chore(public): add CI coverage security and OSS process visibility

docs/QUALITY_STATUS_RU.md

@@ -0,0 +1,41 @@
+# Quality status
+
+Статус: public engineering transparency document.
+
+## CI status
+
+Public GitHub Actions workflows are available for mirror validation:
+
+- `CI`: Rust checks, registry/docs checks and smoke checks.
+- `Coverage`: cargo-llvm-cov baseline summary.
+- `Security`: cargo audit, cargo deny, secret-pattern check and dependency
+  review for pull requests.
+
+GitHub Actions is public mirror validation only. Public CI is not registry release evidence and is not the primary registry build contour.
+
+## Coverage baseline policy
+
+Coverage threshold is not enforced yet. The first stage is tracking and
+regression visibility:
+
+- collect `cargo llvm-cov --workspace --summary-only`;
+- store coverage summary artifact;
+- avoid failing early public builds by percentage before baseline review;
+- add future threshold after the first stable baseline is reviewed.
+
+## Registry release build
+
+Registry release build and release evidence must be produced on the Russian
+build-runner described in
+`docs/registry/RU_BUILD_RUNNER_READINESS_RU.md`.
+
+## Security checks
+
+Public security checks are advisory/public validation. Registry release
+security evidence must be generated in the Russian build contour.
+
+## Conservative positioning
+
+The quality layer does not claim certification, does not position AWatch-rus as
+a SIEM/DLP replacement and does not claim legal completion of Russian software
+registry registration.

docs/registry/REGISTER_RU_SOFTWARE_READINESS_RU.md

@@ -25,6 +25,12 @@ registry-readiness пакета, не подтверждает готовнос
 - Доказательная документация должна храниться в `docs/registry/`.
 - Backup-контур начат, но `restore_tested=false` до проверки восстановления
   на отдельном сервере.
+- Public CI, coverage baseline and security scanning added on GitHub for
+  transparency.
+- GitHub Actions is public mirror validation only and is not the primary
+  registry build contour.
+- Russian build-runner remains required for registry release candidate and
+  release evidence.
 
 ## Текущее состояние
 
@@ -65,6 +71,9 @@ Done / partially done:
 - Russian build-runner: planned.
 - Release artifacts storage in RF: planned.
 - Release evidence automation: partially done after this task.
+- Public CI transparency: added.
+- Coverage baseline: added, threshold not enforced yet.
+- Security scanning: added.
 - Restore test: required.
 - Legal rightsholder confirmation: required.
 

docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md

@@ -1,5 +1,44 @@
 # Registry readiness changelog
 
+## 2026-06-21 public engineering transparency
+
+Added:
+
+- Public CI workflow for GitHub mirror validation.
+- Public coverage baseline workflow.
+- Public security workflow with cargo audit, cargo deny, secret-pattern check
+  and dependency review for pull requests.
+- `SECURITY.md`, `CONTRIBUTING.md`, public `ROADMAP.md`, issue templates and
+  pull request template.
+- `docs/QUALITY_STATUS_RU.md`.
+
+Changed:
+
+- Registry manifest now records public engineering transparency fields.
+- Registry readiness check now validates public CI/security/coverage/process
+  files.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- GitHub Actions is public mirror validation only.
+- Russian build-runner remains required for registry release candidate.
+
+Checks note:
+
+- Rust/runtime checks should run in public CI and on `awatch-build-01`.
+- Local Rust checks may be skipped for this documentation/process-only update
+  only if the skip reason is recorded in the final report.
+
+Remaining gaps:
+
+- First successful public CI run after push.
+- First coverage baseline artifact after push.
+- First security scan baseline after push.
+- Actual `awatch-build-01` provisioning and registry release evidence run.
+
 ## 2026-06-21
 
 Added:

docs/registry/RELEASE_EVIDENCE_MANIFEST_RU.md

@@ -45,6 +45,9 @@ build-runner и storage release artifacts в РФ или документиро
 владельцем схему. До этого нельзя утверждать, что source/build/release contour
 полностью закрыт для подачи.
 
+Public GitHub Actions CI, coverage and security workflows are transparency
+checks only. They are not primary registry release evidence.
+
 ## Build-runner evidence
 
 Для `awatch-build-01` фиксировать:
@@ -68,3 +71,17 @@ build-runner и storage release artifacts в РФ или документиро
 Evidence должен формироваться скриптом `scripts/build_release_evidence.sh` и
 проверяться через `scripts/check_release_evidence.sh`. До первого успешного
 release candidate build нельзя утверждать, что release evidence production-ready.
+
+## Public validation evidence
+
+Public mirror validation may include:
+
+- GitHub Actions CI result;
+- coverage summary artifact;
+- cargo audit / cargo deny result;
+- dependency review result for pull requests;
+- secret-pattern check result;
+- issue and PR process evidence.
+
+This public validation can support engineering trust, but registry release
+evidence remains tied to the Russian build-runner.

docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md

@@ -4,6 +4,10 @@
 candidate на российском build-runner `awatch-build-01`. Он не утверждает, что
 release evidence уже production-ready до первого успешного запуска.
 
+GitHub Actions is public mirror validation only. Public CI, coverage and
+security workflows improve transparency, but registry release evidence must be
+produced on the Russian build-runner.
+
 ## Процесс release candidate
 
 1. Checkout конкретного commit SHA или tag.

docs/registry/RU_BUILD_RUNNER_READINESS_RU.md

@@ -12,6 +12,9 @@ Build-runner нужен для воспроизводимой сборки relea
 build/test/check задачи не конкурировали с Git-хранилищем, HTTPS reverse proxy
 и backup-процедурами.
 
+GitHub Actions is public mirror validation only. GitHub Actions is not the
+primary registry build contour and does not replace `awatch-build-01`.
+
 ## Целевая роль
 
 | Параметр | Значение |
@@ -97,5 +100,8 @@ Build-runner должен формировать:
 - Russian build-runner: planned.
 - Release artifacts storage in RF: planned.
 - Release evidence automation: partially done after this task.
+- Public CI transparency: added.
+- Coverage baseline: added.
+- Security scanning: added.
 - Restore test: required.
 - Legal rightsholder confirmation: required.

docs/registry/registry-evidence-manifest.json

@@ -73,6 +73,15 @@
       "release_manifest": true
     }
   },
+  "public_engineering_transparency": {
+    "github_actions_ci": true,
+    "coverage_baseline": true,
+    "security_scanning": true,
+    "issue_templates": true,
+    "public_roadmap": true,
+    "github_role": "public_mirror_validation_only",
+    "registry_release_build": "requires_russian_build_runner"
+  },
   "github_role_note": "GitHub is a public mirror only, not the target primary source/build/release contour for registry-readiness.",
   "remaining_gaps": [
     "legal rightsholder confirmation",