External/roboco
1
0
Fork 0
mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: reflow hard-wrapped prose to one line per paragraph

Browse Source 
Markdown and editors soft-wrap on their own, so the manual ~75-char line
breaks across the docs added nothing but noise. Join wrapped prose, list
items, and paragraphs into single lines across 67 docs — README, CLAUDE.md,
deployment, usage, the RAG knowledge base, and the agent role prompts.
Whitespace-only: code fences, tables, and blockquote alerts are byte-identical
and the change is token-verified (no content altered). Applied with a
deterministic reflow tool (committed separately).

Also lands two doc edits that were awaiting commit: the measured under-load
resource numbers in usage.md and the pr_reviewer additions to the
org-structure RAG doc.
This commit is contained in:
Renn F
2026-06-16 23:18:55 +02:00
parent 640a964b88
commit f48106cbb6
67 changed files with 504 additions and 1593 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+10 -25
View File
@@ -1,14 +1,10 @@
# Security Policy
RoboCo is licensed under the GNU Affero General Public License v3.0
(AGPL-3.0). This policy explains which versions receive security fixes and how
to report a vulnerability responsibly.
RoboCo is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). This policy explains which versions receive security fixes and how to report a vulnerability responsibly.
## Supported Versions
RoboCo is pre-1.0 and ships as a Docker image / GitHub release rather than a
versioned library. Security fixes are applied to the latest release and the
`master` branch only.
RoboCo is pre-1.0 and ships as a Docker image / GitHub release rather than a versioned library. Security fixes are applied to the latest release and the `master` branch only.
| Version | Supported |
| ------------------ | ------------------ |
@@ -16,9 +12,7 @@ versioned library. Security fixes are applied to the latest release and the
| Latest release tag | :white_check_mark: |
| Older releases | :x: |
Always run the most recent images — from GHCR (`ghcr.io/rennf93/roboco-*`) or
Docker Hub (`renzof93/roboco-*`), tag `latest` — or build from the latest
`master`.
Always run the most recent images — from GHCR (`ghcr.io/rennf93/roboco-*`) or Docker Hub (`renzof93/roboco-*`), tag `latest` — or build from the latest `master`.
## Reporting a Vulnerability
@@ -26,33 +20,24 @@ Docker Hub (`renzof93/roboco-*`), tag `latest` — or build from the latest
Report privately through one of:
1. **GitHub Security Advisories (preferred).** Go to the repository's
**Security** tab → **Report a vulnerability**, which opens a private
advisory visible only to you and the maintainer.
2. **Email.** Contact the maintainer at **rennf93@gmail.com**. Use a subject
line beginning with `[RoboCo Security]`.
1. **GitHub Security Advisories (preferred).** Go to the repository's **Security** tab → **Report a vulnerability**, which opens a private advisory visible only to you and the maintainer.
2. **Email.** Contact the maintainer at **rennf93@gmail.com**. Use a subject line beginning with `[RoboCo Security]`.
Please include, where possible:
- A description of the vulnerability and its impact.
- Steps to reproduce, or a proof-of-concept.
- The affected subsystem (api, services, gateway, orchestrator, enforcement,
db, agents, mcp, panel) and version / image tag.
- The affected subsystem (api, services, gateway, orchestrator, enforcement, db, agents, mcp, panel) and version / image tag.
- Any suggested remediation.
Particularly relevant to RoboCo's design: issues that could let an agent
container exfiltrate a project git token, escape the gateway verb surface, or
escalate task-lifecycle permissions are treated as high severity.
Particularly relevant to RoboCo's design: issues that could let an agent container exfiltrate a project git token, escape the gateway verb surface, or escalate task-lifecycle permissions are treated as high severity.
## Response Expectations
This is a maintainer-led open-source project, so timelines are best-effort:
- **Acknowledgement:** within 5 business days of your report.
- **Initial assessment:** within 10 business days, confirming whether the
issue is accepted and its rough severity.
- **Fix & disclosure:** coordinated with you. We aim to ship a fix and publish
an advisory promptly, crediting you unless you prefer to remain anonymous.
- **Initial assessment:** within 10 business days, confirming whether the issue is accepted and its rough severity.
- **Fix & disclosure:** coordinated with you. We aim to ship a fix and publish an advisory promptly, crediting you unless you prefer to remain anonymous.
Please give us a reasonable window to remediate before any public disclosure.
Thank you for helping keep RoboCo and its users safe.
Please give us a reasonable window to remediate before any public disclosure. Thank you for helping keep RoboCo and its users safe.