# Ethics

This document describes the ethical principles that guide the development of
cnfy. It is a living document — sections will be added as the project evolves.

## Brand Recognition Policy

We are happy to credit and promote third-party products that align with our
values. Great tools deserve recognition.

However, when a company's actions conflict with the ethical framework of this
project — as expressed in the [SIOL-1.0](LICENSE) — we withdraw that
promotion. Complicity in acts of aggression, oppression, or harm to civilian
populations is incompatible with our principles, regardless of how good the
product is.

This is not a blanket policy against third-party branding. It is a deliberate
choice to withhold endorsement from organizations whose conduct we consider
unethical. Promotion can be granted or revoked at any time based on a
company's actions.

## AI-Assisted Development

This project uses AI as a development tool. AI assists with code generation,
refactoring, test writing, and documentation. AI does not make architectural
decisions, merge code, or publish releases.

### Human Oversight

- Every line of AI-generated code is reviewed by a human before it enters the
  codebase.
- Humans are accountable for correctness, security, and licensing of all code.
- AI suggestions that do not meet project standards are rejected or rewritten.
- AI does not have commit access, publish access, or any autonomous authority.
- AI does not generate cryptographic algorithms without human verification
  against reference specifications and known test vectors.

### Transparency

- AI-generated code is marked with `AI-Assisted: true` in commit metadata.
- AI-generated and human-written tests are kept in separate, clearly marked
  modules (`mod ai_tests` and `mod human_tests`) within each source file. This
  makes it easy to audit the origin of any test and ensures human-written tests
  serve as an independent correctness check.

## Security Responsibility

- Side-channel properties of every algorithm are documented in
  [SECURITY.md](SECURITY.md).
- Constant-time alternatives are provided for all operations that may handle
  secret data.
- Known attack vectors against ECC implementations are cataloged with
  references to the original research.

## Licensing

This project is licensed under the
[Shariah-Informed Open License (SIOL-1.0)](LICENSE).
