chore(governance): promote Iteration 140 rollout

.github/CODEOWNERS

@@ -0,0 +1,37 @@
+# CODEOWNERS
+#
+# Iteration 140 / 决策门 D2。
+#
+# D2 已于 2026-08-22 确认：`@cloudQuant` 是本仓库的真实 GitHub 用户，且拥有
+# `cloudQuant/backtrader` 的管理员权限；因此它是有效的、可写入的 CODEOWNER。
+# Gitee 镜像使用 `yunjinqi` 身份，但该身份不是 GitHub CODEOWNERS token，故不在此列。
+# GitHub CODEOWNERS 只接受 `@username` 或 `@org/team-name`；禁止占位帐号。部署后必须
+# 运行 `scripts/ci/verify_github_governance.py` 并校验 codeowners/errors API 没有错误。
+
+# 仓库治理与工具链
+/.github/   @cloudQuant
+/scripts/   @cloudQuant
+/docs/      @cloudQuant
+
+# 核心 line 系统（R2）
+/backtrader/lineroot.py      @cloudQuant
+/backtrader/linebuffer.py    @cloudQuant
+/backtrader/lineseries.py    @cloudQuant
+/backtrader/lineiterator.py  @cloudQuant
+/backtrader/metabase.py      @cloudQuant
+
+# 引擎 / 策略 / 经纪商 / 数据源（R2）
+/backtrader/cerebro.py   @cloudQuant
+/backtrader/strategy.py  @cloudQuant
+/backtrader/broker.py    @cloudQuant
+/backtrader/brokers/     @cloudQuant
+/backtrader/feeds/       @cloudQuant
+
+# 指标与策略回归套件
+/backtrader/indicators/        @cloudQuant
+/tests/functional/strategies/  @cloudQuant
+
+# 打包与依赖（R3 供应链）
+/setup.py          @cloudQuant
+/pyproject.toml    @cloudQuant
+/requirements.txt  @cloudQuant

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,59 @@
+name: Bug Report
+description: 报告一个 bug，帮助定位与修复
+title: "[Bug]: "
+labels: ["type:bug", "status:triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        感谢报告问题。请在提交前确认：该问题不是安全漏洞（安全问题请走 SECURITY.md 私密报告路径），且尚未被他人报告。
+  - type: dropdown
+    id: target-branch
+    attributes:
+      label: 目标版本（分支）
+      description: 这个问题出现在哪个分支？
+      options:
+        - dev
+        - development
+        - master
+        - 不确定
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: 环境
+      description: Python 版本、操作系统、backtrader 版本、安装方式
+      placeholder: "Python 3.11, macOS, backtrader 1.3.0, pip install -e ."
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: 最小复现
+      description: 可独立运行的最小代码，能复现问题
+      render: python
+      placeholder: "import backtrader as bt\n..."
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: 预期行为
+      description: 应该发生什么
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: 实际行为
+      description: 实际发生了什么（含完整 traceback / 错误信息）
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: 日志
+      description: 相关日志输出（可选）
+      render: shell

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 💬 问题与讨论
+    url: https://github.com/cloudQuant/backtrader/discussions
+    about: 一般使用问题、想法与讨论请到 Discussions
+  - name: 🔒 安全漏洞报告
+    url: https://github.com/cloudQuant/backtrader/security/advisories/new
+    about: 请勿在公开 issue 中提交安全漏洞；走私密报告路径（见 SECURITY.md）

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,40 @@
+name: Feature Request
+description: 提出一个新功能或改进建议
+title: "[Feature]: "
+labels: ["type:feature", "status:triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        感谢提出建议。请描述清楚问题与动机，便于评估价值与分支影响。
+  - type: textarea
+    id: problem
+    attributes:
+      label: 问题
+      description: 这个功能解决什么问题？使用场景是什么？
+    validations:
+      required: true
+  - type: textarea
+    id: target-users
+    attributes:
+      label: 目标用户
+      description: 谁会受益？
+    validations:
+      required: true
+  - type: textarea
+    id: branch-impact
+    attributes:
+      label: 分支影响
+      description: 该功能属于哪个分支定位？（常规功能→dev；仅优化版功能→development；不应涉及原始版基线）
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: 替代方案
+      description: 现有替代方式，或考虑过的其他方案
+  - type: textarea
+    id: additional
+    attributes:
+      label: 附加信息
+      description: 示例、参考或实现思路（可选）

.github/PULL_REQUEST_TEMPLATE/master-hotfix.md

@@ -0,0 +1,24 @@
+<!--
+master hotfix PR 模板（仅 hotfix/master-* 分支，R3）。
+适用：原始 Backtrader 基线的真实 Bug / 安全问题。
+见 docs/source/developer-guide/branch-governance.md §7。
+提交后请删除本注释块，并携带 target:master-hotfix 标签。
+-->
+
+## 在 master 上的独立最小复现
+
+<!-- 仅基于原始版（master）复现的步骤与结果，不得依赖优化版环境 -->
+
+## 回归测试
+
+<!-- 目标分支全量测试 / 最小复现的回归测试命令与结果 -->
+
+## 原始 API 兼容性说明
+
+<!-- 确认不破坏原始版公开 API 兼容性 -->
+
+## 关联前移 issue
+
+<!-- 必填：每个 master 修复必须创建 forward-port issue，例如 Fixes #123 -->
+- [ ] 已创建 `forward-port-required` issue
+- [ ] 已分别评估 `dev` 与 `development` 是否受影响

.github/PULL_REQUEST_TEMPLATE/promotion.md

@@ -0,0 +1,27 @@
+<!--
+Promotion PR 模板（dev → development）。
+适用：受控 promotion，见 docs/source/developer-guide/branch-governance.md §6。
+提交后请删除本注释块。
+-->
+
+## 变更范围
+
+<!-- 本次 promotion 纳入的内容摘要 -->
+
+## 已排除内容
+
+<!-- 明确不纳入本次 promotion 的内容及原因 -->
+
+## 完整验证
+
+<!-- R2/R3 内容必跑全量门禁，粘贴实际命令与结果，例如：
+make test-strategies
+-->
+
+## 性能 / 兼容性差异
+
+<!-- 与 dev 相比，development 上的性能或行为差异 -->
+
+## 回滚点
+
+<!-- 若需回滚，回退到哪个 commit / 标签 -->

.github/governance/baseline/README.md

@@ -0,0 +1,46 @@
+# Governance Baseline
+
+This directory records **how** the pre-iteration governance snapshot was taken,
+and **where** the evidence lives. It intentionally stores **no sensitive API
+responses, tokens, or private credentials**.
+
+## Snapshot commands
+
+Run the following with a read-only / minimal-scope credential before any
+governance change, and record the output to an external, non-committed store:
+
+```bash
+# Default branch
+gh repo view cloudQuant/backtrader --json defaultBranchRef
+
+# Rulesets
+gh api repos/cloudQuant/backtrader/rulesets
+
+# Labels
+gh label list --repo cloudQuant/backtrader --limit 100
+
+# Long-lived branch SHAs
+git ls-remote --heads origin master development dev
+```
+
+## Snapshot record
+
+| Item | Timestamp | Summary | Evidence location |
+|---|---|---|---|
+| Default branch | 2026-08-20 | `development` | `gh repo view ... --json defaultBranchRef` output (external) |
+| Rulesets | 2026-08-20 | none configured | `gh api .../rulesets` output (external) |
+| Branch protection | 2026-08-20 | none configured | not captured (see rulesets) |
+| CODEOWNERS | 2026-08-20 | absent | repo state at `.github/CODEOWNERS` (added in Iteration 140) |
+| Long-lived branches | 2026-08-20 | `master`, `development`, `dev` all present | `git ls-remote --heads origin` |
+| D2 owner confirmation | 2026-08-22 | GitHub `@cloudQuant` is a real repository admin; Gitee mirror identity is `yunjinqi` | `gh api user`, collaborator-permission response, and configured push URLs (external) |
+| Mirror comparison | 2026-08-22 | `master` and `dev` matched; `development` diverged (GitHub `95c7302f`, Gitee `d8b6da88`) | paired `git ls-remote --heads` output (external); tracked as a rollout repair item |
+| Rollout start | 2026-08-22 | Rulesets are created in `evaluate`, not active, mode; blocking policy remains disabled through 2026-09-05 | Rulesets API response and Rule Insights (external) |
+
+> **Do not commit** API responses containing user lists, teams, or any token-like
+> values. Commit only the command, the timestamp, the one-line summary, and a
+> pointer to the external evidence store.
+
+## Re-baselining
+
+When any D0–D4 decision changes, or when rulesets/labels/CODEOWNERS are
+modified, append a new row to the table above rather than editing history.

.github/governance/metrics-schema.json

@@ -0,0 +1,98 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "GovernanceMetrics",
+  "description": "Weekly governance metrics captured during Iteration 140 and after (M5).",
+  "type": "object",
+  "required": ["week_start", "repository", "metrics"],
+  "properties": {
+    "week_start": {
+      "type": "string",
+      "format": "date",
+      "description": "ISO date of the Monday that starts the reporting week."
+    },
+    "repository": {
+      "type": "string",
+      "const": "cloudQuant/backtrader"
+    },
+    "metrics": {
+      "type": "object",
+      "required": [
+        "new_prs",
+        "first_response_time_hours",
+        "first_substantive_review_time_hours",
+        "merge_time_hours",
+        "close_reasons",
+        "ci_failure_rate",
+        "flake_rate",
+        "forward_port_completion_rate"
+      ],
+      "properties": {
+        "new_prs": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Number of new PRs opened this week."
+        },
+        "target_branch_misroute_rate": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1,
+          "description": "Fraction of PRs that landed on the wrong target branch. Exit threshold: < 5%."
+        },
+        "first_response_time_hours": {
+          "type": "number",
+          "minimum": 0,
+          "description": "Median hours to first human response."
+        },
+        "first_substantive_review_time_hours": {
+          "type": "number",
+          "minimum": 0,
+          "description": "Median hours to first substantive review."
+        },
+        "merge_time_hours": {
+          "type": "number",
+          "minimum": 0,
+          "description": "Median hours from open to merge."
+        },
+        "close_reasons": {
+          "type": "object",
+          "description": "Count of PRs closed, keyed by reason (merged, rejected, stale, split-requested, duplicate).",
+          "additionalProperties": { "type": "integer" }
+        },
+        "ci_failure_rate": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1,
+          "description": "Fraction of CI runs that failed."
+        },
+        "flake_rate": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1,
+          "description": "Fraction of CI failures attributable to flakiness."
+        },
+        "prs_split_requested": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Number of PRs asked to be split this week."
+        },
+        "unforwarded_hotfixes": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Open master hotfixes without a completed forward-port."
+        },
+        "forward_port_completion_rate": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1,
+          "description": "Fraction of master hotfixes with forward-port-complete."
+        },
+        "mirror_sha_divergence": {
+          "type": "boolean",
+          "description": "Whether GitHub/Gitee long-lived branch SHAs diverged this week."
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}

.github/governance/metrics/README.md

@@ -0,0 +1,27 @@
+# Weekly Governance Record
+
+Iteration 140 starts its observation window on **2026-08-22**. The triage
+maintainer must publish one JSON record per completed Monday–Sunday week using
+`../metrics-schema.json`; store the record in the approved internal evidence
+location, not in this directory, when it contains contributor-identifying data.
+
+## Required operating record
+
+For each week, retain:
+
+1. The `GovernanceMetrics` JSON record, including a clear source/query note.
+2. The GitHub Ruleset Insights result for each long-lived branch.
+3. The three GitHub/Gitee branch SHA comparisons and any divergence reason.
+4. Links to every `master` hotfix, its `forward-port-required` issue, and its
+   independently tested `dev`/`development` resolution.
+5. A list of any administrator bypass, including the emergency reason and PR.
+
+The first activation decision is **not before 2026-09-05**. At that review,
+the maintainer must also have a complete dry-run record for a normal `dev` PR,
+a core `development` PR, and a `master` hotfix PR. Do not create zero-filled
+metrics as a substitute for missing operational evidence.
+
+The review must additionally name and verify a second, independent GitHub
+maintainer before treating the R2/R3 owner-plus-second-review requirement as
+active. The currently confirmed `@cloudQuant` account alone is not evidence of
+that separation of duties.