Follow-up to #1843 / #1850.
The gap
SECURITY.md was restored to main in #1843, but it was never added to v2/main.
Since v2/main is the develop branch that gets merged into main at milestone releases — and the two share no common git ancestor (git merge-base main v2/main returns nothing; the v2 tree swap created unrelated histories) — the next milestone merge re-swaps the tree and silently removes SECURITY.md from the default branch a second time.
This is the exact regression #1843 fixed, primed to recur.
Verification
$ git ls-tree --name-only origin/v2/main SECURITY.md
(empty)
$ git ls-tree --name-only origin/main SECURITY.md
SECURITY.md
The fix
Copy SECURITY.md from main to v2/main byte-for-byte (sha256 bbc8aaa5a33d481f902c1b7ac260a4c9c0d41dac5bb2916607222dd205dda924, 2633 bytes). No content changes — the file already describes the v2 packaging model, since #1843 wrote it for the post-swap world.
Related
#1851 applies the same reasoning to .github/workflows/claude.yml: it now targets v2/main rather than main, so it survives the next swap.
Anything else restored directly to main after the swap is suspect for the same reason and is worth a sweep.
Follow-up to #1843 / #1850.
The gap
SECURITY.mdwas restored tomainin #1843, but it was never added tov2/main.Since
v2/mainis the develop branch that gets merged intomainat milestone releases — and the two share no common git ancestor (git merge-base main v2/mainreturns nothing; the v2 tree swap created unrelated histories) — the next milestone merge re-swaps the tree and silently removesSECURITY.mdfrom the default branch a second time.This is the exact regression #1843 fixed, primed to recur.
Verification
The fix
Copy
SECURITY.mdfrommaintov2/mainbyte-for-byte (sha256bbc8aaa5a33d481f902c1b7ac260a4c9c0d41dac5bb2916607222dd205dda924, 2633 bytes). No content changes — the file already describes the v2 packaging model, since #1843 wrote it for the post-swap world.Related
#1851 applies the same reasoning to
.github/workflows/claude.yml: it now targetsv2/mainrather thanmain, so it survives the next swap.Anything else restored directly to
mainafter the swap is suspect for the same reason and is worth a sweep.