Add SAFETY.md to HF model (parity with GitHub repo)

SAFETY.md

@@ -0,0 +1,62 @@
+# Responsible Use and Safety Scope
+
+Constitutional BioGuard is a **prototype** biological dual-use content classifier.
+It is intended for safety research, content-moderation pipeline experimentation,
+and as a teaching artifact for the Constitutional Classifiers methodology applied
+to a single domain. It is **not** a production safeguard.
+
+## In Scope
+
+- Research on dual-use content detection and constitution-driven training pipelines.
+- Comparison studies between rule-based, classifier-based, and LLM-judge safeguards.
+- Education on NSABB-category classification, calibration vs evasion trade-offs,
+  and the limits of small-classifier safety.
+- Building integration tests for downstream agent stacks (see AgentShield example).
+
+## Out of Scope
+
+- Sole reliance for any deployment that handles biology queries. The 9.79% mean
+  adversarial ASR (and >30% on encoding attacks like ROT13) means this classifier
+  must be paired with input filters, response guards, and human review.
+- Use as evidence that any production system (Anthropic's, OpenAI's, etc.) is or
+  is not "Constitutional-Classifier-equivalent." This repository is a domain
+  extension experiment, not a reproduction of any vendor's deployed pipeline.
+- Generating, expanding, or sharing the synthetic *unsafe* examples in
+  isolation. The `data/` synthetic corpus is gitignored by design; releases
+  publish only constitution rules, training scripts, evaluation harness,
+  and aggregate metrics.
+- Adversarial reuse: probing for evasion vectors against deployed safeguards
+  using the published attack taxonomy as a recipe.
+
+## Withheld Content
+
+The following are intentionally **not** in this public repository:
+
+- Generated synthetic unsafe examples (in `data/`, gitignored)
+- Trained model weights with the unsafe-class probability head (the published
+  HF model is the same architecture; weights are MIT but the unsafe-side
+  generations are not redistributed)
+- Per-attack ROT13 / encoding payloads at full fidelity
+- External validation labels from BioThreat-Eval beyond aggregate kappa
+
+## Reporting Concerns
+
+Open a GitHub issue with the `safety` label for:
+
+- A specific synthetic-example category that should be removed or sanitized
+- A NSABB-category framing that is misleading or out of date
+- Any artifact that could be repurposed as harmful guidance
+
+For sensitive disclosures, email jak4013@med.cornell.edu directly with
+"BIOGUARD SAFETY" in the subject. Do not paste operational biological
+detail into public GitHub issues.
+
+## Limitations Recap
+
+- Solo-author classifier; expert circulation pending
+- Trained on Claude-generated synthetic data; real-world distribution shift
+  is uncharacterized
+- English-centric; multilingual coverage limited to code-switching augmentation
+- Encoding attacks are a fundamental weakness for any embedding-based classifier;
+  they should be handled by an upstream tokenization-aware filter, not by this
+  classifier alone