Update public contact and correction routes (#2)

Route all new Project Shadow correspondence to projectshadowqa@protonmail.com while preserving exact release archives, historical signing identities, and custody evidence. Add correction, CAPA, security, research, press, collaboration, and conduct intake guidance.

Author: PauseBeforeHarmProtocol

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,11 @@
 blank_issues_enabled: false
 contact_links:
+  - name: Contact, correction, or CAPA route
+    url: https://github.com/PauseBeforeHarmProtocol/Project-Shadow/blob/main/CONTACT_AND_CORRECTIONS.md
+    about: Use the current Project Shadow mailbox and the appropriate subject prefix.
   - name: Private vulnerability report
     url: https://github.com/PauseBeforeHarmProtocol/Project-Shadow/security/advisories/new
     about: Report vulnerabilities, exploit details, secrets, or sensitive evidence privately.
   - name: Security policy and email fallback
     url: https://github.com/PauseBeforeHarmProtocol/Project-Shadow/security/policy
-    about: Read the private-reporting instructions and monitored-email fallback.
+    about: Read the private-reporting instructions and current monitored-email fallback.

CITATION.cff

@@ -8,6 +8,7 @@ type: software
 authors:
   - family-names: Linstrum
     given-names: Phillip
+    email: projectshadowqa@protonmail.com
 version: "1.0 R1 Reference (PRELIVE)"
 date-released: 2026-08-14
 repository-code: https://github.com/PauseBeforeHarmProtocol/Project-Shadow

CODE_OF_CONDUCT.md

@@ -22,13 +22,14 @@ after being directed to the private security channel are not acceptable.
 
 ## Reporting and response
 
-For sensitive conduct reports, email
-`pausebeforeharmprotocol_PBHP@protonmail.com` with the subject
-`PROJECT SHADOW CONDUCT REPORT`. Do not place private evidence in a public
-issue. Maintainers may remove content, limit participation, or refer a security
-matter to the process in `SECURITY.md`. Decisions should be proportionate,
-documented where privacy permits, and open to correction when new evidence
-appears.
+For sensitive conduct reports, email `projectshadowqa@protonmail.com` with the
+subject prefix `[CONDUCT]`. Do not place private evidence in a public issue.
+Maintainers may remove content, limit participation, or refer a security matter
+to the process in `SECURITY.md`. Decisions should be proportionate, documented
+where privacy permits, and open to correction when new evidence appears.
+
+The broader contact and correction policy is in
+[`CONTACT_AND_CORRECTIONS.md`](CONTACT_AND_CORRECTIONS.md).
 
 This code governs participation only. It does not certify the project or
 authorize production or operational deployment.

CONTACT_AND_CORRECTIONS.md

@@ -0,0 +1,82 @@
+# Contact, corrections, CAPA, and security
+
+**Current public contact:** `projectshadowqa@protonmail.com`  
+**Effective:** 2026-08-17
+
+Use one of these subject prefixes so the report can be routed correctly:
+
+- `[CORRECTION]`
+- `[CAPA]`
+- `[SECURITY]`
+- `[RESEARCH]`
+- `[PRESS]`
+- `[COLLABORATION]`
+- `[CONDUCT]`
+
+## Corrections
+
+Include:
+
+1. the exact page, URL, release, file, case, or claim;
+2. the disputed text or behavior;
+3. the strongest available supporting evidence;
+4. whether the issue is factual, interpretive, currentness-related,
+   rights-related, technical, or procedural;
+5. the correction requested; and
+6. what evidence would verify that the correction worked.
+
+## CAPA proposals
+
+A useful CAPA proposal distinguishes:
+
+- immediate containment;
+- known impact and affected stakeholders;
+- suspected root cause;
+- confirmed root cause, if available;
+- corrective action;
+- preventive action;
+- owner and target date, if known;
+- effectiveness-check method; and
+- evidence that would close or reopen the issue.
+
+Submitting a correction or CAPA does not guarantee acceptance. Dispositions
+should remain evidence-bound and may be accepted, narrowed, deferred, rejected
+as unsupported, or closed as duplicate or out of scope with a preserved
+rationale.
+
+## Security
+
+Use `[SECURITY]` for suspected vulnerabilities, unsafe verifier behavior,
+secret exposure, account compromise, or sensitive technical issues. Follow
+[`SECURITY.md`](SECURITY.md). Do not publish exploit details, tokens, private
+keys, personal data, or sensitive evidence in a public issue.
+
+## Privacy floor
+
+Do not send:
+
+- passwords, one-time codes, authenticator seeds, recovery codes, or private
+  keys;
+- protected health information;
+- private dossiers or unnecessary personal identifiers;
+- confidential employer information without authority; or
+- real-person accusations unsupported by evidence.
+
+## Historical identities and addresses
+
+Older email addresses may remain inside exact-hash archives, signed records,
+certificates, commits, tags, quoted evidence, or other frozen historical
+artifacts. They are preserved for custody and verification and are **not** the
+current contact route.
+
+In particular, a certificate identity shown in a Cosign command must match the
+identity recorded in the preserved signature evidence. Do not replace it with
+the current mailbox merely for consistency; doing so would make the
+verification command incorrect.
+
+For all new Project Shadow correspondence, use
+**`projectshadowqa@protonmail.com`**.
+
+This contact route does not authorize production or operational deployment and
+does not create efficacy, safety, certification, legal-compliance, or
+independent-validation claims.

CONTRIBUTING.md

@@ -4,10 +4,17 @@ Project Shadow welcomes rigorous technical review, documentation corrections,
 false-positive and false-negative reports, and adverse results. Outside
 criticism is evidence to evaluate, not hostility to suppress.
 
+## Current contact
+
+For corrections, CAPA proposals, research, press, collaboration, conduct, or a
+private security fallback, use `projectshadowqa@protonmail.com` with the
+subject prefix defined in
+[`CONTACT_AND_CORRECTIONS.md`](CONTACT_AND_CORRECTIONS.md).
+
 ## Before opening a contribution
 
-1. Read `README.md`, `RIGHTS.md`, `SECURITY.md`, and
-   `docs/SCOPE_AND_NONCLAIMS.md`.
+1. Read `README.md`, `RIGHTS.md`, `SECURITY.md`,
+   `CONTACT_AND_CORRECTIONS.md`, and `docs/SCOPE_AND_NONCLAIMS.md`.
 2. Select the matching issue form before proposing a pull request.
 3. Use synthetic, non-sensitive evidence wherever possible.
 4. Report vulnerabilities privately under `SECURITY.md`; never publish exploit
@@ -20,6 +27,7 @@ criticism is evidence to evaluate, not hostility to suppress.
 - corrections tied to a precise path, statement, and source;
 - verifier mutation cases that fail closed;
 - false-positive, false-negative, or adverse-result reports;
+- correction and CAPA proposals with an effectiveness-check method;
 - accessibility, portability, and documentation improvements; and
 - narrowly scoped proposals that preserve Project Shadow's governance and
   nonclaim boundaries.
@@ -37,6 +45,8 @@ criticism is evidence to evaluate, not hostility to suppress.
   self-authorizes publication, production, or operational deployment.
 - Do not add efficacy, safety, certification, production-readiness, or
   legal-compliance claims.
+- Historical email addresses and certificate identities in preserved evidence
+  must not be rewritten merely to match the current contact mailbox.
 
 ## Pull requests
 

PUBLIC_CONTACT_STATUS_2026-08-17.json

@@ -0,0 +1,39 @@
+{
+  "schema": "project-shadow.public-contact-status.v1",
+  "effective_date": "2026-08-17",
+  "current_public_contact": "projectshadowqa@protonmail.com",
+  "subject_prefixes": [
+    "[CORRECTION]",
+    "[CAPA]",
+    "[SECURITY]",
+    "[RESEARCH]",
+    "[PRESS]",
+    "[COLLABORATION]",
+    "[CONDUCT]"
+  ],
+  "human_readable_policy": "CONTACT_AND_CORRECTIONS.md",
+  "security_policy": "SECURITY.md",
+  "historical_address_policy": {
+    "preserve_exact_hash_archives": true,
+    "preserve_signed_records_and_certificates": true,
+    "preserve_commits_tags_and_quoted_evidence": true,
+    "superseded_for_new_correspondence": true,
+    "note": "Historical addresses and certificate identities remain where required for custody or cryptographic verification. They are not current correspondence routes."
+  },
+  "artifact_effect": {
+    "r1_archive_modified": false,
+    "myth_sidecar_modified": false,
+    "release_hashes_changed": false,
+    "admission_or_authorization_changed": false,
+    "production_or_operational_authority_created": false
+  },
+  "nonclaims": {
+    "certification_claimed": false,
+    "efficacy_claimed": false,
+    "independent_validation_claimed": false,
+    "legal_compliance_claimed": false,
+    "production_authorized": false,
+    "operational_deployment_authorized": false,
+    "safety_claimed": false
+  }
+}

README.md

@@ -15,6 +15,22 @@ governance evidence, integrity instructions, and nonclaim boundaries. It does
 not contain the release ZIPs in Git history; those are attached to their
 respective GitHub Releases.
 
+## Current contact
+
+All new Project Shadow correspondence should use
+**`projectshadowqa@protonmail.com`**.
+
+Use `[CORRECTION]`, `[CAPA]`, `[SECURITY]`, `[RESEARCH]`, `[PRESS]`,
+`[COLLABORATION]`, or `[CONDUCT]` in the subject line. The full intake and
+privacy rules are in
+[`CONTACT_AND_CORRECTIONS.md`](CONTACT_AND_CORRECTIONS.md), with a
+machine-readable status in
+[`PUBLIC_CONTACT_STATUS_2026-08-17.json`](PUBLIC_CONTACT_STATUS_2026-08-17.json).
+
+Historical addresses and certificate identities may remain inside exact-hash,
+signed, frozen, or quoted evidence. They are preserved for custody and
+verification and are not current contact routes.
+
 ## Exact releases
 
 | Artifact | Role | Bytes | SHA-256 |
@@ -73,7 +89,8 @@ before redistribution or adaptation.
 
 Technical criticism, correction evidence, false positives, false negatives,
 and adverse results are welcome. Outside criticism is evidence to evaluate,
-not hostility to suppress. Start with [`CONTRIBUTING.md`](CONTRIBUTING.md) and
-use the matching issue form. Report vulnerabilities privately under
+not hostility to suppress. Start with [`CONTRIBUTING.md`](CONTRIBUTING.md), use
+the matching issue form, or email `projectshadowqa@protonmail.com` with the
+appropriate subject prefix. Report vulnerabilities privately under
 [`SECURITY.md`](SECURITY.md); never place exploit details or private evidence
 in a public issue.

RELEASES.md

@@ -19,6 +19,17 @@ authorized R1 or sidecar artifacts.
 Exact filenames, sizes, hashes, and ordering are machine-readable in
 [`PUBLICATION_MANIFEST.json`](PUBLICATION_MANIFEST.json).
 
+## Current contact
+
+For release questions, corrections, CAPA proposals, research, press,
+collaboration, or security routing, use `projectshadowqa@protonmail.com` with
+the subject prefix described in
+[`CONTACT_AND_CORRECTIONS.md`](CONTACT_AND_CORRECTIONS.md).
+
+Historical addresses and signing identities in exact-hash archives, signed
+records, certificates, tags, commits, and verification commands remain
+preserved evidence. They are not current correspondence routes.
+
 ## Prospective custody procedure
 
 The two 2026-08-14 tags are preserved lightweight tags pointing to the original

SECURITY.md

@@ -6,9 +6,8 @@ artifact. It is not authorized for production or operational deployment.
 For a suspected vulnerability in this repository or either exact release
 artifact, use [GitHub private vulnerability
 reporting](https://github.com/PauseBeforeHarmProtocol/Project-Shadow/security/advisories/new).
-If that private reporting surface is unavailable, email the monitored
-maintainer address `pausebeforeharmprotocol_PBHP@protonmail.com` with the
-subject `PROJECT SHADOW SECURITY REPORT`.
+If that private reporting surface is unavailable, email
+`projectshadowqa@protonmail.com` with the subject prefix `[SECURITY]`.
 
 We aim to acknowledge a private report within **seven calendar days**. This is
 an acknowledgment target, not a promise of resolution or a statement about
@@ -27,6 +26,17 @@ Include:
 - expected and observed behavior; and
 - whether the issue reproduces after the package's embedded verifier passes.
 
+Do not send passwords, one-time codes, authenticator seeds, recovery codes,
+private keys, protected health information, or unnecessary personal data.
+
+Historical email addresses and certificate identities may remain in exact-hash
+archives, signed records, commits, tags, and verification commands. They are
+preserved evidence, not current security mailboxes. Do not replace a preserved
+certificate identity in a Cosign command with the current contact address.
+
+The full contact, correction, and CAPA routing policy is in
+[`CONTACT_AND_CORRECTIONS.md`](CONTACT_AND_CORRECTIONS.md).
+
 A verification pass establishes only the checks implemented by that verifier.
 It is not a safety, efficacy, certification, production-readiness, or
 legal-compliance claim.

docs/VERIFY_RELEASES.md

@@ -1,5 +1,9 @@
 # Verify the exact Project Shadow releases
 
+For release-verification questions, corrections, or security reports, use
+`projectshadowqa@protonmail.com` with the appropriate subject prefix from
+[`CONTACT_AND_CORRECTIONS.md`](../CONTACT_AND_CORRECTIONS.md).
+
 Do not rely on a filename alone. Verify both byte count and SHA-256 before
 extracting an archive.
 
@@ -107,6 +111,11 @@ Expected verification inputs:
 | Certificate identity | `pausebeforeharmprotocol_PBHP@protonmail.com` |
 | Certificate OIDC issuer | `https://github.com/login/oauth` |
 
+The certificate identity in this table is the frozen historical identity
+recorded in the exact signature evidence. It is not the current contact
+mailbox. Replacing it with `projectshadowqa@protonmail.com` would make the
+verification command incorrect.
+
 The public Rekor entry for the exact admission record is:
 
 | Rekor field | Exact value |