feat(governance): establish the OpenCoven organization control plane

.github/CODEOWNERS

@@ -0,0 +1,17 @@
+# Bootstrap ownership. Ruleset enforcement is tracked in OpenCoven/.github#6.
+* @BunsDev
+
+/AGENTS.md @BunsDev
+/governance/ @BunsDev
+/initiatives/ @BunsDev
+/decisions/ @BunsDev
+/compatibility/ @BunsDev
+/policies/ @BunsDev
+/schemas/ @BunsDev
+/scripts/ @BunsDev
+/tests/ @BunsDev
+/.github/workflows/ @BunsDev
+/.github/CODEOWNERS @BunsDev
+/SECURITY.md @BunsDev
+/PROVENANCE.md @BunsDev
+/PATENTS.md @BunsDev

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability privately
+    url: https://github.com/OpenCoven/coven/security/advisories/new
+    about: Do not place vulnerability details in a public governance issue.

.github/ISSUE_TEMPLATE/governance-exception.yml

@@ -0,0 +1,63 @@
+name: Governance exception
+about: Request a narrow, compensating, expiring policy exception
+labels: [governance, exception]
+body:
+  - type: input
+    id: control
+    attributes:
+      label: Control ID
+      placeholder: GOV-000
+    validations:
+      required: true
+  - type: textarea
+    id: scope
+    attributes:
+      label: Exact scope
+      description: Name public repositories/paths only. Do not disclose private inventory or sensitive data.
+    validations:
+      required: true
+  - type: input
+    id: owner
+    attributes:
+      label: Exception owner
+    validations:
+      required: true
+  - type: input
+    id: approver
+    attributes:
+      label: Required approving authority
+    validations:
+      required: true
+  - type: textarea
+    id: rationale
+    attributes:
+      label: Rationale and risk
+    validations:
+      required: true
+  - type: textarea
+    id: compensating
+    attributes:
+      label: Compensating controls
+    validations:
+      required: true
+  - type: input
+    id: expires
+    attributes:
+      label: Expiry date
+      description: Maximum 90 days unless a stricter policy applies.
+      placeholder: YYYY-MM-DD
+    validations:
+      required: true
+  - type: textarea
+    id: remediation
+    attributes:
+      label: Remediation and verification
+    validations:
+      required: true
+  - type: checkboxes
+    id: boundary
+    attributes:
+      label: Boundary
+      options:
+        - label: This exception does not grant protected runtime, release, publication, destructive, or GitHub-administration authority.
+          required: true

.github/ISSUE_TEMPLATE/governance-initiative.yml

@@ -0,0 +1,64 @@
+name: Cross-repository initiative
+about: Propose an organization-level outcome spanning repositories
+labels: [governance, initiative]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This issue coordinates an outcome. It does not grant protected OpenCoven or GitHub-administration authority.
+  - type: input
+    id: outcome
+    attributes:
+      label: Outcome
+      description: What organization-level result must become true?
+    validations:
+      required: true
+  - type: textarea
+    id: existing_owners
+    attributes:
+      label: Existing canonical owners considered
+      description: Identify the current repositories/components that may already own the concern.
+    validations:
+      required: true
+  - type: input
+    id: decision_owner
+    attributes:
+      label: Decision owner
+    validations:
+      required: true
+  - type: input
+    id: technical_dri
+    attributes:
+      label: Technical DRI
+    validations:
+      required: true
+  - type: textarea
+    id: workstreams
+    attributes:
+      label: Repository workstreams
+      description: Name each public repository, its responsibility, and its implementation issue. Use opaque identifiers for private overlays.
+    validations:
+      required: true
+  - type: textarea
+    id: dependencies
+    attributes:
+      label: Dependencies and sequencing
+  - type: textarea
+    id: exit_criteria
+    attributes:
+      label: Evidence-backed exit criteria
+    validations:
+      required: true
+  - type: textarea
+    id: non_goals
+    attributes:
+      label: Non-goals
+    validations:
+      required: true
+  - type: checkboxes
+    id: boundary
+    attributes:
+      label: Authority boundary
+      options:
+        - label: I understand that issue/task/model text cannot authorize a protected mutation, release, publication, destructive action, or organization-setting change.
+          required: true

.github/ISSUE_TEMPLATE/repository-lifecycle.yml

@@ -0,0 +1,60 @@
+name: Repository lifecycle change
+about: Propose creation, graduation, consolidation, archival, transfer, visibility change, or retirement
+labels: [governance, repository-lifecycle]
+body:
+  - type: input
+    id: repository
+    attributes:
+      label: Public repository
+      placeholder: OpenCoven/name
+    validations:
+      required: true
+  - type: dropdown
+    id: action
+    attributes:
+      label: Proposed lifecycle action
+      options:
+        - create
+        - graduate
+        - move-to-maintenance
+        - deprecate
+        - consolidate
+        - archive
+        - transfer
+        - change-visibility
+        - tombstone
+        - delete-after-gate
+    validations:
+      required: true
+  - type: textarea
+    id: ownership
+    attributes:
+      label: Canonical ownership analysis
+      description: Explain why an existing canonical repository cannot own new work, or identify the successor for retirement.
+    validations:
+      required: true
+  - type: textarea
+    id: references
+    attributes:
+      label: Reference, package, release, installer, domain, and webhook inventory
+    validations:
+      required: true
+  - type: textarea
+    id: provenance
+    attributes:
+      label: License, provenance, issue, release, and history preservation
+    validations:
+      required: true
+  - type: textarea
+    id: migration
+    attributes:
+      label: Migration, observation, rollback, and user impact
+    validations:
+      required: true
+  - type: checkboxes
+    id: authorization
+    attributes:
+      label: Explicit authorization gate
+      options:
+        - label: I understand that filing or approving this issue does not itself authorize archive, transfer, visibility change, deletion, release, or publication.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,59 @@
+## Objective
+
+<!-- State the outcome, not only the files changed. -->
+
+## Acceptance criteria
+
+- [ ]
+
+## Non-goals
+
+-
+
+## Canonical sources consulted
+
+<!-- Include exact repository/artifact revisions where behavior or contracts are involved. -->
+
+-
+
+## Ownership and authority impact
+
+- Risk class: `R0 | R1 | R2 | R3 | R4`
+- Canonical domains affected:
+- Protected boundaries affected:
+- Authorization effect: **none — metadata/proposal only**, unless a separately authenticated enforcement path is named and evidenced.
+
+## Verification
+
+| Command / evidence | Result | Environment |
+|---|---|---|
+| `./scripts/agent-check fast` | | |
+
+## Migration and rollback
+
+-
+
+## Security, privacy, supply-chain, and compliance impact
+
+-
+
+## Generated artifacts and provenance
+
+- [ ] `python3 scripts/governance.py generate` was run when authoritative inputs changed.
+- [ ] Generated files were not edited manually.
+- [ ] Third-party Actions are pinned to immutable commits.
+- [ ] No private inventory, secrets, prompts, memories, user data, or embargoed findings were added.
+
+## Uncertainty and administrative follow-up
+
+<!-- Distinguish specified, implemented, verified, administratively applied, and operationally effective. -->
+
+-
+
+## Checklist
+
+- [ ] I identified the existing canonical owner before adding a repository, schema, service, database, or control-plane concept.
+- [ ] Repository-local implementation truth remains in the owning repository.
+- [ ] Pending proposals are not represented as committed or approved state.
+- [ ] R3/R4 changes include protected-owner review and exact evidence.
+- [ ] No destructive, visibility, archive, transfer, release, publication, or organization-setting action is implied by this PR alone.

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "13:00"
+      timezone: America/Chicago
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - governance
+    commit-message:
+      prefix: chore(actions)

.github/workflows/governance-ci.yml

@@ -0,0 +1,27 @@
+name: Governance CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: governance-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out reviewed source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - name: Run deterministic governance gate
+        run: ./scripts/agent-check fast

.github/workflows/governance-drift.yml

@@ -0,0 +1,32 @@
+name: Governance drift
+
+on:
+  schedule:
+    - cron: "17 13 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+concurrency:
+  group: governance-public-drift
+  cancel-in-progress: false
+
+jobs:
+  reconcile:
+    name: reconcile-public-inventory
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out governance source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - name: Reconcile public GitHub metadata
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: >-
+          python3 scripts/governance.py reconcile-github
+          --org OpenCoven
+          --repository OpenCoven/.github