OSS posture

This directory documents the policies and posture that govern Prisma Next as an open-source project — how decisions are made, how dependencies are managed, how releases are produced, and how external contributions are handled.

These pages are written for maintainers and curious contributors who want to understand the reasoning behind a policy, not just the rule itself. Audience-facing documents that GitHub surfaces by convention — CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, LICENSE — remain the primary entry points for their respective audiences. The pages here cross-reference those files; they don't duplicate them.

Audience map

If you are…	Read…
A would-be contributor	CONTRIBUTING.md
Reporting a vulnerability	SECURITY.md
A current or prospective maintainer	Governance
Triaging incoming contributor PRs	PR triage
Curious about supply-chain hygiene	Supply chain
Wondering how PR CI is structured for cost	PR CI pipeline
Reasoning about the version contract (consumer or extension author)	Versioning
Cutting a release (or auditing how)	Versioning

Pages in this directory

• governance.md — Maintainer team, decision-making model, DCO basis, ADR pointer.
• supply-chain.md — License declarations, NOTICE audit, npm provenance, Dependabot soak window.
• ci-pipeline.md — How PR CI builds once, caches deterministic tasks, and skips heavy work on inert diffs.
• pr-triage.md — Criteria for triaging external contributor PRs: fork-CI safety, version-line scope, direction fit, staleness, and the verdict vocabulary.
• versioning.md — Pre-1.0 cadence and breaking-change policy, lockstep contract (and what it means for skill/extension authors), dist-tag convention, release procedure.