docs: establish BLUM open-source governance

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,33 @@
+name: Bug report
+description: Report a reproducible defect in BLUM.
+title: "[Bug]: "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: Do not include credentials, personal data or proprietary datasets.
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed behavior
+      description: What happened, including the affected route, worker or engine.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction
+      description: Minimal steps, revision and relevant non-sensitive logs.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence and impact
+      description: Explain data integrity, financial logic or runtime impact.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,26 @@
+name: Evidence-driven proposal
+description: Propose a change that improves BLUM's decision intelligence.
+title: "[Proposal]: "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Measured problem
+      description: What limitation is observable today?
+    validations:
+      required: true
+  - type: textarea
+    id: decision_quality
+    attributes:
+      label: Decision-quality impact
+      description: How should this improve selection, risk, learning or validation?
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Validation plan
+      description: Define tests, benchmarks, sample thresholds and rollback.
+    validations:
+      required: true

.github/pull_request_template.md

@@ -0,0 +1,21 @@
+## Problem and evidence
+
+<!-- Describe the measured problem. -->
+
+## Change
+
+<!-- Keep financial logic, runtime and UI responsibilities explicit. -->
+
+## Verification
+
+<!-- Include commands, results, sample sizes and benchmark methodology. -->
+
+## Risk and rollback
+
+<!-- State data, look-ahead, compatibility and operational risks. -->
+
+- [ ] No credentials or restricted data are included.
+- [ ] GET endpoints remain read-only.
+- [ ] No frontend render triggers heavy computation.
+- [ ] Financial claims are evidence-bound.
+- [ ] Tests cover the changed behavior.

CODE_OF_CONDUCT.md

@@ -0,0 +1,22 @@
+# Code of Conduct
+
+## Our commitment
+
+We commit to a professional, inclusive and evidence-focused community. Debate
+technical and financial claims rigorously while treating contributors with
+respect.
+
+## Expected behavior
+
+- Be precise, constructive and transparent about uncertainty.
+- Critique ideas and evidence, not people.
+- Disclose conflicts of interest and data limitations.
+- Respect privacy, licensing and responsible disclosure.
+- Do not promote harassment, discrimination, market manipulation or deceptive
+  performance claims.
+
+## Enforcement
+
+Maintainers may edit, reject or remove contributions and participation that
+violate these standards. Serious security or safety concerns should be reported
+privately as described in `SECURITY.md`.

CONTRIBUTING.md

@@ -0,0 +1,45 @@
+# Contributing to BLUM
+
+BLUM welcomes reproducible contributions that improve evidence quality,
+decision quality, risk control, learning reliability or runtime performance.
+
+## Before opening a change
+
+1. Search existing issues and discussions.
+2. Describe the observed problem and the evidence that it exists.
+3. Keep financial logic separate from runtime and presentation concerns.
+4. Never add fabricated market data, guaranteed-return claims or hidden
+   self-modification.
+5. Keep GET endpoints read-only and page rendering snapshot-first.
+
+## Development workflow
+
+1. Fork `BlumFinancialLab/Blum` and create a focused branch.
+2. Add or update tests before changing behavior.
+3. Run the smallest relevant test set, then the full affected suite.
+4. Document data lineage, point-in-time constraints and benchmark methodology.
+5. Open a pull request with before/after evidence and known limitations.
+
+Useful commands:
+
+```bash
+python3 -m pytest -q
+pnpm --dir frontend test
+pnpm --dir frontend build
+```
+
+## Data and model contributions
+
+Do not commit credentials, personal information, proprietary datasets or data
+whose redistribution terms are unclear. Training examples must preserve
+point-in-time evidence, source provenance and licensing metadata. Community
+memory is quarantined and reviewed; it never changes production weights merely
+because it was uploaded.
+
+## Financial safety
+
+BLUM is research and paper-trading software. Contributions must not introduce
+real-money execution, guaranteed-profit language or benchmark claims without
+stored evidence and sufficient samples.
+
+By submitting a contribution, you agree that it is licensed under Apache-2.0.

GOVERNANCE.md

@@ -0,0 +1,27 @@
+# BLUM Governance
+
+BLUM is developed in public under the Apache-2.0 license. The canonical source
+repository is `BlumFinancialLab/Blum`; Hugging Face hosts the public deployment,
+model artifacts and governed datasets.
+
+## Decision principles
+
+- Evidence outranks confidence.
+- Point-in-time correctness outranks backtest appearance.
+- Capital preservation outranks forced activity.
+- Stored, reproducible outcomes outrank marketing metrics.
+- Financial intelligence belongs in the Engine; presentation belongs in the
+  Runtime; model artifacts assist reasoning but are not market truth.
+
+## Change control
+
+Maintainers review changes for correctness, licensing, data provenance,
+look-ahead bias, reproducibility, security and backward compatibility. Risky
+weight or rule changes require explicit evidence and reversible activation.
+Source code is never modified autonomously by BLUM.
+
+## Community evidence
+
+External usage does not silently transmit data. Contributions are opt-in,
+redacted, versioned and quarantined before they can enter a future training
+snapshot. A submitted example never changes the active model directly.

LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 BLUM Financial Lab contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

README.md

@@ -12,6 +12,29 @@ pinned: false
 
 # BLUM v2.0 Project Split
 
+[![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](LICENSE)
+[![Hugging Face Space](https://img.shields.io/badge/Hugging%20Face-Space-yellow)](https://huggingface.co/spaces/Italianhype/Blum)
+[![BLUM Finance Model](https://img.shields.io/badge/Model-BLUM%20Finance-orange)](https://huggingface.co/Italianhype/Blum)
+
+## Open-Source Project
+
+[`BlumFinancialLab/Blum`](https://github.com/BlumFinancialLab/Blum) is the
+canonical public source repository. The application code is licensed under
+[Apache-2.0](LICENSE); contributions follow [CONTRIBUTING.md](CONTRIBUTING.md),
+[GOVERNANCE.md](GOVERNANCE.md) and [SECURITY.md](SECURITY.md).
+
+The public surfaces have distinct responsibilities:
+
+- **GitHub**: source code, issues, pull requests and engineering history.
+- **Hugging Face Space**: public, paper-only deployment of the Runtime.
+- **Hugging Face Models**: downloadable BLUM Finance model artifacts.
+- **Hugging Face Datasets**: versioned reasoning and opt-in community-memory
+  datasets with their own dataset cards and provenance constraints.
+
+BLUM sends no usage telemetry by default. Community evidence is contributed
+only through an explicit, redacted workflow and is quarantined before review;
+downloads never modify active model weights automatically.
+
 ## BLUM v2.1 Clean Core Release
 
 BLUM v2.1 tightens the v2.0 split around the four product surfaces that matter to the trader brain:
@@ -1977,7 +2000,11 @@ Development standards are tracked in [`ENGINEERING_STANDARDS.md`](ENGINEERING_ST
 
 ## Contributing
 
-Contributions should preserve the project philosophy: transparent evidence, modular models, explainable scoring, no fabricated data and no investment recommendations.
+Contributions should preserve the project philosophy: transparent evidence,
+modular models, explainable scoring, no fabricated data and no investment
+recommendations. See [CONTRIBUTING.md](CONTRIBUTING.md) for the development and
+data-contribution workflow, [GOVERNANCE.md](GOVERNANCE.md) for change control and
+[SECURITY.md](SECURITY.md) for private vulnerability reporting.
 ## Autonomous Forex Alpha Trader
 
 BLUM includes a paper-only Forex decision core for selective scalping and short

SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policy
+
+## Supported version
+
+Security fixes target the current `main` branch. Historical revisions may not
+receive backports.
+
+## Reporting a vulnerability
+
+Do not disclose exploitable vulnerabilities in a public issue. Use GitHub's
+private vulnerability reporting for `BlumFinancialLab/Blum` when available.
+Include affected revisions, reproduction steps, impact and a proposed remedy if
+known. Never include live credentials, broker secrets or personal financial
+data in a report.
+
+## Scope
+
+High-priority reports include credential exposure, unauthorized database
+access, unsafe model or dataset ingestion, server-side request forgery,
+dependency compromise and any path that could turn paper-only behavior into
+real execution.
+
+BLUM does not request brokerage credentials and does not execute real-money
+orders. A deployment that adds those capabilities is outside the supported
+security boundary.