From 7b400a651dad90579a315cdf89f6e0be614c416a Mon Sep 17 00:00:00 2001 From: Greeva Patel Date: Mon, 9 Nov 2026 15:34:29 +0530 Subject: [PATCH] docs(agents): describe the tree as it is now AGENTS.md said the tree held only README.md, LICENSE and .gitignore, with no workflows and no SECURITY.md. The repository now has the org CVD policy, security.txt, the CRA and Mbed TLS docs and a docs-check workflow. Name the one verified command (ci/check_docs.py) and point the Security section at SECURITY.md. --- AGENTS.md | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 98a114b..2e93ced 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,16 +1,27 @@ # eSec — agent notes -Placeholder repository (Status: Planned). No implementation, build manifests, -tests, or automation exist on `master` yet. The code that will become eSec -lives in [`embeddedos-org/eos`](https://github.com/embeddedos-org/eos) at +Placeholder repository (Status: Planned). No implementation, build manifests +or tests exist on `master` yet. The repository holds the org security policy +(`SECURITY.md`, `.well-known/security.txt`) and security docs under `docs/`. +A docs workflow checks those docs, the README and `security.txt` (not +`SECURITY.md` or this file). The code that will become eSec lives in +[`embeddedos-org/eos`](https://github.com/embeddedos-org/eos) at `services/security/` and `services/crypto/`. See [README.md](README.md). ## Build / test / lint -No verified commands exist: the tree holds only `README.md`, `LICENSE`, and -`.gitignore` — no manifest (`package.json`, `pyproject.toml`, -`CMakeLists.txt`), no workflows, no tests, and the README documents no -commands. Do not invent commands; re-check the README before running anything. +There is no build and there are no tests: no manifest (`package.json`, +`pyproject.toml`, `CMakeLists.txt`) and no source code. The one verified +command is the docs check that CI runs (`.github/workflows/ci.yml`): + +```sh +python3 ci/check_docs.py +``` + +It needs only the Python standard library. It checks that each doc under +`docs/` and the README has one H1, that relative links resolve, and that +`.well-known/security.txt` has `Contact` and `Expires` and has not expired. +Do not invent other commands. ## Contributing @@ -19,9 +30,11 @@ automation and review requirements. ## Security -No `SECURITY.md` exists. Do not report suspected vulnerabilities in public -issues; use GitHub private security advisories or a private org channel. -Background: [docs/wiki/Security.md](docs/wiki/Security.md). +[SECURITY.md](SECURITY.md) is the coordinated vulnerability disclosure policy +for the whole organization; [docs/cvd-intake.md](docs/cvd-intake.md) is the +report template and [.well-known/security.txt](.well-known/security.txt) the +RFC 9116 contact file. Do not report suspected vulnerabilities in public +issues. ## Wiki mirror