[OSS POLISH] Bring workspacejson/standard to the public repository polish standard

.editorconfig

@@ -0,0 +1,27 @@
+# https://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[*.md]
+# Two trailing spaces are a hard line break in Markdown. Trimming them silently
+# reflows prose, so it is disabled here rather than everywhere.
+trim_trailing_whitespace = false
+
+[*.{json,jsonc}]
+indent_size = 2
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[Makefile]
+indent_style = tab
+
+[LICENSE]
+insert_final_newline = false

.gitattributes

@@ -0,0 +1,32 @@
+# Normalize line endings in the repository, check out native on the working tree.
+# Without this, a CRLF checkout changes the bytes of the canonical schema and the
+# SHA-256 that downstream repositories pin against it.
+* text=auto eol=lf
+
+# The normative schema and the shipped examples are byte-significant. Never let a
+# platform, filter or merge driver rewrite them.
+packages/spec/schema/v1.json   text eol=lf
+packages/spec/examples/*.json  text eol=lf
+
+# Generated or vendored — exclude from language statistics and collapse in diffs.
+pnpm-lock.yaml                 linguist-generated=true -diff
+migration/parity-*.txt         linguist-generated=true
+migration/commit-map.txt       linguist-generated=true
+migration/architecture-red-tests.txt linguist-generated=true
+
+# Documentation should count as documentation, not as code.
+*.md                           linguist-documentation=true
+
+# Binary assets.
+*.png                          binary
+*.jpg                          binary
+*.svg                          text eol=lf
+
+# Keep the packed tarball free of repository-only material. `files` in each
+# package manifest is the primary control; this is defense in depth for anything
+# consuming the repository as an archive.
+/.github/                      export-ignore
+/migration/                    export-ignore
+/docs/                         export-ignore
+/.editorconfig                 export-ignore
+/.gitattributes                export-ignore

.github/CODEOWNERS

@@ -0,0 +1,29 @@
+# Code owners for workspacejson/standard.
+#
+# GitHub requests review from the owners of every path a pull request touches.
+# This file mirrors MAINTAINERS.md; keep the two in step.
+#
+# Paths are listed most-general first — later patterns win.
+
+*                               @qmarcelle
+
+# The normative surface. Changes here alter the contract for every consumer and
+# require an architecture decision record before implementation. See GOVERNANCE.md.
+/packages/spec/schema/          @qmarcelle
+/packages/spec/src/types.ts     @qmarcelle
+/packages/spec/src/schema.ts    @qmarcelle
+/docs/adr/                      @qmarcelle
+
+# Boundary and publication guards. A change here can silently disable the checks
+# that keep this repository incapable of publishing and free of cross-repository
+# dependencies.
+/scripts/                       @qmarcelle
+/.github/workflows/             @qmarcelle
+/.github/RELEASE-AUTHORITY.md   @qmarcelle
+
+# Governance and ownership statements.
+/GOVERNANCE.md                  @qmarcelle
+/MAINTAINERS.md                 @qmarcelle
+/OWNERSHIP.md                   @qmarcelle
+/SECURITY.md                    @qmarcelle
+/.github/CODEOWNERS             @qmarcelle

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,7 +1,44 @@
 name: Bug report
-description: Report a problem with agents-audit or the supporting packages
+description: Report a problem with the schema, types, validation semantics or rule engine
 labels: [bug]
 body:
+  - type: markdown
+    attributes:
+      value: |
+        This repository owns the **specification** and its deterministic reference
+        behavior. If `.agents/workspace.json` is not being generated or is generated
+        wrongly, that is `workspacejson/cli`. If an MCP or editor integration
+        misbehaves, that is `workspacejson/integrations`. See
+        [SUPPORT.md](https://github.com/workspacejson/standard/blob/main/SUPPORT.md).
+
+        For a security vulnerability, stop and follow
+        [SECURITY.md](https://github.com/workspacejson/standard/blob/main/SECURITY.md)
+        instead of filing here.
+  - type: dropdown
+    id: area
+    attributes:
+      label: Affected surface
+      description: Which part of this repository is wrong?
+      options:
+        - "@workspacejson/spec — JSON Schema"
+        - "@workspacejson/spec — TypeScript types"
+        - "@workspacejson/spec — validation API or workspacejson-spec binary"
+        - "@workspacejson/rules — AGENTS.md parser"
+        - "@workspacejson/rules — repository scanner"
+        - "@workspacejson/rules — rule engine"
+        - "@workspacejson/rules — workspace.json validator"
+        - Documentation in this repository
+        - Not sure
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Package and Node versions
+      description: Output of `npm ls @workspacejson/spec @workspacejson/rules` and `node --version`.
+      placeholder: "@workspacejson/spec 0.4.4, @workspacejson/rules 0.4.4, node v20.11.0"
+    validations:
+      required: true
   - type: textarea
     id: summary
     attributes:
@@ -14,21 +51,32 @@ body:
     id: steps
     attributes:
       label: Steps to reproduce
-      description: Include the minimum steps required to reproduce the issue.
-      placeholder: 1. ...
+      description: >
+        The minimum steps required. Include the smallest workspace.json document
+        that reproduces the problem, and the exact command you ran.
+      render: shell
     validations:
       required: true
   - type: textarea
     id: expected
     attributes:
       label: Expected behavior
-      description: What should have happened instead?
+      description: What should have happened instead, and what makes you say so — schema text, a documented guarantee, a stable read path?
     validations:
       required: true
   - type: textarea
     id: actual
     attributes:
       label: Actual behavior
-      description: What happened in practice?
+      description: What happened in practice. Paste the complete output rather than summarizing it.
+      render: shell
     validations:
       required: true
+  - type: checkboxes
+    id: contract
+    attributes:
+      label: Contract impact
+      description: Check any that apply. These change how the report is triaged.
+      options:
+        - label: This affects one of the four stable read paths (`manual.fragileFiles`, `manual.coChangePatterns`, `generated.fileIndex`, `generated.frameworkManifest`)
+        - label: This affects a published package, not only local development

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,17 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/workspacejson/standard/security/advisories/new
+    about: Report privately through a GitHub security advisory. Do not open a public issue.
+  - name: Artifact generation — .agents/workspace.json missing or wrong
+    url: https://github.com/workspacejson/cli/issues
+    about: This repository defines the format. Producing the file belongs to workspacejson/cli.
+  - name: MCP, Codex or editor integration
+    url: https://github.com/workspacejson/integrations/issues
+    about: Host adapters live in workspacejson/integrations.
+  - name: Documentation on workspacejson.dev
+    url: https://github.com/workspacejson/site/issues
+    about: The published website is assembled in workspacejson/site.
+  - name: Questions and support
+    url: https://github.com/workspacejson/standard/blob/main/SUPPORT.md
+    about: Where to ask, what to include, and what response to expect.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,23 +1,60 @@
 name: Feature request
-description: Suggest an improvement for agents-audit or its packages
+description: Propose a change to the specification, schema or reference behavior
 labels: [enhancement]
 body:
+  - type: markdown
+    attributes:
+      value: |
+        Two properties of this standard are load-bearing and are enforced in CI:
+
+        - **Descriptive, never prescriptive.** `workspace.json` reports what a
+          repository *is*. It does not encode what a team *must do*.
+        - **Daemon-free.** The committed file must remain useful with nothing running.
+
+        Proposals that change either property, the bytes of the normative schema,
+        or the four stable read paths require an architecture decision record
+        before implementation — see
+        [GOVERNANCE.md](https://github.com/workspacejson/standard/blob/main/GOVERNANCE.md).
   - type: textarea
     id: problem
     attributes:
       label: Problem statement
-      description: What problem are you trying to solve?
+      description: What problem are you trying to solve? Describe the situation, not the solution.
     validations:
       required: true
   - type: textarea
     id: proposal
     attributes:
-      label: Proposed solution
-      description: What should the repo or package do differently?
+      label: Proposed change
+      description: What should the specification or reference behavior do differently?
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Does this change the normative surface?
+      description: >
+        The normative surface is the schema bytes, the four stable read paths, and
+        the public exports of either package.
+      options:
+        - "No — additive or internal only"
+        - "Yes — schema bytes change"
+        - "Yes — a stable read path changes"
+        - "Yes — a public export changes"
+        - Not sure
+    validations:
+      required: true
+  - type: textarea
+    id: consumers
+    attributes:
+      label: Consumer impact
+      description: >
+        Who reads this data today, and what breaks if the change lands? If you know
+        of no existing consumer, say so — that is useful information.
     validations:
       required: true
   - type: textarea
     id: context
     attributes:
       label: Additional context
-      description: Add links, examples, or screenshots if helpful.
+      description: Links, prior art, an example document, or the alternatives you rejected.

.github/RELEASE-AUTHORITY.md

@@ -4,7 +4,7 @@
 
 `@workspacejson/spec` and `@workspacejson/rules` are still published from
 `workspace-json/agents-audit`, which holds the `NPM_TOKEN` secret. Transferring
-that authority is **META-243**, and it has not happened.
+that authority is a separate, coordinated change, and it has not happened.
 
 ## Why absence rather than a disabled workflow
 
@@ -28,7 +28,7 @@ the current state. There is nothing to accidentally enable.
    `scripts/check-architecture.test.mjs` prove those guards reject deliberate
    violations.
 
-## What META-243 must do
+## What the authority transfer must do
 
 When publication authority transfers, in a single coordinated change:
 

.github/dependabot.yml

@@ -0,0 +1,51 @@
+version: 2
+
+updates:
+  # Both packages live in one pnpm workspace, so a single npm entry at the root
+  # covers the whole dependency tree. Per-package entries would open duplicate
+  # pull requests for the same shared dependency.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      # Type definitions and build tooling churn constantly and carry no runtime
+      # risk. Grouping them keeps the review queue readable.
+      dev-tooling:
+        dependency-type: development
+        patterns:
+          - "@types/*"
+          - typescript
+          - tsup
+          - vitest
+          - "@changesets/*"
+    ignore:
+      # ajv is a runtime dependency of the validator. A major bump changes
+      # validation behavior, which is a change to the normative contract, not a
+      # dependency update — it needs an architecture decision record first.
+      # See GOVERNANCE.md.
+      - dependency-name: ajv
+        update-types: [version-update:semver-major]
+      # The packages declare `node >=20` and CI runs 20 and 22. A @types/node
+      # major that assumes a newer runtime would typecheck against a Node the
+      # packages do not claim to support.
+      - dependency-name: "@types/node"
+        update-types: [version-update:semver-major]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+    commit-message:
+      prefix: ci

.github/workflows/ci.yml

@@ -6,19 +6,33 @@ on:
   pull_request:
     branches: [main]
 
+# Least privilege by default. This workflow only reads the repository — it does
+# not comment, label, publish or write any artifact. Any job needing more must
+# raise it at the job level with a reason, not here.
+permissions:
+  contents: read
+
+# A superseded push to the same branch has nothing left to prove. `main` is
+# excluded from cancellation so the record of what landed stays complete.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         node-version: [20, 22]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: pnpm
@@ -33,11 +47,19 @@ jobs:
       - name: Architecture guard red tests
         run: pnpm run check:architecture:test
 
+      # Documentation decays silently. This proves every relative link still
+      # resolves, that no internal tracker identifier reached public prose, and
+      # that every documented `pnpm run` command actually exists. External links
+      # are syntax-checked only — fetching them in CI fails on someone else's
+      # outage and trains everyone to ignore red.
+      - name: Documentation integrity
+        run: pnpm run check:docs
+
       # Build precedes typecheck deliberately. @workspacejson/rules typechecks
       # against @workspacejson/spec's EMITTED declarations, which `tsc --noEmit`
       # never produces. In the source monorepo this ordering was hidden by a
       # hand-written ambient `declare module '@workspacejson/spec'`; removing
-      # that stub (META-239 Phase 3) made the real dependency visible.
+      # that stub during the extraction made the real dependency visible.
       - name: Build all packages
         run: pnpm -r build
 
@@ -52,7 +74,7 @@ jobs:
 
       # Standard owns the normative schema. These two gates prove the package
       # ships the canonical bytes and that every shipped example validates
-      # against them. See META-211.
+      # against them.
       - name: Verify schema provenance
         run: pnpm run check:schema