# Open-Source Boundary

This repository is the public website and community gateway for Mian Zhang's research projects. It uses an open-core boundary: public artifacts are released to support inspection, learning, interoperability, and independent extension; production implementation advantages and private data remain outside this repository.

## Open by Default

The following material may be published after normal provenance and claim review:

- Published definitions, formulas, paper metadata, citation files, and claim boundaries.
- Public benchmark protocols, schemas, scorers, validators, and small public or synthetic fixtures.
- Minimal reference implementations that are sufficient to inspect or test a public claim.
- Safe demonstrations, interoperability contracts, documentation, and negative results.
- Public contribution routes, issue forms, community metrics, and release records.

Publication of an interface does not imply publication of every implementation behind that interface.

## Review Before Release

The following material requires an explicit release review because combinations can reveal operational advantage, security exposure, or unpublished research:

- General infrastructure components that approach production capability when combined.
- Large datasets, evaluation answers, detailed ablations, operational traces, or security-relevant examples.
- Reference implementations that substitute for a paid product capability.
- Unpublished paper material, third-party data, or material with uncertain provenance or license.

Release review covers dependency closure, credentials, personal or customer data, provenance, license, scientific claim scope, security exposure, and commercial substitution risk.

## Not Public

The following material is not accepted in Issues, Discussions, pull requests, public datasets, or public demos:

- Production orchestration, policy, memory, optimization, self-improvement, or skill-generation pipelines.
- Exact reward weights, thresholds, routing logic, private prompts, model states, tuning history, or private evaluation rubrics.
- Proprietary datasets, unpublished training data, private failure memory, customer workflows, customer data, or private logs.
- Production integrations, deployment automation, commercial terms, credentials, account records, private correspondence, or unreleased research.
- Personal voice recordings, voice models, identity records, or third-party material without publication rights.

Public documentation may state what a private system accepts, returns, or guarantees at an interface. It does not disclose the defensible implementation used to produce that behavior.

## Public Claims

Public code, papers, benchmarks, and demonstrations are not production certification. A repository, paper, or benchmark result does not by itself establish general intelligence, general safety, customer readiness, clinical validity, real-world profitability, or deployment performance.

Use the cited paper, DOI record, artifact version, and explicit limitations for the scope of each claim.

## Vulnerabilities and Sensitive Exposure

Do not publish a vulnerability, credential, private path, customer record, exploit sequence, or sensitive screenshot in a public thread. Follow [.github/SECURITY.md](.github/SECURITY.md) for private reporting.

## Licensing Scope

Source code intentionally released in this repository is licensed under Apache-2.0 unless a file or directory states otherwise. Papers, datasets, images, photographs, logos, names, and third-party materials retain their item-specific rights. See [CONTENT_AND_MEDIA_LICENSE.md](CONTENT_AND_MEDIA_LICENSE.md).