What a stranger gets: honest security answers before they ask — and a comparison page that concedes first.
Acceptance
docs/security/threat-model.md with both admissions stated plainly: a4h holds the organization's chat bot token; a4h cannot prevent prompt injection — plus the blast-radius story.PRIVACY.md ("nothing is persisted; the project receives no data from your deployment"), SECURITY.md (private vulnerability reporting, 5-working-day acknowledgement), docs/compliance/cra.md including the consulting paragraph.docs/compare.md verified cell by cell against the competitors' own documents in the publication hour (the Hermes A2A cell carries an inline re-check note); concede-first voice; the forbidden-claims grep is green.- Published in the same hour as the v0.1 tag, never before.
Non-goals
Badge campaigns · conformance matrices · enterprise questionnaire packs.
Runs in parallel with the code slices — docs only.
What a stranger gets: honest security answers before they ask — and a comparison page that concedes first.
Acceptance
docs/security/threat-model.mdwith both admissions stated plainly: a4h holds the organization's chat bot token; a4h cannot prevent prompt injection — plus the blast-radius story.PRIVACY.md("nothing is persisted; the project receives no data from your deployment"),SECURITY.md(private vulnerability reporting, 5-working-day acknowledgement),docs/compliance/cra.mdincluding the consulting paragraph.docs/compare.mdverified cell by cell against the competitors' own documents in the publication hour (the Hermes A2A cell carries an inline re-check note); concede-first voice; the forbidden-claims grep is green.Non-goals
Badge campaigns · conformance matrices · enterprise questionnaire packs.
Runs in parallel with the code slices — docs only.