Phase 1: public repository foundation (toolchains, schemas, sanitizer, CI, release, governance) (#4)

* build: scaffold public foundation toolchains

Pinned Go 1.26.5 (with actionlint/govulncheck/staticcheck/shfmt tool
directives) and an npm workspace (Node 24.18.0/npm 12.0.1) with the single
'worker' member. Adds the buildinfo Go seam and the heartbeat protocol-version
worker seam, both test-covered, plus editor/git/lint config and registered
image/deploy placeholders (network broker split into parser and dialer per the
reviewed architecture). No operational runtime.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* config: define synthetic public contracts

Draft 2020-12 closed schemas + synthetic examples for fleet, host-profile,
public-log-event, and notification-event, with an Ajv2020 strict/all-errors
validator (validateFile) and TDD coverage (4 positive + 11 negative cases).
The fleet schema requires all eight enumerated blocked-egress classes,
per-repository concurrency maxima and archive-eligibility state, secret-reference
names only, and the fixed evaluation/stale/unhealthy gates. Examples use
synthetic values only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* security: enforce public-source sanitization

Fail-closed public-source scanner (Python stdlib only) blocking deployment
identifiers, secrets, non-synthetic IPs/domains/paths, and PII from the public
repo, built against an adversarial-reviewed spec (Gemini+Grok, 2 rounds, 19
bypass classes). Covers public + special-use IPs via mathematical subnet
membership on a shared normalizer, a vendor token/key table, RFC-3986 URI
authority parsing, a bounded multi-alphabet decode-and-recheck (base64/base32/
base64url/hex, embedded content re-scanned with the full rule set), archive
recursion by magic bytes, git history+metadata, LFS/submodule policy, a closed
canonical-exception table, and an exact-content-hash allowlist (no path-exclude).
Free-text PII is a documented residual requiring the local --private-denylist
pre-publish scan. 117 tests; gitleaks defaults included.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* community: add public governance baseline

SECURITY (GitHub private vulnerability reporting only), CONTRIBUTING (TDD,
synthetic fixtures, signed commits, full-SHA action pins, hosted CI), Code of
Conduct, changelog, third-party-notices placeholder, CODEOWNERS (* @sumitake),
PR public-safety checklist, and structured issue forms — plus a stdlib metadata
checker and tests. All public-safe and sanitizer-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: add public architecture, trust, operations, and README

Public-safe summaries of the reviewed design: architecture overview + trust
boundaries, five operations runbooks (lifecycle, deployment/rollback, failover/
notifications, workflow migration, operations), and a pre-deployment README with
a generic diagram. Deterministic link/anchor + operator-command checkers and
docs-contract tests enforce heading order and reject unqualified live/verified
claims. Synthetic values only; sanitizer-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci: add stable hosted checks

Five stable hosted CI contexts (go, worker, shell, repository-metadata,
container) on ubuntu-24.04 with least-privilege permissions, timeouts,
concurrency cancellation, persist-credentials:false, and full-SHA-pinned
actions; a fail-closed workflow-policy checker (stdlib, restricted YAML parser)
enforcing the pin table and trigger/runner/permission rules; and a
manifest-driven image check (empty phase-1 manifest passes). Also enables the
checks repo-wide: adds tests/**/__init__.py so unittest discovery finds all
suites, and a .prettierignore + formatting pass so format:check is clean
(design docs stay markdownlint-managed). 247 Python tests + 16 bats green;
actionlint and the policy checker report exactly the five unique contexts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* security: add hosted analysis and dependency automation

Sanitization (Gitleaks over branch range on PRs, full history on push/schedule,
plus sanitize_public.py --tracked always and --history on the release-gate
events), CodeQL (go + javascript-typescript, GitHub-hosted, security-events),
and PR dependency-review (fail on high severity + copyleft denylist) workflows,
and Dependabot for actions/gomod/npm + docker across all six image dirs, no
Renovate. Also fixes a latent policy-checker bug: subpath actions (e.g.
github/codeql-action/init) are now pinned by their owning repo's reviewed SHA.
Seven unique stable contexts; 252 tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ops: codify secure repository settings

Non-executed bootstrap tooling: configure.sh --check (read-only) /
--apply-foundation / --apply-ruleset, using GitHub REST API 2026-03-10 with
read-back on every mutation. Foundation mode sets read-only workflow token, a
narrow selected-actions allowlist, merge/security settings; ruleset mode first
proves all seven contexts succeeded on the exact PR head SHA, then creates an
active main ruleset (PRs, resolved conversations, linear history, signed
commits, no deletion/force-push, six required checks) with a sole-maintainer
zero-approval mode. 21 bats tests via a stub gh — no real API mutation — plus
the two-stage runbook.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* release: add SBOM and provenance pipeline

Deterministic source packager (git archive + commit-derived SOURCE_DATE_EPOCH +
gzip -n, clean-tree + version + manifest + symlink-escape gates) producing one
byte-identical tarball; a manifest restricting release subjects to the source
archive; and a tag-triggered release workflow running the full seven-check
suite, Trivy source/dist scans, archive-member sanitization, an Anchore SPDX
SBOM, a third-party license inventory, SHA-256 checksums, pinned actions/attest
provenance, and an immutable release upload (contents/id-token/attestations
write only). Adds the release job id to the workflow-context test. 14 bats
tests; reproducible-build verified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test: close foundation verification gaps

Full-matrix gate correction: prettier-format the repository-bootstrap runbook so
format:check is clean across the tree. All seven stable contexts, the go/worker/
shell/repository-metadata/container/sanitization/dependency-review suites, the
reproducible source package (byte-identical), Trivy HIGH/CRITICAL, signed-commit,
and sanitizer gates pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: sumitake

.dockerignore

@@ -0,0 +1,13 @@
+.git/
+node_modules/
+dist/
+coverage/
+.wrangler/
+.env
+.env.*
+*.pem
+*.key
+private-overlay/
+*.local.*
+state/
+.DS_Store

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[*.go]
+indent_style = tab
+
+[Makefile]
+indent_style = tab

.gitattributes

@@ -0,0 +1,5 @@
+* text=auto eol=lf
+*.go text eol=lf
+*.sh text eol=lf
+*.png binary
+*.gz binary

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @sumitake

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,86 @@
+name: Bug report
+description: Report unexpected or incorrect behavior in Portable GHAR.
+title: "[bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug report.
+
+        **Do not paste real logs, real configuration, real runtime state,
+        hostnames, IP addresses, tokens, or any other deployment-specific
+        detail into this form.** This repository and every issue on it are
+        public. Use the synthetic placeholders described in
+        [CONTRIBUTING.md](../../CONTRIBUTING.md) instead (for example
+        `owner/repository`, `example-fleet`, `operator@example.invalid`).
+        If you are reporting a security vulnerability instead of a bug,
+        stop here and use
+        [private vulnerability reporting](../../SECURITY.md) instead of
+        this form.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: >-
+        Describe the bug using synthetic examples only. Do not paste real
+        logs, configuration, or runtime state.
+      placeholder: >-
+        Use sanitized, synthetic examples (e.g. owner/repository,
+        example-fleet, operator@example.invalid).
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+      description: A synthetic description of the expected behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: >-
+        Minimal reproduction steps using synthetic fixtures, config, or
+        commands only -- never a real deployment's logs, config, or state.
+      placeholder: |
+        1. ...
+        2. ...
+        3. ...
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version / commit
+      description: The tagged version or commit SHA you observed this on.
+      placeholder: e.g. v0.1.0 or a full commit SHA
+    validations:
+      required: false
+  - type: dropdown
+    id: component
+    attributes:
+      label: Affected component
+      options:
+        - Build / toolchain
+        - Config schemas
+        - Sanitization tooling
+        - CI / workflows
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: checkboxes
+    id: acknowledgements
+    attributes:
+      label: Acknowledgements
+      options:
+        - label: >-
+            I confirm this report contains no real logs, configuration,
+            runtime state, secrets, or deployment identifiers -- synthetic
+            examples only.
+          required: true
+        - label: This is not a security vulnerability report.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,7 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/sumitake/portable-ghar/security/advisories/new
+    about: >-
+      Please do not open a public issue for security vulnerabilities. Use
+      GitHub private vulnerability reporting instead -- see SECURITY.md.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,66 @@
+name: Feature request
+description: Suggest an idea or enhancement for Portable GHAR.
+title: "[feature]: "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for suggesting an improvement.
+
+        **Do not paste real logs, real configuration, real runtime state,
+        hostnames, IP addresses, tokens, or any other deployment-specific
+        detail into this form.** This repository and every issue on it are
+        public. Use the synthetic placeholders described in
+        [CONTRIBUTING.md](../../CONTRIBUTING.md) instead (for example
+        `owner/repository`, `example-fleet`, `operator@example.invalid`).
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: >-
+        Describe the problem or gap using synthetic examples only. Do not
+        paste real logs, configuration, or runtime state.
+      placeholder: >-
+        Use sanitized, synthetic examples (e.g. owner/repository,
+        example-fleet, operator@example.invalid).
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What would you like to see happen?
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Any alternative approaches you considered and why you didn't pick them.
+    validations:
+      required: false
+  - type: dropdown
+    id: component
+    attributes:
+      label: Affected component
+      options:
+        - Build / toolchain
+        - Config schemas
+        - Sanitization tooling
+        - CI / workflows
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: checkboxes
+    id: acknowledgements
+    attributes:
+      label: Acknowledgements
+      options:
+        - label: >-
+            I confirm this request contains no real logs, configuration,
+            runtime state, secrets, or deployment identifiers -- synthetic
+            examples only.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,34 @@
+## Summary
+
+<!-- What does this change do, and why? -->
+
+## Test plan
+
+<!-- How did you verify this? List the exact commands you ran. -->
+
+- [ ] `python3 -m unittest discover -s tests -p 'test_*.py'` passes
+- [ ] Relevant new tests were written FIRST and observed to fail (TDD)
+
+## PUBLIC-SAFETY checklist
+
+This repository is public. Please confirm every item below before
+requesting review -- a reviewer cannot always tell from a diff alone
+whether a value is real or synthetic.
+
+- [ ] This PR contains **no deployment identifiers** (account IDs, zone
+      IDs, tunnel IDs, installation/client/app IDs, or any other
+      environment-specific identifier).
+- [ ] This PR contains **no secrets** (tokens, keys, credentials,
+      passwords, or anything secret-shaped), real or expired.
+- [ ] This PR contains **no real logs, real configuration, or real
+      runtime state** -- only synthetic examples (see CONTRIBUTING.md for
+      the placeholder conventions, e.g. `owner/repository`,
+      `example-fleet`, `operator@example.invalid`).
+- [ ] I ran `python3 scripts/sanitize_public.py --tracked` locally and it
+      reported `sanitization passed`.
+- [ ] I ran `python3 scripts/check_repository_metadata.py` locally (if
+      this PR touches governance/repository metadata) and it exited 0.
+
+## Additional context
+
+<!-- Anything else a reviewer should know. -->

.github/dependabot.yml

@@ -0,0 +1,100 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      actions-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      gomod-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      npm-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "docker"
+    directory: "/images/runner"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      docker-runner-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "docker"
+    directory: "/images/network-adapter"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      docker-network-adapter-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "docker"
+    directory: "/images/network-broker-parser"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      docker-network-broker-parser-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "docker"
+    directory: "/images/network-broker-dialer"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      docker-network-broker-dialer-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "docker"
+    directory: "/images/network-helper"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      docker-network-helper-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "docker"
+    directory: "/images/network-verifier"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      docker-network-verifier-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"