chore(repo): prepare public contribution settings

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,44 @@
+name: Bug report
+description: Report reproducible incorrect behavior in CodeMesh.
+title: "bug: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Do not include credentials, private source, customer identifiers, or
+        sensitive paths. Use the security-reporting route for vulnerabilities.
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Safety check
+      options:
+        - label: This report contains no secret or private source material.
+          required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What happened, and what did you expect instead?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Provide the smallest synthetic or public reproduction available.
+    validations:
+      required: true
+  - type: input
+    id: commit
+    attributes:
+      label: CodeMesh commit
+      description: Provide the tested commit SHA.
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Validation details
+      description: Include relevant checks, environment details, and bounded logs.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security reports
+    url: https://github.com/Oneiros667/CodeMesh/security/policy
+    about: Report vulnerabilities and exposed secrets through the private route in the security policy.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,32 @@
+name: Feature request
+description: Propose a focused improvement aligned with the current roadmap.
+title: "proposal: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What agent or developer problem should CodeMesh address?
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence and users
+      description: What source, observation, or measurement supports the need?
+    validations:
+      required: true
+  - type: textarea
+    id: scope
+    attributes:
+      label: Proposed scope
+      description: Describe the smallest useful change and important exclusions.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Note existing workflows or smaller alternatives.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+# Pull request
+
+<!-- Use a Conventional Commit title: type(optional-scope): imperative summary -->
+
+## Summary
+
+Describe the problem, the change, and why this approach was selected.
+
+## Scope
+
+- Included:
+- Intentionally excluded:
+
+## Validation
+
+List each relevant check as passed, failed, skipped, or unavailable. Include
+commands when they help reviewers reproduce the result.
+
+## Safety and evidence
+
+- [ ] No credentials, private source, customer or employer material, generated
+      indexes, databases, model output, or raw evaluation traces are included.
+- [ ] Documentation and status claims distinguish implementation, automated
+      verification, inspected evidence, acceptance, release, and deployment.
+- [ ] Online providers, live services, and cost-bearing evaluation were not
+      used without explicit authorization.

.github/workflows/baseline-standards.yml

@@ -87,9 +87,16 @@ jobs:
           uv run --no-sync python -m codemesh_agent_access eval
 
       - name: Check repository standards
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PULL_REQUEST_TITLE: ${{ github.event.pull_request.title }}
         run: |
           git diff --check "$CHECK_RANGE"
           npx --yes markdownlint-cli2@0.23.1 "**/*.md"
           python tools/check_markdown_links.py
           python tools/check_publication_safety.py
-          python tools/check_conventional_commit.py --range "$CHECK_RANGE"
+          if [[ "$EVENT_NAME" == "pull_request" ]]; then
+            python tools/check_conventional_commit.py --message "$PULL_REQUEST_TITLE"
+          else
+            python tools/check_conventional_commit.py --range "$CHECK_RANGE"
+          fi

CODE_OF_CONDUCT.md

@@ -0,0 +1,32 @@
+# Code of Conduct
+
+## Our commitment
+
+CodeMesh contributors and maintainers commit to a respectful, inclusive, and
+professional project environment. Participation should remain constructive and
+focused on improving the software and its evidence.
+
+## Expected behaviour
+
+- Discuss ideas and reviews with empathy, clarity, and technical specificity.
+- Welcome questions and good-faith disagreement.
+- Respect privacy, confidentiality, licences, and repository boundaries.
+- Give credit for work and distinguish observation from attribution or claim.
+- Accept correction and help resolve misunderstandings proportionately.
+
+## Unacceptable behaviour
+
+Harassment, discrimination, threats, sexualized attention, personal attacks,
+doxxing, deliberate disclosure of private material, sustained disruption, and
+retaliation are not acceptable in project spaces.
+
+## Scope and enforcement
+
+This policy applies to repository interactions and to public representation of
+the project. Maintainers may edit or remove contributions, limit participation,
+or ban a participant when needed to protect the community.
+
+For a conduct concern, open an issue containing only a minimal, non-sensitive
+request for maintainer contact. Do not publish private evidence or personal
+information. The maintainer will arrange an appropriate private follow-up and
+will handle the report as confidentially and impartially as practical.

CONTRIBUTING.md

@@ -32,7 +32,16 @@ password, and never commit the resulting file.
   summary-free and deterministic.
 - Add or update canonical documentation when behavior, commands, contracts, or
   architecture change.
-- Use Conventional Commits when a commit is requested.
+- Format pull-request titles and requested commits as Conventional Commits.
+
+## Pull requests
+
+- Keep each pull request focused and explain the problem, the chosen approach,
+  and any intentionally excluded work.
+- Complete the repository pull-request template and report each relevant check
+  as passed, failed, skipped, or unavailable.
+- Resolve review conversations and update the branch before squash merging.
+- Follow the [Code of Conduct](CODE_OF_CONDUCT.md) in repository interactions.
 
 ## Validation
 

README.md

@@ -125,7 +125,8 @@ references, guides, status, evidence, engineering policy, and future proposals.
 ## Security, contribution, and licence
 
 Read [SECURITY.md](SECURITY.md) before reporting a suspected secret or
-vulnerability, and [CONTRIBUTING.md](CONTRIBUTING.md) before proposing changes.
+vulnerability, [CONTRIBUTING.md](CONTRIBUTING.md) before proposing changes, and
+the [Code of Conduct](CODE_OF_CONDUCT.md) when participating in the project.
 
 CodeMesh is licensed under the [MIT License](LICENSE). Third-party packages,
 services, and referenced evaluation repositories retain their own licences; see

docs/engineering/conventional-commits.md

@@ -15,6 +15,11 @@ Validate a Git range before review or release:
 python tools/check_conventional_commit.py --range origin/main..HEAD
 ```
 
+Pull requests are squash-merged and their titles become the resulting commit
+subjects. Use the same `type(optional-scope): imperative summary` format for a
+pull-request title. The hosted pull-request workflow validates the title while
+local range validation remains useful for branch review.
+
 The checker allows merge and revert commits produced by Git workflows. It does
 not install a hook. Hook adoption requires a separate reviewed decision and
 must preserve existing repository tooling.

docs/engineering/github-actions.md

@@ -9,14 +9,15 @@ The read-only workflow validates:
 - Markdown with the repository-pinned `markdownlint-cli2` version;
 - local Markdown links;
 - publication-safety patterns in Git-visible files; and
-- Conventional Commit messages in the pushed or pull-request range.
+- Conventional Commit messages in the pushed range, or the pull-request title.
 
-Normal pushes validate the complete pushed range and pull requests validate the
-base-to-head range. A forced push validates only its new head commit because the
-replaced history may be unavailable to the runner and is not a meaningful
-Conventional Commit comparison. Force pushes require separate owner approval;
-the publication rewrite is audited independently before its one-time remote
-replacement.
+Normal pushes validate the complete pushed range. Pull requests use the
+base-to-head range for source checks and validate the pull-request title as the
+future squash-commit subject. A forced push validates only its new head commit
+because the replaced history may be unavailable to the runner and is not a
+meaningful Conventional Commit comparison. Force pushes require separate owner
+approval; a publication rewrite must be audited independently before its
+one-time remote replacement.
 
 Every action is pinned to a full immutable commit SHA, checkout credentials are
 not persisted, and the workflow receives only `contents: read`. It uses no