Revamp onboarding and unblock checkpoint validation

.buildkite/scripts/provenance-coverage.sh

@@ -63,7 +63,7 @@ c8 --clean=false --exclude '**/node_modules/**' --reporter=json --reports-dir co
 # Include the policy benchmark and negative setup diagnostics without discarding
 # the integration demo coverage collected above.
 c8 --clean=false --exclude '**/node_modules/**' --reporter=json --reports-dir coverage \
-  node --test --test-concurrency=1 tests/provenance-benchmark.test.mjs tests/demo-provenance.test.mjs tests/validation-checkpoints.test.mjs
+  node --test --test-concurrency=1 tests/provenance-benchmark.test.mjs tests/demo-provenance.test.mjs tests/validation-checkpoints.test.mjs tests/docs-check.test.mjs
 
 # Fallow 2.89 consumes function/statement coverage but rejects c8's unknown
 # branch-column sentinel (-1). Preserve the original report; omit only branch

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,47 @@
+name: Bug report
+description: Report a reproducible problem with current Tabellio behavior.
+title: "[Bug]: "
+body:
+  - type: markdown
+    attributes:
+      value: "For vulnerabilities, use https://github.com/IntelIP/Tabellio/security/advisories/new. Do not include credentials, private sessions, provider bodies, or account data."
+  - type: input
+    id: version
+    attributes:
+      label: Package version and source commit
+      description: Include tabellio-version output fields, not private machine paths.
+      placeholder: "0.7.0; source commit if known"
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Operating system and relevant tool versions
+      description: Include Node.js, Git, PostgreSQL, or Entire versions used by this workflow.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps
+      description: Give minimal commands and safe sample inputs. Label synthetic fixtures.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: Include the safe error or receipt status and what remained unfinished.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Safe evidence references
+      description: Link sanitized receipts, existing validation/review artifacts, and the affected code version. Never attach private checkpoint bundles.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Private vulnerability report
+    url: https://github.com/IntelIP/Tabellio/security/advisories/new
+    about: Report security issues privately. Do not post vulnerability details in public issues.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,43 @@
+name: Feature request
+description: Propose a bounded improvement for a user outcome.
+title: "[Feature]: "
+body:
+  - type: markdown
+    attributes:
+      value: "Keep evidence safe. Never include credentials, private transcripts, provider bodies, or account data."
+  - type: input
+    id: version
+    attributes:
+      label: Current package version and source commit
+      placeholder: "0.7.0; source commit if known"
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Who needs this and what problem they face
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Current workflow or reproduction
+      description: Show the current steps or a clearly labeled hypothetical example.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior and observable result
+      description: Describe completion and relevant failure cases without assumed performance gains.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Existing tools or alternatives considered
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Safe evidence references and constraints
+      description: Link sanitized examples or existing records; identify access and approval dependencies.

.github/pull_request_template.md

@@ -0,0 +1,43 @@
+## Objective and behavior
+
+Who benefits, what problem this solves, and the observable before/after behavior.
+List changed files, scope limits, and any unfinished work.
+
+## Tabellio Evidence
+
+- [ ] Evidence envelope generated
+- [ ] Evidence envelope validated
+- [ ] Required commands listed with pass/fail/skipped status
+- [ ] Changed files listed
+- [ ] External action policy present
+- [ ] No deploy, migration, infrastructure, DNS, hosting, billing, live-money, credentialed provider read, secret-value read, or destructive workspace action attempted without explicit approval
+
+Evidence summary:
+
+```json
+{
+  "schemaVersion": "tabellio-evidence/v0.1",
+  "runId": "",
+  "baseRef": "",
+  "headRef": "",
+  "changedFileCount": 0,
+  "commandsRun": [],
+  "checks": [],
+  "externalActionsAttempted": false
+}
+```
+
+Code version: repository, branch, full head commit, and base.
+Verification: commands with pass/fail/blocked/skipped results.
+Evidence references: existing manifest, exact-head validation, and durable review records.
+External-action authority: source of explicit approval, or no protected action attempted.
+
+## Review Notes
+
+Use this section for human review context, known gaps, and follow-up work. Keep agent claims tied to evidence artifacts or command output.
+
+Blockers and decisions:
+
+Next step and responsible role:
+
+Passing checks and this note do not grant merge, release, publication, or deployment approval.

AGENTS.md

@@ -1,4 +1,77 @@
-# Code cleanup
+# Agent entry point
 
-- Run `npm run quality:dead-code` after JavaScript removals. Run `npm run quality:changed-code` before opening a pull request.
-- For cross-file removals, refresh Graphify and inspect callers before deleting. Verify current source and framework registrations.
+Tabellio helps teams review AI-assisted code with evidence tied to the exact code
+version. Serve teams trying and connecting Tabellio before adding operator detail.
+
+## Find the right guide
+
+- [README](README.md): product, published demo, limits, and help.
+- [Documentation home](docs/README.md): try, connect, contribute, or operate.
+- [Contributing](CONTRIBUTING.md): setup, verification, work-plan and handoff format.
+- [Harness workflow](docs/harness.md): task state, failure routes, and lesson mapping.
+- `scripts/` and `scripts/lib/`: CLIs and shared implementation.
+- `schemas/`, `migrations/`, `examples/`: contracts, storage changes, and fixtures.
+- Root `tabellio.*.validation.json` and `.tabellio/`: acceptance and validator authority.
+- `reports/`: bounded evidence; `docs/historical/`: previous plans and review snapshots.
+- `.github/` and `.buildkite/`: hosted checks using shared scripts.
+
+## Initialize before implementation
+
+1. Read the request, nearest instructions, and the relevant current guide.
+2. Inspect status, branch, remotes, worktrees, and diff names. Preserve existing edits.
+3. Use one isolated task branch when the current checkout contains unrelated work.
+4. Use Node.js 20+, npm, Git 2.38+, and Entire 0.7.7+. CI uses Node.js 22.23.1.
+5. Check `node scripts/tabellio-preflight.mjs --profile agent` and `npm run check`.
+6. Establish the passing baseline or save the specific missing-access blocker.
+
+PostgreSQL client/server tools are needed for provenance integration checks.
+Use the pinned scanner setup in [Contributing](CONTRIBUTING.md). git-spice 0.18+
+is needed for stack work. Preflight is read-only; `entire doctor` requires explicit
+operator repair approval. Trust Codex hooks through `/hooks` when preflight directs it.
+
+## Select one task
+
+Follow initialize → select one task → implement → verify → review → human decision.
+Write its objective, allowed files/behavior, completion criteria, and required checks
+using the contributor format. Keep one active task; finish or hand it off before
+starting another. Avoid runtime, schema, migration, or manifest changes for docs-only work.
+
+## Verify the change
+
+| Change | Required checks |
+| --- | --- |
+| All changes | `npm run check`; `npm run quality:changed-code`; `npm pack --dry-run` |
+| Docs, entry files, templates | `npm run docs:check`; inspect commands and rendered Markdown |
+| Installation or first-use instructions | Clean consumer install and documented demo |
+| JavaScript changes | Focused behavior tests and `node --check` on changed scripts |
+| JavaScript removals | `npm run quality:dead-code`; inspect callers and registrations |
+| Cross-file removals | Refresh Graphify for relationships, then verify current source |
+| Product or acceptance changes | Committed exact-head validation and required hosted checks |
+| Provenance/security changes | Existing PostgreSQL and pinned scanner checks; see current guides |
+
+Failed checks return to the relevant fix. Never call skipped or blocked checks passed.
+Use existing manifests, validation refs, and durable review records as the authority.
+New code, base movement, or changed inputs can invalidate a previous passing result.
+
+## Authority and data
+
+Keep public `origin` limited to code branches and approved tags. Keep private
+checkpoints, transcripts, validation, and review state on customer-owned storage.
+Do not retain credentials, raw prompts, provider bodies, or private account data
+in notes, packets, issues, logs, or PRs. Follow [data boundaries](tabellio.data-boundary.json).
+Merge, publication, releases, deployment, migrations, infrastructure, DNS, hosting,
+billing, live-money, credentialed reads, secret-value reads, and destructive actions
+need explicit authority. Checks and notes grant no approval. Never bypass gates.
+Plane is a legacy import capability. IntelIP uses AgentShift; no adapter is included.
+
+## Recover and hand off
+
+Resume from the task's saved code version, decisions, check artifacts, blockers,
+and next step. Compare them with current Git and provider state before reusing readiness.
+Reuse [agent-run state](docs/agent-run-lifecycle.md), [review records](docs/review-loop.md),
+and [validation results](docs/validation-runner.md); notes are navigation, not approval.
+Save missing access immediately. After three consecutive failed attempts without
+material progress, stop retries and hand off the cause, attempted fixes, and next decision.
+Remove only task-owned temporary files. Never reset others' changes or delete
+private checkpoint history. Leave a clean scoped commit or an explicit unfinished-work
+handoff using [Contributing](CONTRIBUTING.md).