docs(repo-hygiene): add contributor baseline

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,84 @@
+name: Bug report
+description: Report incorrect CodexBar behavior with safe, reproducible evidence.
+labels: [bug, needs-triage]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not paste API keys, cookies, Authorization headers, browser databases, Keychain exports, account files, or
+        unredacted logs. Security issues belong in a private vulnerability report.
+  - type: input
+    id: version
+    attributes:
+      label: CodexBar version
+      placeholder: e.g. 0.45.3
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Operating system and architecture
+      placeholder: e.g. macOS 15.5 (arm64) or Ubuntu 24.04 (x86_64)
+    validations:
+      required: true
+  - type: dropdown
+    id: install
+    attributes:
+      label: Installation method
+      options:
+        - GitHub release
+        - Homebrew
+        - Built from source
+        - CLI tarball
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: provider
+    attributes:
+      label: Provider
+      description: Use `None` if this is not provider-specific.
+  - type: dropdown
+    id: source_mode
+    attributes:
+      label: Source mode
+      options:
+        - Not applicable
+        - Automatic
+        - CLI
+        - OAuth or device flow
+        - Browser cookies or local storage
+        - API key
+        - Local file or database
+        - Manual cookie header
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1.
+        2.
+        3.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Redacted evidence
+      description: Screenshots, exact error text, or safe diagnostics. Remove credentials and personal data first.
+  - type: input
+    id: last_working
+    attributes:
+      label: Last working version or date

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/steipete/CodexBar/security/advisories/new
+    about: Report vulnerabilities privately. Do not include secrets in a public issue.
+  - name: Contribution guide
+    url: https://github.com/steipete/CodexBar/blob/main/CONTRIBUTING.md
+    about: Read contribution, validation, and privacy expectations before opening a pull request.

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -0,0 +1,33 @@
+name: Feature request
+description: Propose a product or UX improvement before implementation.
+labels: [enhancement, needs-design]
+body:
+  - type: checkboxes
+    id: searched
+    attributes:
+      label: Existing work
+      options:
+        - label: I searched open issues and documentation for an existing request or supported workflow.
+          required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem to solve
+      description: Describe the user problem, not only a preferred implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+    validations:
+      required: true
+  - type: checkboxes
+    id: impact
+    attributes:
+      label: Potential impact
+      options:
+        - label: This may affect provider authentication, privacy, stored data, refresh cadence, or permissions.
+          required: false
+        - label: This changes visible UI or menu behavior.
+          required: false

.github/ISSUE_TEMPLATE/provider-request.yml

@@ -0,0 +1,45 @@
+name: Provider request
+description: Propose a provider or source-mode integration with enough evidence for review.
+labels: [enhancement, "area:providers", needs-design]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not include live credentials, cookies, browser exports, or private account data. New providers require
+        maintainer sign-off before implementation.
+  - type: input
+    id: provider
+    attributes:
+      label: Provider and official URL
+    validations:
+      required: true
+  - type: textarea
+    id: use_case
+    attributes:
+      label: Usage or quota data to show
+      description: Describe windows, credits, spend, reset times, or status data users need.
+    validations:
+      required: true
+  - type: textarea
+    id: auth
+    attributes:
+      label: Supported authentication and data source
+      description: CLI, documented API, OAuth, browser cookie, local file, or another source. Link official docs.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Public evidence and redacted sample
+      description: Include official documentation and only redacted response examples.
+    validations:
+      required: true
+  - type: checkboxes
+    id: boundary
+    attributes:
+      label: Integration boundary
+      options:
+        - label: This may require a new host API, broad file access, Keychain access, browser import, or bespoke UI.
+          required: false
+        - label: I understand that unclear operator, authorization, or privacy boundaries can block integration.
+          required: true

.github/ISSUE_TEMPLATE/question.yml

@@ -0,0 +1,26 @@
+name: Question or support request
+description: Ask for setup or usage help after checking documentation.
+labels: [question, needs-triage]
+body:
+  - type: input
+    id: version
+    attributes:
+      label: CodexBar version
+  - type: input
+    id: environment
+    attributes:
+      label: Operating system and architecture
+  - type: input
+    id: provider
+    attributes:
+      label: Provider and source mode, if relevant
+  - type: textarea
+    id: question
+    attributes:
+      label: Question
+      description: Include what you tried and the relevant documentation page.
+    validations:
+      required: true
+  - type: markdown
+    attributes:
+      value: Do not include API keys, cookies, Authorization headers, account files, or personal data.

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+    groups:
+      github-actions:
+        patterns: ['*']

.github/pull_request_template.md

@@ -0,0 +1,40 @@
+## Summary
+
+<!-- Briefly state the user-visible or maintainer-visible change. -->
+
+## Why
+
+<!-- Explain the problem and why this is the right scope. -->
+
+## Linked issue or maintainer sign-off
+
+<!--
+Use `Fixes #123`, `Closes #123`, or `Resolves #123` when this PR completely
+addresses an issue. This creates GitHub's closing link and closes the issue on
+merge to the default branch.
+
+Use `Refs #123` only for related context that does not fully resolve the issue.
+If no issue applies, write `No linked issue: <reason>` or describe the requested
+maintainer sign-off.
+-->
+
+## Validation
+
+<!-- List commands, focused tests, and redacted reproduction evidence. -->
+
+## UI proof
+
+<!-- For visible UI changes, include before/after proof from a freshly built bundle. Otherwise say `Not applicable`. -->
+
+## Provider and privacy impact
+
+<!-- State `None` or describe providers, source modes, Keychain/cookie/local-data access, and redaction handling. -->
+
+## Checklist
+
+- [ ] This PR is focused and contains no unrelated changes.
+- [ ] I ran `make check` and the relevant focused tests.
+- [ ] I ran `make test`, or explained why it was not practical.
+- [ ] UI changes include visual proof; logic changes include reproducible evidence.
+- [ ] I did not include credentials, cookies, Authorization headers, account files, or unredacted personal data.
+- [ ] Provider data remains siloed and this change does not create an unbounded network, PTY, or UI wait.

.github/workflows/ci.yml

@@ -10,6 +10,9 @@ concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   SWIFT_VERSION: 6.3.3
   SWIFTLY_VERSION: 1.1.3
@@ -173,14 +176,15 @@ jobs:
             printf '| Runs lint-macos | `%s` |\n' "$RUNS_LINT_MACOS"
           } >> "$GITHUB_STEP_SUMMARY"
 
-  lint-build-test:
+  required:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     needs:
       - changes
       - lint
       - swift-test-macos
       - build-linux-musl-cli
+      - build-linux-cli
     if: ${{ always() && !cancelled() }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -194,7 +198,8 @@ jobs:
             "${{ needs.swift-test-macos.result }}" \
             "${{ needs.changes.outputs.macos-tests-deferred }}" \
             "${{ needs.changes.outputs.linux-musl-build }}" \
-            "${{ needs.build-linux-musl-cli.result }}"
+            "${{ needs.build-linux-musl-cli.result }}" \
+            "${{ needs.build-linux-cli.result }}"
 
       - name: Summarize aggregate CI gate
         if: ${{ always() }}
@@ -209,14 +214,15 @@ jobs:
           LINUX_MUSL_BUILD: ${{ needs.changes.outputs.linux-musl-build }}
           LINUX_MUSL_BUILD_REASON: ${{ needs.changes.outputs.linux-musl-build-reason }}
           LINUX_MUSL_RESULT: ${{ needs.build-linux-musl-cli.result }}
+          LINUX_CLI_RESULT: ${{ needs.build-linux-cli.result }}
         run: |
           set -euo pipefail
           reason="${MACOS_TESTS_REASON:-<unset>}"
           reason="${reason//|/\\|}"
           musl_reason="${LINUX_MUSL_BUILD_REASON:-<unset>}"
           musl_reason="${musl_reason//|/\\|}"
           {
-            printf '### Aggregate CI gate\n\n'
+            printf '### Required CI gate\n\n'
             printf '| Field | Value |\n'
             printf '| --- | --- |\n'
             printf '| lint result | `%s` |\n' "$LINT_RESULT"
@@ -228,6 +234,7 @@ jobs:
             printf '| Linux musl build required | `%s` |\n' "${LINUX_MUSL_BUILD:-<unset>}"
             printf '| Linux musl gate reason | %s |\n' "$musl_reason"
             printf '| build-linux-musl-cli result | `%s` |\n' "$LINUX_MUSL_RESULT"
+            printf '| build-linux-cli result | `%s` |\n' "$LINUX_CLI_RESULT"
           } >> "$GITHUB_STEP_SUMMARY"
 
   build-linux-musl-cli:

.github/workflows/pr-policy.yml

@@ -0,0 +1,77 @@
+name: PR policy
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened, ready_for_review]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  pr-policy:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Check title and contribution template
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const pull = context.payload.pull_request
+            const issues = []
+            if (pull.user.login === "dependabot[bot]") {
+              core.info("Skipping the human contribution policy for Dependabot.")
+            } else {
+              const conventionalTitle = /^(build|ci|chore|docs|feat|fix|perf|refactor|revert|style|test)(\([a-z0-9][a-z0-9-]*\))?:\s+\S.*$/
+              const imperativeTitle = /^[A-Z][^.!?\n]{2,118}$/
+
+              if (!conventionalTitle.test(pull.title) && !imperativeTitle.test(pull.title)) {
+                issues.push("Use a concise conventional or imperative PR title, such as `fix(provider): correct reset time`.")
+              }
+
+              const body = pull.body || ""
+              const requiredSections = [
+                "Summary",
+                "Why",
+                "Linked issue or maintainer sign-off",
+                "Validation",
+                "UI proof",
+                "Provider and privacy impact",
+                "Checklist",
+              ]
+
+              const sectionContent = section => {
+                const match = body.match(new RegExp(`(?:^|\\n)## ${section}\\r?\\n([\\s\\S]*?)(?=\\r?\\n## |$)`))
+                return match ? match[1].replace(/<!--[\s\S]*?-->/g, "").trim() : ""
+              }
+
+              for (const section of requiredSections) {
+                if (!new RegExp(`^## ${section}$`, "m").test(body)) {
+                  issues.push(`Missing PR template section: ${section}.`)
+                }
+              }
+
+              for (const section of [
+                "Summary",
+                "Why",
+                "Linked issue or maintainer sign-off",
+                "Validation",
+                "UI proof",
+                "Provider and privacy impact",
+              ]) {
+                if (!sectionContent(section)) {
+                  issues.push(`Fill in the ${section} section with concrete information.`)
+                }
+              }
+
+              const linkedIssue = sectionContent("Linked issue or maintainer sign-off")
+              const issueReference = /(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?|refs?)\s*:?\s+(?:[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)?#\d+/i
+              const noIssueExplanation = /(?:no|without)\s+(?:linked\s+)?issue\b/i
+              const maintainerSignOff = /\bmaintainer\s+sign[- ]off\b/i
+              if (linkedIssue && !issueReference.test(linkedIssue) && !noIssueExplanation.test(linkedIssue) && !maintainerSignOff.test(linkedIssue)) {
+                issues.push("Use `Fixes #123`, `Refs #123`, or explain why no linked issue or maintainer sign-off applies.")
+              }
+            }
+
+            if (issues.length > 0) {
+              core.setFailed(`PR policy needs attention:\n- ${issues.join("\n- ")}`)
+            }