email [billing@msx.no](mailto:billing@msx.no). +Private support matters go to [support@msx.no](mailto:support@msx.no). ## Sensitive reports From bce4f5d0c3aaabcdfa21ca68477e49cea8a28df2 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 29 Aug 2026 10:08:08 +0200 Subject: [PATCH 08/14] Clarify reportable security concerns --- .github/SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/SECURITY.md b/.github/SECURITY.md index b485c37..7be9553 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -17,8 +17,8 @@ privately when private vulnerability reporting is available. If that option is unavailable, email [security@msx.no](mailto:security@msx.no). Use the same private routes to report accidentally exposed sensitive -information, credentials or secrets, and weak or unsafe security controls or -configurations. +information, exposed credentials, exposed secrets, and weak or unsafe security +controls or configurations. Include the affected repository and version or commit, the vulnerability and its impact, steps to reproduce it, and any proof of concept or suggested From bda2f84995bd5ffc7f636c0d60c0e27e02eeff26 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 29 Aug 2026 10:15:09 +0200 Subject: [PATCH 09/14] Match Contributor Covenant source formatting --- .github/CODE_OF_CONDUCT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md index 42ac347..45b274d 100644 --- a/.github/CODE_OF_CONDUCT.md +++ b/.github/CODE_OF_CONDUCT.md @@ -6,6 +6,7 @@ We pledge to make our community welcoming, safe, and equitable for all. We are committed to fostering an environment that respects and promotes the dignity, rights, and contributions of all individuals, regardless of characteristics including race, ethnicity, caste, color, age, physical characteristics, neurodiversity, disability, sex or gender, gender identity or expression, sexual orientation, language, philosophy or religion, national or social origin, socio-economic position, level of education, or other status. The same privileges of participation are extended to everyone who participates in good faith and in accordance with this Covenant. + ## Encouraged Behaviors While acknowledging differences in social norms, we all strive to meet our community's expectations for positive behavior. We also understand that our words and actions may be interpreted differently than we intend based on culture, background, or native language. @@ -20,6 +21,7 @@ With these considerations in mind, we agree to behave mindfully toward each othe 6. Committing to **repairing harm** when it occurs. 7. Behaving in other ways that promote and sustain the **well-being of our community**. + ## Restricted Behaviors We agree to restrict the following behaviors in our community. Instances, threats, and promotion of these behaviors are violations of this Code of Conduct. @@ -39,6 +41,7 @@ We agree to restrict the following behaviors in our community. Instances, threat 3. **Promotional materials**. Sharing marketing or other commercial content in a way that is outside the norms of the community. 4. **Irresponsible communication.** Failing to responsibly present content which includes, links or describes any other restricted behaviors. + ## Reporting an Issue Tensions can occur between community members even when they are trying their best to collaborate. Not every conflict represents a code of conduct violation, and this Code of Conduct reinforces encouraged behaviors and norms that can help avoid conflicts and minimize harm. @@ -47,6 +50,7 @@ When an incident does occur, it is important to report it promptly. To report a Community Moderators take reports of violations seriously and will make every effort to respond in a timely manner. They will investigate all reports of code of conduct violations, reviewing messages, logs, and recordings, or interviewing witnesses and other participants. Community Moderators will keep investigation and enforcement actions as transparent as possible while prioritizing safety and confidentiality. In order to honor these values, enforcement actions are carried out in private with the involved parties, but communicating to the whole community may be part of a mutually agreed upon resolution. + ## Addressing and Repairing Harm If an investigation by the Community Moderators finds that this Code of Conduct has been violated, the following enforcement ladder may be used to determine how best to repair harm, based on the incident's impact on the individuals involved and the community as a whole. Depending on the severity of a violation, lower rungs on the ladder may be skipped. @@ -70,10 +74,12 @@ If an investigation by the Community Moderators finds that this Code of Conduct This enforcement ladder is intended as a guideline. It does not limit the ability of Community Managers to use their discretion and judgment, in keeping with the best interests of our community. + ## Scope This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public or other spaces. Examples of representing our community include using an official email address, posting via an official social media account, or acting as an appointed representative at an online or offline event. + ## Attribution This Code of Conduct is adapted from the Contributor Covenant, version 3.0, permanently available at [https://www.contributor-covenant.org/version/3/0/](https://www.contributor-covenant.org/version/3/0/). From 9cea8028f04efa66ced8520b8845b704409ec55e Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 29 Aug 2026 10:16:01 +0200 Subject: [PATCH 10/14] Align shared community file formatting --- .github/SUPPORT.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/SUPPORT.md b/.github/SUPPORT.md index 19b5d37..18cdd55 100644 --- a/.github/SUPPORT.md +++ b/.github/SUPPORT.md @@ -10,7 +10,8 @@ Include the repository and version, relevant environment details, expected and actual behavior, reproduction steps, and sanitized logs. Remove credentials, personal information, and other secrets before posting. -Private support matters go to [support@msx.no](mailto:support@msx.no). +Private support matters go to +[support@msx.no](mailto:support@msx.no). ## Sensitive reports From ec1413d76ee450300b09000f438edae6bde28a27 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 29 Aug 2026 10:22:51 +0200 Subject: [PATCH 11/14] Normalize Contributor Covenant spacing --- .github/CODE_OF_CONDUCT.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/.github/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md index 45b274d..42ac347 100644 --- a/.github/CODE_OF_CONDUCT.md +++ b/.github/CODE_OF_CONDUCT.md @@ -6,7 +6,6 @@ We pledge to make our community welcoming, safe, and equitable for all. We are committed to fostering an environment that respects and promotes the dignity, rights, and contributions of all individuals, regardless of characteristics including race, ethnicity, caste, color, age, physical characteristics, neurodiversity, disability, sex or gender, gender identity or expression, sexual orientation, language, philosophy or religion, national or social origin, socio-economic position, level of education, or other status. The same privileges of participation are extended to everyone who participates in good faith and in accordance with this Covenant. - ## Encouraged Behaviors While acknowledging differences in social norms, we all strive to meet our community's expectations for positive behavior. We also understand that our words and actions may be interpreted differently than we intend based on culture, background, or native language. @@ -21,7 +20,6 @@ With these considerations in mind, we agree to behave mindfully toward each othe 6. Committing to **repairing harm** when it occurs. 7. Behaving in other ways that promote and sustain the **well-being of our community**. - ## Restricted Behaviors We agree to restrict the following behaviors in our community. Instances, threats, and promotion of these behaviors are violations of this Code of Conduct. @@ -41,7 +39,6 @@ We agree to restrict the following behaviors in our community. Instances, threat 3. **Promotional materials**. Sharing marketing or other commercial content in a way that is outside the norms of the community. 4. **Irresponsible communication.** Failing to responsibly present content which includes, links or describes any other restricted behaviors. - ## Reporting an Issue Tensions can occur between community members even when they are trying their best to collaborate. Not every conflict represents a code of conduct violation, and this Code of Conduct reinforces encouraged behaviors and norms that can help avoid conflicts and minimize harm. @@ -50,7 +47,6 @@ When an incident does occur, it is important to report it promptly. To report a Community Moderators take reports of violations seriously and will make every effort to respond in a timely manner. They will investigate all reports of code of conduct violations, reviewing messages, logs, and recordings, or interviewing witnesses and other participants. Community Moderators will keep investigation and enforcement actions as transparent as possible while prioritizing safety and confidentiality. In order to honor these values, enforcement actions are carried out in private with the involved parties, but communicating to the whole community may be part of a mutually agreed upon resolution. - ## Addressing and Repairing Harm If an investigation by the Community Moderators finds that this Code of Conduct has been violated, the following enforcement ladder may be used to determine how best to repair harm, based on the incident's impact on the individuals involved and the community as a whole. Depending on the severity of a violation, lower rungs on the ladder may be skipped. @@ -74,12 +70,10 @@ If an investigation by the Community Moderators finds that this Code of Conduct This enforcement ladder is intended as a guideline. It does not limit the ability of Community Managers to use their discretion and judgment, in keeping with the best interests of our community. - ## Scope This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public or other spaces. Examples of representing our community include using an official email address, posting via an official social media account, or acting as an appointed representative at an online or offline event. - ## Attribution This Code of Conduct is adapted from the Contributor Covenant, version 3.0, permanently available at [https://www.contributor-covenant.org/version/3/0/](https://www.contributor-covenant.org/version/3/0/). From 2f417d96ce5eda2108e77e9b0c2e583be27988d5 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 29 Aug 2026 10:22:52 +0200 Subject: [PATCH 12/14] Document the MSX agent plugin --- .github/CONTRIBUTING.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 56e74e7..2bb2c8a 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -12,6 +12,12 @@ before this organization-wide fallback. - Read the repository's code of conduct and applicable MSX standards. - Keep each change focused on one deliverable. +## Agent plugin + +The [MSX agent plugin marketplace](https://github.com/MSXOrg/docs/tree/main/.github/plugin) +provides Copilot CLI with skills that route work to current MSX standards and +workflows. + ## Submit the change 1. Create a short-lived branch from the repository's default branch. From d1d8ea4943d239b759eb36e84a96a01b5602278f Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 29 Aug 2026 10:32:00 +0200 Subject: [PATCH 13/14] Remove repository-level license --- LICENSE | 21 --------------------- README.md | 6 ------ 2 files changed, 27 deletions(-) delete mode 100644 LICENSE diff --git a/LICENSE b/LICENSE deleted file mode 100644 index 58e5360..0000000 --- a/LICENSE +++ /dev/null @@ -1,21 +0,0 @@ -MIT License - -Copyright (c) 2026 MSX - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. diff --git a/README.md b/README.md index b8ba85c..2d442f4 100644 --- a/README.md +++ b/README.md @@ -16,9 +16,3 @@ See GitHub's guide to [default community health files](https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file) and the MSX [Organization Standard](https://msx.no/docs/Ways-of-Working/Organization-Standard/). - -## Licensing - -Repository content is licensed under the [MIT License](LICENSE), except -[the code of conduct](.github/CODE_OF_CONDUCT.md), which retains the -Contributor Covenant's CC BY-SA 4.0 license. From 7a50d1b0c8d05df024ab9258338e8697dd8278e3 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 29 Aug 2026 10:46:38 +0200 Subject: [PATCH 14/14] Route agents to repository context --- AGENTS.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index a81e831..aae4dfb 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,14 +1,16 @@ # Agent instructions -This repository is `github.com/MSXOrg/.github`. Read in this order: +Read nearest first, prefer documentation over memory, and always use the newest +version. 1. [README.md](README.md) — what this repository provides and how its defaults are enforced. 2. [.github/CONTRIBUTING.md](.github/CONTRIBUTING.md) — how a change is made and reviewed. -3. `~/.msx/docs/src/docs/index.md` — the organization standards. Follow the - index inward. -4. `~/.msx/memory/index.md` — durable lessons from earlier work, read last. - -Read nearest first. A local file never overrides a standard, and memory never -overrides documentation. +3. [`MSXOrg/docs`](https://github.com/MSXOrg/docs) — organization standards. + Start at + [`src/docs/index.md`](https://github.com/MSXOrg/docs/blob/main/src/docs/index.md) + or the [published documentation](https://msx.no/docs/). Store a local clone + at `~/.msxorg/docs`. +4. `github.com/MSXOrg/memory` (private) — durable lessons from earlier work. + Store a local clone at `~/.msxorg/memory` and read `index.md` last.