Add production release governance and repository guardrails

.github/CODEOWNERS

@@ -0,0 +1,20 @@
+# Default review ownership
+* @saldestechnology
+
+# Release, security, compatibility, and governance surfaces
+/.github/ @saldestechnology
+/governance/ @saldestechnology
+/scripts/ @saldestechnology
+/Cargo.toml @saldestechnology
+/Cargo.lock @saldestechnology
+/perf/Cargo.lock @saldestechnology
+/CHANGELOG.md @saldestechnology
+/deny.toml @saldestechnology
+/src/cli.rs @saldestechnology
+/src/config.rs @saldestechnology
+/src/exit.rs @saldestechnology
+/src/json.rs @saldestechnology
+/src/db/schema.rs @saldestechnology
+/src/mcp/ @saldestechnology
+/src/update.rs @saldestechnology
+/src/harness/templates/ @saldestechnology

.github/PULL_REQUEST_TEMPLATE.md

@@ -9,12 +9,27 @@ Brief description of the changes.
 - [ ] Breaking change (fix or feature that would cause existing functionality to change)
 - [ ] Documentation update
 
+## Compatibility and release impact
+
+- [ ] No compatibility-sensitive contract changed
+- [ ] Contract changed additively; I updated the CLI snapshot if applicable
+- [ ] Breaking change; the PR has `contract-review` and `breaking-change`
+      maintainer acknowledgement, a compatible version bump, migration notes,
+      and a prominent `BREAKING:` changelog entry
+- [ ] Release preparation; the PR has the `release-preparation` label and used
+      `scripts/version.py`
+
 ## Checklist
 
 - [ ] I have run `cargo fmt`
 - [ ] I have run `cargo clippy` and addressed any warnings
 - [ ] I have added tests that prove my fix/feature works
 - [ ] I have updated documentation if needed
+- [ ] I added a categorized `CHANGELOG.md` Unreleased entry, or a maintainer
+      confirmed `skip-changelog` is appropriate
+- [ ] I reviewed CLI, JSON, config, schema/index, Rust API, MCP/plugin, exit-code,
+      platform/package, and self-update compatibility as applicable
+- [ ] I ran `python3 scripts/check-governance.py check`
 - [ ] All tests pass (`cargo test`)
 
 ## Related Issues

.github/dependabot.yml

@@ -0,0 +1,39 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      rust-runtime:
+        dependency-type: production
+      rust-development:
+        dependency-type: development
+
+  - package-ecosystem: cargo
+    directory: "/perf"
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      perf-harness:
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  - package-ecosystem: npm
+    directory: "/docs/website"
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      documentation-site:
+        patterns: ["*"]

.github/workflows/ci.yml

@@ -20,6 +20,9 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
@@ -36,13 +39,17 @@ jobs:
             features: "--no-default-features"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88
+        with:
+          toolchain: "1.91"
 
       - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/bin/
@@ -56,49 +63,56 @@ jobs:
           key: ${{ runner.os }}-${{ env.ImageVersion }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Build
-        run: cargo build --verbose ${{ matrix.features }}
+        run: cargo build --locked --verbose ${{ matrix.features }}
 
       - name: Run tests
-        run: cargo test --verbose ${{ matrix.features }}
+        run: cargo test --locked --verbose ${{ matrix.features }}
 
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88
         with:
+          toolchain: "1.91"
           components: rustfmt, clippy
 
       - name: Check formatting
         run: cargo fmt --all -- --check
 
       - name: Clippy
-        run: cargo clippy -- -D warnings
+        run: cargo clippy --locked --all-targets --all-features -- -D warnings
 
       - name: Test PR report renderer
         run: node --test .github/scripts/render-ctx-pr-comment.test.cjs
 
   plugins:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88
+        with:
+          toolchain: "1.91"
 
       - name: Verify generated and committed plugins match
         run: ./scripts/release-plugin-check.sh --check
 
       - name: Install Claude Code
-        run: npm install -g @anthropic-ai/claude-code
+        run: npm install -g @anthropic-ai/claude-code@2.1.207
 
       - name: Validate Claude plugin
         run: claude plugin validate ./plugins/claude/ctx --strict
 
       - name: Install Codex
-        run: npm install -g @openai/codex
+        run: npm install -g @openai/codex@0.144.3
 
       - name: Validate Codex marketplace and install
         env:
@@ -111,21 +125,27 @@ jobs:
   publish-dry-run:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88
+        with:
+          toolchain: "1.91"
 
       - name: Dry-run publish (with features)
-        run: cargo publish --dry-run
+        run: cargo publish --locked --dry-run
 
       - name: Dry-run publish (minimal)
-        run: cargo publish --dry-run --no-default-features
+        run: cargo publish --locked --dry-run --no-default-features
 
   packaging-metadata:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
 
       - name: Validate generated package-manager files
         run: |
@@ -145,17 +165,20 @@ jobs:
   perf:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           # ctx score/check diff against git history; the harness also
           # records the commit SHA in its results.
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88
+        with:
+          toolchain: "1.91"
 
       - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/bin/
@@ -170,15 +193,15 @@ jobs:
           key: ${{ runner.os }}-${{ env.ImageVersion }}-cargo-perf-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Build ctx (perf profile, all features)
-        run: cargo build --profile perf --all-features
+        run: cargo build --locked --profile perf --all-features
 
       - name: Harness unit tests
-        run: cargo test --manifest-path perf/Cargo.toml
+        run: cargo test --locked --manifest-path perf/Cargo.toml
 
       - name: Harness smoke run
         env:
           CTX_PERF_BIN: ${{ github.workspace }}/target/perf/ctx
-        run: cargo run --release --manifest-path perf/Cargo.toml -- --smoke
+        run: cargo run --locked --release --manifest-path perf/Cargo.toml -- --smoke
 
       # Advisory period: continue-on-error until the ubuntu-latest baseline
       # lands in perf/baselines/ and run-to-run spread is confirmed <20%.
@@ -195,14 +218,14 @@ jobs:
              { [ "${{ github.event_name }}" = "push" ] && [ "${{ github.ref }}" = "refs/heads/main" ]; }; then
             SUITE=full
           fi
-          cargo run --release --manifest-path perf/Cargo.toml -- \
+          cargo run --locked --release --manifest-path perf/Cargo.toml -- \
             --suite "$SUITE" \
             --baseline perf/baselines/ubuntu-latest.json \
             --json-out perf-results.json
 
       - name: Upload perf results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: perf-results
           path: perf-results.json

.github/workflows/docs.yml

@@ -31,10 +31,10 @@ jobs:
       run:
         working-directory: docs/website
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
           cache: npm
@@ -47,7 +47,7 @@ jobs:
         run: npm run build
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: docs/website/build
 
@@ -62,4 +62,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4