docs(governance): maintainers, governance and support files

.github/PULL_REQUEST_TEMPLATE.md

@@ -49,13 +49,13 @@ Checklist
 ---------
 
 <!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
-<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
+<!--- If you're unsure about any of these, ask in the pull request. -->
 
-- [ ] My code follows the code style of this project (Mypy, Ruff)
+- [ ] My code follows the code style of this project (`php -l`, `composer validate --strict`)
 - [ ] I have added tests to cover my changes
 - [ ] All new and existing tests passed
 - [ ] My change requires a change to the documentation
 - [ ] I have updated the documentation accordingly
 - [ ] I have checked that my changes don't introduce any new warnings or errors
 - [ ] I have updated the version number if necessary
-- [ ] I have added any new dependencies to the appropriate requirements file
+- [ ] I have added any new dependencies to the composer.json

GOVERNANCE.md

@@ -0,0 +1,29 @@
+# Governance
+
+Guard Agent PHP is part of the [Guard Core](https://github.com/Guard-Core) ecosystem. I maintain it alone; [MAINTAINERS.md](MAINTAINERS.md) lists who I am and how to check it.
+
+## Decisions
+
+I make the final call on every change: features, releases, security fixes and repository access. A proposal starts as an issue, so the reasoning is public before any code is written.
+
+## How a change lands
+
+1. Every change is a pull request to `main`.
+2. The branch ruleset requires signed commits, linear history, passing status checks and two approvals, one of them from a code owner ([CODEOWNERS](.github/CODEOWNERS)). As the only maintainer I cannot get those approvals, so I merge my own pull requests with admin rights. That skips the approval count only: I never merge with a failing check.
+3. A pull request closes an open issue (`Closes #N`), or carries the `no-issue` label when it is a small fix with nothing to discuss.
+
+## Releases
+
+Versions follow semantic versioning. The Guard Agent telemetry agents share one version number across languages and release together. Releases are cut from tags and recorded in [CHANGELOG.md](CHANGELOG.md).
+
+## Security
+
+Vulnerabilities go through [SECURITY.md](SECURITY.md), never through public issues.
+
+## New maintainers
+
+Contributors with a record of reviewed and merged work can be invited as maintainers. A new maintainer is added to MAINTAINERS.md and CODEOWNERS in a pull request.
+
+## Conduct
+
+The [Code of Conduct](CODE_OF_CONDUCT.md) applies to every space of this project.

MAINTAINERS.md

@@ -0,0 +1,21 @@
+# Maintainers
+
+Guard Agent PHP has one maintainer.
+
+| Name | GitHub | Email | Role |
+|---|---|---|---|
+| Renzo Franceschini | [@rennf93](https://github.com/rennf93) | rennf93@guard-core.com | Lead maintainer: reviews and merges every change, publishes every release, handles security reports |
+
+## Identity
+
+- GitHub profile [@rennf93](https://github.com/rennf93): name Renzo Franceschini, website guard-core.com.
+- [guard-core.com/company](https://guard-core.com/company) names Renzo Franceschini and links to @rennf93.
+- The [Guard-Core](https://github.com/Guard-Core) GitHub organization has guard-core.com as a verified domain.
+- Packagist: the package is [rennf93/guard-agent-php](https://packagist.org/packages/rennf93/guard-agent-php), and `composer.json` lists `Renzo Franceschini <rennf93@guard-core.com>` as author.
+
+## Related files
+
+- Code ownership: [CODEOWNERS](.github/CODEOWNERS)
+- How decisions are made: [GOVERNANCE.md](GOVERNANCE.md)
+- Security reports: [SECURITY.md](SECURITY.md)
+- Getting help: [SUPPORT.md](SUPPORT.md)

SECURITY.md

@@ -2,19 +2,17 @@
 
 ## Supported Versions
 
-We currently provide security updates for the following versions of Guard Agent PHP:
+I provide security updates for the following versions of Guard Agent PHP:
 
-| Version | Supported          |
-| ------- | ------------------ |
-| 3.1.x | :white_check_mark: |
-| 3.0.x | :white_check_mark: |
-| < 3.0.0 | :x:              |
+| Version | Supported |
+| ------- | --------- |
+| 3.x | :white_check_mark: bug and security fixes |
 
 ## Reporting a Vulnerability
 
-We take the security of Guard Agent PHP seriously. If you believe you've found a security vulnerability, please follow these steps:
+I take the security of Guard Agent PHP seriously. If you believe you've found a security vulnerability, please follow these steps:
 
-1. **Do not disclose the vulnerability publicly** until it has been addressed by the maintainers.
+1. **Do not disclose the vulnerability publicly** until I have fixed it.
 2. **Report the vulnerability through GitHub's security advisory feature**:
    - Go to the [Security tab](https://github.com/Guard-Core/guard-agent-php/security/advisories) of the Guard Agent PHP repository
    - Click on "New draft security advisory"
@@ -29,7 +27,7 @@ We take the security of Guard Agent PHP seriously. If you believe you've found a
    - Affected versions
    - Any potential mitigations or workarounds
 
-The maintainers will acknowledge your report within 48 hours and provide a detailed response within 7 days, including the next steps in handling the vulnerability.
+I will acknowledge your report within 48 hours and send a detailed response within 7 days, including the next steps in handling the vulnerability.
 
 ## Security Considerations
 

SUPPORT.md

@@ -0,0 +1,8 @@
+# Support
+
+- Documentation: [https://guard-core.github.io/guard-agent-php/](https://guard-core.github.io/guard-agent-php/)
+- Questions: [GitHub Discussions](https://github.com/Guard-Core/guard-agent-php/discussions)
+- Chat: [Discord](https://discord.gg/ZW7ZJbjMkK), #help for questions, #releases for new versions.
+- Bugs and feature requests: [issues](https://github.com/Guard-Core/guard-agent-php/issues/new/choose), using the templates.
+- Security reports: [SECURITY.md](SECURITY.md), never a public issue.
+- The hosted Guard Core app (app.guard-core.com): [saas-issues](https://github.com/Guard-Core/saas-issues).

composer.json

@@ -3,6 +3,14 @@
     "description": "PHP telemetry agent for the guard-core ecosystem: buffers security events, metrics, and agent status locally and ships them to the Guard Core App ingestion API with at-least-once semantics",
     "type": "library",
     "license": "MIT",
+    "authors": [
+        {
+            "name": "Renzo Franceschini",
+            "email": "rennf93@guard-core.com",
+            "homepage": "https://github.com/rennf93",
+            "role": "Maintainer"
+        }
+    ],
     "require": {
         "php": "^8.2",
         "ext-json": "*",