Prepare repository for public contributions (advances #78)

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Every change requires approval from one of the designated maintainers.
+* @vantasnerdan @axis-marbell @mlops-kelvin

.github/ISSUE_TEMPLATE/agent_task.yml

@@ -1,11 +1,11 @@
-name: Agent task
-description: Create the canonical issue required before an agent submits a pull request
-title: "[Agent task] "
+name: Contribution task or research proposal
+description: Create the canonical issue required before a person or agent submits a pull request
+title: "[Contribution] "
 body:
   - type: markdown
     attributes:
       value: |
-        Every pull request requires one canonical issue that exists before even a draft PR is submitted. The contributing agent may create this issue, but may not merge the resulting PR if it opens, commits to, or materially implements that PR.
+        Every pull request requires one canonical issue that exists before even a draft PR is submitted. The contributor may create this issue, but a person or agent may not merge the resulting PR if they open it, author a commit, or materially implement it.
   - type: textarea
     id: objective
     attributes:
@@ -50,5 +50,5 @@ body:
           required: true
         - label: I will not submit even a draft pull request until this issue exists.
           required: true
-        - label: An agent that opens, commits to, or materially implements the pull request will not merge it.
+        - label: A person or agent that opens, commits to, or materially implements the pull request will not merge it.
           required: true

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,57 @@
+name: Bug report
+description: Report a reproducible implementation, validation, or documentation defect
+title: '[Bug] '
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Search existing issues and pull requests first. Do not include secrets, private correspondence, or unlicensed source material. Security vulnerabilities belong in private vulnerability reporting.
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed behavior
+      description: State what happened, including the exact error or incorrect result.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior and positive objective
+      description: State the correct behavior or object that would resolve the defect.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Include the commit, command, inputs, output, and environment needed to reproduce the problem.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope, dependencies, and affected consumers
+      description: Name relevant files, symbols, claims, conventions, and downstream paths.
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Success and validation gates
+      description: State the test, oracle, counterexample, or replay that would demonstrate the fix.
+    validations:
+      required: true
+  - type: checkboxes
+    id: acknowledgements
+    attributes:
+      label: Acknowledgements
+      options:
+        - label: I searched existing issues and pull requests for this defect.
+          required: true
+        - label: This report contains no secret or material lacking redistribution rights.
+          required: true
+        - label: I will create a branch and pull request only after this canonical issue exists.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions and design discussion
+    url: https://github.com/vantasnerdan/substrate-framework/discussions
+    about: Ask setup and usage questions or discuss an idea before defining a scoped objective.
+  - name: Private security report
+    url: https://github.com/vantasnerdan/substrate-framework/security/advisories/new
+    about: Report a vulnerability privately. Do not disclose it in a public issue.

.github/ISSUE_TEMPLATE/documentation.yml

@@ -0,0 +1,52 @@
+name: Documentation improvement
+description: Propose a concrete correction or addition to maintained documentation
+title: '[Docs] '
+labels:
+  - documentation
+body:
+  - type: textarea
+    id: objective
+    attributes:
+      label: Positive objective
+      description: State the exact documentation improvement and who it helps.
+    validations:
+      required: true
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope and write boundary
+      description: Name the maintained source files. Never propose hand-editing generated documentation.
+    validations:
+      required: true
+  - type: textarea
+    id: authority
+    attributes:
+      label: Sources and authority
+      description: Link authoritative claims, APIs, releases, or external sources that support the change.
+    validations:
+      required: true
+  - type: textarea
+    id: success
+    attributes:
+      label: Success and validation gates
+      description: State link checks, generation checks, tests, or review needed for completion.
+    validations:
+      required: true
+  - type: textarea
+    id: coordination
+    attributes:
+      label: Coordination and merger handoff
+      description: Name the planned branch/write surfaces and a distinct reviewer or owner handoff.
+    validations:
+      required: true
+  - type: checkboxes
+    id: acknowledgements
+    attributes:
+      label: Acknowledgements
+      options:
+        - label: I searched existing issues, pull requests, and maintained documentation for overlap.
+          required: true
+        - label: I will not edit files under `docs/generated/` by hand.
+          required: true
+        - label: I will not submit a pull request until this canonical issue exists.
+          required: true

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '04:00'
+      timezone: Europe/Zurich
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '04:30'
+      timezone: Europe/Zurich
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies

.github/workflows/validate.yml

@@ -0,0 +1,42 @@
+name: Repository validation
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: repository-validation-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  repository-validation:
+    name: repository-validation
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install pipx
+        run: python -m pip install --disable-pip-version-check pipx==1.16.7
+
+      - name: Bootstrap the repository
+        run: scripts/bootstrap.sh
+
+      - name: Run full repository validation
+        run: scripts/validate.sh --full

.gitleaks.toml

@@ -0,0 +1,7 @@
+title = "Substrate Framework Gitleaks configuration"
+
+[allowlist]
+description = "One immutable campaign result contains a public API identifier list that matches the generic-api-key heuristic. The file contains no credential syntax, URL, or assignment."
+paths = [
+  '''^campaigns/P184-tx5-full-field-stability-audit/attempts/0005/result\.yaml$''',
+]

CODE_OF_CONDUCT.md

@@ -0,0 +1,69 @@
+# Community Code of Conduct
+
+## Our pledge
+
+We pledge to make participation in Substrate Framework welcoming, safe, and
+equitable. Everyone who participates in good faith receives the same
+opportunity to contribute, regardless of identity, background, experience, or
+status.
+
+## Expected behavior
+
+Community members are expected to:
+
+- engage kindly, honestly, and with respect for different viewpoints;
+- distinguish evidence, interpretation, authority status, and uncertainty;
+- give and receive constructive feedback without attacking people;
+- credit sources and collaborators accurately;
+- respect confidentiality, privacy, and intellectual-property boundaries;
+- take responsibility for mistakes and help repair resulting harm; and
+- follow the repository's scientific, review, and security processes.
+
+## Restricted behavior
+
+The following are not acceptable:
+
+- harassment, threats, intimidation, or unwanted personal attention;
+- insults, character attacks, discrimination, or sexualized conduct;
+- publishing private information or correspondence without permission;
+- impersonation or misleading identity used to evade accountability;
+- plagiarism or deliberate failure to credit sources;
+- knowingly exposing credentials or non-redistributable material; or
+- retaliation against someone who reports a concern in good faith.
+
+Scientific disagreement, rejected claims, and critical review are not conduct
+violations when expressed professionally and supported with concrete reasoning.
+
+## Reporting a concern
+
+For a confidential report, use [GitHub private vulnerability
+reporting](https://github.com/vantasnerdan/substrate-framework/security/advisories/new)
+and begin the title with `[conduct]`. Include the relevant links or records and
+the safest way to contact you. Do not disclose the report in a public issue.
+
+The repository owner acts as community moderator. If the concern involves the
+owner or cannot safely be handled within the project, use GitHub's platform
+reporting and blocking tools. Reports will be handled as privately as possible,
+with access limited to people needed to investigate and resolve them.
+
+## Enforcement
+
+Depending on severity, context, and repeated behavior, maintainers may issue a
+private warning, limit participation temporarily, suspend access, or impose a
+permanent ban. The goal is to protect the community, stop ongoing harm, and
+support proportionate repair where possible. Severe incidents may skip lower
+steps. Good-faith reports will not be punished merely because evidence is
+ultimately inconclusive.
+
+## Scope
+
+This policy applies in repository issues, pull requests, discussions, reviews,
+workflows, and related project spaces, and when someone officially represents
+the project elsewhere.
+
+## Attribution
+
+This policy is adapted from [Contributor Covenant
+3.0](https://www.contributor-covenant.org/version/3/0/), stewarded by the
+Organization for Ethical Source and licensed under [CC BY-SA
+4.0](https://creativecommons.org/licenses/by-sa/4.0/).