diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..2804d45
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,19 @@
+# Code of Conduct
+
+The rossoctl Code of Conduct is maintained in the main project repository:
+
+**→ [rossoctl/rossoctl/CODE_OF_CONDUCT.md](https://github.com/rossoctl/rossoctl/blob/main/CODE_OF_CONDUCT.md)**
+
+It applies to every repository, issue tracker, pull request and communication channel in the
+[rossoctl organization](https://github.com/rossoctl).
+
+GitHub serves this file to any rossoctl repository that does not define its own, so the policy
+is written once and inherited everywhere rather than copied and left to drift.
+
+## Reporting
+
+Reporting addresses and the enforcement process are in the document linked above; conduct
+concerns are handled by the maintainers listed in
+[MAINTAINERS.md](https://github.com/rossoctl/rossoctl/blob/main/MAINTAINERS.md). See also
+[GOVERNANCE.md](https://github.com/rossoctl/rossoctl/blob/main/GOVERNANCE.md) for how
+enforcement decisions are made.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..1fc296e
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,40 @@
+# Contributing to rossoctl
+
+The rossoctl contribution process — how to claim an issue, how review works, the developer's
+guide and the path to becoming a maintainer — is maintained in the main project repository:
+
+**→ [rossoctl/rossoctl/CONTRIBUTING.md](https://github.com/rossoctl/rossoctl/blob/main/CONTRIBUTING.md)**
+
+GitHub serves this file to any rossoctl repository that does not define its own, so the
+process is written once and inherited everywhere rather than copied and left to drift.
+
+## Project-wide documents
+
+| Topic                       | Document                                                                                      |
+| --------------------------- | --------------------------------------------------------------------------------------------- |
+| Contribution process        | [CONTRIBUTING.md](https://github.com/rossoctl/rossoctl/blob/main/CONTRIBUTING.md)             |
+| Governance & voting         | [GOVERNANCE.md](https://github.com/rossoctl/rossoctl/blob/main/GOVERNANCE.md)                 |
+| Maintainers                 | [MAINTAINERS.md](https://github.com/rossoctl/rossoctl/blob/main/MAINTAINERS.md)               |
+| Becoming a maintainer       | [CONTRIBUTOR_LADDER.md](https://github.com/rossoctl/rossoctl/blob/main/CONTRIBUTOR_LADDER.md) |
+| How features are accepted   | [FEATURE_ACCEPTANCE.md](https://github.com/rossoctl/rossoctl/blob/main/FEATURE_ACCEPTANCE.md) |
+| Personas and roles          | [PERSONAS_AND_ROLES.md](https://github.com/rossoctl/rossoctl/blob/main/PERSONAS_AND_ROLES.md) |
+| Code of conduct             | [CODE_OF_CONDUCT.md](https://github.com/rossoctl/rossoctl/blob/main/CODE_OF_CONDUCT.md)       |
+| Security policy             | [SECURITY.md](https://github.com/rossoctl/rossoctl/blob/main/SECURITY.md)                     |
+| License (Apache-2.0)        | [LICENSE](https://github.com/rossoctl/rossoctl/blob/main/LICENSE)                             |
+
+## What an individual repository adds
+
+A rossoctl repository may carry its own `CONTRIBUTING.md` covering **only what is specific to
+it** — prerequisites, build, test and lint commands — and link back here for the process. Note
+that a local file **replaces** this one rather than merging with it, so a repo-specific
+`CONTRIBUTING.md` should link the process documents above explicitly.
+
+Two files are **not** inherited and must exist in every repository:
+
+- **`LICENSE`** — GitHub does not inherit a license. A repository without one is
+  all-rights-reserved regardless of the organization's intent.
+- **`CODEOWNERS`** — review assignment is per-repository.
+
+New repositories should start from
+[**rossoctl/repo-template**](https://github.com/rossoctl/repo-template), which ships both of
+those plus the project's documentation convention.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..28c9bb4
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,25 @@
+# Security Policy
+
+The rossoctl security policy — reporting process, response timelines, disclosure policy and
+supported versions — is maintained in the main project repository:
+
+**→ [rossoctl/rossoctl/SECURITY.md](https://github.com/rossoctl/rossoctl/blob/main/SECURITY.md)**
+
+GitHub serves this file to any rossoctl repository that does not define its own, so the policy
+is written once and inherited everywhere rather than copied and left to drift.
+
+## Reporting a vulnerability — the short version
+
+**Do NOT open a public GitHub issue for a security vulnerability.**
+
+1. **GitHub Security Advisories (preferred).** Report privately against the repository where
+   you found the issue, via its **Security → Advisories → Report a vulnerability** tab. For
+   the main project that is
+   [here](https://github.com/rossoctl/rossoctl/security/advisories/new).
+2. **Email.** <rossoctl-maintainers@googlegroups.com>
+3. **Include:** a clear description, steps to reproduce, affected versions, and potential
+   impact.
+
+You can expect acknowledgement within 48 hours and an initial assessment within 7 business
+days. Full timelines, the coordinated-disclosure policy and the security controls in place are
+in the linked policy above — read it before reporting.
diff --git a/SUPPORT.md b/SUPPORT.md
new file mode 100644
index 0000000..a1d0185
--- /dev/null
+++ b/SUPPORT.md
@@ -0,0 +1,34 @@
+# Getting help
+
+GitHub shows this page from the **Help** link on issues in any rossoctl repository that does
+not define its own.
+
+## Where to ask
+
+| If you…                                        | Then…                                                                                  |
+| ---------------------------------------------- | -------------------------------------------------------------------------------------- |
+| have a question about using rossoctl           | open a **Question** issue on the relevant repository                                   |
+| think you have found a bug                     | open a **Bug report** on the repository where you saw it                               |
+| want a new capability                          | open a **Feature request**; see [FEATURE_ACCEPTANCE.md](https://github.com/rossoctl/rossoctl/blob/main/FEATURE_ACCEPTANCE.md) for how proposals are evaluated |
+| have found a **security vulnerability**        | **do not open an issue** — follow [SECURITY.md](https://github.com/rossoctl/rossoctl/blob/main/SECURITY.md) |
+| want to contribute a change                    | read [CONTRIBUTING.md](https://github.com/rossoctl/rossoctl/blob/main/CONTRIBUTING.md) |
+
+Issue templates are provided org-wide from this repository, so the forms are the same
+everywhere.
+
+## Project documents
+
+Governance, maintainers, the contributor ladder, the code of conduct and the security policy
+are maintained once in the main project repository,
+[**rossoctl/rossoctl**](https://github.com/rossoctl/rossoctl) — see
+[CONTRIBUTING.md](CONTRIBUTING.md) for the full index.
+
+## Licensing
+
+rossoctl is licensed under **Apache-2.0**. The canonical text is
+[rossoctl/rossoctl/LICENSE](https://github.com/rossoctl/rossoctl/blob/main/LICENSE).
+
+GitHub does **not** inherit a license across repositories, so each rossoctl repository carries
+its own `LICENSE` file — a repository without one would be all-rights-reserved whatever the
+organization intends. If you find a rossoctl repository with no `LICENSE`, please report it as
+a bug.