docs: document audit transaction fix and utc_now relocation (PR #5 follow-up)

.cursorrules

@@ -0,0 +1,7 @@
+# FlightDeck — Cursor
+
+Read **`AGENTS.md`** for mission, non-goals, public contracts, engineering rules, verification, and docs policy. **`CLAUDE.md`** is a short index for Claude Code / Cursor.
+
+Quick verify (uv): `uv sync --frozen --extra dev`, then `uv run python -m ruff check src tests`, `uv run python -m pytest`, `uv run python scripts/quickstart_smoke.py` (pip/venv equivalents in `DEVELOPMENT.md`; on Windows, `py -3` if needed).
+
+Normative v1 direction: https://github.com/flightdeckdev/flightdeck/blob/main/docs/spec-v1-forward.md · backlog: https://github.com/flightdeckdev/flightdeck/blob/main/docs/v1-next-steps.md · CLI: https://github.com/flightdeckdev/flightdeck/blob/main/docs/cli.md

.gitattributes

@@ -0,0 +1,2 @@
+# Golden bundle checksum is sensitive to line endings on checkout (see CHANGELOG 0.7.0).
+tests/fixtures/golden_bundle/** text eol=lf

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Team must exist under https://github.com/orgs/flightdeckdev/teams (or replace with @username).
+* @flightdeckdev/maintainers

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,29 @@
+name: Bug report
+description: Report a reproducible problem with FlightDeck.
+title: "bug: "
+labels: ["bug"]
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What happened?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction
+      description: Commands, inputs, and output needed to reproduce.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: FlightDeck version or commit.
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, Python version, and relevant setup details.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,34 @@
+name: Feature request
+description: Propose a focused FlightDeck capability.
+title: "feat: "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What release safety problem does this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What should FlightDeck do?
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - release artifact
+        - run event
+        - safety ledger
+        - pricing
+        - policy
+        - CLI
+        - docs
+        - other
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,21 @@
+## Summary
+
+## Why
+
+## Changes
+
+## Validation
+
+- [ ] `python -m ruff check src tests`
+- [ ] `python -m pytest`
+- [ ] CLI smoke test, if relevant
+
+## Schema / Storage Impact
+
+- [ ] None
+- [ ] Schema change
+- [ ] Storage change
+
+## Risk
+
+## Notes

.github/workflows/ci.yml

@@ -0,0 +1,81 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.14"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+          python-version: ${{ matrix.python-version }}
+
+      - name: Sync dependencies
+        run: uv sync --frozen --extra dev
+
+      - name: Lint
+        run: uv run python -m ruff check src tests
+
+      - name: Test
+        run: uv run python -m pytest
+
+      - name: JSON Schemas drift check
+        run: |
+          uv run python scripts/generate_schemas.py
+          git diff --exit-code schemas/
+
+      - name: Quickstart smoke (cross-platform)
+        run: uv run python scripts/quickstart_smoke.py
+
+      - name: CLI smoke
+        run: uv run flightdeck --help
+
+  test-windows:
+    runs-on: windows-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.14"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+          python-version: ${{ matrix.python-version }}
+
+      - name: Sync dependencies
+        run: uv sync --frozen --extra dev
+
+      - name: Lint
+        run: uv run python -m ruff check src tests
+
+      - name: Test
+        run: uv run python -m pytest
+
+      - name: JSON Schemas drift check
+        run: |
+          uv run python scripts/generate_schemas.py
+          git diff --exit-code schemas/
+
+      - name: Quickstart smoke (cross-platform)
+        run: uv run python scripts/quickstart_smoke.py
+
+      - name: CLI smoke
+        run: uv run flightdeck --help

.github/workflows/release-pypi.yml

@@ -0,0 +1,89 @@
+# Publish sdist + wheel to PyPI when a SemVer tag is pushed (e.g. v1.0.2).
+# Configure "trusted publishing" on PyPI for this workflow + repository + optional GitHub environment.
+# https://docs.pypi.org/trusted-publishers/
+
+name: Release (PyPI)
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+
+jobs:
+  publish:
+    name: Build, verify, publish
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/flightdeck-ai/
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+          python-version-file: .python-version
+
+      - name: Sync locked dev environment
+        run: uv sync --frozen --extra dev
+
+      - name: Verify tag matches declared package versions
+        shell: bash
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Unexpected tag format: $TAG (expected vMAJOR.MINOR.PATCH)"
+            exit 1
+          fi
+          uv run python <<'PY'
+          import os
+          import pathlib
+          import re
+          import tomllib
+
+          tag = os.environ["TAG"]
+          expected = tag.removeprefix("v")
+          data = tomllib.loads(pathlib.Path("pyproject.toml").read_text(encoding="utf-8"))
+          pyproject = data["project"]["version"]
+          init = pathlib.Path("src/flightdeck/__init__.py").read_text(encoding="utf-8")
+          m = re.search(r'__version__\s*=\s*["\']([^"\']+)["\']', init)
+          if not m:
+              raise SystemExit("Could not parse __version__ from src/flightdeck/__init__.py")
+          module = m.group(1)
+          if pyproject != expected:
+              raise SystemExit(f"Tag {tag} expects {expected} but pyproject.toml has {pyproject}")
+          if module != expected:
+              raise SystemExit(f"Tag {tag} expects {expected} but __init__.py has {module}")
+          PY
+
+      - name: Lint
+        run: uv run python -m ruff check src tests
+
+      - name: Test
+        run: uv run python -m pytest
+
+      - name: JSON Schemas drift check
+        run: |
+          uv run python scripts/generate_schemas.py
+          git diff --exit-code schemas/
+
+      - name: Build distributions
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*
+          generate_release_notes: true

.gitignore

@@ -0,0 +1,31 @@
+__pycache__/
+*.py[cod]
+.pytest_cache/
+pytest-cache-files-*/
+.ruff_cache/
+.tmp/
+.venv/
+build/
+dist/
+*.egg-info/
+.coverage
+htmlcov/
+.DS_Store
+Thumbs.db
+
+# Local FlightDeck workspace (SQLite ledger + local config); never commit.
+.flightdeck/
+
+# Environment and secrets
+.env
+.env.*
+*.pem
+*.p12
+*.pfx
+secrets/
+private/
+
+# Common credential filenames (adjust if you add fixtures with similar names).
+*credentials*.json
+*service-account*.json
+google-credentials.json

.pre-commit-config.yaml

@@ -0,0 +1,17 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: check-ast
+      - id: check-merge-conflict
+      - id: check-yaml
+        args:
+          - --allow-multiple-documents
+      - id: debug-statements
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.12
+    hooks:
+      - id: ruff

.python-version

@@ -0,0 +1 @@
+3.14