chore: add code of conduct, issue templates and third-party license inventory

[Icecream0507]

Which issue(s) this PR fixes:

Ref #11

Completes three of the six outstanding items tracked in #11:

• .github/CODE_OF_CONDUCT.md
• .github/ISSUE_TEMPLATE/ — bug report, feature request, question
• THIRD_PARTY_LICENSES.md

Still open in #11: brand assets, eval/COMPARISON_REPORT.md, quick-start demo cases.

---

What this changes

1. .github/CODE_OF_CONDUCT.md

CONTRIBUTING.md links to the community Code of Conduct, but there was no file in the
repository, so GitHub did not surface it under community standards.

Rather than copying the org-level policy text into this repo (which would fork it and let the
two drift), this follows the same pointer-style convention already used by SECURITY.md —
a short local file linking to
iflytek/community, plus
scope and the reporting contact. Bilingual, matching the repo's existing EN/中文 docs.

2. .github/ISSUE_TEMPLATE/

Only the HER Hack-Astron challenge template existed, so every other report arrived
unstructured. Adds three templates and a config.yml.

The bug template is domain-specific rather than generic — it asks for the input utterance,
expected vs. actual structured output, model source, and inference backend, which are the
fields that actually determine whether a Domux output bug is reproducible.

config.yml routes users to the docs, the HF/ModelScope model pages, and — importantly —
sends security reports to the community security policy instead of a public issue.

3. THIRD_PARTY_LICENSES.md

Inventory of direct dependencies with a risk assessment, complementing NOTICE.

Two points worth a reviewer's attention:

• torch is recorded as its full declared SPDX expression
  (Apache-2.0 AND Apache-2.0 WITH LLVM-exception AND BSD-2-Clause AND BSD-3-Clause AND BSL-1.0 AND MIT), not the commonly-cited "BSD-3-Clause", because the wheels bundle
  third-party components.
• The assessment states plainly that the code-side position is clean (all direct deps are
  permissive, no copyleft), and the real compliance obligation is the Gemma-derived model
  weights, which are not Apache-2.0. NOTICE remains authoritative there.

---

Special notes for reviewers

• No existing files are modified. Six new files, +329 lines, zero deletions.
• cases-lint CI does not trigger on these paths; I ran scripts/validate_cases.py --self-test
  and the full validator locally anyway — both pass.
• All YAML frontmatter and config.yml parse; the bug / enhancement / question labels
  were checked to already exist in this repo.
• All internal doc links were checked to resolve; external links return 200 (the Hugging Face
  URL is copied verbatim from README.md).
• Licenses were verified against PyPI package metadata on 2026-08-26 — not from memory.
• Happy to split this into three PRs, drop the bilingual sections, or adjust the template fields
  if you'd prefer a different shape. 如需拆分或调整格式，请直接告诉我。

AI assistance disclosure

This contribution was prepared with AI assistance (Claude). The dependency licenses were
verified against primary sources (PyPI metadata) rather than generated from the model's memory,
and I have reviewed every line submitted and can explain it.

[CLAassistant]

All committers have signed the CLA.

[FenjuFu]

Thanks — this is a clean, well-scoped community-standards contribution. Correctly using Ref #11 (not Fixes) since it completes 3 of the 6 tracked deliverables.

I verified every factual claim against the current repo:

• CODE_OF_CONDUCT.md — points to the real iflytek/community Code of Conduct and the ifly_opensource@iflytek.com report address; it references the org policy rather than fabricating one. Good.
• Issue templates / config.yml — model name Domux-Gemma-4-E2B-it, HF iFlytekOpenSource/Domux, ModelScope iflytek/domux, and the security link all match the README.
• THIRD_PARTY_LICENSES.md — the four training deps (ms-swift[llm]>=3.0.0, torch>=2.0.0, transformers>=4.40.0, peft>=0.10.0) match training/requirements.txt exactly; vllm==0.22.0 / sglang[all]==0.5.12 match the README; and NOTICE, scripts/validate_cases.py, eval/run_eval.py all exist as cited. The risk assessment correctly flags that the Gemma-derived weights are governed by the Gemma Terms of Use (not Apache-2.0) and defers to NOTICE — that's the right call.

DCO + CLA green. Deferring the merge decision to the maintainers, but from a factual-accuracy standpoint this checks out.

[FenjuFu]

Nice, well-scoped community-standards PR. Reviewed the three deliverables:

• CODE_OF_CONDUCT.md — good call using the pointer-style convention already established by SECURITY.md rather than forking the org policy text; links to iflytek/community, bilingual, correct reporting contact. Avoids the two-copies-drift problem.
• ISSUE_TEMPLATE/ — domain-specific bug template (input utterance, expected vs actual structured output, model source, inference backend) is much more useful than a generic one for this repo.
• THIRD_PARTY_LICENSES.md — good addition.

Correct use of Ref #11 rather than Fixes so the umbrella issue stays open for the remaining three items (brand assets, eval/COMPARISON_REPORT.md, quick-start demos). CI (DCO + CLA) green. No blocking concerns.