docs(governance): add CoC, security policy, PR/issue templates, PR checks

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,79 @@
+name: Bug report
+description: Something is broken or behaving unexpectedly
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug. Please fill in the fields below.
+
+        For **security issues**, do NOT open an issue. See [SECURITY.md](../../SECURITY.md).
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Run the version command or check the release you're on.
+      placeholder: "0.2.1"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - macOS (Apple Silicon)
+        - macOS (Intel)
+        - Windows
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: os-version
+    attributes:
+      label: OS version
+      placeholder: "Ubuntu 24.04 / macOS 15.2 / Windows 11"
+    validations:
+      required: true
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear and concise description of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Numbered list of exact steps.
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / output
+      description: Paste relevant terminal output or logs.
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched existing issues and didn't find a duplicate
+          required: true
+        - label: I am running the latest version
+          required: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,50 @@
+name: Feature request
+description: Suggest a new feature or improvement
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the idea! A short conversation here saves everyone time before any code is written.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: The **why**, not the **what**.
+      placeholder: "When I'm working with X, I want Y so that Z."
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: How would you imagine using this?
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What workarounds have you tried?
+
+  - type: dropdown
+    id: contribution
+    attributes:
+      label: Are you willing to contribute the implementation?
+      options:
+        - "Yes, with guidance"
+        - "Yes, I can do it"
+        - "No, just suggesting"
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched existing issues and didn't find a duplicate
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,34 @@
+<!--
+PR title must follow Conventional Commits — it becomes the squash commit message.
+Format: type(scope): short description
+Examples: fix(ingest): handle empty envelope / feat(web): add issue filter presets
+-->
+
+## What
+<!-- One or two sentences describing the change. -->
+
+## Why
+<!-- The problem you're solving. Link to the issue if there is one (e.g. "Closes #42"). -->
+
+## How
+<!-- Brief notes on the approach, only if non-obvious. -->
+
+## Testing
+
+- [ ] `cargo test --workspace` passes
+- [ ] `cargo fmt --all -- --check` passes
+- [ ] `cargo clippy --workspace --all-targets -- -D warnings` passes
+- [ ] Frontend checks pass (`svelte-check` + build) if `web/` changed
+- [ ] Local code review tool run (e.g. Cora)
+- [ ] Manual smoke-test of the affected feature <!-- describe what you tested -->
+
+## Related Issues
+<!-- Link to related issues, e.g. Closes #123 -->
+
+## Checklist
+
+- [ ] Branch name follows convention (`fix/`, `feat/`, `docs/`, `chore/`, `refactor/`, `test/`, `perf/`, `security/`)
+- [ ] Branch is from `develop`
+- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
+- [ ] No secrets or credentials committed
+- [ ] One logical change per PR (no mixed concerns)

.github/workflows/pr-checks.yml

@@ -0,0 +1,70 @@
+name: PR Checks
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+    branches: [develop, main]
+
+jobs:
+  branch-naming:
+    name: Branch Naming
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check branch name
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          echo "Checking branch: $HEAD_REF"
+          ALLOWED="^(feat|fix|docs|chore|perf|security|refactor|test|build|ci)/"
+          if echo "$HEAD_REF" | grep -qE "$ALLOWED"; then
+            echo "OK: branch name follows convention"
+          else
+            echo "::error::Branch name must start with one of: feat/, fix/, docs/, chore/, perf/, security/, refactor/, test/, build/, ci/"
+            echo "Example: fix/ingest-envelope, feat/web-filters"
+            echo "Current: $HEAD_REF"
+            exit 1
+          fi
+
+  pr-template:
+    name: PR Description
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check PR body
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          echo "Checking PR description..."
+          MISSING=""
+          if ! echo "$PR_BODY" | grep -qi "## What"; then
+            MISSING="$MISSING\n  - ## What (description of the change)"
+          fi
+          if ! echo "$PR_BODY" | grep -qi "## Why"; then
+            MISSING="$MISSING\n  - ## Why (the problem you're solving)"
+          fi
+          if ! echo "$PR_BODY" | grep -qi "## Testing"; then
+            MISSING="$MISSING\n  - ## Testing (how you verified this works)"
+          fi
+          if [ -n "$MISSING" ]; then
+            echo "::error::PR description is missing required sections:$MISSING"
+            exit 1
+          fi
+          echo "OK: PR description has required sections"
+
+  commit-conventional:
+    name: Conventional Commits
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check PR title format
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          echo "Checking PR title: $PR_TITLE"
+          PATTERN="^(feat|fix|docs|chore|perf|refactor|test|build|ci|security)(\(.+\))?!?: .+"
+          if echo "$PR_TITLE" | grep -qE "$PATTERN"; then
+            echo "OK: PR title follows Conventional Commits"
+          else
+            echo "::error::PR title must follow Conventional Commits format"
+            echo "Expected: type(scope): short description"
+            echo "Example: fix(ingest): handle empty envelope"
+            exit 1
+          fi

CODE_OF_CONDUCT.md

@@ -0,0 +1,34 @@
+# Code of Conduct
+
+TrapFall is a small open-source project and we want it to stay a place people enjoy contributing to.
+
+## The rules, briefly
+
+- **Be respectful.** Disagreement is fine; rudeness, condescension, and personal attacks are not.
+- **Assume good faith.** Most miscommunication isn't malicious, so clarify before escalating.
+- **Stay on topic.** Issues, PRs, and discussions are about TrapFall. Take off-topic conversations elsewhere.
+- **No harassment.** Targeted insults, slurs, sustained disruption, sexualized comments, doxxing, or threats are not tolerated, anywhere, against anyone.
+- **No spam.** That includes promotional links, irrelevant cross-posting, and AI-generated noise that doesn't engage with the actual conversation.
+
+This applies to everything inside the project: issues, PRs, discussions, commits, and any community space we create later (Discord, etc.).
+
+## Enforcement
+
+If you see a violation, or experience one, email **hello@codecora.dev** with subject `[TrapFall conduct]`. Include links and context.
+
+Maintainers may, at their discretion:
+
+1. Edit or delete the offending content
+2. Issue a private warning
+3. Lock the thread
+4. Block the account from the project
+
+We default to the lightest action that resolves the situation. Severe or repeat violations skip steps.
+
+## Scope
+
+Maintainers act in this project's spaces. We don't police behavior outside the project, but we do consider patterns of behavior elsewhere when deciding on enforcement here.
+
+---
+
+*This document is intentionally short. It is inspired by the [Contributor Covenant](https://www.contributor-covenant.org/) but kept compact for a small project.*

SECURITY.md

@@ -0,0 +1,49 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| v0.2.x (latest release) | ✅ |
+| Previous release line | ✅ (critical only) |
+| Older versions | ❌ |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in TrapFall, please report it responsibly.
+
+**Do NOT** open a public issue for security vulnerabilities.
+
+### How to Report
+
+Use [GitHub Private Vulnerability Reporting](https://github.com/codecoradev/trapfall/security/advisories/new). This keeps the report confidential and visible only to maintainers.
+
+Include as much detail as possible:
+
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+### What to Expect
+
+- **Acknowledgment** within 48 hours
+- **Initial assessment** within 5 business days
+- **Fix timeline** depends on severity:
+  - Critical: 7 days
+  - High: 14 days
+  - Medium: 30 days
+  - Low: next minor release
+
+### Security in the Development Process
+
+TrapFall runs automated security checks on every PR and weekly (Monday 06:00 UTC):
+
+- **Cargo Audit** — Rust dependency advisories scan on the workspace
+- **Trivy Secrets** — scans for committed credentials and keys
+- **Trivy Filesystem** — misconfiguration and vulnerability scan
+- **npm Audit** — frontend (`web/`) dependency advisories, tracked on PRs and the weekly schedule
+
+### Deployment Surface Notes
+
+The production Docker image is built `FROM scratch` with a statically linked MUSL binary and rustls (no OpenSSL). There is no shell, no package manager, and no OS layer inside the container, which keeps the runtime attack surface minimal. Report anything that contradicts that expectation.