Foundation phase: workspace, libraries, infra, CI, governance

.editorconfig

@@ -0,0 +1,27 @@
+root = true
+
+[*]
+charset                  = utf-8
+end_of_line              = lf
+insert_final_newline     = true
+trim_trailing_whitespace = true
+indent_style             = space
+indent_size              = 2
+
+[*.rs]
+indent_size = 4
+
+[*.{ts,tsx,js,jsx,mjs,cjs,json,yaml,yml,html,css,scss}]
+indent_size = 2
+
+[*.toml]
+indent_size = 2
+
+[Cargo.lock]
+indent_size = 2
+
+[Makefile]
+indent_style = tab
+
+[*.md]
+trim_trailing_whitespace = false

.env.example

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copy to .env before running:
+#   docker compose -f deploy/docker/compose.yaml up -d
+# Do not commit your local .env (it is gitignored).
+
+POSTGRES_USER=zagrosi
+POSTGRES_PASSWORD=changeme-strong-password-required
+POSTGRES_DB=zagrosi
+POSTGRES_PORT=5432
+
+VALKEY_PORT=6379
+
+NATS_CLIENT_PORT=4222
+NATS_MONITOR_PORT=8222
+NATS_SERVER_NAME=nats-dev

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: Bug report
+description: Report a defect in Zagrosi.
+title: "[Bug]: "
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Please fill in the fields below.
+  - type: input
+    id: summary
+    attributes:
+      label: Summary
+      description: One-sentence description of the bug.
+      placeholder: "When I do X, Y happens instead of Z."
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Reproduction steps
+      description: Numbered list. Include the exact commands or UI actions.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behaviour
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behaviour
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: |
+        Operating system, Zagrosi version, browser (if web), Rust toolchain version (if relevant).
+      placeholder: |
+        OS: macOS 15.2
+        Zagrosi: 0.1.0
+        Browser: n/a
+        Rust: 1.91.0
+    validations:
+      required: true
+  - type: dropdown
+    id: severity
+    attributes:
+      label: Severity
+      description: Triage severity. See governance manual for severity-to-priority mapping.
+      options:
+        - critical
+        - high
+        - medium
+        - low
+      default: 2
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+blank_issues_enabled: false
+contact_links:
+  - name: Discussions
+    url: https://github.com/MicrosoftWindows96/zagrosi/discussions
+    about: General questions, ideas, and conversations belong in Discussions.
+  - name: Security policy
+    url: https://github.com/MicrosoftWindows96/zagrosi/security/policy
+    about: Vulnerabilities are reported privately via the Security policy. Do not open a public issue.

.github/ISSUE_TEMPLATE/design-feedback.yml

@@ -0,0 +1,56 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: Design feedback
+description: Provide feedback on a design proposal or ADR before implementation.
+title: "[Design]: "
+labels: ["design", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this template to share design feedback before implementation begins.
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      description: The bounded context this design concerns.
+      options:
+        - identity
+        - workspaces
+        - tasks
+        - agile
+        - docs
+        - chat
+        - incidents
+        - oncall
+        - postmortems
+        - search
+        - notifications
+        - scheduler
+        - gateway
+        - web
+        - mcp
+        - helm
+        - compose
+        - ci
+        - deps
+    validations:
+      required: true
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: Summary of the design question or proposal.
+    validations:
+      required: true
+  - type: textarea
+    id: references
+    attributes:
+      label: References
+      description: Links to relevant ADRs, prior issues, related PRs.
+  - type: textarea
+    id: feedback
+    attributes:
+      label: Feedback
+      description: Your specific feedback, concerns, or alternative approaches.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: Feature request
+description: Propose a new capability for Zagrosi.
+title: "[Feature]: "
+labels: ["enhancement", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for proposing a feature. Please fill in the fields below.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user-facing problem does this feature solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposed_solution
+    attributes:
+      label: Proposed solution
+      description: How would you like the feature to behave?
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Other approaches you considered and why this one is preferred.
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope and acceptance criteria
+      description: What is in scope, what is out of scope, what would mark the feature as done.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,58 @@
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
+
+## Summary
+
+<!-- One to three sentences describing what this PR does and why. -->
+
+## Linked issue
+
+Closes #
+
+## Type of change
+
+<!-- Pick one Conventional Commits prefix that applies to the PR's commits. -->
+
+- [ ] feat
+- [ ] fix
+- [ ] docs
+- [ ] chore
+- [ ] refactor
+- [ ] test
+- [ ] perf
+- [ ] ci
+
+## Scope
+
+<!-- Pick the scope from the project's allowed set. -->
+
+- [ ] identity
+- [ ] workspaces
+- [ ] tasks
+- [ ] agile
+- [ ] docs
+- [ ] chat
+- [ ] incidents
+- [ ] oncall
+- [ ] postmortems
+- [ ] search
+- [ ] notifications
+- [ ] scheduler
+- [ ] gateway
+- [ ] web
+- [ ] mcp
+- [ ] helm
+- [ ] compose
+- [ ] ci
+- [ ] deps
+
+## Test plan
+
+<!-- Describe how you validated this change. Include the commands you ran. -->
+
+## Checklist
+
+- [ ] DCO sign-off on every commit
+- [ ] Conventional Commits subjects throughout
+- [ ] All status checks running locally before push
+- [ ] All committed prose meets the project's writing standards (see CONTRIBUTING.md)
+- [ ] No new dependencies introduced without a clear reason

.github/branch-protection.json

@@ -0,0 +1,48 @@
+{
+  "name": "main-branch-protection",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/main"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    { "type": "required_linear_history" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "required_status_checks": [
+          { "context": "dco / dco" },
+          { "context": "commitlint / lint" },
+          { "context": "rust / cargo fmt" },
+          { "context": "rust / dotenv lint" },
+          { "context": "rust / cargo clippy" },
+          { "context": "rust / rust test summary" },
+          { "context": "rust / cargo deny" },
+          { "context": "rust / cargo sbom" },
+          { "context": "rust / compose smoke" },
+          { "context": "web / pnpm lint" },
+          { "context": "web / pnpm typecheck" },
+          { "context": "web / pnpm test" },
+          { "context": "helm / helm lint" }
+        ]
+      }
+    }
+  ]
+}

.github/branch-protection.json.LICENSE

@@ -0,0 +1,6 @@
+SPDX-License-Identifier: AGPL-3.0-or-later
+
+Sidecar SPDX header for branch-protection.json. The JSON itself is data
+consumed by the GitHub Rulesets API (gh api PUT /repos/.../rulesets/<id>
+--input branch-protection.json), which rejects unknown top-level keys;
+this sidecar follows the REUSE specification for licensing data files.

.github/workflows/commitlint.yml

@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+name: commitlint
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: commitlint-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
+        with:
+          configFile: commitlint.config.mjs