docs: canonical README opening + SECURITY.md (#4)

* docs: canonical README opening per Hanzo OSS taxonomy * docs: add canonical SECURITY.md
2026-05-18 23:53:36 -07:00
parent 72cebf1432
commit 72a705a291
2 changed files with 49 additions and 9 deletions
@@ -1,3 +1,44 @@
+# o11y
+
+Metrics, traces, logs — the unified observability spine for the Hanzo platform. OpenTelemetry-native, OLAP-backed via Hanzo Datastore.
+
+[![Status](https://img.shields.io/badge/status-stable-green)]()
+[![License](https://img.shields.io/badge/license-MIT-blue)]()
+
+## Quick start
+
+```bash
+docker compose -f compose.yml up -d
+```
+
+Open `http://localhost:3301`.
+
+## What this is
+
+`o11y` is the unified APM / logs / traces / metrics surface every Hanzo service emits to. OpenTelemetry on the wire, Hanzo Datastore (OLAP column store) on disk. Multi-tenant by design — 309 `X-Org-Id` call sites — every panel scopes by org from the JWT. Sits behind `gateway` like every other Hanzo subsystem; eventually mounts under `hanzoai/cloud` per HIP-0106.
+
+## Specs
+
+Implements:
+- HIP-0106 Unified Cloud Binary (o11y subsystem)
+
+## Architecture
+
+```
+   instrumented app  ->  OTLP  ->  o11y collector
+                                       |
+                                Hanzo Datastore (OLAP column store)
+                                       |
+                                  APM | logs | traces | metrics
+                                       |
+                                queries scoped by X-Org-Id from JWT
+                                       |
+                                  dashboards | alerting | exceptions
+```
+
+
+---
+
 <h1 align="center" style="border-bottom: none">
    <a href="https://o11y.hanzo.ai" target="_blank">
        <img alt="Hanzo O11y" src="https://github.com/user-attachments/assets/ef9a33f7-12d7-4c94-8908-0a02b22f0c18" width="100" height="100">
@@ -1,18 +1,17 @@
 # Security Policy

-Hanzo O11y is looking forward to working with security researchers across the world to keep Hanzo O11y and our users safe. If you have found an issue in our systems/applications, please reach out to us.
+## Reporting a vulnerability

-## Supported Versions
-We always recommend using the latest version of Hanzo O11y to ensure you get all security updates
+Email security@hanzo.ai with details. Encrypt with our PGP key (fingerprint TBD).

-## Reporting a Vulnerability
+We respond within 48 hours. Critical issues receive same-day acknowledgment.

-If you believe you have found a security vulnerability within Hanzo O11y, please let us know right away. We'll try and fix the problem as soon as possible.
+## Scope

-**Do not report vulnerabilities using public GitHub issues**. Instead, email <security@o11y.hanzo.ai> with a detailed account of the issue. Please submit one issue per email, this helps us triage vulnerabilities.
+This policy covers code in this repository. For the broader Hanzo platform threat model, see [hanzoai/HIPs](https://github.com/hanzoai/HIPs).

-Once we've received your email we'll keep you updated as we fix the vulnerability.
+## Sandbox boundary

-## Thanks
+`o11y` ingests telemetry from every Hanzo service, so every query path is scoped by the JWT-validated `X-Org-Id` header — no panel, alert, or query can cross an org boundary. Logs, traces, and metrics are stored on Hanzo Datastore with per-tenant retention, and sensitive headers / payload fields are redacted at ingest time.

-Thank you for keeping Hanzo O11y and our users safe. 🙇
+For runtime sandbox guarantees, see HIP-0105 (in-process extension runtimes).