chore(compliance): security policy, release SBOM and provenance, licence headers

.github/release.yml

@@ -3,7 +3,7 @@
 #
 # Categorizes the notes that `gh release create --generate-notes` produces
 # (grouping merged PRs by label into sections). Those categorized notes flow
-# into the resq-software/landing changelog aggregator, whose `kind` inference
+# into the org's changelog aggregator, whose `kind` inference
 # reads these section headers — so labeling PRs makes the changelog's
 # feature/fix/improvement classification accurate instead of a default guess.
 # Add `C-*` category labels to PRs to populate the sections; the path labels

.github/workflows/ci.yml

@@ -50,27 +50,78 @@ jobs:
             *) echo "::error::rust reusable returned: $RUST_RESULT"; exit 1 ;;
           esac
 
-  # Publish a GitHub Release per v* tag so resq-software/landing's changelog
+  # Publish a GitHub Release per v* tag so the org's changelog
   # aggregator picks the version up — the aggregator ingests GitHub *Releases*,
   # not git tags. Runs only on a tag push, after the `required` gate passes.
+  #
+  # What a release publishes is the tagged source, so the job also attaches an
+  # SPDX JSON SBOM of it and a source archive with a fixed digest, and attests
+  # build provenance for both. GitHub's own tag archives are generated on
+  # demand, so their bytes are not a stable subject for an attestation.
   release:
     name: GitHub Release
     needs: [required]
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     permissions:
-      contents: write # create the release
+      contents: write # create the release and upload its assets
+      id-token: write # sign the provenance attestation through Sigstore
+      attestations: write # store the attestation against this repository
     steps:
+      # The tagged commit, for the SBOM and the source archive. Nothing here
+      # pushes, so no credential is kept.
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      # The assets are generated and attested before the Release exists, so a
+      # failure here publishes nothing.
+      #
+      # Generated before the archive exists, so it describes the checkout only.
+      - name: Generate SBOM (SPDX JSON)
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        with:
+          path: .
+          format: spdx-json
+          output-file: sbom.spdx.json
+          # Uploaded to the Release below: the action's own release upload
+          # only works on `release` events, and this job runs on a tag push.
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Archive the tagged source
+        env:
+          TAG: ${{ github.ref_name }}
+        run: git archive --format=tar.gz --prefix="programs-$TAG/" -o "programs-$TAG-source.tar.gz" HEAD
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: |
+            programs-*-source.tar.gz
+            sbom.spdx.json
+
       - name: Create GitHub Release from the tag
         # `gh` reads $GH_TOKEN and $GITHUB_REPOSITORY automatically; the tag is
         # passed via env (never `${{ }}` inside run:) to avoid zizmor template
         # injection. --generate-notes builds notes from merged PRs since the
         # previous tag; --verify-tag asserts the ref is a real tag first.
+        # Skipped when the Release already exists, so a re-run after a failed
+        # upload below can finish the job instead of failing here.
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -eu
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "release $TAG already exists; attaching assets only"
+          else
+            gh release create "$TAG" --title "$TAG" --generate-notes --verify-tag
+          fi
+
+      - name: Attach the source archive and SBOM to the Release
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
-        run: >
-          gh release create "$TAG"
-          --title "$TAG"
-          --generate-notes
-          --verify-tag
+        # --clobber keeps a re-run idempotent.
+        run: gh release upload "$TAG" "programs-$TAG-source.tar.gz" sbom.spdx.json --clobber

.github/workflows/conventional-title-labeler.yml

@@ -4,7 +4,7 @@
 # Applies the org C-* change-type label (C-Feature / C-Bug / ...) to a PR based
 # on its conventional-commit title prefix. Combined with .github/release.yml,
 # this makes `gh release create --generate-notes` group PRs by type, which flows
-# into resq-software/landing's changelog aggregator so its feature/fix/kind
+# into the org's changelog aggregator so its feature/fix/kind
 # classification is automatic rather than a default guess. Path labels come from
 # .github/labeler.yml; this covers the change *type* that paths cannot express.
 name: Conventional Title Labeler

.github/workflows/dependency-licences.yml

@@ -0,0 +1,31 @@
+# Copyright 2026 ResQ Systems, Inc.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Dependency licence check on pull requests. WARN-ONLY: a dependency under a
+# listed licence is reported as a warning in the job log and summary, and the
+# job still passes. It informs review; it does not block a merge.
+#
+# The org security-scan workflow called from security.yml already runs
+# dependency-review for vulnerabilities, but it takes no licence inputs, so the
+# licence check lives here. vulnerability-check is off so this job does not
+# repeat that one.
+
+name: dependency-licences
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  licence-check:
+    name: licence check (warn-only)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          vulnerability-check: false
+          deny-licenses: GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later, SSPL-1.0
+          warn-only: true

.gitignore

@@ -4,3 +4,6 @@ node_modules/
 test-ledger/
 *.so
 .DS_Store
+
+# Local agent/tool settings; never tracked.
+.claude/settings.local.json

SECURITY.md

@@ -0,0 +1,43 @@
+# Security Policy
+
+This repository follows the ResQ organisation's [security policy](https://github.com/resq-software/.github/blob/main/SECURITY.md), which covers scope, response times and disclosure. This file restates how to report a vulnerability in this repository and adds the sections below.
+
+## Supported versions
+
+As the organisation policy's [supported-versions table](https://github.com/resq-software/.github/blob/main/SECURITY.md#supported-versions) sets out, security fixes go to the latest published version only. If you run an older one, please check whether the issue still affects the latest version, as it may already be fixed. Reports about older versions are still welcome; say which commit or release tag you tested.
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a suspected vulnerability.** Use one of these private channels:
+
+1. **GitHub private vulnerability reporting** (preferred): [open a draft advisory](https://github.com/resq-software/programs/security/advisories/new) on this repository.
+2. **Email**: `security@resq.software`.
+
+Please include the affected commit SHA or release tag, a short description of the issue and its impact, and steps to reproduce.
+
+## EU Cyber Resilience Act reporting
+
+Where the EU Cyber Resilience Act (Regulation (EU) 2024/2847) applies to a product in this repository, ResQ reports through ENISA's Single Reporting Platform, to the CSIRT designated as coordinator and to ENISA:
+
+- **Actively exploited vulnerabilities:** an early warning within 24 hours of becoming aware of one, a notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available.
+- **Severe incidents** affecting the security of the product: an early warning within 24 hours, a notification within 72 hours, and a final report within one month of the notification.
+
+We inform affected users as the Act requires. Reporting to us through the private channels above never requires you to contact ENISA yourself. You may also report to a national CSIRT under its coordinated vulnerability disclosure policy.
+
+## Safe harbour
+
+If you make a good-faith effort to follow this policy while researching a vulnerability, we will:
+
+- treat your research as authorised, and not pursue or support legal action against you for it;
+- work with you to understand and fix the issue quickly; and
+- credit you, unless you ask us not to.
+
+Good faith means that you:
+
+- test only against your own accounts, data and installations;
+- stop and report as soon as you find a vulnerability;
+- access, change or keep no one else's data beyond what's needed to show the issue;
+- don't degrade our services or anyone else's; and
+- give us reasonable time to fix the issue before you disclose it.
+
+This safe harbour covers ResQ's own claims only; it cannot bind third parties.

resq-airspace/src/error.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/src/instructions/close_permit.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/src/instructions/grant_permit.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/src/instructions/initialize_property.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/src/instructions/mod.rs

@@ -2,6 +2,7 @@
 
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/src/instructions/record_crossing.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/src/instructions/transfer_ownership.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/src/instructions/update_policy.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/src/instructions/update_treasury.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/src/lib.rs

@@ -8,6 +8,7 @@
 
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/src/state/airspace_account.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/src/state/mod.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/src/state/permit.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/tests/host_init_regression.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-airspace/tests/integration.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-delivery/src/error.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-delivery/src/instructions/mod.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-delivery/src/instructions/record_delivery.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-delivery/src/lib.rs

@@ -2,6 +2,7 @@
 
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-delivery/src/state/delivery_record.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-delivery/src/state/mod.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-delivery/tests/integration.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-gating/src/lib.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

resq-gating/tests/integration.rs

@@ -1,5 +1,6 @@
 /*
  * Copyright 2026 ResQ
+ * SPDX-License-Identifier: Apache-2.0
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.