D-census 20/21.08 measured llms.txt missing in 23 of 23 org repos, and this
repo among four naming hello@ as its security contact. Two operator decisions
from 21.08 land here.
llms.txt: the reader is an AI agent already standing in the repo, not a
crawler (GPTBot/ClaudeBot/Google-Extended skip /llms.txt in practice, so that
is never the argument). The README carries three code blocks; the entrance is
the first one, and nothing in the file says so. llms.txt names it and quotes
that block byte-for-byte -- sha256 of README:45-48 equals sha256 of
llms.txt:13-16, so a rewritten variant cannot drift in unnoticed. Kept minimal:
H1, one blockquote, the command, two link sections. All 9 link targets verified
to exist on disk. llms.txt is a convention, not a ratified standard (a June 2026
W3C proposal makes four substantive changes, which four is NOT verified here) --
another reason to keep it small.
SECURITY.md: hello@ works and is not a dead address; the defect is that a
reporter comparing two repos from the same org sees two addresses and has to
guess which one is the security channel. security@ is the designated one and
the operator confirmed it works. Only the security contact moved. hello@ stays
in CODE_OF_CONDUCT.md, where it is correct.
shared/SECURITY.md carries the same hello@, but shared/ is a pull-only subtree
of portfolio-optimiser-commons -- untouched here, reported to its owner instead.
923 tests still green. No version bump, no tag, no publish.
Order: 20260821T041218Z-8541228824-from-.claude
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PmgNBXGNpDvUALdGBBhiK8
