chore(public): add CI coverage security and OSS process visibility

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,42 @@
+name: Bug report
+description: Report a reproducible defect with sanitized evidence.
+title: "fix: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not publish secrets, tokens, private keys, personal data, real employee logs or customer evidence. Use demo/anonymized evidence.
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What is broken?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Reproduction steps
+      description: Minimal steps using sanitized data.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Sanitized evidence
+      description: Logs, screenshots or output with secrets and personal data removed.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,42 @@
+name: Feature request
+description: Request a capability without using customer or employee data.
+title: "feat: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not publish secrets, personal data, real employee logs or non-anonymized customer evidence.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user or operator problem should this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Describe the desired behavior conservatively.
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Workforce
+        - Security analytics
+        - Forensics
+        - Registry-readiness
+        - Install/deployment
+        - Documentation
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Demo/anonymized evidence
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/registry_readiness_task.yml

@@ -0,0 +1,29 @@
+name: Registry-readiness task
+description: Track registry-readiness documentation, evidence or process gaps.
+title: "docs(registry): "
+labels: ["registry-readiness", "documentation"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not claim legal completion of registry registration. Do not publish secrets, personal data, real employee logs or private infrastructure credentials.
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope
+      description: What registry-readiness gap is being tracked?
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Required evidence
+      description: List sanitized evidence or documents needed.
+    validations:
+      required: true
+  - type: textarea
+    id: remaining
+    attributes:
+      label: Remaining gaps
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/security_hardening_task.yml

@@ -0,0 +1,30 @@
+name: Security hardening task
+description: Track hardening without exposing sensitive data.
+title: "chore(security): "
+labels: ["security", "hardening"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not publish exploits, secrets, private keys, tokens, personal data, real employee logs or customer evidence.
+  - type: textarea
+    id: hardening
+    attributes:
+      label: Hardening target
+      description: What should be hardened?
+    validations:
+      required: true
+  - type: textarea
+    id: risk
+    attributes:
+      label: Risk addressed
+      description: Explain the risk without sensitive details.
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Validation
+      description: Checks or evidence required.
+    validations:
+      required: true

.github/pull_request_template.md

@@ -1,13 +1,24 @@
 ## Summary
 
-- what changed
-- why it changed
-- risk and rollback notes
+Describe what changed and why.
 
-## Checklist
+## Validation
 
-- [ ] No real secrets or credentials committed
-- [ ] Server-side scripts validated (`bash -n`)
-- [ ] PowerShell scripts validated (`Invoke-ScriptAnalyzer`)
-- [ ] Docs updated (full paths and runbook steps)
-- [ ] Rollback steps documented
+List commands executed. Use `skipped: <reason>` when a check requires a live
+stand or unavailable tool.
+
+## Registry / Public Mirror Scope
+
+- GitHub is public mirror validation only.
+- Primary registry release evidence must be produced on the Russian
+  build-runner.
+- Update `docs/registry/` when registry-readiness behavior or evidence changes.
+
+## Safety
+
+- No secrets, tokens, passwords or private keys.
+- No personal data.
+- No real employee logs.
+- No customer evidence unless anonymized.
+- No unsupported claims about certification, DLP/SIEM replacement or legal
+  registry completion.

.github/workflows/ci.yml

@@ -1,70 +1,114 @@
-name: shell-and-powershell-ci
+name: CI
+
+# GitHub Actions is public mirror validation only.
+# Primary registry release evidence must be produced on Russian build-runner.
 
 on:
   push:
-    branches: [ "main" ]
   pull_request:
-    branches: [ "main" ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
-  shell-check:
+  rust-checks:
+    name: Rust checks
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: adk-rust
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          lfs: false
 
-      - name: Install shellcheck
-        run: sudo apt-get update && sudo apt-get install -y shellcheck
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
 
-      - name: Run shellcheck
-        run: |
-          find . -type f -name "*.sh" -print0 | xargs -0 -r shellcheck -S error -e SC1007,SC1090,SC2016
+      - name: cargo fmt
+        run: cargo fmt --all --check
 
-      - name: Run production inventory placeholder guard self-test
-        run: bash scripts/check_production_inventory_placeholders.sh --self-test
+      - name: cargo test
+        run: cargo test --workspace
 
-      - name: Run private-config guard
-        run: bash scripts/check_private_config_guard.sh
+      - name: cargo clippy
+        run: cargo clippy --workspace --all-targets -- -D warnings
 
-      - name: Run portal contract sync guard
-        run: node scripts/check_portal_contract_sync.mjs
+      - name: cargo build
+        run: cargo build --workspace
 
-  rust-runtime-guard:
+  docs-registry-checks:
+    name: Docs and registry checks
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          lfs: false
 
-      - name: Test detmir-core runtime guard
-        run: cargo test --manifest-path adk-rust/Cargo.toml -p detmir-core runtime_guard
+      - name: Registry script syntax
+        run: bash -n scripts/registry_readiness_check.sh
 
-      - name: Test detmir readiness crate
-        run: cargo test --manifest-path adk-rust/Cargo.toml -p detmir-readiness
+      - name: Registry readiness
+        run: bash scripts/registry_readiness_check.sh
 
-  powershell-analyzer:
+      - name: Release evidence script syntax
+        run: |
+          if [[ -f scripts/build_release_evidence.sh ]]; then
+            bash -n scripts/build_release_evidence.sh
+          fi
+          if [[ -f scripts/check_release_evidence.sh ]]; then
+            bash -n scripts/check_release_evidence.sh
+          fi
+
+      - name: Whitespace diff check
+        run: git diff --check
+
+  smoke-checks:
+    name: Smoke checks
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          lfs: false
 
-      - name: Install PSScriptAnalyzer
-        shell: pwsh
-        run: |
-          Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
-          Install-Module PSScriptAnalyzer -Scope CurrentUser -Force
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
 
-      - name: Analyze PowerShell scripts
-        shell: pwsh
+      - name: Deployment readiness smoke
         run: |
-          $targets = @(
-            "windows/*.ps1",
-            "windows/*.psm1",
-            "windows/*.psd1"
-          )
-          $issues = $targets | ForEach-Object {
-            Invoke-ScriptAnalyzer -Path $_ -Recurse -Severity Error
-          }
-          if ($issues) {
-            $issues | Format-Table -AutoSize
-            throw "PSScriptAnalyzer detected issues."
-          }
+          if command -v node >/dev/null 2>&1 && [[ -f scripts/deployment-readiness-smoke.mjs ]]; then
+            node scripts/deployment-readiness-smoke.mjs
+          else
+            echo "skipped: node or scripts/deployment-readiness-smoke.mjs missing"
+          fi
+
+      - name: Pilot validation smoke
+        run: |
+          if command -v node >/dev/null 2>&1 && [[ -f scripts/pilot-validation-smoke.mjs ]]; then
+            node scripts/pilot-validation-smoke.mjs
+          else
+            echo "skipped: node or scripts/pilot-validation-smoke.mjs missing"
+          fi
+
+      - name: Browser conformance smoke
+        run: |
+          if [[ -f scripts/browser-conformance-smoke.mjs ]]; then
+            echo "skipped: requires live stand unless explicitly run by operator"
+          else
+            echo "skipped: scripts/browser-conformance-smoke.mjs missing"
+          fi

.github/workflows/coverage.yml

@@ -0,0 +1,47 @@
+name: Coverage
+
+# GitHub Actions is public mirror validation only.
+# Primary registry release evidence must be produced on Russian build-runner.
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  coverage-baseline:
+    name: Coverage baseline
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: adk-rust
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+
+      - name: Generate coverage summary
+        run: |
+          mkdir -p ../coverage
+          cargo llvm-cov --workspace --summary-only | tee ../coverage/coverage-summary.txt
+
+      - name: Upload coverage summary
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-summary
+          path: coverage/coverage-summary.txt
+
+      - name: Future threshold placeholder
+        run: |
+          echo "Coverage threshold is not enforced yet; this workflow tracks baseline and regressions."

.github/workflows/security.yml

@@ -0,0 +1,131 @@
+name: Security
+
+# GitHub Actions is public mirror validation only.
+# Primary registry release security evidence must be produced on Russian build-runner.
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  cargo-audit:
+    name: Cargo audit
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: adk-rust
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@cargo-audit
+
+      - name: cargo audit
+        run: cargo audit
+
+  cargo-deny:
+    name: Cargo deny
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@cargo-deny
+
+      - name: cargo deny
+        run: cargo deny --manifest-path adk-rust/Cargo.toml --config deny.toml check
+
+  secret-pattern-check:
+    name: Secret pattern check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Scan for obvious secret patterns
+        run: |
+          python3 - <<'PY'
+          import os
+          import re
+          import sys
+          from pathlib import Path
+
+          root = Path(".")
+          text_suffixes = {
+              ".cfg", ".conf", ".env", ".ini", ".json", ".lock", ".md", ".py",
+              ".rs", ".sh", ".toml", ".ts", ".txt", ".yaml", ".yml"
+          }
+          skip_dirs = {
+              ".git", "target", "node_modules", "release-evidence", "dist", "bin"
+          }
+          patterns = [
+              ("private_key_header", re.compile(r"-----BEGIN (?:RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----")),
+              ("aws_access_key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
+              ("secret_assignment", re.compile(
+                  r"(?i)\b(password|passwd|pwd|token|secret|api[_-]?key|bearer|cookie)\b"
+                  r"\s*[:=]\s*[\"']?[A-Za-z0-9_./+=-]{16,}"
+              )),
+          ]
+          findings = []
+          for path in root.rglob("*"):
+              if not path.is_file():
+                  continue
+              if any(part in skip_dirs for part in path.parts):
+                  continue
+              if path.suffix.lower() not in text_suffixes:
+                  continue
+              try:
+                  lines = path.read_text(encoding="utf-8", errors="ignore").splitlines()
+              except OSError:
+                  continue
+              for line_no, line in enumerate(lines, start=1):
+                  for name, pattern in patterns:
+                      if pattern.search(line):
+                          findings.append(f"{path}:{line_no}:{name}")
+                          break
+          if findings:
+              print("secret_pattern_check=fail")
+              for finding in findings:
+                  print(finding)
+              sys.exit(2)
+          print("secret_pattern_check=ok")
+          PY
+
+  dependency-review:
+    name: Dependency review
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4

CONTRIBUTING.md

@@ -1,5 +1,9 @@
 # Contributing
 
+GitHub is public mirror validation only. Primary registry release evidence is
+produced separately on the Russian build-runner and documented under
+`docs/registry/`.
+
 ## Branching
 
 - Работайте в feature-ветке, не пушьте напрямую в `main`.
@@ -15,13 +19,36 @@
 
 ## Required checks before PR
 
-- `bash -n` для всех `*.sh`.
+- `cargo fmt --all --check` from `adk-rust/`.
+- `cargo test --workspace` from `adk-rust/`, unless the PR is documentation-only
+  and the skip is documented.
+- `cargo clippy --workspace --all-targets -- -D warnings` from `adk-rust/`.
+- `bash -n` для всех changed `*.sh`.
+- `bash scripts/registry_readiness_check.sh` when registry docs/process changes.
+- `node scripts/deployment-readiness-smoke.mjs` when Node.js is available.
+- `node scripts/pilot-validation-smoke.mjs` when Node.js is available.
 - `Invoke-ScriptAnalyzer` для `windows/*.ps1`, `windows/*.psm1`, `windows/*.psd1`.
-- Проверка, что нет секретов (`secrets/deploy.secrets.env` не должен быть в индексе git).
+- Проверка, что нет секретов (`secrets/deploy.secrets.env` не должен быть в
+  индексе git).
 - Обновлены инструкции и runbook при изменении поведения.
 
+## Registry-readiness docs
+
+- Registry-readiness documents live in `docs/registry/`.
+- Public GitHub CI is not registry release evidence.
+- Registry release evidence must be generated on the Russian build-runner.
+- GitHub remains public mirror validation only.
+
+## Secrets and personal data
+
+- Do not commit secrets, tokens, passwords, cookies or private keys.
+- Do not commit personal data.
+- Do not commit real employee logs.
+- Use demo/anonymized evidence for issues, PRs, docs and screenshots.
+
 ## PR content
 
 - Изменения и обоснование.
 - Риск и rollback.
 - Какие команды валидации были выполнены.
+- Какие проверки были пропущены и почему, если пропуск был необходим.

README.md

@@ -1,5 +1,9 @@
 # AWatch-rus
 
+[![CI](https://github.com/igor04091968/AWatch-rus/actions/workflows/ci.yml/badge.svg)](https://github.com/igor04091968/AWatch-rus/actions/workflows/ci.yml)
+[![Security](https://github.com/igor04091968/AWatch-rus/actions/workflows/security.yml/badge.svg)](https://github.com/igor04091968/AWatch-rus/actions/workflows/security.yml)
+[![Coverage](https://github.com/igor04091968/AWatch-rus/actions/workflows/coverage.yml/badge.svg)](https://github.com/igor04091968/AWatch-rus/actions/workflows/coverage.yml)
+
 AWatch-rus - программный комплекс операционного контроля,
 технического аудита, оценки трудоотдачи сотрудников и мониторинга
 корпоративной ИТ-инфраструктуры на базе ActivityWatch, Rust-сервисов
@@ -231,6 +235,16 @@ collectors.
   [RU_BUILD_RUNNER_READINESS_RU.md](docs/registry/RU_BUILD_RUNNER_READINESS_RU.md).
 - GitHub remains public mirror only.
 
+### Public engineering transparency
+
+- Public CI, coverage baseline and security scanning are enabled on GitHub.
+- Issue templates, PR template and public roadmap are maintained for process
+  visibility.
+- GitHub remains public mirror validation only.
+- Primary registry contour remains Gitea plus the Russian build-runner.
+- Quality status:
+  [docs/QUALITY_STATUS_RU.md](docs/QUALITY_STATUS_RU.md).
+
 - [Позиционирование для реестра российского ПО](docs/RUSSIAN_SOFTWARE_REGISTRY_POSITIONING_RU.md)
 - [Сведения для подачи в реестр](REGISTER_RU_SOFTWARE.md)
 - [Registry product passport](docs/REGISTRY_PRODUCT_PASSPORT_RU.md)

ROADMAP.md

@@ -0,0 +1,67 @@
+# AWatch-rus Roadmap
+
+This roadmap is public planning. It does not claim completion of unverified
+work and does not replace `docs/registry/` evidence for registry-readiness.
+
+## Registry-readiness
+
+- Maintain `docs/registry/` as the authoritative registry-readiness
+  documentation package.
+- Keep conservative product claims and explicit remaining gaps.
+- Prepare final rightsholder confirmation and legal review separately.
+
+## Russian Git/build contour
+
+- Keep self-hosted Gitea as the target Russian Git contour for
+  registry-readiness.
+- Keep GitHub as public mirror validation only.
+- Provision `awatch-build-01` as a separate Russian build-runner.
+
+## Release evidence
+
+- Run release candidate checks on the Russian build-runner.
+- Generate source archive, binary archive, SBOM, SHA256SUMS, smoke logs and
+  release evidence manifest.
+- Keep public GitHub Actions separate from registry release evidence.
+
+## Backup/restore test
+
+- Complete a test restore of Gitea backup on a separate server.
+- Keep `restore_tested=false` until evidence exists.
+- Document offsite backup in RF before registry submission.
+
+## Coverage and CI
+
+- Use public CI for engineering transparency.
+- Track coverage baseline without enforcing a threshold at first.
+- Add coverage threshold after baseline review.
+
+## Security scanning
+
+- Maintain cargo audit, cargo deny, dependency review and secret-pattern checks.
+- Treat public security checks as advisory validation.
+- Produce registry release security evidence in the Russian build contour.
+
+## Russian OS compatibility
+
+- Validate deployment and agent behavior on target Russian OS variants.
+- Document unsupported combinations explicitly.
+
+## Pilot hardening
+
+- Keep demo data anonymized.
+- Improve smoke coverage for install kit and operational reports.
+- Preserve clear rollback and backup-first operational procedures.
+
+## Future UI
+
+- Future UI work remains planned unless backed by implemented code and tests.
+- Public roadmap entries are not product claims.
+
+## Not claimed / out of scope
+
+- No claim of FSTEC/FSB certification.
+- No claim of replacing DLP or SIEM.
+- No claim of ML/LLM-based detection.
+- No claim of automatic remediation.
+- No claim of legal completion of Russian software registry registration.

SECURITY.md

@@ -0,0 +1,41 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report suspected vulnerabilities privately to the project maintainer
+before publishing technical details. If a private contact channel is not
+available, open a GitHub issue with a minimal description and no exploit,
+secret, customer data, employee logs or personal data.
+
+Do not include:
+
+- passwords, tokens, cookies or private keys;
+- real employee logs;
+- personal data;
+- private network details;
+- customer evidence that has not been anonymized.
+
+Use demo or anonymized evidence whenever possible.
+
+## Security scope
+
+AWatch-rus is not positioned as a certified security product. It is not a replacement for DLP or SIEM platforms. Public security checks are advisory validation for engineering transparency.
+
+## Public validation
+
+GitHub Actions security checks run in the public mirror:
+
+- cargo audit;
+- cargo deny;
+- secret-pattern check;
+- dependency review for pull requests.
+
+GitHub remains public mirror validation only. Registry release security
+evidence must be produced in the Russian build contour on the Russian
+build-runner.
+
+## Registry-readiness note
+
+Security checks do not confirm legal completion of Russian software registry
+registration. Final submission requires rightsholder confirmation and legal
+review.

deny.toml

@@ -0,0 +1,39 @@
+# Public mirror dependency policy for cargo-deny.
+# This is advisory validation for public engineering transparency.
+# Final license and registry-submission review still requires legal review.
+
+[advisories]
+version = 2
+yanked = "warn"
+ignore = []
+
+[licenses]
+version = 2
+confidence-threshold = 0.8
+allow = [
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "CC0-1.0",
+  "ISC",
+  "MIT",
+  "MPL-2.0",
+  "OpenSSL",
+  "Unicode-3.0",
+  "Unicode-DFS-2016",
+  "Zlib",
+]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "warn"
+deny = []
+skip = []
+skip-tree = []
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []

docs/QUALITY_STATUS_RU.md

@@ -0,0 +1,41 @@
+# Quality status
+
+Статус: public engineering transparency document.
+
+## CI status
+
+Public GitHub Actions workflows are available for mirror validation:
+
+- `CI`: Rust checks, registry/docs checks and smoke checks.
+- `Coverage`: cargo-llvm-cov baseline summary.
+- `Security`: cargo audit, cargo deny, secret-pattern check and dependency
+  review for pull requests.
+
+GitHub Actions is public mirror validation only. Public CI is not registry release evidence and is not the primary registry build contour.
+
+## Coverage baseline policy
+
+Coverage threshold is not enforced yet. The first stage is tracking and
+regression visibility:
+
+- collect `cargo llvm-cov --workspace --summary-only`;
+- store coverage summary artifact;
+- avoid failing early public builds by percentage before baseline review;
+- add future threshold after the first stable baseline is reviewed.
+
+## Registry release build
+
+Registry release build and release evidence must be produced on the Russian
+build-runner described in
+`docs/registry/RU_BUILD_RUNNER_READINESS_RU.md`.
+
+## Security checks
+
+Public security checks are advisory/public validation. Registry release
+security evidence must be generated in the Russian build contour.
+
+## Conservative positioning
+
+The quality layer does not claim certification, does not position AWatch-rus as
+a SIEM/DLP replacement and does not claim legal completion of Russian software
+registry registration.

docs/registry/REGISTER_RU_SOFTWARE_READINESS_RU.md

@@ -25,6 +25,12 @@ registry-readiness пакета, не подтверждает готовнос
 - Доказательная документация должна храниться в `docs/registry/`.
 - Backup-контур начат, но `restore_tested=false` до проверки восстановления
   на отдельном сервере.
+- Public CI, coverage baseline and security scanning added on GitHub for
+  transparency.
+- GitHub Actions is public mirror validation only and is not the primary
+  registry build contour.
+- Russian build-runner remains required for registry release candidate and
+  release evidence.
 
 ## Текущее состояние
 
@@ -65,6 +71,9 @@ Done / partially done:
 - Russian build-runner: planned.
 - Release artifacts storage in RF: planned.
 - Release evidence automation: partially done after this task.
+- Public CI transparency: added.
+- Coverage baseline: added, threshold not enforced yet.
+- Security scanning: added.
 - Restore test: required.
 - Legal rightsholder confirmation: required.
 

docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md

@@ -1,5 +1,44 @@
 # Registry readiness changelog
 
+## 2026-06-21 public engineering transparency
+
+Added:
+
+- Public CI workflow for GitHub mirror validation.
+- Public coverage baseline workflow.
+- Public security workflow with cargo audit, cargo deny, secret-pattern check
+  and dependency review for pull requests.
+- `SECURITY.md`, `CONTRIBUTING.md`, public `ROADMAP.md`, issue templates and
+  pull request template.
+- `docs/QUALITY_STATUS_RU.md`.
+
+Changed:
+
+- Registry manifest now records public engineering transparency fields.
+- Registry readiness check now validates public CI/security/coverage/process
+  files.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- GitHub Actions is public mirror validation only.
+- Russian build-runner remains required for registry release candidate.
+
+Checks note:
+
+- Rust/runtime checks should run in public CI and on `awatch-build-01`.
+- Local Rust checks may be skipped for this documentation/process-only update
+  only if the skip reason is recorded in the final report.
+
+Remaining gaps:
+
+- First successful public CI run after push.
+- First coverage baseline artifact after push.
+- First security scan baseline after push.
+- Actual `awatch-build-01` provisioning and registry release evidence run.
+
 ## 2026-06-21
 
 Added:

docs/registry/RELEASE_EVIDENCE_MANIFEST_RU.md

@@ -45,6 +45,9 @@ build-runner и storage release artifacts в РФ или документиро
 владельцем схему. До этого нельзя утверждать, что source/build/release contour
 полностью закрыт для подачи.
 
+Public GitHub Actions CI, coverage and security workflows are transparency
+checks only. They are not primary registry release evidence.
+
 ## Build-runner evidence
 
 Для `awatch-build-01` фиксировать:
@@ -68,3 +71,17 @@ build-runner и storage release artifacts в РФ или документиро
 Evidence должен формироваться скриптом `scripts/build_release_evidence.sh` и
 проверяться через `scripts/check_release_evidence.sh`. До первого успешного
 release candidate build нельзя утверждать, что release evidence production-ready.
+
+## Public validation evidence
+
+Public mirror validation may include:
+
+- GitHub Actions CI result;
+- coverage summary artifact;
+- cargo audit / cargo deny result;
+- dependency review result for pull requests;
+- secret-pattern check result;
+- issue and PR process evidence.
+
+This public validation can support engineering trust, but registry release
+evidence remains tied to the Russian build-runner.

docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md

@@ -4,6 +4,10 @@
 candidate на российском build-runner `awatch-build-01`. Он не утверждает, что
 release evidence уже production-ready до первого успешного запуска.
 
+GitHub Actions is public mirror validation only. Public CI, coverage and
+security workflows improve transparency, but registry release evidence must be
+produced on the Russian build-runner.
+
 ## Процесс release candidate
 
 1. Checkout конкретного commit SHA или tag.

docs/registry/RU_BUILD_RUNNER_READINESS_RU.md

@@ -12,6 +12,9 @@ Build-runner нужен для воспроизводимой сборки relea
 build/test/check задачи не конкурировали с Git-хранилищем, HTTPS reverse proxy
 и backup-процедурами.
 
+GitHub Actions is public mirror validation only. GitHub Actions is not the
+primary registry build contour and does not replace `awatch-build-01`.
+
 ## Целевая роль
 
 | Параметр | Значение |
@@ -97,5 +100,8 @@ Build-runner должен формировать:
 - Russian build-runner: planned.
 - Release artifacts storage in RF: planned.
 - Release evidence automation: partially done after this task.
+- Public CI transparency: added.
+- Coverage baseline: added.
+- Security scanning: added.
 - Restore test: required.
 - Legal rightsholder confirmation: required.

docs/registry/registry-evidence-manifest.json

@@ -73,6 +73,15 @@
       "release_manifest": true
     }
   },
+  "public_engineering_transparency": {
+    "github_actions_ci": true,
+    "coverage_baseline": true,
+    "security_scanning": true,
+    "issue_templates": true,
+    "public_roadmap": true,
+    "github_role": "public_mirror_validation_only",
+    "registry_release_build": "requires_russian_build_runner"
+  },
   "github_role_note": "GitHub is a public mirror only, not the target primary source/build/release contour for registry-readiness.",
   "remaining_gaps": [
     "legal rightsholder confirmation",

scripts/registry_readiness_check.sh

@@ -46,8 +46,21 @@ required_files=(
   "docs/registry/LIFECYCLE_AND_SUPPORT_RU.md"
   "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md"
   "docs/registry/registry-evidence-manifest.json"
+  "docs/QUALITY_STATUS_RU.md"
   "scripts/build_release_evidence.sh"
   "scripts/check_release_evidence.sh"
+  ".github/workflows/ci.yml"
+  ".github/workflows/security.yml"
+  ".github/workflows/coverage.yml"
+  ".github/ISSUE_TEMPLATE/bug_report.yml"
+  ".github/ISSUE_TEMPLATE/feature_request.yml"
+  ".github/ISSUE_TEMPLATE/registry_readiness_task.yml"
+  ".github/ISSUE_TEMPLATE/security_hardening_task.yml"
+  ".github/pull_request_template.md"
+  "SECURITY.md"
+  "CONTRIBUTING.md"
+  "ROADMAP.md"
+  "deny.toml"
   "README.md"
 )
 
@@ -79,6 +92,13 @@ if [[ -s "$MANIFEST" ]]; then
       and .build_runner.target_hostname == "awatch-build-01"
       and .build_runner.separate_from_git_server == true
       and (.build_runner.required_checks | index("release_evidence_check") != null)
+      and .public_engineering_transparency.github_actions_ci == true
+      and .public_engineering_transparency.coverage_baseline == true
+      and .public_engineering_transparency.security_scanning == true
+      and .public_engineering_transparency.issue_templates == true
+      and .public_engineering_transparency.public_roadmap == true
+      and .public_engineering_transparency.github_role == "public_mirror_validation_only"
+      and .public_engineering_transparency.registry_release_build == "requires_russian_build_runner"
     ' "$MANIFEST" >/dev/null || fail "manifest_required_fields"
   elif command -v python3 >/dev/null 2>&1; then
     python3 -m json.tool "$MANIFEST" >/dev/null || fail "invalid_json:docs/registry/registry-evidence-manifest.json"
@@ -135,6 +155,20 @@ if build_runner.get("separate_from_git_server") is not True:
     raise SystemExit("build_runner.separate_from_git_server mismatch")
 if "release_evidence_check" not in build_runner.get("required_checks", []):
     raise SystemExit("build_runner.required_checks missing release_evidence_check")
+
+public = data.get("public_engineering_transparency") or {}
+public_expected = {
+    "github_actions_ci": True,
+    "coverage_baseline": True,
+    "security_scanning": True,
+    "issue_templates": True,
+    "public_roadmap": True,
+    "github_role": "public_mirror_validation_only",
+    "registry_release_build": "requires_russian_build_runner",
+}
+for key, value in public_expected.items():
+    if public.get(key) != value:
+        raise SystemExit(f"public_engineering_transparency.{key} mismatch")
 PY
   else
     fail "json_validator_missing:jq_or_python3_required"
@@ -160,11 +194,30 @@ require_grep "restore_tested=false|restore_tested..false|\"restore_tested\"[[:sp
 require_grep "\"restore_tested\"[[:space:]]*:[[:space:]]*false" "docs/registry/registry-evidence-manifest.json" "restore_tested_false_manifest"
 require_grep "docs/registry" "docs/registry/WIKI_AND_DOCUMENTATION_POLICY_RU.md" "authoritative_docs_path_wiki_policy"
 require_grep "release_evidence_check" "docs/registry/registry-evidence-manifest.json" "release_evidence_check_manifest"
+require_grep "Public engineering transparency" "README.md" "readme_public_engineering_transparency"
+require_grep "GitHub Actions is public mirror validation only|public mirror validation only" "docs/registry/RU_BUILD_RUNNER_READINESS_RU.md" "github_actions_not_registry_build_runner"
+require_grep "GitHub Actions is public mirror validation only|public mirror validation only" "docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md" "github_actions_not_registry_release_runbook"
+require_grep "Public CI is not registry release evidence|not registry release evidence" "docs/QUALITY_STATUS_RU.md" "quality_public_ci_not_registry_evidence"
+require_grep "requires_russian_build_runner|public_mirror_validation_only" "docs/registry/registry-evidence-manifest.json" "public_engineering_manifest"
+require_grep "public mirror validation only" "SECURITY.md" "security_public_mirror_validation"
+require_grep "public mirror validation only" "CONTRIBUTING.md" "contributing_public_mirror_validation"
+require_grep "public mirror validation only" "ROADMAP.md" "roadmap_public_mirror_validation"
+require_grep "cargo audit|cargo deny|secret-pattern" ".github/workflows/security.yml" "security_workflow_checks"
+require_grep "cargo llvm-cov" ".github/workflows/coverage.yml" "coverage_workflow_llvm_cov"
+require_grep "cargo fmt --all --check" ".github/workflows/ci.yml" "ci_workflow_fmt"
 
 scan_files=(
   "$ROOT/README.md"
   "$REGISTRY_DIR"/*.md
   "$REGISTRY_DIR"/*.json
+  "$ROOT/docs/QUALITY_STATUS_RU.md"
+  "$ROOT/SECURITY.md"
+  "$ROOT/CONTRIBUTING.md"
+  "$ROOT/ROADMAP.md"
+  "$ROOT/deny.toml"
+  "$ROOT/.github/workflows"/*.yml
+  "$ROOT/.github/ISSUE_TEMPLATE"/*.yml
+  "$ROOT/.github/pull_request_template.md"
   "$ROOT/scripts/build_release_evidence.sh"
   "$ROOT/scripts/check_release_evidence.sh"
 )
@@ -173,6 +226,10 @@ claim_scan_files=(
   "$ROOT/README.md"
   "$REGISTRY_DIR"/*.md
   "$REGISTRY_DIR"/*.json
+  "$ROOT/docs/QUALITY_STATUS_RU.md"
+  "$ROOT/SECURITY.md"
+  "$ROOT/CONTRIBUTING.md"
+  "$ROOT/ROADMAP.md"
 )
 
 if grep -RInEi "(password|passwd|pwd|token|secret|api[_-]?key|private[[:space:]_-]?key)[[:space:]]*[:=][[:space:]]*['\"]?[A-Za-z0-9_./+=-]{8,}" "${scan_files[@]}" >/tmp/registry_secret_like.$$ 2>/dev/null; then
@@ -195,7 +252,7 @@ fi
 rm -f /tmp/registry_forbidden_replacement.$$
 
 if grep -RInEi "(ML/LLM-based detection|LLM-based detection|ML-based detection|automatic remediation)" "${claim_scan_files[@]}" \
-  | grep -Eiv "(forbidden|not_made|not_claimed|не заявляет|не фиксируется|не используется|does not claim)" \
+  | grep -Eiv "(forbidden|not_made|not_claimed|no claim|не заявляет|не фиксируется|не используется|does not claim)" \
   >/tmp/registry_forbidden_ai_auto.$$ 2>/dev/null; then
   fail "forbidden_claim_ai_or_automatic_remediation:$(cat /tmp/registry_forbidden_ai_auto.$$)"
 fi