diff --git a/README.md b/README.md
index d8341bc..00951d3 100755
--- a/README.md
+++ b/README.md
@@ -263,6 +263,10 @@ collectors.
   [docs/RESIDUAL_RISKS_RU.md](docs/RESIDUAL_RISKS_RU.md).
 - Public issues plan:
   [docs/PUBLIC_ISSUES_PLAN_RU.md](docs/PUBLIC_ISSUES_PLAN_RU.md).
+- Public issue templates are prepared and should be created manually or through
+  the opt-in script; this does not claim community adoption:
+  [creation runbook](docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md),
+  [manifest](docs/public-issues/public-issues-manifest.json).
 
 ### Engineering governance and residual risks
 
@@ -272,6 +276,10 @@ collectors.
   [docs/RESIDUAL_RISKS_RU.md](docs/RESIDUAL_RISKS_RU.md).
 - Public issues plan:
   [docs/PUBLIC_ISSUES_PLAN_RU.md](docs/PUBLIC_ISSUES_PLAN_RU.md).
+- Public issues creation runbook:
+  [docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md](docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md).
+- Public issues manifest:
+  [docs/public-issues/public-issues-manifest.json](docs/public-issues/public-issues-manifest.json).
 - Advisory branch protection policy:
   [docs/BRANCH_PROTECTION_POLICY_RU.md](docs/BRANCH_PROTECTION_POLICY_RU.md).
 - CODEOWNERS and PR template are maintained for review routing and public
diff --git a/docs/PROJECT_STATUS_RU.md b/docs/PROJECT_STATUS_RU.md
index 6208017..dd2b7a3 100644
--- a/docs/PROJECT_STATUS_RU.md
+++ b/docs/PROJECT_STATUS_RU.md
@@ -32,6 +32,12 @@ backup, registry-readiness документации, плана российск
   `docs/RESIDUAL_RISKS_RU.md`.
 - План публичных GitHub issues:
   `docs/PUBLIC_ISSUES_PLAN_RU.md`.
+- Пакет шаблонов публичных GitHub issues подготовлен:
+  `docs/public-issues/`.
+- Manifest публичных issues:
+  `docs/public-issues/public-issues-manifest.json`.
+- Runbook создания публичных issues:
+  `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`.
 - Review checklist:
   `docs/REVIEW_CHECKLIST_RU.md`.
 - Advisory branch protection policy:
@@ -74,6 +80,10 @@ backup, registry-readiness документации, плана российск
   `docs/RESIDUAL_RISKS_RU.md`.
 - Подготовлен план публичных issues для ручного заведения:
   `docs/PUBLIC_ISSUES_PLAN_RU.md`.
+- Подготовлен пакет issue templates со статусом `ready_to_create`:
+  `docs/public-issues/`.
+- Подготовлен runbook ручного/opt-in создания issues:
+  `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`.
 
 ## Planned / pending
 
@@ -84,7 +94,12 @@ backup, registry-readiness документации, плана российск
 - Юридическое подтверждение правообладателя.
 - Финальная юридическая проверка пакета документов перед подачей.
 - Проверка совместимости с российскими ОС.
-- Публичные roadmap/issues из `docs/PUBLIC_ISSUES_PLAN_RU.md`.
+- Публичные roadmap/issues из `docs/PUBLIC_ISSUES_PLAN_RU.md`: templates
+  готовы, создание самих GitHub issues остается manual/pending, пока URLs не
+  записаны в `docs/public-issues/public-issues-manifest.json`.
+- GitHub issue creation remains pending until URLs are recorded in
+  `docs/public-issues/public-issues-manifest.json`.
+- URLs remain pending in `docs/public-issues/public-issues-manifest.json`.
 - Visible external code review is still pending.
 - Branch protection enablement is not claimed until repository settings are
   verified.
@@ -119,4 +134,6 @@ backup, registry-readiness документации, плана российск
 - `docs/REVIEW_CHECKLIST_RU.md`
 - `docs/RESIDUAL_RISKS_RU.md`
 - `docs/PUBLIC_ISSUES_PLAN_RU.md`
+- `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`
+- `docs/public-issues/public-issues-manifest.json`
 - `docs/BRANCH_PROTECTION_POLICY_RU.md`
diff --git a/docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md b/docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md
new file mode 100644
index 0000000..a8d71d3
--- /dev/null
+++ b/docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md
@@ -0,0 +1,137 @@
+# Runbook создания публичных GitHub issues
+
+Дата: 2026-06-23
+
+Статус: issue templates готовы к созданию. Реальные GitHub issues считаются
+pending, пока ссылки не записаны в
+`docs/public-issues/public-issues-manifest.json`.
+
+GitHub issues используются для public roadmap visibility. Они не являются
+registry release evidence. Primary registry contour остается Russian Gitea +
+planned Russian build-runner.
+
+## Подготовленный пакет
+
+- Issue templates: `docs/public-issues/*.md`.
+- Manifest: `docs/public-issues/public-issues-manifest.json`.
+- Dry-run check: `scripts/prepare_public_issues.sh`.
+- Opt-in creation script: `scripts/create_public_issues_from_manifest.sh`.
+
+## Ручное создание через GitHub UI
+
+1. Открыть GitHub repository issue tracker.
+2. Для каждого файла `docs/public-issues/NNN-*.md` создать новый issue.
+3. Взять `Title` из секции `## Title`.
+4. Скопировать тело issue из markdown-файла целиком.
+5. Назначить labels из секции `## Labels`.
+6. Проверить, что в тексте нет секретов, персональных данных, реальных
+   customer identifiers, внутренних IP/hostname и логов сотрудников.
+7. После публикации скопировать URL issue.
+8. Обновить `github_issue_url` в
+   `docs/public-issues/public-issues-manifest.json`.
+
+## Создание через gh CLI
+
+Dry-run:
+
+```bash
+bash scripts/prepare_public_issues.sh
+```
+
+Скрипт проверяет наличие файлов, обязательные секции и manifest. Он не требует
+GitHub token и не создает issues.
+
+Opt-in создание:
+
+```bash
+gh auth status
+CONFIRM_CREATE_GITHUB_ISSUES=YES bash scripts/create_public_issues_from_manifest.sh
+```
+
+Скрипт:
+
+- требует `CONFIRM_CREATE_GITHUB_ISSUES=YES`;
+- требует `gh` и `jq`;
+- проверяет `gh auth status`;
+- создает отсутствующие labels;
+- создает issues по manifest;
+- печатает URL созданных issues для последующего ручного внесения в manifest.
+
+Скрипт не запускается из `scripts/registry_readiness_check.sh`.
+
+## Labels
+
+Ожидаемые labels:
+
+- `registry`
+- `ops`
+- `evidence`
+- `build-runner`
+- `release`
+- `legal`
+- `docs`
+- `qa`
+- `coverage`
+- `policy`
+- `security`
+- `review`
+- `governance`
+- `compat`
+- `demo`
+- `public`
+- `pilot`
+- `process`
+- `github`
+
+## Обновление manifest после создания
+
+До создания:
+
+```json
+"github_issue_url": null
+```
+
+После создания:
+
+```json
+"github_issue_url": "https://github.com/igor04091968/AWatch-rus/issues/<number>"
+```
+
+Status можно оставлять `ready_to_create` до отдельного решения о переводе в
+`created`; минимальное evidence требование - наличие URL.
+
+## Запрещенные данные
+
+В публичные issues нельзя вставлять:
+
+- пароли, tokens, private keys, recovery codes;
+- реальные IP, hostname, VPN details или private network topology;
+- ФИО сотрудников, логи сотрудников, screenshots с персональными данными;
+- customer identifiers, contract data или private legal evidence;
+- security exploit details до triage по `SECURITY.md`.
+
+## Forbidden claims
+
+Issues не должны утверждать:
+
+- Do not claim completed Russian software registry submission.
+- Do not claim FSTEC/FSB certification.
+- Do not claim SIEM/DLP replacement.
+- Forbidden claim: ML/LLM-based detection is not claimed.
+- Forbidden claim: automatic remediation is not claimed.
+- Do not claim active external peer review until public reviewed PRs exist.
+- Do not claim enabled branch protection until repository settings are verified.
+- Do not claim ready Russian build-runner until provisioning evidence exists.
+- Do not claim completed restore test until restore evidence exists.
+
+## Проверки перед commit
+
+```bash
+python3 scripts/public_secret_pattern_check.py
+bash -n scripts/prepare_public_issues.sh
+bash scripts/prepare_public_issues.sh
+bash -n scripts/create_public_issues_from_manifest.sh
+bash -n scripts/registry_readiness_check.sh
+bash scripts/registry_readiness_check.sh
+git diff --check
+```
diff --git a/docs/PUBLIC_ISSUES_PLAN_RU.md b/docs/PUBLIC_ISSUES_PLAN_RU.md
index e4e4bcc..438087d 100644
--- a/docs/PUBLIC_ISSUES_PLAN_RU.md
+++ b/docs/PUBLIC_ISSUES_PLAN_RU.md
@@ -2,30 +2,43 @@
 
 Дата: 2026-06-22
 
-Статус: public governance backlog plan.
+Статус: public governance backlog plan; issue templates are
+`ready_to_create`.
 
 Этот документ перечисляет публичные GitHub issues, которые нужно завести
-вручную. Он не утверждает, что задачи уже созданы или выполнены.
+вручную или через opt-in `gh` script. Он не утверждает, что задачи уже созданы
+или выполнены.
 
 Цель: повысить visibility development process после настройки российского
 Gitea-контура, backup, public CI, coverage, security scanning и status freeze.
 
+Подготовленный пакет:
+
+- issue templates: `docs/public-issues/`;
+- machine manifest:
+  `docs/public-issues/public-issues-manifest.json`;
+- creation runbook: `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`;
+- dry-run check: `scripts/prepare_public_issues.sh`;
+- opt-in creation script: `scripts/create_public_issues_from_manifest.sh`.
+
+Реальные GitHub issue URLs остаются pending, пока они не записаны в manifest.
+
 ## Issues to create manually
 
 | Title | Labels | Short goal | Acceptance criteria | Status |
 | --- | --- | --- | --- | --- |
-| `[registry] Perform Gitea backup restore test` | `registry`, `ops`, `evidence` | Prove restore procedure on a separate host and keep `restore_tested=false` until evidence exists. | Restore log, checksum verification, post-restore checks and rollback notes are attached or linked. | planned |
-| `[registry] Prepare temporary Russian build-runner awatch-build-01` | `registry`, `build-runner`, `ops` | Provision temporary or permanent Russian build-runner for registry release evidence. | Host provisioning notes, toolchain list, Gitea access method and required checks plan are documented. | planned |
-| `[release] Produce first release evidence package` | `release`, `registry`, `evidence` | Run release evidence scripts on `awatch-build-01` and collect artifacts/logs/checksums. | Release evidence manifest, logs, checksums and artifact storage path are documented. | planned |
-| `[legal] Prepare rightsholder evidence package` | `legal`, `registry`, `docs` | Prepare rightsholder and legal evidence for future registry submission. | Rightsholder evidence checklist, ownership notes and legal review TODOs are documented. | planned |
-| `[qa] Define coverage threshold policy` | `qa`, `coverage`, `policy` | Define threshold only after stable coverage baseline review. | Coverage baseline reviewed and initial threshold policy proposed without blocking current baseline workflow. | planned |
-| `[security] Prepare external security/code review checklist` | `security`, `review`, `governance` | Establish visible peer review and external security review checklist. | Checklist references `docs/REVIEW_CHECKLIST_RU.md` and defines public review evidence expectations. | planned |
-| `[compat] Test Russian OS compatibility matrix` | `compat`, `qa`, `registry` | Validate supported Russian OS matrix and document evidence. | Matrix lists target OS versions, test status and gaps without unsupported compatibility claims. | planned |
-| `[ops] Validate release artifacts storage in RF` | `ops`, `release`, `registry` | Confirm release artifact storage location and retention in the Russian contour. | Storage path, retention, access model and checksum verification procedure are documented. | planned |
-| `[docs] Refresh public demo pack and screenshots` | `docs`, `demo`, `public` | Update public demo pack, screenshots and non-sensitive demo evidence. | Demo materials contain no secrets, PII, real employee data or customer infrastructure identifiers. | planned |
-| `[pilot] Prepare Pilot Acceptance Checklist v2` | `pilot`, `qa`, `docs` | Update pilot acceptance checklist after residual risk register and public issue plan. | Checklist references residual risks, smoke checks and acceptance evidence needed for pilot stage. | planned |
-| `[governance] Enable PR-based review workflow` | `governance`, `review`, `process` | Move visible changes through pull requests where practical. | First public PR review record exists or a documented dry-run PR demonstrates the process. | planned |
-| `[governance] Add branch protection policy` | `governance`, `github`, `policy` | Configure GitHub branch protection after maintainer review of the advisory policy. | Branch protection settings are documented with screenshots or notes, or blockers are recorded. | planned |
+| `[registry] Perform Gitea backup restore test` | `registry`, `ops`, `evidence` | Prove restore procedure on a separate host and keep `restore_tested=false` until evidence exists. | Restore log, checksum verification, post-restore checks and rollback notes are attached or linked. | ready_to_create |
+| `[registry] Prepare temporary Russian build-runner awatch-build-01` | `registry`, `build-runner`, `ops` | Provision temporary or permanent Russian build-runner for registry release evidence. | Host provisioning notes, toolchain list, Gitea access method and required checks plan are documented. | ready_to_create |
+| `[release] Produce first release evidence package` | `release`, `registry`, `evidence` | Run release evidence scripts on `awatch-build-01` and collect artifacts/logs/checksums. | Release evidence manifest, logs, checksums and artifact storage path are documented. | ready_to_create |
+| `[legal] Prepare rightsholder evidence package` | `legal`, `registry`, `docs` | Prepare rightsholder and legal evidence for future registry submission. | Rightsholder evidence checklist, ownership notes and legal review TODOs are documented. | ready_to_create |
+| `[qa] Define coverage threshold policy` | `qa`, `coverage`, `policy` | Define threshold only after stable coverage baseline review. | Coverage baseline reviewed and initial threshold policy proposed without blocking current baseline workflow. | ready_to_create |
+| `[security] Prepare external security/code review checklist` | `security`, `review`, `governance` | Establish visible peer review and external security review checklist. | Checklist references `docs/REVIEW_CHECKLIST_RU.md` and defines public review evidence expectations. | ready_to_create |
+| `[compat] Test Russian OS compatibility matrix` | `compat`, `qa`, `registry` | Validate supported Russian OS matrix and document evidence. | Matrix lists target OS versions, test status and gaps without unsupported compatibility claims. | ready_to_create |
+| `[ops] Validate release artifacts storage in RF` | `ops`, `release`, `registry` | Confirm release artifact storage location and retention in the Russian contour. | Storage path, retention, access model and checksum verification procedure are documented. | ready_to_create |
+| `[docs] Refresh public demo pack and screenshots` | `docs`, `demo`, `public` | Update public demo pack, screenshots and non-sensitive demo evidence. | Demo materials contain no secrets, PII, real employee data or customer infrastructure identifiers. | ready_to_create |
+| `[pilot] Prepare Pilot Acceptance Checklist v2` | `pilot`, `qa`, `docs` | Update pilot acceptance checklist after residual risk register and public issue plan. | Checklist references residual risks, smoke checks and acceptance evidence needed for pilot stage. | ready_to_create |
+| `[governance] Enable PR-based review workflow` | `governance`, `review`, `process` | Move visible changes through pull requests where practical. | First public PR review record exists or a documented dry-run PR demonstrates the process. | ready_to_create |
+| `[governance] Add branch protection policy` | `governance`, `github`, `policy` | Configure GitHub branch protection after maintainer review of the advisory policy. | Branch protection settings are documented with screenshots or notes, or blockers are recorded. | ready_to_create |
 
 ## Guardrails
 
diff --git a/docs/RESIDUAL_RISKS_RU.md b/docs/RESIDUAL_RISKS_RU.md
index 6c3de7e..20e2792 100644
--- a/docs/RESIDUAL_RISKS_RU.md
+++ b/docs/RESIDUAL_RISKS_RU.md
@@ -68,19 +68,23 @@ visibility, release evidence contour and legal package. Они требуют д
 
 ## 3. Низкая публичная активность issue tracker
 
-- Текущий статус: риск открыт частично; issue templates and public roadmap
-  exist, but public roadmap-tasks are still few.
+- Текущий статус: риск открыт частично; issue templates, public roadmap and
+  issue creation package exist, but real GitHub issues are still pending until
+  URLs are recorded.
 - Влияние: низкая внешняя visibility development process; сложнее показать
   плановое управление backlog and governance.
 - Почему не блокирует pilot/readiness stage: templates, roadmap and status docs
   already define expected process; missing public tasks are a visibility gap,
   not a runtime readiness gap.
 - Как риск будет снижаться: manually create public issues for registry, QA,
-  security, compatibility, ops and pilot follow-up work.
+  security, compatibility, ops and pilot follow-up work using
+  `docs/public-issues/` and `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`.
 - Уже снижающие evidence/documents/CI: `ROADMAP.md`, issue templates,
-  `docs/PROJECT_STATUS_RU.md`, `docs/PUBLIC_ISSUES_PLAN_RU.md`.
-- Следующий action: завести публичные issues по списку из
-  `docs/PUBLIC_ISSUES_PLAN_RU.md`.
+  `docs/PROJECT_STATUS_RU.md`, `docs/PUBLIC_ISSUES_PLAN_RU.md`,
+  `docs/public-issues/public-issues-manifest.json`,
+  `scripts/prepare_public_issues.sh`.
+- Следующий action: создать реальные GitHub issues и записать URLs в
+  `docs/public-issues/public-issues-manifest.json`.
 
 ## 4. Низкая community adoption
 
@@ -183,3 +187,5 @@ visibility, release evidence contour and legal package. Они требуют д
 Полный список задач для ручного заведения в GitHub issue tracker:
 
 - `docs/PUBLIC_ISSUES_PLAN_RU.md`.
+- `docs/public-issues/`.
+- `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md`.
diff --git a/docs/public-issues/001-registry-gitea-restore-test.md b/docs/public-issues/001-registry-gitea-restore-test.md
new file mode 100644
index 0000000..e292736
--- /dev/null
+++ b/docs/public-issues/001-registry-gitea-restore-test.md
@@ -0,0 +1,73 @@
+# Public issue template 001
+
+## Title
+
+[registry] Perform Gitea backup restore test
+
+## Labels
+
+`registry`, `ops`, `evidence`
+
+## Purpose
+
+Prove that the documented Gitea backup can be restored on a separate host and
+that restore evidence is reproducible.
+
+## Background
+
+The Russian Gitea contour and backup process are documented, but restore proof
+is not complete. The registry evidence manifest must keep restore status pending
+until a separate-host restore drill is recorded.
+
+## Scope
+
+- Run a restore drill on a separate test host or isolated environment.
+- Verify backup checksum before restore.
+- Verify repository availability after restore.
+- Record commands, logs, timestamps and rollback notes in non-sensitive form.
+
+## Non-goals
+
+- No production restore.
+- No change to runtime services, API, UI or business logic.
+- No claim that registry submission is complete.
+
+## Acceptance criteria
+
+- Restore log is attached or linked.
+- SHA256 verification is recorded.
+- Post-restore repository checks are recorded.
+- Rollback or cleanup notes are recorded.
+- Registry evidence manifest is updated only after evidence exists.
+
+## Evidence required
+
+- Backup artifact name without secrets.
+- Checksum verification output.
+- Restore command log with sensitive values redacted.
+- Post-restore repository clone or integrity check.
+- Reviewer note confirming evidence location.
+
+## Safety/privacy guardrails
+
+- Do not publish passwords, tokens, private keys or recovery codes.
+- Do not publish customer identifiers, employee data or private infrastructure
+  details.
+- Redact internal paths when they expose sensitive topology.
+
+## Registry-positioning guardrails
+
+- Keep `restore_tested=false` until evidence is recorded.
+- Do not describe the restore contour as registry-ready until the drill is
+  complete and reviewed.
+- GitHub issue visibility is public roadmap visibility, not registry release
+  evidence.
+
+## Checklist
+
+- [ ] Select isolated restore target.
+- [ ] Verify backup checksum.
+- [ ] Perform restore.
+- [ ] Run post-restore repository checks.
+- [ ] Record evidence location.
+- [ ] Update manifest only after evidence exists.
diff --git a/docs/public-issues/002-registry-russian-build-runner.md b/docs/public-issues/002-registry-russian-build-runner.md
new file mode 100644
index 0000000..bb4f3f0
--- /dev/null
+++ b/docs/public-issues/002-registry-russian-build-runner.md
@@ -0,0 +1,68 @@
+# Public issue template 002
+
+## Title
+
+[registry] Prepare temporary Russian build-runner awatch-build-01
+
+## Labels
+
+`registry`, `build-runner`, `ops`
+
+## Purpose
+
+Prepare the Russian build-runner contour required for registry release
+evidence.
+
+## Background
+
+GitHub Actions is public mirror validation only. Registry release evidence must
+be produced in the Russian contour connected to the Russian Gitea source.
+
+## Scope
+
+- Define provisioning notes for `awatch-build-01`.
+- Document toolchain, OS baseline, access model and Gitea clone method.
+- Document required checks for release evidence builds.
+- Keep runner status pending until provisioning evidence exists.
+
+## Non-goals
+
+- No production deployment.
+- No automatic release.
+- No claim that the build-runner is already ready.
+
+## Acceptance criteria
+
+- Build-runner setup notes exist.
+- Toolchain list is documented.
+- Gitea access method is documented without secrets.
+- Required checks list is documented.
+- Known blockers are recorded.
+
+## Evidence required
+
+- Host provisioning notes without sensitive addresses.
+- Toolchain versions.
+- Gitea access verification with credentials redacted.
+- Planned release evidence command list.
+
+## Safety/privacy guardrails
+
+- Do not publish credentials, VPN data, SSH keys or private network topology.
+- Do not include live internal IPs or host access details in the public issue.
+- Use sanitized host labels where possible.
+
+## Registry-positioning guardrails
+
+- Do not mark `awatch-build-01` as ready before evidence exists.
+- Do not use GitHub Actions output as registry release evidence.
+- Primary registry contour remains Russian Gitea plus Russian build-runner.
+
+## Checklist
+
+- [ ] Confirm target OS and hosting contour.
+- [ ] Install required toolchain.
+- [ ] Verify Russian Gitea clone path.
+- [ ] Document required checks.
+- [ ] Record blockers.
+- [ ] Update registry evidence docs only after verification.
diff --git a/docs/public-issues/003-release-evidence-package.md b/docs/public-issues/003-release-evidence-package.md
new file mode 100644
index 0000000..e8b3c7c
--- /dev/null
+++ b/docs/public-issues/003-release-evidence-package.md
@@ -0,0 +1,70 @@
+# Public issue template 003
+
+## Title
+
+[release] Produce first release evidence package
+
+## Labels
+
+`release`, `registry`, `evidence`
+
+## Purpose
+
+Produce the first release evidence package from the Russian build-runner once
+the runner is available.
+
+## Background
+
+Release evidence scripts exist, but the first real release evidence build must
+run in the Russian build contour before it can be treated as registry evidence.
+
+## Scope
+
+- Run release evidence scripts on the Russian build-runner.
+- Collect logs, checksums, artifact manifest and command versions.
+- Store evidence in the documented Russian storage contour.
+- Link evidence from registry documentation after review.
+
+## Non-goals
+
+- No claim that release evidence is already produced.
+- No publication of secret build logs.
+- No runtime, API or UI changes.
+
+## Acceptance criteria
+
+- Release evidence manifest exists.
+- Build logs are retained with secrets redacted.
+- Checksums are recorded.
+- Artifact storage path is documented.
+- Review note confirms evidence completeness.
+
+## Evidence required
+
+- Release manifest.
+- Build logs.
+- SHA256 checksums.
+- Cargo metadata/tree or equivalent dependency evidence.
+- Artifact retention note.
+
+## Safety/privacy guardrails
+
+- Do not publish credentials, private paths with sensitive data or customer
+  environment identifiers.
+- Redact tokens and private repository access details.
+- Keep evidence links scoped to approved public-safe material.
+
+## Registry-positioning guardrails
+
+- Do not treat GitHub Actions as release evidence.
+- Do not claim registry submission is complete.
+- Keep evidence pending until artifacts and checksums exist.
+
+## Checklist
+
+- [ ] Confirm build-runner readiness.
+- [ ] Run release evidence script.
+- [ ] Verify generated checksums.
+- [ ] Store artifacts in Russian contour.
+- [ ] Review logs for sensitive data.
+- [ ] Record evidence links.
diff --git a/docs/public-issues/004-legal-rightsholder-package.md b/docs/public-issues/004-legal-rightsholder-package.md
new file mode 100644
index 0000000..c521a8f
--- /dev/null
+++ b/docs/public-issues/004-legal-rightsholder-package.md
@@ -0,0 +1,67 @@
+# Public issue template 004
+
+## Title
+
+[legal] Prepare rightsholder evidence package
+
+## Labels
+
+`legal`, `registry`, `docs`
+
+## Purpose
+
+Prepare the rightsholder and legal evidence checklist needed before any future
+Russian software registry submission.
+
+## Background
+
+Technical readiness documentation does not replace legal confirmation. The
+rightsholder package remains pending until reviewed by the responsible party.
+
+## Scope
+
+- Prepare a rightsholder evidence checklist.
+- Identify ownership and license evidence to collect.
+- Document legal review TODOs.
+- Keep public wording conservative.
+
+## Non-goals
+
+- No legal conclusion by engineering.
+- No claim that registry submission is complete.
+- No publication of confidential contracts or personal data.
+
+## Acceptance criteria
+
+- Checklist of required legal evidence exists.
+- Ownership evidence categories are documented.
+- Open legal questions are recorded.
+- Public docs avoid certification and registry-completion claims.
+
+## Evidence required
+
+- Legal checklist document.
+- Rightsholder evidence inventory in non-sensitive form.
+- Dependency/license summary reference.
+- Legal review status note.
+
+## Safety/privacy guardrails
+
+- Do not publish passport data, signatures, contracts or confidential legal
+  documents.
+- Do not expose personal data of representatives.
+- Use references to private evidence storage when needed.
+
+## Registry-positioning guardrails
+
+- Do not claim legal readiness until formal review is complete.
+- Do not claim completed Russian software registry submission.
+- GitHub issues are public tracking, not legal evidence.
+
+## Checklist
+
+- [ ] Draft rightsholder evidence checklist.
+- [ ] Map ownership evidence categories.
+- [ ] Reference dependency/license documents.
+- [ ] Record open legal questions.
+- [ ] Review public wording for forbidden claims.
diff --git a/docs/public-issues/005-coverage-threshold-policy.md b/docs/public-issues/005-coverage-threshold-policy.md
new file mode 100644
index 0000000..42b9646
--- /dev/null
+++ b/docs/public-issues/005-coverage-threshold-policy.md
@@ -0,0 +1,67 @@
+# Public issue template 005
+
+## Title
+
+[qa] Define coverage threshold policy
+
+## Labels
+
+`qa`, `coverage`, `policy`
+
+## Purpose
+
+Define a conservative coverage threshold policy after the baseline is stable and
+reviewed.
+
+## Background
+
+Coverage workflow exists for visibility, but threshold enforcement is not
+enabled yet. Premature thresholds can create noisy failures before the baseline
+is understood.
+
+## Scope
+
+- Review current coverage baseline.
+- Identify crates or modules where thresholds are meaningful.
+- Propose a staged threshold policy.
+- Document exceptions and review cadence.
+
+## Non-goals
+
+- No immediate hard threshold without baseline review.
+- No claim that coverage proves absence of defects.
+- No runtime, API or UI changes.
+
+## Acceptance criteria
+
+- Baseline coverage summary is reviewed.
+- Initial threshold proposal is documented.
+- Exceptions are documented.
+- Enforcement plan is staged and reversible.
+
+## Evidence required
+
+- Coverage workflow artifact reference.
+- Baseline review notes.
+- Proposed threshold values.
+- Rationale for exclusions or delayed enforcement.
+
+## Safety/privacy guardrails
+
+- Do not publish private test data or production logs.
+- Keep coverage artifacts free of secrets and customer identifiers.
+- Avoid copying sensitive paths into public issue text.
+
+## Registry-positioning guardrails
+
+- Coverage visibility is quality evidence, not registry release evidence.
+- Threshold policy must not imply certification.
+- GitHub remains public mirror validation only.
+
+## Checklist
+
+- [ ] Review coverage baseline.
+- [ ] Identify meaningful threshold scope.
+- [ ] Document proposed values.
+- [ ] Document exclusions.
+- [ ] Decide when enforcement can start.
diff --git a/docs/public-issues/006-external-security-code-review-checklist.md b/docs/public-issues/006-external-security-code-review-checklist.md
new file mode 100644
index 0000000..a1561fe
--- /dev/null
+++ b/docs/public-issues/006-external-security-code-review-checklist.md
@@ -0,0 +1,65 @@
+# Public issue template 006
+
+## Title
+
+[security] Prepare external security/code review checklist
+
+## Labels
+
+`security`, `review`, `governance`
+
+## Purpose
+
+Prepare a public checklist for future visible external security/code review.
+
+## Background
+
+Review checklist and CODEOWNERS exist, but active external peer review is not
+claimed until public reviewed pull requests or equivalent evidence exist.
+
+## Scope
+
+- Extend review evidence expectations from `docs/REVIEW_CHECKLIST_RU.md`.
+- Define security review scope and artifacts.
+- Define how reviewed PRs will be referenced.
+- Define forbidden data for public review comments.
+
+## Non-goals
+
+- No claim that external review is already active.
+- No publication of sensitive findings before triage.
+- Forbidden claim: automatic remediation is not claimed.
+
+## Acceptance criteria
+
+- External/security review checklist is documented.
+- Evidence format for reviewed PRs is defined.
+- Sensitive disclosure handling is documented.
+- First review remains pending until public evidence exists.
+
+## Evidence required
+
+- Checklist document.
+- Link to review policy.
+- Future reviewed PR URL or placeholder status.
+- Security disclosure guardrails.
+
+## Safety/privacy guardrails
+
+- Do not publish exploit details before coordinated handling.
+- Do not publish customer data, employee data or secrets.
+- Keep vulnerability handling aligned with `SECURITY.md`.
+
+## Registry-positioning guardrails
+
+- Do not claim active external peer review until public reviewed PRs exist.
+- Security review evidence is governance evidence, not certification.
+- Do not claim FSTEC/FSB certification.
+
+## Checklist
+
+- [ ] Draft external review checklist.
+- [ ] Define evidence requirements.
+- [ ] Define sensitive disclosure rules.
+- [ ] Link to `docs/REVIEW_CHECKLIST_RU.md`.
+- [ ] Record first reviewed PR only after it exists.
diff --git a/docs/public-issues/007-russian-os-compatibility-matrix.md b/docs/public-issues/007-russian-os-compatibility-matrix.md
new file mode 100644
index 0000000..ad5e111
--- /dev/null
+++ b/docs/public-issues/007-russian-os-compatibility-matrix.md
@@ -0,0 +1,66 @@
+# Public issue template 007
+
+## Title
+
+[compat] Test Russian OS compatibility matrix
+
+## Labels
+
+`compat`, `qa`, `registry`
+
+## Purpose
+
+Build an evidence-backed compatibility matrix for target Russian operating
+systems.
+
+## Background
+
+Compatibility must be tested and documented. Unsupported compatibility claims
+must not be made before evidence exists.
+
+## Scope
+
+- Define target OS versions.
+- Run installation and smoke checks where applicable.
+- Record pass/fail/blocked status.
+- Document gaps and next actions.
+
+## Non-goals
+
+- No claim of support for untested OS versions.
+- No certification claims.
+- No runtime change in this issue.
+
+## Acceptance criteria
+
+- Compatibility matrix exists.
+- Each target OS has status and evidence reference.
+- Failed or blocked cases include next action.
+- Public wording avoids unsupported claims.
+
+## Evidence required
+
+- OS/version list.
+- Test command summary.
+- Smoke check results.
+- Known gaps and blockers.
+
+## Safety/privacy guardrails
+
+- Do not publish customer infrastructure identifiers.
+- Do not publish private hostnames, credentials or internal IPs.
+- Use sanitized environment descriptions.
+
+## Registry-positioning guardrails
+
+- Compatibility matrix is evidence support, not registry completion.
+- Do not claim FSTEC/FSB certification.
+- Do not claim support until test evidence exists.
+
+## Checklist
+
+- [ ] Define OS list.
+- [ ] Run installation checks.
+- [ ] Run smoke checks.
+- [ ] Record evidence.
+- [ ] Update compatibility matrix.
diff --git a/docs/public-issues/008-release-artifacts-storage-rf.md b/docs/public-issues/008-release-artifacts-storage-rf.md
new file mode 100644
index 0000000..8296add
--- /dev/null
+++ b/docs/public-issues/008-release-artifacts-storage-rf.md
@@ -0,0 +1,67 @@
+# Public issue template 008
+
+## Title
+
+[ops] Validate release artifacts storage in RF
+
+## Labels
+
+`ops`, `release`, `registry`
+
+## Purpose
+
+Validate the storage location, retention and integrity process for release
+artifacts in the Russian contour.
+
+## Background
+
+Release evidence requires reproducible artifacts and checksums stored in the
+approved contour. Storage remains pending until verified.
+
+## Scope
+
+- Identify storage path or service in the Russian contour.
+- Document retention and access model.
+- Verify checksum procedure.
+- Document backup or immutability expectations.
+
+## Non-goals
+
+- No publication of private artifact URLs if access is restricted.
+- No release creation.
+- No runtime/API/UI change.
+
+## Acceptance criteria
+
+- Storage location is documented in non-sensitive form.
+- Retention policy is documented.
+- Access model is documented.
+- Checksum verification procedure is documented.
+
+## Evidence required
+
+- Storage policy note.
+- Checksum verification example.
+- Retention setting or procedure.
+- Access model review note.
+
+## Safety/privacy guardrails
+
+- Do not publish credentials or private storage tokens.
+- Do not expose private URLs that grant access.
+- Redact internal storage topology where needed.
+
+## Registry-positioning guardrails
+
+- Storage validation is a prerequisite for release evidence, not proof of
+  registry submission.
+- Do not claim release package completion until artifacts exist.
+- Primary evidence remains in the Russian contour.
+
+## Checklist
+
+- [ ] Identify storage contour.
+- [ ] Document retention.
+- [ ] Document access model.
+- [ ] Verify checksum procedure.
+- [ ] Record blockers.
diff --git a/docs/public-issues/009-public-demo-pack-refresh.md b/docs/public-issues/009-public-demo-pack-refresh.md
new file mode 100644
index 0000000..ba75d21
--- /dev/null
+++ b/docs/public-issues/009-public-demo-pack-refresh.md
@@ -0,0 +1,67 @@
+# Public issue template 009
+
+## Title
+
+[docs] Refresh public demo pack and screenshots
+
+## Labels
+
+`docs`, `demo`, `public`
+
+## Purpose
+
+Refresh public demo materials and screenshots while keeping them free of
+sensitive data.
+
+## Background
+
+Public demo evidence improves transparency, but demo assets must not expose
+customer infrastructure, employee data or secrets.
+
+## Scope
+
+- Review demo pack and screenshots.
+- Replace stale screenshots where needed.
+- Confirm demo data is synthetic or anonymized.
+- Update public demo references.
+
+## Non-goals
+
+- No use of real employee activity logs.
+- No customer infrastructure disclosure.
+- No product behavior change.
+
+## Acceptance criteria
+
+- Demo assets are current.
+- Sensitive data review is recorded.
+- Screenshots use synthetic/anonymized data.
+- README/docs links remain valid.
+
+## Evidence required
+
+- Updated demo asset list.
+- Screenshot review note.
+- Secret/PII scan result.
+- Link validation notes where applicable.
+
+## Safety/privacy guardrails
+
+- Do not publish secrets, tokens, internal hostnames, private IPs, employee
+  names or customer identifiers.
+- Use synthetic data for examples.
+- Remove metadata from images when needed.
+
+## Registry-positioning guardrails
+
+- Demo pack is public visibility, not registry release evidence.
+- Do not claim customer adoption from demo assets.
+- Do not imply certification.
+
+## Checklist
+
+- [ ] Inventory demo assets.
+- [ ] Refresh stale screenshots.
+- [ ] Check for secrets and PII.
+- [ ] Update references.
+- [ ] Record review result.
diff --git a/docs/public-issues/010-pilot-acceptance-checklist-v2.md b/docs/public-issues/010-pilot-acceptance-checklist-v2.md
new file mode 100644
index 0000000..65f6873
--- /dev/null
+++ b/docs/public-issues/010-pilot-acceptance-checklist-v2.md
@@ -0,0 +1,66 @@
+# Public issue template 010
+
+## Title
+
+[pilot] Prepare Pilot Acceptance Checklist v2
+
+## Labels
+
+`pilot`, `qa`, `docs`
+
+## Purpose
+
+Update pilot acceptance criteria after the residual risk register and public
+issue plan.
+
+## Background
+
+Pilot acceptance must distinguish technical readiness, operational evidence,
+governance visibility and pending registry release evidence.
+
+## Scope
+
+- Update pilot acceptance checklist.
+- Reference residual risks and smoke checks.
+- Define evidence required for pilot closeout.
+- Keep registry completion claims out of pilot wording.
+
+## Non-goals
+
+- No change to runtime behavior.
+- No claim that registry submission is complete.
+- No automatic acceptance without evidence.
+
+## Acceptance criteria
+
+- Pilot checklist v2 exists.
+- Residual risks are referenced.
+- Smoke and evidence checks are listed.
+- Pending registry items remain marked pending.
+
+## Evidence required
+
+- Updated checklist.
+- Links to residual risks and validation runbooks.
+- Pilot smoke command results when available.
+- Open gap list.
+
+## Safety/privacy guardrails
+
+- Do not publish real customer data, employee logs or confidential pilot notes.
+- Use sanitized evidence references.
+- Keep private pilot evidence outside public issue text.
+
+## Registry-positioning guardrails
+
+- Pilot acceptance is not registry registration.
+- Registry release evidence still requires the Russian build-runner.
+- Do not claim certification or SIEM/DLP replacement.
+
+## Checklist
+
+- [ ] Review current pilot checklist.
+- [ ] Add residual risk references.
+- [ ] Add smoke/evidence requirements.
+- [ ] Mark pending registry items.
+- [ ] Review forbidden claims.
diff --git a/docs/public-issues/011-governance-pr-based-review-workflow.md b/docs/public-issues/011-governance-pr-based-review-workflow.md
new file mode 100644
index 0000000..d003263
--- /dev/null
+++ b/docs/public-issues/011-governance-pr-based-review-workflow.md
@@ -0,0 +1,66 @@
+# Public issue template 011
+
+## Title
+
+[governance] Enable PR-based review workflow
+
+## Labels
+
+`governance`, `review`, `process`
+
+## Purpose
+
+Move visible changes through pull requests where practical and record review
+evidence.
+
+## Background
+
+PR template, CODEOWNERS and review checklist exist. Active visible external
+review is still pending until reviewed public PRs exist.
+
+## Scope
+
+- Define PR-based workflow for public changes.
+- Run a documented dry-run PR or first reviewed PR.
+- Record required status checks.
+- Record review evidence expectations.
+
+## Non-goals
+
+- No claim that external review is already active.
+- No bypass of emergency maintainer control for security incidents.
+- No runtime behavior change.
+
+## Acceptance criteria
+
+- PR workflow is documented.
+- First reviewed PR or dry-run PR is recorded.
+- Required evidence and checks are listed.
+- Open blockers are documented.
+
+## Evidence required
+
+- Reviewed PR URL or dry-run PR URL after creation.
+- Checklist completion note.
+- CI/security/coverage status notes.
+- Review comment or approval evidence when available.
+
+## Safety/privacy guardrails
+
+- Do not publish secrets or private customer context in PRs or issues.
+- Do not expose security-sensitive details before triage.
+- Keep emergency fixes possible under documented policy.
+
+## Registry-positioning guardrails
+
+- PR review workflow is governance evidence, not registry release evidence.
+- Do not claim external peer review is active until public reviewed PRs exist.
+- GitHub remains public mirror validation only.
+
+## Checklist
+
+- [ ] Define PR workflow.
+- [ ] Create dry-run or first reviewed PR.
+- [ ] Record checks.
+- [ ] Record review evidence.
+- [ ] Update status docs after evidence exists.
diff --git a/docs/public-issues/012-governance-branch-protection-policy.md b/docs/public-issues/012-governance-branch-protection-policy.md
new file mode 100644
index 0000000..6aba8cb
--- /dev/null
+++ b/docs/public-issues/012-governance-branch-protection-policy.md
@@ -0,0 +1,67 @@
+# Public issue template 012
+
+## Title
+
+[governance] Add branch protection policy
+
+## Labels
+
+`governance`, `github`, `policy`
+
+## Purpose
+
+Verify and, after maintainer review, configure GitHub branch protection aligned
+with the advisory policy.
+
+## Background
+
+Branch protection policy is documented as advisory. It must not be claimed as
+enabled until repository settings are verified and evidence is recorded.
+
+## Scope
+
+- Review advisory branch protection policy.
+- Verify current repository settings.
+- Configure settings if approved.
+- Record screenshots or textual evidence after verification.
+
+## Non-goals
+
+- No claim that branch protection is enabled before verification.
+- No destructive repository setting changes without maintainer review.
+- No runtime/API/UI change.
+
+## Acceptance criteria
+
+- Current branch protection state is documented.
+- Approved settings are recorded.
+- Evidence is attached or linked after verification.
+- If blocked, blockers are recorded.
+
+## Evidence required
+
+- Repository settings notes or screenshots.
+- Required status checks list.
+- Maintainer approval note.
+- Blocker list if settings cannot be changed.
+
+## Safety/privacy guardrails
+
+- Do not publish admin tokens or private repository settings that expose
+  sensitive access details.
+- Redact account-level private information in screenshots.
+- Keep emergency access policy documented.
+
+## Registry-positioning guardrails
+
+- Do not claim branch protection is enabled until settings are verified.
+- Branch protection is governance control, not registry release evidence.
+- GitHub remains public mirror validation only.
+
+## Checklist
+
+- [ ] Review advisory policy.
+- [ ] Verify current settings.
+- [ ] Configure approved settings if authorized.
+- [ ] Record evidence.
+- [ ] Update status docs only after verification.
diff --git a/docs/public-issues/public-issues-manifest.json b/docs/public-issues/public-issues-manifest.json
new file mode 100644
index 0000000..7f1f2db
--- /dev/null
+++ b/docs/public-issues/public-issues-manifest.json
@@ -0,0 +1,104 @@
+{
+  "status": "planned_issue_templates_ready",
+  "github_issue_tracker": "manual_or_gh_cli_creation_required",
+  "github_role": "public_mirror_validation_only",
+  "registry_release_evidence": "requires_russian_build_runner",
+  "issues": [
+    {
+      "id": "001",
+      "title": "[registry] Perform Gitea backup restore test",
+      "labels": ["registry", "ops", "evidence"],
+      "source": "docs/public-issues/001-registry-gitea-restore-test.md",
+      "status": "ready_to_create",
+      "github_issue_url": null
+    },
+    {
+      "id": "002",
+      "title": "[registry] Prepare temporary Russian build-runner awatch-build-01",
+      "labels": ["registry", "build-runner", "ops"],
+      "source": "docs/public-issues/002-registry-russian-build-runner.md",
+      "status": "ready_to_create",
+      "github_issue_url": null
+    },
+    {
+      "id": "003",
+      "title": "[release] Produce first release evidence package",
+      "labels": ["release", "registry", "evidence"],
+      "source": "docs/public-issues/003-release-evidence-package.md",
+      "status": "ready_to_create",
+      "github_issue_url": null
+    },
+    {
+      "id": "004",
+      "title": "[legal] Prepare rightsholder evidence package",
+      "labels": ["legal", "registry", "docs"],
+      "source": "docs/public-issues/004-legal-rightsholder-package.md",
+      "status": "ready_to_create",
+      "github_issue_url": null
+    },
+    {
+      "id": "005",
+      "title": "[qa] Define coverage threshold policy",
+      "labels": ["qa", "coverage", "policy"],
+      "source": "docs/public-issues/005-coverage-threshold-policy.md",
+      "status": "ready_to_create",
+      "github_issue_url": null
+    },
+    {
+      "id": "006",
+      "title": "[security] Prepare external security/code review checklist",
+      "labels": ["security", "review", "governance"],
+      "source": "docs/public-issues/006-external-security-code-review-checklist.md",
+      "status": "ready_to_create",
+      "github_issue_url": null
+    },
+    {
+      "id": "007",
+      "title": "[compat] Test Russian OS compatibility matrix",
+      "labels": ["compat", "qa", "registry"],
+      "source": "docs/public-issues/007-russian-os-compatibility-matrix.md",
+      "status": "ready_to_create",
+      "github_issue_url": null
+    },
+    {
+      "id": "008",
+      "title": "[ops] Validate release artifacts storage in RF",
+      "labels": ["ops", "release", "registry"],
+      "source": "docs/public-issues/008-release-artifacts-storage-rf.md",
+      "status": "ready_to_create",
+      "github_issue_url": null
+    },
+    {
+      "id": "009",
+      "title": "[docs] Refresh public demo pack and screenshots",
+      "labels": ["docs", "demo", "public"],
+      "source": "docs/public-issues/009-public-demo-pack-refresh.md",
+      "status": "ready_to_create",
+      "github_issue_url": null
+    },
+    {
+      "id": "010",
+      "title": "[pilot] Prepare Pilot Acceptance Checklist v2",
+      "labels": ["pilot", "qa", "docs"],
+      "source": "docs/public-issues/010-pilot-acceptance-checklist-v2.md",
+      "status": "ready_to_create",
+      "github_issue_url": null
+    },
+    {
+      "id": "011",
+      "title": "[governance] Enable PR-based review workflow",
+      "labels": ["governance", "review", "process"],
+      "source": "docs/public-issues/011-governance-pr-based-review-workflow.md",
+      "status": "ready_to_create",
+      "github_issue_url": null
+    },
+    {
+      "id": "012",
+      "title": "[governance] Add branch protection policy",
+      "labels": ["governance", "github", "policy"],
+      "source": "docs/public-issues/012-governance-branch-protection-policy.md",
+      "status": "ready_to_create",
+      "github_issue_url": null
+    }
+  ]
+}
diff --git a/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md b/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md
index b1263af..798aec0 100644
--- a/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md
+++ b/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md
@@ -1,5 +1,42 @@
 # Registry readiness changelog
 
+## 2026-06-23 public issue creation package
+
+Added:
+
+- `docs/public-issues/` with public issue templates for the planned governance,
+  registry, QA, security, compatibility, ops, demo and pilot tasks.
+- `docs/public-issues/public-issues-manifest.json` with `ready_to_create`
+  status and `github_issue_url: null` until real issue URLs are recorded.
+- `docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md` for manual and opt-in `gh` CLI
+  issue creation.
+- `scripts/prepare_public_issues.sh` as a dry-run validation and command
+  preparation script.
+- `scripts/create_public_issues_from_manifest.sh` as an opt-in helper that
+  requires `CONFIRM_CREATE_GITHUB_ISSUES=YES`.
+
+Changed:
+
+- `docs/PUBLIC_ISSUES_PLAN_RU.md`, project status, residual risks and README now
+  distinguish prepared issue templates from real created GitHub issues.
+- Registry readiness checks now verify the public issue package and pending URL
+  status.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- No business logic changes.
+
+Guardrails:
+
+- GitHub remains public mirror validation only.
+- Russian Gitea plus planned Russian build-runner remains the primary registry
+  contour.
+- Real GitHub issue creation remains manual/opt-in.
+- GitHub issue URLs remain pending until created and recorded in the manifest.
+
 ## 2026-06-22 review governance and branch protection policy
 
 Added:
diff --git a/scripts/create_public_issues_from_manifest.sh b/scripts/create_public_issues_from_manifest.sh
new file mode 100755
index 0000000..4f25a89
--- /dev/null
+++ b/scripts/create_public_issues_from_manifest.sh
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+MANIFEST="$ROOT/docs/public-issues/public-issues-manifest.json"
+
+if [[ "${CONFIRM_CREATE_GITHUB_ISSUES:-}" != "YES" ]]; then
+  printf 'create_public_issues=refused\n' >&2
+  printf 'Set CONFIRM_CREATE_GITHUB_ISSUES=YES to create GitHub issues.\n' >&2
+  printf 'Run scripts/prepare_public_issues.sh first and review the issue bodies.\n' >&2
+  exit 2
+fi
+
+if ! command -v gh >/dev/null 2>&1; then
+  printf 'create_public_issues=fail\n' >&2
+  printf 'gh CLI is not installed or not in PATH.\n' >&2
+  exit 2
+fi
+
+if ! command -v jq >/dev/null 2>&1; then
+  printf 'create_public_issues=fail\n' >&2
+  printf 'jq is required for manifest-driven issue creation.\n' >&2
+  exit 2
+fi
+
+if [[ ! -s "$MANIFEST" ]]; then
+  printf 'create_public_issues=fail\n' >&2
+  printf 'Missing manifest: docs/public-issues/public-issues-manifest.json\n' >&2
+  exit 2
+fi
+
+jq -e . "$MANIFEST" >/dev/null
+jq -e '
+  .status == "planned_issue_templates_ready"
+  and .github_issue_tracker == "manual_or_gh_cli_creation_required"
+  and .github_role == "public_mirror_validation_only"
+  and .registry_release_evidence == "requires_russian_build_runner"
+  and all(.issues[]; .status == "ready_to_create")
+' "$MANIFEST" >/dev/null
+
+gh auth status >/dev/null
+
+existing_labels="$(mktemp)"
+trap 'rm -f "$existing_labels"' EXIT
+gh label list --limit 500 --json name --jq '.[].name' >"$existing_labels"
+
+while IFS= read -r label; do
+  if ! grep -Fxq "$label" "$existing_labels"; then
+    gh label create "$label" --color "ededed" --description "AWatch-rus public governance label"
+    printf '%s\n' "$label" >>"$existing_labels"
+  fi
+done < <(jq -r '.issues[].labels[]' "$MANIFEST" | sort -u)
+
+created=0
+
+while IFS=$'\t' read -r title labels source; do
+  body="$ROOT/$source"
+  if [[ ! -s "$body" ]]; then
+    printf 'create_public_issues=fail\n' >&2
+    printf 'Missing issue body: %s\n' "$source" >&2
+    exit 2
+  fi
+  url="$(gh issue create --title "$title" --label "$labels" --body-file "$body")"
+  printf 'created_issue=%s\n' "$url"
+  created=$((created + 1))
+done < <(
+  jq -r '.issues[] | [.title, (.labels | join(",")), .source] | @tsv' "$MANIFEST"
+)
+
+printf 'create_public_issues=ok\n'
+printf 'created=%d\n' "$created"
+printf 'Update docs/public-issues/public-issues-manifest.json with the printed issue URLs.\n'
diff --git a/scripts/prepare_public_issues.sh b/scripts/prepare_public_issues.sh
new file mode 100755
index 0000000..cc5621b
--- /dev/null
+++ b/scripts/prepare_public_issues.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ISSUES_DIR="$ROOT/docs/public-issues"
+MANIFEST="$ISSUES_DIR/public-issues-manifest.json"
+
+expected_files=(
+  "001-registry-gitea-restore-test.md"
+  "002-registry-russian-build-runner.md"
+  "003-release-evidence-package.md"
+  "004-legal-rightsholder-package.md"
+  "005-coverage-threshold-policy.md"
+  "006-external-security-code-review-checklist.md"
+  "007-russian-os-compatibility-matrix.md"
+  "008-release-artifacts-storage-rf.md"
+  "009-public-demo-pack-refresh.md"
+  "010-pilot-acceptance-checklist-v2.md"
+  "011-governance-pr-based-review-workflow.md"
+  "012-governance-branch-protection-policy.md"
+)
+
+required_sections=(
+  "Title"
+  "Labels"
+  "Purpose"
+  "Scope"
+  "Non-goals"
+  "Acceptance criteria"
+  "Evidence required"
+  "Safety/privacy guardrails"
+  "Registry-positioning guardrails"
+)
+
+failures=()
+
+fail() {
+  failures+=("$1")
+}
+
+section_value() {
+  local section="$1"
+  local file="$2"
+  awk -v section="$section" '
+    $0 == "## " section { found = 1; next }
+    found && /^## / { exit }
+    found && NF { print; exit }
+  ' "$file"
+}
+
+labels_for_gh() {
+  printf '%s' "$1" \
+    | tr -d '`' \
+    | tr ',' '\n' \
+    | sed -E 's/^[[:space:]]+|[[:space:]]+$//g' \
+    | awk 'NF { printf "%s%s", sep, $0; sep="," }'
+}
+
+if [[ ! -d "$ISSUES_DIR" ]]; then
+  fail "missing_directory:docs/public-issues"
+fi
+
+if [[ ! -s "$MANIFEST" ]]; then
+  fail "missing_or_empty:docs/public-issues/public-issues-manifest.json"
+fi
+
+for name in "${expected_files[@]}"; do
+  file="$ISSUES_DIR/$name"
+  if [[ ! -s "$file" ]]; then
+    fail "missing_or_empty:docs/public-issues/$name"
+    continue
+  fi
+  for section in "${required_sections[@]}"; do
+    if ! grep -Eq "^## ${section}$" "$file"; then
+      fail "missing_section:docs/public-issues/$name:$section"
+    fi
+  done
+done
+
+if [[ -s "$MANIFEST" ]] && command -v jq >/dev/null 2>&1; then
+  jq -e . "$MANIFEST" >/dev/null || fail "invalid_json:docs/public-issues/public-issues-manifest.json"
+  jq -e '
+    .status == "planned_issue_templates_ready"
+    and .github_issue_tracker == "manual_or_gh_cli_creation_required"
+    and .github_role == "public_mirror_validation_only"
+    and .registry_release_evidence == "requires_russian_build_runner"
+    and (.issues | length == 12)
+    and all(.issues[]; .status == "ready_to_create" and .github_issue_url == null)
+  ' "$MANIFEST" >/dev/null || fail "manifest_required_fields"
+  while IFS= read -r source; do
+    [[ -s "$ROOT/$source" ]] || fail "manifest_source_missing:$source"
+  done < <(jq -r '.issues[].source' "$MANIFEST")
+elif [[ -s "$MANIFEST" ]]; then
+  printf 'warning: jq not found; JSON syntax validation skipped\n' >&2
+fi
+
+if ((${#failures[@]} > 0)); then
+  printf 'public_issues_prepare=fail\n'
+  for failure in "${failures[@]}"; do
+    printf '%s\n' "$failure"
+  done
+  exit 2
+fi
+
+printf 'public_issues_prepare=ok\n'
+printf 'status=ready_to_create\n'
+printf 'issue_templates=%d\n' "${#expected_files[@]}"
+printf '\n'
+printf 'Manual gh CLI commands, after maintainer review and gh auth:\n'
+
+for name in "${expected_files[@]}"; do
+  file="$ISSUES_DIR/$name"
+  title="$(section_value "Title" "$file")"
+  labels="$(labels_for_gh "$(section_value "Labels" "$file")")"
+  rel="docs/public-issues/$name"
+  printf 'gh issue create --title %q --label %q --body-file %q\n' "$title" "$labels" "$rel"
+done
+
+printf '\n'
+printf 'After creating issues, update docs/public-issues/public-issues-manifest.json with github_issue_url values.\n'
diff --git a/scripts/registry_readiness_check.sh b/scripts/registry_readiness_check.sh
index f04e2c2..e84d9c9 100644
--- a/scripts/registry_readiness_check.sh
+++ b/scripts/registry_readiness_check.sh
@@ -4,6 +4,8 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 REGISTRY_DIR="$ROOT/docs/registry"
 MANIFEST="$REGISTRY_DIR/registry-evidence-manifest.json"
+PUBLIC_ISSUES_DIR="$ROOT/docs/public-issues"
+PUBLIC_ISSUES_MANIFEST="$PUBLIC_ISSUES_DIR/public-issues-manifest.json"
 
 failures=()
 
@@ -31,6 +33,10 @@ if [[ ! -d "$REGISTRY_DIR" ]]; then
   fail "missing_directory:docs/registry"
 fi
 
+if [[ ! -d "$PUBLIC_ISSUES_DIR" ]]; then
+  fail "missing_directory:docs/public-issues"
+fi
+
 required_files=(
   "docs/registry/REGISTER_RU_SOFTWARE_READINESS_RU.md"
   "docs/registry/SOURCE_CODE_AND_BUILD_INFRASTRUCTURE_RU.md"
@@ -52,10 +58,26 @@ required_files=(
   "docs/REVIEW_CHECKLIST_RU.md"
   "docs/RESIDUAL_RISKS_RU.md"
   "docs/PUBLIC_ISSUES_PLAN_RU.md"
+  "docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md"
+  "docs/public-issues/public-issues-manifest.json"
+  "docs/public-issues/001-registry-gitea-restore-test.md"
+  "docs/public-issues/002-registry-russian-build-runner.md"
+  "docs/public-issues/003-release-evidence-package.md"
+  "docs/public-issues/004-legal-rightsholder-package.md"
+  "docs/public-issues/005-coverage-threshold-policy.md"
+  "docs/public-issues/006-external-security-code-review-checklist.md"
+  "docs/public-issues/007-russian-os-compatibility-matrix.md"
+  "docs/public-issues/008-release-artifacts-storage-rf.md"
+  "docs/public-issues/009-public-demo-pack-refresh.md"
+  "docs/public-issues/010-pilot-acceptance-checklist-v2.md"
+  "docs/public-issues/011-governance-pr-based-review-workflow.md"
+  "docs/public-issues/012-governance-branch-protection-policy.md"
   "docs/BRANCH_PROTECTION_POLICY_RU.md"
   "scripts/build_release_evidence.sh"
   "scripts/check_release_evidence.sh"
   "scripts/public_secret_pattern_check.py"
+  "scripts/prepare_public_issues.sh"
+  "scripts/create_public_issues_from_manifest.sh"
   ".github/CODEOWNERS"
   ".github/workflows/ci.yml"
   ".github/workflows/security.yml"
@@ -191,6 +213,55 @@ PY
   fi
 fi
 
+if [[ -s "$PUBLIC_ISSUES_MANIFEST" ]]; then
+  if command -v jq >/dev/null 2>&1; then
+    jq -e . "$PUBLIC_ISSUES_MANIFEST" >/dev/null || fail "invalid_json:docs/public-issues/public-issues-manifest.json"
+    jq -e '
+      .status == "planned_issue_templates_ready"
+      and .github_issue_tracker == "manual_or_gh_cli_creation_required"
+      and .github_role == "public_mirror_validation_only"
+      and .registry_release_evidence == "requires_russian_build_runner"
+      and (.issues | length == 12)
+      and all(.issues[];
+        .status == "ready_to_create"
+        and .github_issue_url == null
+        and (.source | startswith("docs/public-issues/"))
+      )
+    ' "$PUBLIC_ISSUES_MANIFEST" >/dev/null || fail "public_issues_manifest_required_fields"
+  elif command -v python3 >/dev/null 2>&1; then
+    python3 - "$PUBLIC_ISSUES_MANIFEST" <<'PY' || fail "public_issues_manifest_required_fields"
+import json
+import sys
+
+with open(sys.argv[1], "r", encoding="utf-8") as fh:
+    data = json.load(fh)
+
+expected = {
+    "status": "planned_issue_templates_ready",
+    "github_issue_tracker": "manual_or_gh_cli_creation_required",
+    "github_role": "public_mirror_validation_only",
+    "registry_release_evidence": "requires_russian_build_runner",
+}
+for key, value in expected.items():
+    if data.get(key) != value:
+        raise SystemExit(f"{key} mismatch")
+
+issues = data.get("issues")
+if not isinstance(issues, list) or len(issues) != 12:
+    raise SystemExit("issues length mismatch")
+for issue in issues:
+    if issue.get("status") != "ready_to_create":
+        raise SystemExit("issue status mismatch")
+    if issue.get("github_issue_url") is not None:
+        raise SystemExit("github_issue_url must remain null until created")
+    if not str(issue.get("source", "")).startswith("docs/public-issues/"):
+        raise SystemExit("issue source mismatch")
+PY
+  else
+    fail "json_validator_missing:jq_or_python3_required"
+  fi
+fi
+
 require_grep "git\\.iri1968\\.dpdns\\.org" "docs/registry/SOURCE_CODE_AND_BUILD_INFRASTRUCTURE_RU.md" "gitea_domain_source_infra"
 require_grep "git\\.iri1968\\.dpdns\\.org" "docs/registry/GIT_RU_MIRRORING_RUNBOOK_RU.md" "gitea_domain_git_runbook"
 require_grep "git\\.iri1968\\.dpdns\\.org" "docs/registry/WIKI_AND_DOCUMENTATION_POLICY_RU.md" "gitea_domain_wiki_policy"
@@ -216,6 +287,9 @@ require_grep "Russian build-runner.*required|requires_russian_build_runner" "doc
 require_grep "docs/registry" "docs/PROJECT_STATUS_RU.md" "project_status_registry_docs"
 require_grep "RESIDUAL_RISKS_RU\\.md" "docs/PROJECT_STATUS_RU.md" "project_status_residual_risks_link"
 require_grep "PUBLIC_ISSUES_PLAN_RU\\.md" "docs/PROJECT_STATUS_RU.md" "project_status_public_issues_plan_link"
+require_grep "docs/public-issues" "docs/PROJECT_STATUS_RU.md" "project_status_public_issue_templates"
+require_grep "PUBLIC_ISSUES_CREATION_RUNBOOK_RU\\.md" "docs/PROJECT_STATUS_RU.md" "project_status_public_issue_runbook"
+require_grep "manual/pending.*URLs.*public-issues-manifest|URLs.*public-issues-manifest" "docs/PROJECT_STATUS_RU.md" "project_status_issue_creation_pending_urls"
 require_grep "GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU\\.md|Restore outline|Post-restore checks" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_restore_runbook"
 require_grep "awatch-gitea-backup\\.timer" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_timer"
 require_grep "sha256|SHA256" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_sha256"
@@ -242,12 +316,18 @@ require_grep "public GitHub Actions validation passed" "docs/registry/REGISTRY_R
 require_grep "No business logic changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_no_business_logic_changes"
 require_grep "RESIDUAL_RISKS_RU\\.md" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_residual_risks"
 require_grep "PUBLIC_ISSUES_PLAN_RU\\.md" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_plan"
+require_grep "public issue creation package" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issue_creation_package"
+require_grep "docs/public-issues" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_dir"
+require_grep "runtime/product code changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_no_runtime"
+require_grep "GitHub remains public mirror validation only" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_issues_github_role"
 require_grep "Restore test is not claimed as completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_restore_not_completed"
 require_grep "Russian build-runner is not claimed as ready" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_build_runner_not_ready"
 require_grep "First release evidence build is not claimed as completed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_release_evidence_not_completed"
 require_grep "Legal rightsholder package remains pending" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_legal_package_pending"
 require_grep "RESIDUAL_RISKS_RU\\.md" "README.md" "readme_residual_risks_link"
 require_grep "PUBLIC_ISSUES_PLAN_RU\\.md" "README.md" "readme_public_issues_plan_link"
+require_grep "PUBLIC_ISSUES_CREATION_RUNBOOK_RU\\.md" "README.md" "readme_public_issues_creation_runbook"
+require_grep "public-issues/public-issues-manifest\\.json" "README.md" "readme_public_issues_manifest"
 require_grep "Engineering governance and residual risks" "README.md" "readme_engineering_governance_section"
 require_grep "REVIEW_CHECKLIST_RU\\.md" "README.md" "readme_review_checklist_link"
 require_grep "BRANCH_PROTECTION_POLICY_RU\\.md" "README.md" "readme_branch_protection_policy_link"
@@ -303,7 +383,10 @@ require_grep "\\[pilot\\] Prepare Pilot Acceptance Checklist v2" "docs/PUBLIC_IS
 require_grep "\\[governance\\] Enable PR-based review workflow" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_pr_review_workflow"
 require_grep "\\[governance\\] Add branch protection policy" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issue_branch_protection_policy"
 require_grep "Acceptance criteria" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_acceptance_criteria"
-require_grep "planned" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_status_planned"
+require_grep "ready_to_create" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_status_ready_to_create"
+require_grep "docs/public-issues" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_templates_dir"
+require_grep "public-issues-manifest\\.json" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_manifest_link"
+require_grep "URLs.*pending|pending.*URLs" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_urls_pending"
 require_grep "Do not mark restore test as completed until restore evidence exists" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_restore_guardrail"
 require_grep "Do not mark .*awatch-build-01.* as ready until provisioning evidence exists" "docs/PUBLIC_ISSUES_PLAN_RU.md" "issues_build_runner_guardrail"
 require_grep "public mirror validation only" "SECURITY.md" "security_public_mirror_validation"
@@ -326,6 +409,9 @@ scan_files=(
   "$ROOT/docs/REVIEW_CHECKLIST_RU.md"
   "$ROOT/docs/RESIDUAL_RISKS_RU.md"
   "$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md"
+  "$ROOT/docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md"
+  "$ROOT/docs/public-issues"/*.md
+  "$ROOT/docs/public-issues"/*.json
   "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md"
   "$ROOT/SECURITY.md"
   "$ROOT/CONTRIBUTING.md"
@@ -349,6 +435,9 @@ claim_scan_files=(
   "$ROOT/docs/REVIEW_CHECKLIST_RU.md"
   "$ROOT/docs/RESIDUAL_RISKS_RU.md"
   "$ROOT/docs/PUBLIC_ISSUES_PLAN_RU.md"
+  "$ROOT/docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md"
+  "$ROOT/docs/public-issues"/*.md
+  "$ROOT/docs/public-issues"/*.json
   "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md"
   "$ROOT/SECURITY.md"
   "$ROOT/CONTRIBUTING.md"
@@ -397,6 +486,13 @@ if grep -RInEi "(юридически заверш(е|ё)нн?ая регист
 fi
 rm -f /tmp/registry_forbidden_legal_done.$$
 
+if grep -RInEi "(completed Russian software registry submission|registry submission is complete|Russian software registry submission.{0,80}(completed|done))" "${claim_scan_files[@]}" \
+  | grep -Eiv "(do not|no claim|not |не |forbidden|pending|until evidence)" \
+  >/tmp/registry_forbidden_registry_submission_done.$$ 2>/dev/null; then
+  fail "forbidden_claim_registry_submission_completed:$(cat /tmp/registry_forbidden_registry_submission_done.$$)"
+fi
+rm -f /tmp/registry_forbidden_registry_submission_done.$$
+
 if grep -RInEi "(branch protection).{0,120}(enabled|включ(е|ё)н|настроен|active)" "$ROOT/README.md" "$ROOT/docs/PROJECT_STATUS_RU.md" "$ROOT/docs/BRANCH_PROTECTION_POLICY_RU.md" "$REGISTRY_DIR"/*.md \
   | grep -Eiv "(not |не |не утверждает|not claimed|advisory|until repository settings|если применимо|recommended)" \
   >/tmp/registry_forbidden_branch_protection_enabled.$$ 2>/dev/null; then