Add Cowork plugin, DCR setup, and security checks

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/security.yml

@@ -0,0 +1,80 @@
+name: Security
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+  schedule:
+    - cron: "23 3 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-scan:
+    name: Dependency audit and local SAST
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+          cache: npm
+      - name: Install locked dependencies without lifecycle scripts
+        run: npm ci --ignore-scripts --no-audit
+      - name: Audit production dependency advisories
+        run: npm run security:deps
+      - name: Run repository SAST preflight
+        run: npm run security:sast
+      - name: Run tests
+        run: npm test
+      - name: Validate Cowork package source
+        run: npm run validate:cowork
+      - name: Build and verify Cowork ZIP
+        run: npm run build:cowork
+
+  dependency-review:
+    name: Dependency review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+
+  codeql:
+    name: CodeQL SAST
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+      packages: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@b7351df727350dca84cb9d725d57dcf5bc82ba26 # v3
+        with:
+          languages: javascript-typescript
+      - name: Analyze
+        uses: github/codeql-action/analyze@b7351df727350dca84cb9d725d57dcf5bc82ba26 # v3
+        with:
+          category: /language:javascript-typescript

.gitignore

@@ -2,4 +2,5 @@ node_modules/
 *.log
 .env
 .env.*
+!toolkit/evolver-cowork-dcr/env/.env.example
 .DS_Store

CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to the Evolver GitHub Copilot integration are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.2.0] — 2026-07-18
+
+Adds a tenant-deployable Microsoft 365 Copilot Cowork plugin while preserving the
+existing VS Code/GitHub Copilot integration.
+
+### Added
+
+- Microsoft 365 Unified App manifest v1.28 with a stable application ID.
+- Cowork-native `capability-evolver` Agent Skill with explicit redaction,
+  validation, and untrusted-result handling rules.
+- Hosted EvoMap Streamable HTTP MCP connector using OAuth Dynamic Client
+  Registration and PKCE, with no embedded tenant secret or API key.
+- Static MCP tool catalog exposing eight remote-safe GEP tools.
+- Deterministic Cowork package validation and build scripts producing
+  `dist/evolver-cowork.zip`.
+- Cowork package tests, live read-only MCP/OAuth compatibility check, npm audit,
+  local SAST preflight, GitHub Dependency Review, and CodeQL workflow.
+- Microsoft 365 admin deployment and first-use verification instructions.
+
 ## [0.1.0] — 2026-07-17
 
 Initial public release. Adapts the Evolver agent-memory workflow for GitHub