feat: add portable governed workflows

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,92 @@
+name: Bug report
+description: Report a reproducible problem in Roundtable
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve Roundtable. Do not report vulnerabilities, secrets, private source, or personal data here. Use the private process in SECURITY.md.
+  - type: textarea
+    id: summary
+    attributes:
+      label: What happened?
+      description: Describe the observable problem and why it matters.
+      placeholder: Roundtable showed…
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      placeholder: I expected…
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Include the smallest safe sequence that reproduces the problem. Redact prompts, paths, credentials, source, and runtime output.
+      placeholder: |
+        1. Start with local-dispatch…
+        2. Create a mission…
+        3. Approve the plan…
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Roundtable version or commit
+      placeholder: 0.1.0-beta.1 or commit SHA
+    validations:
+      required: true
+  - type: dropdown
+    id: adapter
+    attributes:
+      label: Adapter/runtime
+      options:
+        - local-dispatch
+        - Claude Code
+        - Claude Code Router
+        - Codex
+        - OpenCode
+        - E2B
+        - MiniMax
+        - OpenAI-compatible
+        - Not runtime-related
+    validations:
+      required: true
+  - type: dropdown
+    id: store
+    attributes:
+      label: Store driver
+      options:
+        - Local JSON
+        - Normalized Postgres
+        - Legacy Postgres JSONB
+        - Unknown / not applicable
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, Node version, browser, and whether this is local or hosted. Do not include personal paths.
+      placeholder: Ubuntu 24.04, Node 24, Chromium, local
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Safe supporting evidence
+      description: Optional screenshots or sanitized error codes only. Do not paste raw logs until you have checked them for secrets and private data.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checklist
+      options:
+        - label: I reproduced this on the latest supported beta or current main.
+          required: true
+        - label: This report contains no secrets, private source, personal paths, or vulnerability details.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/EdwinjJ1/roundtable/security/advisories/new
+    about: Report vulnerabilities privately; never include security details in a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,63 @@
+name: Feature request
+description: Describe a workflow or governance problem Roundtable should solve
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Start with the user's problem and evidence. A proposed implementation is useful after the need is clear.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Who encounters this problem, in what workflow, and what do they do today?
+      placeholder: When I manage several local coding agents…
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Describe observable success without prescribing internal architecture.
+    validations:
+      required: true
+  - type: textarea
+    id: example
+    attributes:
+      label: Concrete example
+      description: Give a redacted input/output or workflow example. Do not include proprietary prompts or source.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Current workaround or alternatives
+      description: What have you tried, and why is it insufficient?
+  - type: dropdown
+    id: area
+    attributes:
+      label: Product area
+      options:
+        - Workflows and revisions
+        - Planning and approval
+        - Scheduling and execution
+        - Runtime integration
+        - Artifacts and review
+        - Permissions and safety
+        - Storage and migration
+        - UI and accessibility
+        - Contributor experience
+        - Other
+    validations:
+      required: true
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Scope check
+      options:
+        - label: I checked ROADMAP.md and existing issues for related work.
+          required: true
+        - label: This request concerns file-, script-, or command-centered workflows rather than general SaaS automation.
+          required: false

.github/ISSUE_TEMPLATE/support_question.yml

@@ -0,0 +1,39 @@
+name: Setup or usage question
+description: Ask for help using or contributing to Roundtable
+title: "[Question]: "
+labels:
+  - question
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Questions are public. Do not include credentials, private source, prompts, local paths, raw logs, or vulnerability details.
+  - type: textarea
+    id: goal
+    attributes:
+      label: What are you trying to do?
+      description: Describe the intended workflow or contribution.
+    validations:
+      required: true
+  - type: textarea
+    id: tried
+    attributes:
+      label: What have you tried?
+      description: Include relevant documentation and sanitized commands or error codes.
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Roundtable version/commit, OS, Node version, store driver, and runtime kind when relevant.
+      placeholder: main@abc1234, Ubuntu 24.04, Node 24, local JSON, local-dispatch
+    validations:
+      required: true
+  - type: checkboxes
+    id: privacy
+    attributes:
+      label: Privacy check
+      options:
+        - label: I removed secrets, private source, prompts, personal paths, raw logs, and security-sensitive details.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,35 @@
+## Problem
+
+What user or contributor problem does this change solve? Link the issue or ADR
+when one exists.
+
+## Change
+
+Describe the smallest relevant behavior change and any deliberate non-goals.
+
+## Verification
+
+List commands and manual checks actually run. Do not mark a check complete if it
+was skipped.
+
+- [ ] `corepack pnpm typecheck`
+- [ ] `corepack pnpm lint`
+- [ ] `corepack pnpm test`
+- [ ] `corepack pnpm build`
+- [ ] `corepack pnpm test:e2e` (cross-layer/UI changes on POSIX)
+
+## Evidence and risk
+
+- Add screenshots or a short clip for visible UI changes.
+- Explain migration, owner-isolation, runtime, permission, privacy, or recovery
+  risk when relevant.
+- State any unsupported platform/runtime or follow-up work.
+
+## Contributor checklist
+
+- [ ] Tests verify public behavior or a distinct risk, not private call order or
+      coverage for its own sake.
+- [ ] No secret, private source, personal path, raw runtime output, or generated
+      `.roundtable` data is included.
+- [ ] User-facing behavior and `CHANGELOG.md` are updated when appropriate.
+- [ ] The PR is focused and does not overwrite unrelated work.

CHANGELOG.md

@@ -0,0 +1,53 @@
+# Changelog
+
+Notable user-visible changes are documented here. This project follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and uses
+[Semantic Versioning](https://semver.org/) for tagged releases.
+
+## [Unreleased]
+
+### Added
+
+- Initial open-source beta documentation, including architecture decisions,
+  privacy boundaries, security reporting, roadmap, and contribution templates.
+- Immutable, owner-scoped workflow revision foundation with historical mission
+  snapshots.
+- Execution run and task-attempt foundation for durable run history.
+- Deterministic Chromium Playwright golden paths for plan approval, delivery,
+  and history recovery.
+- Versioned `.roundtable.json` export, compatibility preflight, and explicit
+  owner-scoped import with server-recomputed content confirmation.
+- Workflow revision and execution history in the editor, including honest
+  runtime, model, duration, token, and cost evidence per task attempt.
+- Safe-checkpoint pause/resume and single-task retry with transitive downstream
+  stale-state detection.
+- A first-time-friendly workflow builder with a visible creation action,
+  explicit step instructions, expected results, ownership, and approval rules.
+
+### Changed
+
+- Package metadata now identifies the private application as
+  `@roundtable/app` and prepares version `0.1.0-beta.1`.
+- Product positioning now describes Roundtable as a visual workflow and
+  governance layer over local AI coding agents.
+- Runtime usage evidence distinguishes complete, partial, and unavailable
+  provider reports instead of presenting missing data as zero.
+
+### Security
+
+- Documented the difference between artifact safety scanning and runtime
+  permission enforcement, including the current external-runtime risks.
+- Defined an opt-in telemetry allowlist and manual diagnostic-export boundary;
+  these are policies for future implementation, not enabled collection.
+- Workflow imports reject incompatible environments, invalid domain graphs,
+  invalid SemVer requirements, and provenance hash mismatches before
+  persistence.
+- Clarified that the current beta supports one trusted operator per host;
+  runtime commands and provider configuration are not tenant-isolated.
+
+## Before this changelog
+
+Roundtable was developed without a maintained release changelog. Git history is
+the source of truth for earlier work. The first published beta should move the
+relevant entries above into a dated version section without rewriting earlier
+release history.

CODE_OF_CONDUCT.md

@@ -0,0 +1,48 @@
+# Code of Conduct
+
+Roundtable contributors, maintainers, and community members are expected to
+make participation safe, focused, and welcoming.
+
+## Expected behavior
+
+- Be respectful of different backgrounds, experience levels, and ways of
+  communicating.
+- Critique ideas and observable behavior, not people.
+- Give technical feedback with enough context to act on it.
+- Respect privacy. Do not publish another person's identity, prompts, source,
+  logs, paths, or private correspondence without consent.
+- Accept a clear “no”, maintain project scope, and stop conduct when asked by a
+  maintainer.
+
+## Unacceptable behavior
+
+- harassment, threats, sexualized attention, discrimination, or personal
+  attacks;
+- trolling, sustained disruption, or knowingly misleading security claims;
+- doxxing or sharing private information, credentials, source, or vulnerability
+  details;
+- retaliation against someone who raises a good-faith concern.
+
+## Scope
+
+This policy applies in repository issues, pull requests, discussions, review
+comments, project events, and private project communication. It also applies
+when someone publicly represents the Roundtable community.
+
+## Reporting and enforcement
+
+For an immediate public-thread problem, stop engaging and use GitHub's report or
+block controls. To request confidential maintainer review, contact the
+repository owner through their [GitHub profile](https://github.com/EdwinjJ1)
+with only a request for a private channel; do not publish sensitive details.
+Security vulnerabilities use the separate process in
+[SECURITY.md](SECURITY.md).
+
+Maintainers will consider context, impact, history, and the safety of affected
+people. Responses may include a private warning, content removal, temporary
+participation limits, or a permanent ban. Maintainers must recuse themselves
+when they have a conflict of interest and must protect reporter privacy as far
+as reasonably possible.
+
+This policy is informed by the
+[Contributor Covenant 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).