v0.11.0: dashboard polish, cost accuracy, attribution tags

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,51 @@
+---
+name: Bug report
+about: Something isn't working as expected
+title: ""
+labels: bug
+assignees: ""
+---
+
+<!--
+Burnwall stores zero telemetry and is local-only, so we can't see your machine.
+The single most useful thing you can attach is a redacted diagnostic bundle:
+
+    burnwall doctor --export
+
+It is metadata-only (no prompts, no API keys, no raw paths) and self-scans for
+secrets before writing — if anything secret-shaped survived, it refuses to write
+rather than risk a leak. Review the file, then paste it below.
+-->
+
+## What happened
+
+A clear description of the problem.
+
+## What you expected
+
+What you expected to happen instead.
+
+## Steps to reproduce
+
+1.
+2.
+3.
+
+## Diagnostic bundle
+
+Paste the output of `burnwall doctor --export` (it's redacted + self-scanned):
+
+```
+(paste here)
+```
+
+## Environment
+
+- Burnwall version: <!-- `burnwall --version` -->
+- OS / arch:
+- AI tool(s) involved: <!-- Claude Code, Codex CLI, Aider, … -->
+
+## Anything else
+
+Logs, screenshots, or context. Please don't paste API keys or prompt content —
+the `doctor --export` bundle already excludes them.

.github/actions/burnwall-scan/action.yml

@@ -0,0 +1,63 @@
+name: 'Burnwall Scan'
+description: >-
+  Scan agent config files (CLAUDE.md, .cursorrules, .mcp.json, .claude/ and
+  friends) for committed credentials and hidden-instruction smuggling, and
+  upload the findings as SARIF to the repository Security tab.
+author: 'Burnwall'
+branding:
+  icon: 'shield'
+  color: 'orange'
+
+inputs:
+  paths:
+    description: 'Space-separated files or directories to scan.'
+    required: false
+    default: '.'
+  all-files:
+    description: 'Scan every text file in directories, not just known agent configs.'
+    required: false
+    default: 'false'
+  fail-on-findings:
+    description: 'Fail the job when anything is found (in addition to the SARIF upload).'
+    required: false
+    default: 'false'
+  upload-sarif:
+    description: >-
+      Upload the SARIF report to GitHub code scanning. Requires the
+      `security-events: write` permission on the job. Set to false to only
+      print findings (and optionally gate via fail-on-findings).
+    required: false
+    default: 'true'
+  burnwall-version:
+    description: 'Burnwall release to install (for example "0.9.15"). Defaults to the latest release.'
+    required: false
+    default: 'latest'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Install Burnwall
+      shell: bash
+      run: |
+        if [ "${{ inputs.burnwall-version }}" != "latest" ]; then
+          export BURNWALL_VERSION="${{ inputs.burnwall-version }}"
+        fi
+        curl -fsSL https://raw.githubusercontent.com/intbot/burnwall/main/install.sh | sh
+        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+    - name: Scan agent configs
+      shell: bash
+      run: |
+        ARGS=""
+        if [ "${{ inputs.all-files }}" = "true" ]; then ARGS="$ARGS --all-files"; fi
+        if [ "${{ inputs.fail-on-findings }}" = "true" ]; then ARGS="$ARGS --fail-on-findings"; fi
+        # fail-on-findings exits non-zero AFTER writing the SARIF report, so
+        # the upload step still runs (`if: always()` below) and the Security
+        # tab gets the findings either way.
+        burnwall scan ${{ inputs.paths }} --sarif burnwall-scan.sarif $ARGS
+
+    - name: Upload SARIF to code scanning
+      if: ${{ always() && inputs.upload-sarif == 'true' }}
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: burnwall-scan.sarif

.github/workflows/release.yml

@@ -112,6 +112,10 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json
+    permissions:
+      "attestations": "write"
+      "contents": "read"
+      "id-token": "write"
     steps:
       - name: enable windows longpaths
         run: |
@@ -144,6 +148,30 @@ jobs:
           # Actually do builds and make zips and whatnot
           dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
           echo "dist ran successfully"
+      # NOTE: manual patch over the cargo-dist-generated workflow — re-apply
+      # after `dist generate`. Retries build-provenance attestation up to 3x
+      # because Sigstore's transparency log intermittently returns a transient
+      # "InternalError: error fetching tlog entry". Attestation stays MANDATORY:
+      # the final attempt is not continue-on-error, so a persistent Sigstore
+      # outage still fails the job (we never ship an un-attested release).
+      - name: Attest
+        id: attest1
+        continue-on-error: true
+        uses: actions/attest@v4
+        with:
+          subject-path: "target/distrib/*${{ join(matrix.targets, ', ') }}*"
+      - name: Attest (retry 1)
+        id: attest2
+        if: steps.attest1.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/attest@v4
+        with:
+          subject-path: "target/distrib/*${{ join(matrix.targets, ', ') }}*"
+      - name: Attest (retry 2)
+        if: steps.attest1.outcome == 'failure' && steps.attest2.outcome == 'failure'
+        uses: actions/attest@v4
+        with:
+          subject-path: "target/distrib/*${{ join(matrix.targets, ', ') }}*"
       - id: cargo-dist
         name: Post-build
         # We force bash here just because github makes it really hard to get values up

.github/workflows/scorecard.yml

@@ -0,0 +1,45 @@
+# OpenSSF Scorecard — supply-chain health signal for a zero-telemetry tool.
+# A local tool can't use product analytics for trust; a published Scorecard +
+# the dist-built reproducible release artifacts stand in for it.
+name: Scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "37 4 * * 1" # weekly, Monday
+  push:
+    branches: ["main"]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # upload SARIF to the Security tab
+      id-token: write # publish results to the public Scorecard API
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v5
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif