Repository governance

The canonical source is vamos-optimization/VAMOS. The organization repository owns authoritative main, issues, pull requests, Actions and CI, the roadmap, security reporting, official tags, GitHub Releases, release artifacts, and PyPI/TestPyPI publishing.

Personal mirror: NicolasRodriguezUribe/VAMOS.

The personal repository receives canonical main through normal fast-forward updates. It preserves the same source history and tree; independent development belongs in the organization repository. Official tags may be copied only after successful publication. A mirror or fork is never an authorized package publisher or source of release artifacts. Repository guards in the shared workflows enforce this even when both repositories contain the same commit.

Use the canonical issues, pull requests, and releases. Documentation is hosted on organization Pages. For security reports, use the organization's private vulnerability reporting.

python tools/check_repository_identity.py checks tracked references and the publication guard. The personal-mirror declaration above is the only permitted project link to the personal repository. The checker's owner identifier is a policy constant, not a project link. Historical audit evidence stays outside the repository. Health, CI, and release validation enforce this policy.

See release verification for the publisher identity, Pages configuration, and the required fresh official artifact freeze.