Support · Help & Disclosure

How to get help. How to report. What to expect.

Heiwa is local-first software. Support runs through the public source tree, the documentation site, and a small set of disclosure channels. Response-time fiducials are honest, not aspirational.

Read Docs Open Issue Security Disclosure

01 · Channels

PUBLIC FIRST · PRIVATE FOR SECURITY

Documentation

FIRST STOP

Runbooks, doctrine, provider lanes, install path, and the publishing pipeline.

docs.heiwa.ltd

GitHub Issues

PUBLIC TRACKER

Bug reports, feature requests, runtime questions, and CLI behaviour. Templates wired for each.

Open tracker

Security

PRIVATE CHANNEL

Suspected vulnerabilities, credential leakage, or sandbox escapes go to security@heiwa.ltd first — not the public tracker.

Disclose

02 · Response-Time Fiducials

HONEST · NOT ASPIRATIONAL

DocsSELF-SERVE

Issue triage72H

Security ack24H

Security fix7–30D

Office hoursUTC

Heiwa is operated by a small team on the operator's primary machine. SLAs are honest fiducials, not contractual. Paid enterprise support is not offered today — if that changes, it will land here first.

03 · Disclosure Policy

COORDINATED · PRIVATE FIRST

REPORT INCLUDES

Affected component (runtime, CLI, web shell, STDB)
Heiwa version · heiwa --version
Reproduction steps or proof-of-concept
Suspected impact · severity estimate
Disclosure preferences · embargo window

WE COMMIT TO

Acknowledge within 24h
Triage within 72h
Coordinate a disclosure window — default 30 days
Credit researchers in SECURITY.md unless asked not to
Publish a postmortem in docs/security/ after fix lands

04 · Governance & Boundaries

PUBLIC SURFACE · PRIVATE RUNTIME

Channel	For	Latency target	Status
GitHub Issues	Public bugs, feature requests, runtime questions	72h	open
GitHub Discussions	Architecture, doctrine, lane proposals	—	community-paced
`security@heiwa.ltd`	Coordinated vulnerability disclosure	24h	private
`governance@heiwa.ltd`	Policy, contributor licence, enterprise enquiry	5d	slow channel
Status surface	Hosted backbone health · read-only	live	websocket

05 · What This Channel Does Not Cover

PROVIDER BOUNDARIES

PROVIDER RUNTIMES

Claude Code, Codex, Gemini CLI, Antigravity, Ollama, and OpenRouter own their inference, auth, quotas, and model inventory. Heiwa wraps; it does not adjudicate provider behaviour.

Provider issues route to the provider's own support.

OPERATOR DATA

Memory, sessions, evidence, and provider secrets live on the operator's machine. Heiwa support cannot read, recover, or restore that data — by design.

Backups remain the operator's responsibility.

Heiwa Support · docs · issues · security

Honest fiducials · Public-first · Local runtime sovereignty preserved