Policies

• AI covenant nobody has checked this yet, still a draft
  The rules for AI-assisted work in oscal: a contributor owns what they submit; every element says what OSCAL’s metaschema says at the pinned release and each enum names its lists in oscal_allowed_values; the metaschema copy is never edited; everything the schema defines lives under oscal:; and the scheduled librarian works through pull requests a person approves, with least privilege.

• License and attribution nobody has checked this yet, still a draft
  Which licence covers what in the oscal repository: Apache-2.0 for the schema, the generated models and the code; the OSCAL metaschema copy, NIST’s work in the public domain and dedicated worldwide under CC0 1.0, with NIST’s request for acknowledgement; the CNCF AI benchmark fixtures under Apache-2.0 and Luigi Carpio’s fixture under MIT; the linkml-project-copier scaffolding under MIT; the KTL sidecar and site templates under Apache-2.0; and the bundle under CC BY 4.0.

• Security policy nobody has checked this yet, still a draft
  How to report a vulnerability in oscal (GitHub’s private vulnerability reporting, not a public issue), which release gets fixes, what the repository releases and runs, what holds each workflow, and the three repository settings not yet in force: required reviewers on the release Environment, a deletion and force-push rule on main, and secret scanning with push protection.