fix: Address audit findings — security, CI/CD, OSS readiness

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,27 @@
+---
+name: Bug report
+about: Report a bug or unexpected behavior
+title: ''
+labels: bug
+assignees: ''
+---
+
+## Describe the Bug
+A clear description of what's not working.
+
+## To Reproduce
+Steps to reproduce the behavior:
+1. OpenCode version: [...]
+2. Config setup: [...]
+3. Steps: [...]
+
+## Expected Behavior
+What you expected to happen instead.
+
+## Environment
+- OpenCode version: [...]
+- OS: [...]
+- Node.js version: [...]
+
+## Additional Context
+Add any other context, logs, or screenshots.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,19 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: enhancement
+assignees: ''
+---
+
+## Problem Statement
+What problem would this feature solve? Be specific.
+
+## Proposed Solution
+Describe the feature and how it would work.
+
+## Alternative Approaches
+What alternatives have you considered?
+
+## Would You Be Willing to Implement?
+Yes / No / Maybe (with guidance)

.github/workflows/ci.yml

@@ -0,0 +1,93 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  node_version: "20"
+
+jobs:
+  lint:
+    name: Lint & Validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use Node.js ${{ env.node_version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.node_version }}
+      - name: Install dependencies
+        run: |
+          if [ -f yarn.lock ]; then
+            yarn install --frozen-lockfile
+          elif [ -f package.json ]; then
+            yarn install
+          fi
+      - name: TypeScript check (plugins)
+        run: |
+          if command -v npx &> /dev/null; then
+            cd plugin && npx tsc --noEmit 2>/dev/null && cd .. || echo "⚠️ tsc check skipped (no tsconfig or errors expected for JS plugins)"
+          fi
+      - name: Validate agent frontmatter
+        run: |
+          error=0
+          for f in agents/*.md agent/*.md; do
+            if ! head -1 "$f" | grep -q "^---$"; then
+              echo "❌ Missing frontmatter in $f"
+              error=1
+            fi
+          done
+          for f in skills/*/SKILL.md; do
+            if ! head -1 "$f" | grep -q "^---$"; then
+              echo "❌ Missing frontmatter in $f"
+              error=1
+            fi
+          done
+          [ "$error" -eq 0 ] || exit 1
+          echo "✅ All agent/skill files have frontmatter"
+      - name: README skill list sync check
+        run: |
+          error=0
+          for skill_dir in skills/*/; do
+            skill_name=$(basename "$skill_dir")
+            if ! grep -q "| \`$skill_name\`" README.md; then
+              echo "⚠️ Skill '$skill_name' not found in README table"
+              error=1
+            fi
+          done
+          [ "$error" -eq 0 ] && echo "✅ All skills listed in README" || echo "Run: Verify README skill table matches skills/ directory"
+      - name: Sensitive data scan
+        run: |
+          error=0
+          # Check for potential secrets
+          if grep -rn 'sk-[A-Za-z0-9]\{20,\}' --include='*.{md,ts,sh,jsonc}' --exclude-dir=node_modules . 2>/dev/null; then
+            echo "❌ Possible OpenAI API key detected"
+            error=1
+          fi
+          if grep -rn 'ghp_[A-Za-z0-9]\{36,\}' --include='*.{md,ts,sh,jsonc}' --exclude-dir=node_modules . 2>/dev/null; then
+            echo "❌ Possible GitHub token detected"
+            error=1
+          fi
+          if grep -rn 'AKIA[0-9A-Z]\{16\}' --include='*.{md,ts,sh,jsonc}' --exclude-dir=node_modules . 2>/dev/null; then
+            echo "❌ Possible AWS key detected"
+            error=1
+          fi
+          if grep -rn '/home/[^/]*/' --include='*.{md,jsonc,yaml,yml}' --exclude-dir=node_modules . 2>/dev/null | grep -v '.bak.'; then
+            echo "❌ Possible personal path detected"
+            error=1
+          fi
+          [ "$error" -eq 0 ] && echo "✅ No sensitive data found" || exit 1
+
+  shellcheck:
+    name: ShellCheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master
+        with:
+          scandir: './scripts'
+          severity: warning

CODE_OF_CONDUCT.md

@@ -0,0 +1,53 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes
+* Focusing on what is best for the overall community
+
+Examples of unacceptable behavior:
+
+* The use of sexualized language or imagery, and sexual attention or advances
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement Responsibilities
+
+Project maintainers are responsible for clarifying and enforcing our standards.
+
+## Scope
+
+This Code of Conduct applies within all community spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the project maintainer. All complaints will be reviewed and
+investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+
+[homepage]: https://www.contributor-covenant.org

README.md

@@ -45,14 +45,15 @@ This repo does **not** install OpenCode. It assumes you already have it.
 | `reviewer` | Code review against quality standards |
 | `scribe` | Documentation, changelogs, and human-facing prose |
 
-### Skills (23 Total)
+### Skills (21 Total)
 
 Production-ready workflows that agents invoke for structured decision-making and execution:
 
 | Skill | Purpose |
 |-------|---------|
 | `architecture-principles` | System architecture principles and technology selection criteria |
 | `architecture-lifecycle` | RFCs and ADRs for systematic architecture decisions |
+| `chezmoi-expert` | Expert chezmoi dotfiles management with templates and secrets |
 | `bug-lifecycle` | Triage, fix, and verify bugs through a structured process |
 | `code-philosophy` | The 5 Laws of Elegant Defense — backend code quality standards |
 | `code-review` | Comprehensive review methodology with severity classification |
@@ -64,6 +65,7 @@ Production-ready workflows that agents invoke for structured decision-making and
 | `feature-lifecycle` | Structured process for implementing new features |
 | `frontend-philosophy` | The 5 Pillars of Intentional UI — frontend quality standards |
 | `incident-lifecycle` | Production incident response with minimal impact |
+| `org-audit` | Record organization routing effectiveness and agent selection accuracy |
 | `org-governance` | Shared governance, separation of duties, and interaction patterns |
 | `org-routing` | Agent routing — when to consult each organization role |
 | `plan-protocol` | Guidelines for creating and managing implementation plans |

SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+This repository provides OpenCode configuration guardrails. If you discover a security vulnerability:
+
+1. **Do NOT** open a public GitHub issue
+2. Send details to the maintainer via a private channel
+3. Include steps to reproduce and potential impact
+
+## What We Consider a Vulnerability
+
+- Hardcoded secrets, tokens, or credentials in configuration files
+- Scripts that handle sensitive data unsafely (e.g., API keys visible in terminal)
+- Agent permission models that allow privilege escalation
+- Supply chain risks in dependencies
+- Any mechanism that could leak secrets from debug logs or error messages
+
+## Expectations
+
+- You will receive an acknowledgment within 48 hours
+- We will investigate and provide a timeline for a fix
+- We will coordinate disclosure once a fix is released
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| latest  | ✅ Active development |
+
+## Security Best Practices for This Config
+
+- API keys are stored in `~/.config/agentmemory/.env` with `chmod 600`
+- Agents follow least-privilege permissions
+- Sensitive data is sanitized before writing to debug logs
+- Always review diffs before committing (see PR template)

opencode.jsonc

@@ -104,7 +104,17 @@
         "edit": "allow",
         "glob": "allow",
         "grep": "allow",
-        "bash": "allow",
+        "bash": {
+          "*": "allow",
+          "rm -rf *": "deny",
+          "sudo *": "deny",
+          "git push --force*": "deny",
+          "git push -f*": "deny",
+          "curl * | sh*": "deny",
+          "curl * | bash*": "deny",
+          "wget * -O- * | sh*": "deny",
+          "wget * -qO- * | sh*": "deny"
+        },
         "plan_read": "deny",
         "todoread": "deny"
       }