open/portfolio-optimiser-claude
1
0
Fork 0
Code Issues Releases 1 Activity

docs: one way in for an agent, and one address for a vulnerability

Browse source 
D-census 20/21.08 measured llms.txt missing in 23 of 23 org repos, and this
repo among four naming hello@ as its security contact. Two operator decisions
from 21.08 land here.

llms.txt: the reader is an AI agent already standing in the repo, not a
crawler (GPTBot/ClaudeBot/Google-Extended skip /llms.txt in practice, so that
is never the argument). The README carries three code blocks; the entrance is
the first one, and nothing in the file says so. llms.txt names it and quotes
that block byte-for-byte -- sha256 of README:45-48 equals sha256 of
llms.txt:13-16, so a rewritten variant cannot drift in unnoticed. Kept minimal:
H1, one blockquote, the command, two link sections. All 9 link targets verified
to exist on disk. llms.txt is a convention, not a ratified standard (a June 2026
W3C proposal makes four substantive changes, which four is NOT verified here) --
another reason to keep it small.

SECURITY.md: hello@ works and is not a dead address; the defect is that a
reporter comparing two repos from the same org sees two addresses and has to
guess which one is the security channel. security@ is the designated one and
the operator confirmed it works. Only the security contact moved. hello@ stays
in CODE_OF_CONDUCT.md, where it is correct.

shared/SECURITY.md carries the same hello@, but shared/ is a pull-only subtree
of portfolio-optimiser-commons -- untouched here, reported to its owner instead.

923 tests still green. No version bump, no tag, no publish.

Order: 20260821T041218Z-8541228824-from-.claude

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PmgNBXGNpDvUALdGBBhiK8
This commit is contained in:
Kjell Tore Guttormsen 2026-08-21 11:24:54 +02:00
commit f6f98edb1d
2 changed files with 33 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
SECURITY.md
View file

@ -8,7 +8,7 @@ We take security seriously. If you discover a security vulnerability, please rep
### How to Report
Email: hello@fromaitochitta.com
Email: security@fromaitochitta.com
Include:
- Description of the vulnerability

32
llms.txt Normal file
View file

@ -0,0 +1,32 @@
# portfolio-optimiser-claude
> Claude Agent SDK sibling implementation of the portfolio-optimiser method: an open Python
> framework that finds cost savings *inside* each project in a portfolio. Agents propose
> measures, a mandatory deterministic validator gates every number before it leaves the
> system, domain experts judge via human-in-the-loop, and the loop learns from the verdicts.
> A technical framework only — the deployer owns DPIA, risk assessment, and legal basis.
Not published to a package index. This is the way in — from a clean clone, offline, without
an API key:
```bash
git clone https://git.fromaitochitta.com/open/portfolio-optimiser-claude.git
cd portfolio-optimiser-claude
uv sync
uv run pytest # the full suite, offline, no API key
```
## Docs
- [README.md](README.md): what the framework does, the seams it is built from, the operator CLI, and the one budgeted live run
- [shared/method-spec.md](shared/method-spec.md): the normative method specification (RFC 2119) both reference implementations build
- [shared/ingest-spec.md](shared/ingest-spec.md): the normative ingest specification — connectors and bundle materialization
- [CLAUDE.md](CLAUDE.md): the invariants of this repo — offline test suite, load-bearing tests, budget ceilings
- [CHANGELOG.md](CHANGELOG.md): released versions
## Optional
- [docs/extending.md](docs/extending.md): how the ingest layer is implemented here and how to extend it
- [docs/oppskrift-kunnskapsbase.md](docs/oppskrift-kunnskapsbase.md): recipe for building a knowledge base for a project
- [CONTRIBUTING.md](CONTRIBUTING.md): how to propose changes
- [SECURITY.md](SECURITY.md): how to report a vulnerability