Harden Apply public release surface

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,14 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Security report
-    url: https://github.com/0xprogrammable/programmable-registry/security/advisories/new
-    about: Report vulnerabilities privately. Do not open a public security issue.
-  - name: Builder support
-    url: https://github.com/0xprogrammable/programmable-v4-builder/discussions
-    about: Ask how to build, verify, submit, or discover a project.
+  - name: Report a vulnerability privately
+    url: https://github.com/0xprogrammable/apply/security/advisories/new
+    about: Report security-sensitive findings privately. Do not open a public issue.
+  - name: Ask an Apply question
+    url: https://github.com/0xprogrammable/apply/discussions/new?category=q-a
+    about: Ask about applications, review records, registry data, or integrations.
+  - name: Propose an Apply idea
+    url: https://github.com/0xprogrammable/apply/discussions/new?category=ideas
+    about: Discuss a review-rule, registry, or workflow improvement before opening a pull request.
+  - name: Get Hookbuilder support
+    url: https://github.com/0xprogrammable/hookbuilder/issues/new/choose
+    about: Report Builder bugs or propose building capabilities and templates.

.github/ISSUE_TEMPLATE/documentation.yml

@@ -0,0 +1,34 @@
+name: Documentation correction
+description: Report inaccurate, missing, or unclear Apply documentation.
+title: "[Docs] "
+labels:
+  - documentation
+body:
+  - type: input
+    id: location
+    attributes:
+      label: Page or file
+      description: Link to the exact page, file, or section.
+      placeholder: https://github.com/0xprogrammable/apply/blob/main/README.md
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: What is inaccurate or missing?
+    validations:
+      required: true
+  - type: textarea
+    id: correction
+    attributes:
+      label: Suggested correction
+      description: State the verifiable replacement or missing information.
+    validations:
+      required: true
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Public-report confirmation
+      options:
+        - label: This report contains no secret, personal data, private repository content, wallet material, or unpatched exploit.
+          required: true

.github/ISSUE_TEMPLATE/review-or-registry-bug.yml

@@ -0,0 +1,69 @@
+name: Checker or registry bug
+description: Report a reproducible, non-sensitive problem in Apply.
+title: "[Bug] "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for public, non-sensitive defects. Report exploitable vulnerabilities privately through [GitHub Security](https://github.com/0xprogrammable/apply/security/advisories/new).
+  - type: dropdown
+    id: component
+    attributes:
+      label: Affected component
+      options:
+        - Public checker or policy
+        - Application intake
+        - Registry or discovery data
+        - Schema
+        - GitHub workflow
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: revision
+    attributes:
+      label: Apply release or commit
+      description: Provide the exact tag or 40-character commit when possible.
+      placeholder: v1.1.0 or ba485e37561763179a694130b59de0cd09954b16
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: List the exact commands and smallest public input needed to reproduce the problem.
+      placeholder: |
+        1. Run ...
+        2. Provide ...
+        3. Observe ...
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual result
+      description: Include sanitized output or a public link.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected result
+      description: Explain the objective result you expected and why.
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Include the operating system, Node.js version, and relevant command or host.
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Public-report confirmation
+      options:
+        - label: This report contains no secret, personal data, private repository content, wallet material, or unpatched exploit.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,17 +1,19 @@
 <!--
-Application pull requests are generated by the released Programmable v4 Builder.
+Application pull requests are generated by the released Hookbuilder.
 Do not paste secrets, private RPC URLs, wallet keys, or personal data.
 Passing intake is not acceptance, an audit, deployment approval, or availability.
 -->
 
 ## Contribution type
 
 - [ ] Generated six-file application package
-- [ ] Registry maintenance
+- [ ] Apply repository maintenance
+- [ ] Open Review Standard maintenance
 
 ## Evidence
 
-Describe the exact source revision, reason for the change, and checks run. For a generated application, keep the Builder-generated title and body unchanged.
+Describe the exact source revision, reason for the change, and checks run. For a generated application, keep the
+Hookbuilder-generated title and body unchanged.
 
 ## Checklist
 

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: apply-codeql-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+          lfs: false
+          submodules: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: javascript-typescript
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6

.github/workflows/verify-hook-builder.yml

@@ -4,10 +4,6 @@ on:
   pull_request_target:
     branches:
       - main
-  push:
-    branches:
-      - main
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -156,37 +152,3 @@ jobs:
         if: steps.classify.outputs.mode == 'no-op'
         shell: bash
         run: echo "No current Registry intake content changed."
-
-  trusted-post-merge:
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-
-    steps:
-      - name: Checkout trusted revision
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.sha }}
-          path: source
-          persist-credentials: false
-          fetch-depth: 1
-          lfs: false
-          submodules: false
-
-      - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: 20
-
-      - name: Verify trusted Registry revision
-        working-directory: source
-        run: npm test
-
-      - name: Validate all maintained applications
-        shell: bash
-        run: |
-          set -euo pipefail
-          source_root="$GITHUB_WORKSPACE/source"
-          node "$source_root/scripts/verify-public-hook-application.mjs" \
-            --verify-maintained \
-            --repository-root "$source_root"

.github/workflows/verify-post-merge.yml

@@ -0,0 +1,48 @@
+name: Verify trusted main
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: apply-post-merge-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  trusted-post-merge:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout trusted revision
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          path: source
+          persist-credentials: false
+          fetch-depth: 1
+          lfs: false
+          submodules: false
+
+      - name: Set up Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 20
+
+      - name: Verify trusted Apply revision
+        working-directory: source
+        run: npm test
+
+      - name: Validate all maintained applications
+        shell: bash
+        run: |
+          set -euo pipefail
+          source_root="$GITHUB_WORKSPACE/source"
+          node "$source_root/scripts/verify-public-hook-application.mjs" \
+            --verify-maintained \
+            --repository-root "$source_root"

AGENTS.md

@@ -1,11 +1,11 @@
-# Registry contribution contract
+# Apply contribution contract
 
 This repository is the public application ledger and canonical discovery registry for Programmable projects built with
-the Programmable v4 Builder.
+Hookbuilder.
 
 ## Authority boundaries
 
-- Builder projects remain in builder-controlled public GitHub repositories.
+- Applicant projects remain in applicant-owned public GitHub repositories.
 - `submissions/` contains bounded, untrusted application records. A submission never edits `registry/`.
 - `registry/projects/` contains maintainer-authored records only. A record describes evidence; it is not an audit or
   safety guarantee.

CONTRIBUTING.md

@@ -1,18 +1,19 @@
 # Contributing
 
-There are two intentionally separate contribution paths.
+There are three intentionally separate contribution paths. Keep each pull request to one path.
 
 ## Application pull requests
 
-Use the released Programmable v4 Builder. An application pull request changes exactly one generated six-file directory
+Use the released [Hookbuilder](https://github.com/0xprogrammable/hookbuilder). An application pull request changes
+exactly one generated six-file directory
 under `submissions/<application-id>/`. Do not add project source, workflows, registry records, vendored code, or policy
-changes. The complete project stays in the builder-controlled public repository bound by numeric repository id, commit,
+changes. The complete project stays in the applicant-owned public repository bound by numeric repository id, commit,
 tree, and evidence digests.
 
 An intake pass proves only that the public record is structurally valid and bound to reachable source. It is not
 acceptance, an audit, deployment approval, provider support, availability, or Uniswap endorsement.
 
-## Registry maintenance
+## Apply repository maintenance
 
 Maintainers use a separate pull request for schemas, project records, generated indexes, documentation, workflows,
 tests, or the pinned Builder validation dependency. Run `npm test` and include the exact source evidence for every status