chore(public): add CI coverage security and OSS process visibility

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,42 @@
+name: Bug report
+description: Report a reproducible defect with sanitized evidence.
+title: "fix: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not publish secrets, tokens, private keys, personal data, real employee logs or customer evidence. Use demo/anonymized evidence.
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What is broken?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Reproduction steps
+      description: Minimal steps using sanitized data.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Sanitized evidence
+      description: Logs, screenshots or output with secrets and personal data removed.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,42 @@
+name: Feature request
+description: Request a capability without using customer or employee data.
+title: "feat: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not publish secrets, personal data, real employee logs or non-anonymized customer evidence.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user or operator problem should this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Describe the desired behavior conservatively.
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Workforce
+        - Security analytics
+        - Forensics
+        - Registry-readiness
+        - Install/deployment
+        - Documentation
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Demo/anonymized evidence
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/registry_readiness_task.yml

@@ -0,0 +1,29 @@
+name: Registry-readiness task
+description: Track registry-readiness documentation, evidence or process gaps.
+title: "docs(registry): "
+labels: ["registry-readiness", "documentation"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not claim legal completion of registry registration. Do not publish secrets, personal data, real employee logs or private infrastructure credentials.
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope
+      description: What registry-readiness gap is being tracked?
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Required evidence
+      description: List sanitized evidence or documents needed.
+    validations:
+      required: true
+  - type: textarea
+    id: remaining
+    attributes:
+      label: Remaining gaps
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/security_hardening_task.yml

@@ -0,0 +1,30 @@
+name: Security hardening task
+description: Track hardening without exposing sensitive data.
+title: "chore(security): "
+labels: ["security", "hardening"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not publish exploits, secrets, private keys, tokens, personal data, real employee logs or customer evidence.
+  - type: textarea
+    id: hardening
+    attributes:
+      label: Hardening target
+      description: What should be hardened?
+    validations:
+      required: true
+  - type: textarea
+    id: risk
+    attributes:
+      label: Risk addressed
+      description: Explain the risk without sensitive details.
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Validation
+      description: Checks or evidence required.
+    validations:
+      required: true

.github/pull_request_template.md

@@ -1,13 +1,24 @@
 ## Summary
 
-- what changed
-- why it changed
-- risk and rollback notes
+Describe what changed and why.
 
-## Checklist
+## Validation
 
-- [ ] No real secrets or credentials committed
-- [ ] Server-side scripts validated (`bash -n`)
-- [ ] PowerShell scripts validated (`Invoke-ScriptAnalyzer`)
-- [ ] Docs updated (full paths and runbook steps)
-- [ ] Rollback steps documented
+List commands executed. Use `skipped: <reason>` when a check requires a live
+stand or unavailable tool.
+
+## Registry / Public Mirror Scope
+
+- GitHub is public mirror validation only.
+- Primary registry release evidence must be produced on the Russian
+  build-runner.
+- Update `docs/registry/` when registry-readiness behavior or evidence changes.
+
+## Safety
+
+- No secrets, tokens, passwords or private keys.
+- No personal data.
+- No real employee logs.
+- No customer evidence unless anonymized.
+- No unsupported claims about certification, DLP/SIEM replacement or legal
+  registry completion.

.github/workflows/ci.yml

@@ -1,70 +1,114 @@
-name: shell-and-powershell-ci
+name: CI
+
+# GitHub Actions is public mirror validation only.
+# Primary registry release evidence must be produced on Russian build-runner.
 
 on:
   push:
-    branches: [ "main" ]
   pull_request:
-    branches: [ "main" ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
-  shell-check:
+  rust-checks:
+    name: Rust checks
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: adk-rust
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          lfs: false
 
-      - name: Install shellcheck
-        run: sudo apt-get update && sudo apt-get install -y shellcheck
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
 
-      - name: Run shellcheck
-        run: |
-          find . -type f -name "*.sh" -print0 | xargs -0 -r shellcheck -S error -e SC1007,SC1090,SC2016
+      - name: cargo fmt
+        run: cargo fmt --all --check
 
-      - name: Run production inventory placeholder guard self-test
-        run: bash scripts/check_production_inventory_placeholders.sh --self-test
+      - name: cargo test
+        run: cargo test --workspace
 
-      - name: Run private-config guard
-        run: bash scripts/check_private_config_guard.sh
+      - name: cargo clippy
+        run: cargo clippy --workspace --all-targets -- -D warnings
 
-      - name: Run portal contract sync guard
-        run: node scripts/check_portal_contract_sync.mjs
+      - name: cargo build
+        run: cargo build --workspace
 
-  rust-runtime-guard:
+  docs-registry-checks:
+    name: Docs and registry checks
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          lfs: false
 
-      - name: Test detmir-core runtime guard
-        run: cargo test --manifest-path adk-rust/Cargo.toml -p detmir-core runtime_guard
+      - name: Registry script syntax
+        run: bash -n scripts/registry_readiness_check.sh
 
-      - name: Test detmir readiness crate
-        run: cargo test --manifest-path adk-rust/Cargo.toml -p detmir-readiness
+      - name: Registry readiness
+        run: bash scripts/registry_readiness_check.sh
 
-  powershell-analyzer:
+      - name: Release evidence script syntax
+        run: |
+          if [[ -f scripts/build_release_evidence.sh ]]; then
+            bash -n scripts/build_release_evidence.sh
+          fi
+          if [[ -f scripts/check_release_evidence.sh ]]; then
+            bash -n scripts/check_release_evidence.sh
+          fi
+
+      - name: Whitespace diff check
+        run: git diff --check
+
+  smoke-checks:
+    name: Smoke checks
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          lfs: false
 
-      - name: Install PSScriptAnalyzer
-        shell: pwsh
-        run: |
-          Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
-          Install-Module PSScriptAnalyzer -Scope CurrentUser -Force
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
 
-      - name: Analyze PowerShell scripts
-        shell: pwsh
+      - name: Deployment readiness smoke
         run: |
-          $targets = @(
-            "windows/*.ps1",
-            "windows/*.psm1",
-            "windows/*.psd1"
-          )
-          $issues = $targets | ForEach-Object {
-            Invoke-ScriptAnalyzer -Path $_ -Recurse -Severity Error
-          }
-          if ($issues) {
-            $issues | Format-Table -AutoSize
-            throw "PSScriptAnalyzer detected issues."
-          }
+          if command -v node >/dev/null 2>&1 && [[ -f scripts/deployment-readiness-smoke.mjs ]]; then
+            node scripts/deployment-readiness-smoke.mjs
+          else
+            echo "skipped: node or scripts/deployment-readiness-smoke.mjs missing"
+          fi
+
+      - name: Pilot validation smoke
+        run: |
+          if command -v node >/dev/null 2>&1 && [[ -f scripts/pilot-validation-smoke.mjs ]]; then
+            node scripts/pilot-validation-smoke.mjs
+          else
+            echo "skipped: node or scripts/pilot-validation-smoke.mjs missing"
+          fi
+
+      - name: Browser conformance smoke
+        run: |
+          if [[ -f scripts/browser-conformance-smoke.mjs ]]; then
+            echo "skipped: requires live stand unless explicitly run by operator"
+          else
+            echo "skipped: scripts/browser-conformance-smoke.mjs missing"
+          fi

.github/workflows/coverage.yml

@@ -0,0 +1,47 @@
+name: Coverage
+
+# GitHub Actions is public mirror validation only.
+# Primary registry release evidence must be produced on Russian build-runner.
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  coverage-baseline:
+    name: Coverage baseline
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: adk-rust
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+
+      - name: Generate coverage summary
+        run: |
+          mkdir -p ../coverage
+          cargo llvm-cov --workspace --summary-only | tee ../coverage/coverage-summary.txt
+
+      - name: Upload coverage summary
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-summary
+          path: coverage/coverage-summary.txt
+
+      - name: Future threshold placeholder
+        run: |
+          echo "Coverage threshold is not enforced yet; this workflow tracks baseline and regressions."

.github/workflows/security.yml

@@ -0,0 +1,131 @@
+name: Security
+
+# GitHub Actions is public mirror validation only.
+# Primary registry release security evidence must be produced on Russian build-runner.
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  cargo-audit:
+    name: Cargo audit
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: adk-rust
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@cargo-audit
+
+      - name: cargo audit
+        run: cargo audit
+
+  cargo-deny:
+    name: Cargo deny
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@cargo-deny
+
+      - name: cargo deny
+        run: cargo deny --manifest-path adk-rust/Cargo.toml --config deny.toml check
+
+  secret-pattern-check:
+    name: Secret pattern check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Scan for obvious secret patterns
+        run: |
+          python3 - <<'PY'
+          import os
+          import re
+          import sys
+          from pathlib import Path
+
+          root = Path(".")
+          text_suffixes = {
+              ".cfg", ".conf", ".env", ".ini", ".json", ".lock", ".md", ".py",
+              ".rs", ".sh", ".toml", ".ts", ".txt", ".yaml", ".yml"
+          }
+          skip_dirs = {
+              ".git", "target", "node_modules", "release-evidence", "dist", "bin"
+          }
+          patterns = [
+              ("private_key_header", re.compile(r"-----BEGIN (?:RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----")),
+              ("aws_access_key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
+              ("secret_assignment", re.compile(
+                  r"(?i)\b(password|passwd|pwd|token|secret|api[_-]?key|bearer|cookie)\b"
+                  r"\s*[:=]\s*[\"']?[A-Za-z0-9_./+=-]{16,}"
+              )),
+          ]
+          findings = []
+          for path in root.rglob("*"):
+              if not path.is_file():
+                  continue
+              if any(part in skip_dirs for part in path.parts):
+                  continue
+              if path.suffix.lower() not in text_suffixes:
+                  continue
+              try:
+                  lines = path.read_text(encoding="utf-8", errors="ignore").splitlines()
+              except OSError:
+                  continue
+              for line_no, line in enumerate(lines, start=1):
+                  for name, pattern in patterns:
+                      if pattern.search(line):
+                          findings.append(f"{path}:{line_no}:{name}")
+                          break
+          if findings:
+              print("secret_pattern_check=fail")
+              for finding in findings:
+                  print(finding)
+              sys.exit(2)
+          print("secret_pattern_check=ok")
+          PY
+
+  dependency-review:
+    name: Dependency review
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4