docs(community): Community Standards

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,31 @@
+---
+name: Bug report
+about: Something in clicklisp is not working as expected
+labels: bug
+---
+
+## What happened
+
+<!-- A short description of the problem. -->
+
+## What you expected
+
+<!-- What should have happened instead. -->
+
+## How to reproduce
+
+<!-- The exact command and input, plus the output you got. For example: -->
+
+```sh
+echo '(select * :from t)' | clicklisp compile
+```
+
+```
+<output or error here>
+```
+
+## Version info
+
+- clicklisp version (`clicklisp version`):
+- OS / architecture:
+- ECL version (if built from source):

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,26 @@
+---
+name: Feature request
+about: Suggest an improvement or new capability for clicklisp
+labels: enhancement
+---
+
+## What you want to do
+
+<!-- The problem or use case, in a sentence or two. -->
+
+## What you'd like
+
+<!-- Describe the feature. For query-language requests, show the
+     s-expression you'd want to write and the SQL it should produce: -->
+
+```lisp
+;; s-expression
+```
+
+```sql
+-- expected SQL
+```
+
+## Alternatives / workarounds
+
+<!-- Anything you've tried or considered instead. -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,10 @@
+## What / why
+
+<!-- Describe the change and the reason for it. -->
+
+## Checklist
+
+- [ ] `make test` and `make smoke` pass
+- [ ] README.md and `site/` updated if behavior or docs changed (samples in `site/src/samples.ts` stay verbatim)
+- [ ] Tests added/updated for compiler, rules, or UDF changes
+- [ ] Code stays portable to ECL 21.2.1

CODE_OF_CONDUCT.md

@@ -0,0 +1,132 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances
+  of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+julio@clickhouse.com.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

CONTRIBUTING.md

@@ -0,0 +1,50 @@
+# Contributing to clicklisp
+
+Thanks for your interest in contributing. clicklisp is a small, focused project — an s-expression → ClickHouse SQL compiler and executable-UDF runner in zero-dependency Common Lisp — and this guide is correspondingly short.
+
+## Building and testing
+
+You need [ECL](https://ecl.common-lisp.dev/) (`brew install ecl` / `apt install ecl`) and a C compiler. There are no other dependencies — no Quicklisp, no third-party Lisp libraries.
+
+```sh
+make            # build bin/clicklisp (override the compiler: make ECL=/path/to/ecl)
+make test       # run the test suite
+make smoke      # end-to-end checks against the built binary
+```
+
+Before opening a pull request, make sure all three pass.
+
+## Iterating interactively
+
+The whole test suite runs in seconds, so the simplest loop is just `make test` after each change. The harness (`tests/harness.lisp`) is homegrown (`deftest` / `is` / `is=` / `signals-sql-error`) and has no single-test filter — `run-tests` runs everything in definition order.
+
+To poke at a single form, use `bin/clicklisp repl` or a raw `ecl --norc`, then load the system:
+
+```lisp
+(require :asdf)
+(asdf:load-asd #p"/path/to/clicklisp/clicklisp.asd")
+(asdf:load-system "clicklisp/test")   ; or just "clicklisp"
+```
+
+## Ground rules for changes
+
+- **Stay portable to ECL 21.2.1.** CI's test job deliberately uses the old apt ECL on Ubuntu 24.04, even though local development may use a much newer release. Don't use features that only exist in recent ECL.
+- **Keep the docs in sync.** README.md is the primary documentation: changes to the CLI, the query language, rules, or UDFs must be reflected there. If user-facing behavior or docs change, update the site (`site/`) too. The code samples in `site/src/samples.ts` are hand-lifted verbatim from README.md and must stay identical to it.
+- **Add tests.** Compiler, rules, and UDF changes need tests in `tests/` (extend `compiler-tests.lisp` or `udf-tests.lisp`, or add a new file).
+- **Adding a source file:** declare it in `clicklisp.asd`'s `:components` (files load serially in the declared order). The build script parses that list, so nothing else needs to change.
+
+## Commits and pull requests
+
+- Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/), matching the existing history (e.g. `fix(compiler): ...`, `docs(readme): ...`, `chore(deps): ...`).
+- Open pull requests against `main`. CI (tests, sanitizer, static build) must pass before merge.
+
+## Bugs, features, and security
+
+- Bug reports and feature requests go through [GitHub issues](https://github.com/ClickHouse/clicklisp/issues).
+- **Security issues must not be reported publicly.** Follow the process in [SECURITY.md](SECURITY.md) instead of opening an issue.
+
+## License and conduct
+
+clicklisp is licensed under [Apache-2.0](LICENSE). By contributing, you agree that your contributions are licensed under the same terms (inbound = outbound).
+
+All participants are expected to follow the [Code of Conduct](CODE_OF_CONDUCT.md).

SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Supported versions
+
+Only the latest released version of clicklisp is supported. Development is fix-forward: security fixes land on `main` and ship in the next release. There are no backports or patch releases for older versions.
+
+| Version        | Supported |
+| -------------- | --------- |
+| Latest release | Yes       |
+| Older releases | No        |
+
+## Reporting a vulnerability
+
+Please report vulnerabilities privately through GitHub's Security Advisories feature: go to the repository's [**Security** tab](https://github.com/ClickHouse/clicklisp/security) and choose [**Report a vulnerability**](https://github.com/ClickHouse/clicklisp/security/advisories/new).
+
+Do not open public issues or pull requests for security problems.
+
+## What to expect
+
+- We will acknowledge your report and keep you informed as we investigate.
+- Fixes are developed privately, merged to `main`, and shipped in the next release.
+- We coordinate disclosure with the reporter and publish details once a fixed release is available.