docs: tighten for OSS release #63

Merged

jlxq0 merged 1 commit from docs/release-prep into main

2026-05-16 15:14:27 +00:00

jlxq0 commented

2026-05-16 15:08:37 +00:00

(Migrated from github.com)

Summary

Tightens the public-facing documentation for the open-source release. No code changes.

README.md rewritten – ~25% shorter, dropped the verbose Multi-user paragraph, the Container subsection, the prose Security section. Tools listed terse, docs table preserved.
SECURITY.md (new) – reporting policy only. No SLA theatre, no "supported versions" table, no "disclosure history" stub.
THREAT_MODEL.md (new) – roles table + in/out of scope. Dropped the meta "when this doc needs updating" section and the "cryptographic verification of trust chain" section (already covered in SECURITY.md and docs/cross-signing-recover-flow.md).
docs/multi-user.md (new) – per-mxid isolation guarantees: store path derivation, audit-room scoping via Matrix account_data, mxid spoof-resistance from MAS introspection, plus a manual verification recipe.
CHANGELOG.md – added v0.2.0, v0.2.1, v0.2.2, v0.2.2.1 entries.

What's deliberately NOT in this PR

CODE_OF_CONDUCT.md – one-person AI-written project, the Contributor Covenant is cargo cult here.
CONTRIBUTING.md – folded a three-line "PRs welcome, run cargo fmt/clippy/test" note into the README instead.
.github/ISSUE_TEMPLATE/ and pull_request_template.md – free-form issues are fine at this scale.

Test plan

README renders on github.com
All cross-links resolve (SECURITY.md, THREAT_MODEL.md, docs/multi-user.md, docs/cross-signing-recover-flow.md)
CHANGELOG compare links resolve
CI green (no code touched, but cargo fmt etc. still run on this branch)

🤖 Generated with Claude Code

## Summary Tightens the public-facing documentation for the open-source release. No code changes. - **README.md** rewritten – ~25% shorter, dropped the verbose Multi-user paragraph, the Container subsection, the prose Security section. Tools listed terse, docs table preserved. - **SECURITY.md** (new) – reporting policy only. No SLA theatre, no "supported versions" table, no "disclosure history" stub. - **THREAT_MODEL.md** (new) – roles table + in/out of scope. Dropped the meta "when this doc needs updating" section and the "cryptographic verification of trust chain" section (already covered in SECURITY.md and `docs/cross-signing-recover-flow.md`). - **docs/multi-user.md** (new) – per-mxid isolation guarantees: store path derivation, audit-room scoping via Matrix `account_data`, mxid spoof-resistance from MAS introspection, plus a manual verification recipe. - **CHANGELOG.md** – added v0.2.0, v0.2.1, v0.2.2, v0.2.2.1 entries. ## What's deliberately NOT in this PR - **CODE_OF_CONDUCT.md** – one-person AI-written project, the Contributor Covenant is cargo cult here. - **CONTRIBUTING.md** – folded a three-line "PRs welcome, run cargo fmt/clippy/test" note into the README instead. - **.github/ISSUE_TEMPLATE/** and **pull_request_template.md** – free-form issues are fine at this scale. ## Test plan - [ ] README renders on github.com - [ ] All cross-links resolve (`SECURITY.md`, `THREAT_MODEL.md`, `docs/multi-user.md`, `docs/cross-signing-recover-flow.md`) - [ ] CHANGELOG compare links resolve - [ ] CI green (no code touched, but `cargo fmt` etc. still run on this branch) 🤖 Generated with [Claude Code](https://claude.com/claude-code)