docs(governance): add office hours, review etiquette, audit, and whistleblower documents

[bilkee]

Summary

Adds two community documents and two compliance documents under Governance/, closing the governance gaps tracked in #1505, #1506, #1523, and #1524.

Document	Closes	Covers
community/OFFICE_HOURS.md	#1505	Schedule and format, who hosts, how topics are submitted
community/REVIEW_ETIQUETTE.md	#1506	Tone and expectations, author and reviewer norms, handling disagreement
compliance/AUDIT_ASSURANCE.md	#1523	Audit scope and cadence, evidence retention, finding remediation
compliance/WHISTLEBLOWER.md	#1524	Reporting channels, non-retaliation guarantee, investigation process

What these documents add

Office hours with a stated format. Fortnightly, 60 minutes, fixed and published, with the schedule chosen to avoid the project's busiest overlap window rather than a maintainer's convenience. Hosting is voluntary and rotates, and the host is explicitly not on duty — a question the host cannot answer is assigned rather than guessed at, because the alternative is an invented answer given to a newcomer. Three output requirements do the real work: published notes usable by someone who was not present, follow-up issues for anything needing tracking, and pointers where the documentation is a better answer than a verbal one. The accessibility section treats notes-as-subscription as the mechanism rather than an afterthought, and requires interpretation and translated summaries to be arranged in advance on request without the requester having to justify it.

Review etiquette, with the substance separated from the tone. For reviewers: write to the author rather than about them, distinguish blocking comments from preferences, explain the why, offer the alternative you would accept, and approve what is good — because withholding approval to reserve leverage is a misuse of the mechanism. For authors: assume good faith, explain context before review so it is not missing, respond to every comment including disagreements, and say when a draft is not finished. Disagreement follows a six-step sequence from asking for the underlying fact through to escalation, with the rule that a substantive disagreement moves to an issue or an RFC rather than blocking a merge, and that persistent hostility is a conduct matter handled separately and never used as leverage in a technical argument. Governance reviews get their own note: checkable claims must be verified, and a policy that describes a control that does not exist is worse than no policy.

Audit with findings that lead somewhere. Cadence varies by consequence, quarterly for governance, access, and security, annually for data protection, supply chain, and release controls, and a skipped review is recorded as skipped — a documented gap can be planned for, an invisible one cannot. Findings carry severity and a deadline (7 days Critical, 30 High, 90 Medium), require a second reviewer to self-certify a High or Critical closure, and a recurring finding is treated as systemic: the individual fix is secondary to why the same gap reappeared. The Continuous Verification table lists what this repository's CI genuinely checks today — audit.yml on push and weekly, dependency-cruiser boundaries, lint, format, typecheck, tests, OpenAPI, bundle size, API performance — and the policy states plainly that no external audit has been commissioned and none is claimed.

Non-retaliation as the centre of the whistleblower policy. The guarantee covers good-faith reports that turn out to be unfounded, which is the part that matters: a policy protecting only reporters who were right protects silence. Retaliation is defined to include small acts — reduced access, reassigned work, contributions rejected for improper reasons, pressure via a third party — and a pattern of small acts is assessed as a pattern. Retaliation is handled as the most serious category, because the alternative is a project where the cost of speaking up is borne by the person who speaks. The handling process has handler conflict-checking, interim measures available while a report is investigated, proportionality, and an explicit statement of confidentiality's limits: the project will not promise to keep a report secret from everyone regardless of consequences, but it will not identify a reporter unnecessarily.

Notes for reviewers

• Existing processes stay authoritative for their own categories. A vulnerability goes to the Security Policy, a conduct concern to the Code of Conduct Reporting process, a governance dispute to Conflict Resolution. WHISTLEBLOWER.md is the safeguard for cases where those cannot safely be used, which is why it is narrower than a general grievance process and explicit about its limits — including that no external ethics hotline is operated and none is claimed.
• Forward references. OFFICE_HOURS.md links to MENTORSHIP_PROGRAM.md and WELCOME_GUIDE.md (added in docs(governance): add access review policy and community onboarding documents #1551), and AUDIT_ASSURANCE.md links to policies added in docs(governance): add CI/CD, secret rotation, service account, and encryption policies #1548, docs(governance): add key, certificate, vulnerability SLA, and patch management policies #1549, docs(governance): add end-of-life, support, compatibility, and data residency policies #1550 and this series. The links resolve once those land and can be dropped if you would rather each pull request stand alone.
• Link and anchor integrity. All 24 new files across the six pull requests in this series were checked for relative-path and anchor validity; four broken links and one bad anchor were found and fixed in follow-up commits. Every link in these four files resolves against main plus the file sets in this series.
• Enforcement status is stated in each document. Office hours and the reporting channels are human processes with no automated component. The automation that does exist is named rather than implied.
• Scope. Each issue adds exactly one new file inside Governance/. No application code, CI, or configuration is touched, and no tests are added or changed.

Closes #1505
Closes #1506
Closes #1523
Closes #1524

[drips-wave]

@bilkee Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Thank you for contributing to the project