chore(compliance): relicense to Apache-2.0, add security and accessibility statements

[WomB0ComB0]

Remediates the compliance-lens findings for this repository.

PUB-LIC-01 — root licence (2 findings)

What changed:

• LICENSE is now the Apache License 2.0, byte-identical to the licence file in the org's other Apache-2.0 repositories. The copyright line stays in the README ("Copyright 2026 ResQ"), as it does in those repositories.
• The previous MIT text (Copyright (c) 2023 Mintlify) moves unchanged to THIRD_PARTY_NOTICES.md. It names the template it covers: mintlify/starter, which this repository was created from.
• README.md keeps its Apache-2.0 badge and licence line, and now points to the notices file.

The README badge, the licence line, the SPDX-License-Identifier: Apache-2.0 headers (workflows, .spectral.yml, templates) and the info.license in specs/*.json already said Apache-2.0. Only LICENSE disagreed, and now it doesn't. docs.json and manifest.webmanifest declare no licence.

PUB-SEC-01 — security policy (2 findings)

What changed: the repo had no policy of its own, so there's now a root SECURITY.md. It links the org policy and gives the private reporting channels (private vulnerability reporting on this repo, or security@resq.software). After those come the EU Cyber Resilience Act reporting and Safe harbour sections, pasted verbatim from the shared wording.

PUB-ACC-01 — accessibility (2 findings)

What changed: new ACCESSIBILITY.md, covering:

• the target, WCAG 2.2 AA;
• the status: not yet formally audited, and no automated checks yet;
• known issues: none recorded yet;
• how to report a barrier: GitHub issues, or contact@resq.software (the site's published contact).

It's linked from the site footer ("Policies → Accessibility") so visitors to docs.resq.software can find it.

Left: automated accessibility testing. This repo has no browser-test setup (no Playwright, Cypress or similar), so no axe-core check was added. That's a follow-up.

PUB-CLM-01 — claims (2 findings)

File	Before	After
index.mdx (home page card)	Stay legal — "Human-in-the-loop mission approval (EU AI Act Art. 14 HITL) and permitted-airspace gating built into the dispatch flow."	Human approval — "Critical missions wait for an operator with the missions.approve scope, and the dispatcher refuses flight plans outside permitted airspace."
sdks/cpp/api/resq-common/resq.md	"Provides geofencing functionality for FAA Part 107 compliance:"	"Provides geofencing primitives for checking positions and flight paths against no-fly zones:"

The new card text is backed by facts in concepts.mdx and the Coordination API spec: the missions.approve scope, the pending/approve/reject endpoints, and the dispatcher's airspace gate.

The same card appears in the four locale mirrors (es/, zh/, ar/, hi/index.mdx), which the README says are kept in lock-step with the English page. Their titles and text were updated to match. The locale parity check still reports 0 gaps.

Left:

• sdks/cpp/api/resq-common/resq.md is generated from the C++ SDK's header. The next auto-doc PR will bring back whatever the header says, so the header needs the same softening upstream.
• Other pages that cite EU AI Act Article 14 were not flagged by this scan and are unchanged.

PUB-CNF-02 — tracked local tool file (1 finding)

What changed: .claude/settings.local.json is untracked (git rm --cached) and added to .gitignore. It was checked for secrets first and has none: it holds only three local permission-allow entries.

Supporting changes

• .mintignore keeps the three new root documents (SECURITY.md, ACCESSIBILITY.md, THIRD_PARTY_NOTICES.md) from becoming stray site pages.
• scripts/i18n_parity.py adds the same three names to EXCLUDED_NAMES, next to README.md, AGENTS.md and CONTRIBUTING.md. Without this, the parity report would count them as 12 untranslated pages.

Checks run locally

• mint broken-links: no broken links found.
• python3 scripts/i18n_parity.py --root .: 0 gaps across 4 locales.
• mint validate: 348 warnings on this branch, the same 348 as on main. They're all nav entries for SDK pages that don't exist, not in CI, and none relate to this change.
• The content guard is unaffected: no files under sdks/** are deleted.

Summary by CodeRabbit

• Documentation
  • Added accessibility guidance, including the site’s WCAG 2.2 AA target and ways to report barriers.
  • Added instructions for reporting security vulnerabilities, along with safe-harbor conditions.
  • Clarified licensing information for ResQ and the Mintlify starter template.
• Content Updates
  • Updated the human-approval descriptions across supported languages: critical missions require approval from an operator with the appropriate scope, and flight plans outside permitted airspace are rejected.
  • Clarified that geofencing documentation describes checks against no-fly zones.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ecb3a091-3168-4e7f-8bad-51f42f92e989

📥 Commits

Reviewing files that changed from the base of the PR and between b018e2b and 05b358b.

📒 Files selected for processing (16)

• .claude/settings.local.json
• .gitignore
• .mintignore
• ACCESSIBILITY.md
• LICENSE
• README.md
• SECURITY.md
• THIRD_PARTY_NOTICES.md
• ar/index.mdx
• docs.json
• es/index.mdx
• hi/index.mdx
• index.mdx
• scripts/i18n_parity.py
• sdks/cpp/api/resq-common/resq.md
• zh/index.mdx

💤 Files with no reviewable changes (1)

• .claude/settings.local.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The repository adds accessibility and security policies, updates licensing and policy-document handling, removes a local Claude settings file, and revises product descriptions across the homepage translations and C++ SDK documentation.

Changes

Repository policies and licensing

Layer / File(s)	Summary
License and attribution records LICENSE, THIRD_PARTY_NOTICES.md, README.md	LICENSE now contains Apache License 2.0. The notices and README identify the Mintlify starter template and retain its MIT license notice.
Policy documents and site configuration ACCESSIBILITY.md, SECURITY.md, docs.json, .mintignore, scripts/i18n_parity.py	The repository adds accessibility and security policies. The site footer links to the accessibility policy, and the policy documents are excluded from site processing and i18n parity checks.

Product description updates

Layer / File(s)	Summary
Product descriptions and translations index.mdx, ar/index.mdx, es/index.mdx, hi/index.mdx, zh/index.mdx, sdks/cpp/api/resq-common/resq.md	The homepage cards describe approval by an operator with missions.approve and rejection of flight plans outside permitted airspace. The SDK description identifies position and flight-path checks against no-fly zones.

Local settings cleanup

Layer / File(s)	Summary
Remove tracked local settings .claude/settings.local.json, .gitignore	The local Claude settings file is removed, and .gitignore excludes its path.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 05b35

The changes update licensing, policy documents, and product descriptions without evidence of a broken workflow or contradictory claim. The PR appears ready to merge after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary changes: relicense the repository to Apache-2.0 and add security and accessibility statements.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}