From 5e6f01d5e683b85295913552a816135d5519e8df Mon Sep 17 00:00:00 2001
From: Cortex OSS <oss@barbat.dev>
Date: Sat, 4 Jul 2026 01:37:29 -0300
Subject: [PATCH 1/2] chore: add public contribution governance

---
 .github/CODEOWNERS                        |  2 +
 .github/ISSUE_TEMPLATE/bug_report.yml     | 32 ++++++++++++++++
 .github/ISSUE_TEMPLATE/change_request.yml | 39 ++++++++++++++++++++
 .github/ISSUE_TEMPLATE/config.yml         |  5 +++
 .github/PULL_REQUEST_TEMPLATE.md          | 22 +++++++++++
 CONTRIBUTING.md                           | 45 +++++++++++++++++++++++
 6 files changed, 145 insertions(+)
 create mode 100644 .github/CODEOWNERS
 create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml
 create mode 100644 .github/ISSUE_TEMPLATE/change_request.yml
 create mode 100644 .github/ISSUE_TEMPLATE/config.yml
 create mode 100644 .github/PULL_REQUEST_TEMPLATE.md
 create mode 100644 CONTRIBUTING.md

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..a23a6c7
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+# Require repository-owner review for every change.
+* @barbatdev
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..33a1aa3
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,32 @@
+name: Bug report
+description: Report broken behavior in the dotfiles or installer.
+title: "[Bug]: "
+labels: ["bug", "needs-triage"]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What happened?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Include commands and relevant environment details, but do not include secrets or private paths.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Checks already run
+      description: For example, `bash install.sh --check` or `scripts/oss-audit.sh`.
+    validations:
+      required: false
diff --git a/.github/ISSUE_TEMPLATE/change_request.yml b/.github/ISSUE_TEMPLATE/change_request.yml
new file mode 100644
index 0000000..d78e76c
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/change_request.yml
@@ -0,0 +1,39 @@
+name: Change request
+description: Propose a focused change before opening a pull request.
+title: "[Change]: "
+labels: ["needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please open an issue before a PR. PRs without an agreed issue may be closed.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What should change, and why?
+    validations:
+      required: true
+  - type: textarea
+    id: proposed-scope
+    attributes:
+      label: Proposed scope
+      description: What files or behavior do you expect to touch?
+    validations:
+      required: true
+  - type: textarea
+    id: safety
+    attributes:
+      label: Public safety considerations
+      description: Note any installer, shell, AI CLI, package-manager, or private-data exposure risks.
+    validations:
+      required: true
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      options:
+        - label: I understand changes must go through a pull request and maintainer review before merge.
+          required: true
+        - label: I will not include secrets, private paths, private hostnames, private IPs, real emails, or machine-specific values.
+          required: true
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..901f023
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security issue
+    url: https://github.com/barbatdev/cortex-dots/security/policy
+    about: Please report secrets, credential exposure, or command-injection findings privately.
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..5a0302a
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,22 @@
+## Summary
+
+- 
+
+## Linked Issue
+
+Fixes #
+
+## Validation
+
+- [ ] `scripts/oss-audit.sh`
+- [ ] Relevant syntax/config checks from `README.md`
+
+## Public Safety Checklist
+
+- [ ] No secrets, tokens, private keys, real emails, private hostnames, private IPs, customer names, or machine-specific paths.
+- [ ] Local/private values remain in `~/.config/cortex-dots/local/env.zsh` or another untracked local file.
+- [ ] Installer, shell, AI CLI, and package-manager changes were reviewed for security impact.
+
+## Notes
+
+- 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..aeb2fe5
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,45 @@
+# Contributing
+
+Thanks for helping improve `cortex-dots`. This repository is public, but changes are intentionally gated because these dotfiles affect local shells, developer tooling, package-manager defaults, and AI CLI behavior.
+
+## Contribution Flow
+
+1. Open an issue before starting work.
+2. Wait for maintainer agreement on the scope.
+3. Open a pull request linked to the issue.
+4. Keep the PR focused on one change.
+5. Wait for maintainer review before merge.
+
+Maintainers may close PRs that do not have a linked issue or that expand beyond the agreed scope.
+
+## What Needs Review
+
+All changes to `main` require maintainer review. This is especially important for:
+
+- Shell startup files and helper scripts.
+- Installer behavior.
+- Package-manager configuration.
+- AI CLI configuration or permission flags.
+- GitHub Actions and repository governance files.
+- Any file that could expose private paths, hostnames, emails, tokens, or machine-specific data.
+
+## Public Safety Rules
+
+- Do not commit secrets, tokens, private keys, real emails, private hostnames, private IPs, customer names, or machine-specific paths.
+- Put local/private values in `~/.config/cortex-dots/local/env.zsh`.
+- Keep examples generic and placeholder-based.
+- Run `scripts/oss-audit.sh` before opening a PR.
+- Run the validation commands listed in `README.md` when touching scripts or config formats.
+
+## Pull Request Expectations
+
+Every PR should include:
+
+- A linked issue, using `Fixes #123`, `Closes #123`, or `Refs #123`.
+- A short summary of the change.
+- Validation performed.
+- Any security or public-exposure considerations.
+
+## Maintainer Merge Policy
+
+Only maintainers merge to `main`. PRs should be merged only after the repository owner has reviewed and approved the change.

From 3d699eca566ec18c2bdc3389e51b96f733d47451 Mon Sep 17 00:00:00 2001
From: Cortex OSS <oss@barbat.dev>
Date: Sat, 4 Jul 2026 02:07:21 -0300
Subject: [PATCH 2/2] fix: point security contact to policy file

---
 .github/ISSUE_TEMPLATE/config.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index 901f023..431aac0 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
   - name: Security issue
-    url: https://github.com/barbatdev/cortex-dots/security/policy
-    about: Please report secrets, credential exposure, or command-injection findings privately.
+    url: https://github.com/barbatdev/cortex-dots/blob/main/SECURITY.md
+    about: Please read the security policy before reporting secrets, credential exposure, or command-injection findings.