chore(repo): prepare v0.1.0-rc.1 launch

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @DevChiniwala

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,77 @@
+name: Bug report
+description: Report a reproducible ControlSurface defect.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve ControlSurface. Remove credentials, prompts, trace payloads, and other sensitive telemetry before submitting.
+  - type: input
+    id: version
+    attributes:
+      label: ControlSurface version
+      description: Tag, commit SHA, or container/source revision.
+      placeholder: v0.1.0-rc.1
+    validations:
+      required: true
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - Web console
+        - Control API
+        - OTLP ingest
+        - Worker / ClickHouse projection
+        - Python SDK
+        - CLI / release gates
+        - Docker Compose / operations
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Operating system, browser or Python version, deployment method, and relevant service versions.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction steps
+      description: Provide the smallest deterministic sequence that reproduces the problem.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: diagnostics
+    attributes:
+      label: Sanitized diagnostics
+      description: Add relevant logs, screenshots, trace IDs, or error output after removing secrets and sensitive telemetry.
+      render: shell
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Submission checks
+      options:
+        - label: I reproduced this on the latest release candidate or current main branch.
+          required: true
+        - label: I removed secrets and sensitive production telemetry.
+          required: true
+        - label: I searched existing issues for the same problem.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/DevChiniwala/ControlSurface/security/advisories/new
+    about: Report vulnerabilities privately. Do not open a public security issue.
+  - name: Questions and support
+    url: https://github.com/DevChiniwala/ControlSurface/discussions/categories/q-a
+    about: Ask installation, configuration, and usage questions in Discussions.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,53 @@
+name: Feature request
+description: Propose a focused product or engineering improvement.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What production-agent workflow is difficult or impossible today?
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Describe observable behavior and user value, not only an implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed approach
+      description: Include interfaces, workflow, or data implications when known.
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: dropdown
+    id: area
+    attributes:
+      label: Product area
+      options:
+        - Observe
+        - Evaluate
+        - Monitor
+        - Diagnose
+        - Improve
+        - Ship
+        - Operations
+        - Developer experience
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Submission checks
+      options:
+        - label: This request describes a concrete problem rather than a duplicate feature list.
+          required: true
+        - label: I searched existing issues and roadmap items.
+          required: true

.github/ISSUE_TEMPLATE/integration.yml

@@ -0,0 +1,44 @@
+name: Integration request
+description: Request or propose an agent framework, model, tool, or telemetry integration.
+title: "[Integration]: "
+labels:
+  - integration
+body:
+  - type: input
+    id: target
+    attributes:
+      label: Integration target
+      placeholder: Framework, provider, protocol, tool system, or runtime
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Relevant versions
+  - type: textarea
+    id: use_case
+    attributes:
+      label: Production use case
+      description: Describe the agent workflow and why generic OpenTelemetry instrumentation is insufficient.
+    validations:
+      required: true
+  - type: textarea
+    id: telemetry
+    attributes:
+      label: Expected telemetry
+      description: Which agent, model, tool, retrieval, retry, session, token, cost, or error data should be captured?
+    validations:
+      required: true
+  - type: textarea
+    id: references
+    attributes:
+      label: Public technical references
+      description: Link official documentation or protocol specifications only.
+  - type: checkboxes
+    id: contribution
+    attributes:
+      label: Contribution
+      options:
+        - label: I am willing to help validate the integration.
+        - label: I am willing to contribute an implementation or fixtures.
+        - label: I can provide a minimal public reproduction.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## What changed
+
+<!-- Explain the problem and the smallest coherent solution. -->
+
+## Verification
+
+- [ ] Relevant unit or integration tests pass.
+- [ ] Formatting, lint, and type checks pass.
+- [ ] Documentation and examples are updated when behavior changes.
+- [ ] UI changes include current screenshots and keyboard/accessibility verification.
+- [ ] Schema or migration changes are forward-safe and documented.
+- [ ] Security, privacy, retention, and secret-handling implications were considered.
+- [ ] No sensitive telemetry, credentials, generated evidence, or private paths are included.
+
+## Related issue
+
+<!-- Use "Closes #123" when appropriate. -->

.github/dependabot.yml

@@ -0,0 +1,49 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /apps/web
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      web-routine:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: pip
+    directory: /services/controlplane
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      controlplane-routine:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: pip
+    directory: /sdk/python
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      sdk-routine:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+
+  - package-ecosystem: docker
+    directory: /services/controlplane
+    schedule:
+      interval: weekly
+      day: monday
+
+  - package-ecosystem: docker
+    directory: /apps/web
+    schedule:
+      interval: weekly
+      day: monday

.github/workflows/ci.yml

@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [main]
@@ -11,15 +14,15 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"
           cache: pip
           cache-dependency-path: |
             services/controlplane/pyproject.toml
             sdk/python/pyproject.toml
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: "22"
           cache: npm
@@ -63,15 +66,15 @@ jobs:
     needs: quality
     timeout-minutes: 35
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.12"
           cache: pip
           cache-dependency-path: |
             services/controlplane/pyproject.toml
             sdk/python/pyproject.toml
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: "22"
           cache: npm

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 All notable changes are recorded here. ControlSurface has not published a package or container release.
 
-## Unreleased — v0.1.0-rc.1 candidate
+## 0.1.0-rc.1 — 2026-09-28
 
 ### Added
 

README.md

@@ -24,6 +24,16 @@
   <img src="docs/assets/readme/hero-banner.png" width="100%" alt="ControlSurface — ship reliable AI agents with production health, traces, incident intelligence, and release gates">
 </p>
 
+<p align="center">
+  <a href="https://github.com/DevChiniwala/ControlSurface/releases/download/v0.1.0-rc.1/controlsurface-v0.1.0-rc.1-demo.mp4">
+    <img src="docs/assets/readme/hero-demo.gif" width="100%" alt="ControlSurface real-product workflow from Production Health to a passing release gate">
+  </a>
+</p>
+
+<p align="center">
+  <a href="https://github.com/DevChiniwala/ControlSurface/releases/download/v0.1.0-rc.1/controlsurface-v0.1.0-rc.1-demo.mp4"><strong>Watch the complete 70-second failure-to-release workflow</strong></a>
+</p>
+
 ## Production failures should make your system smarter.
 
 **Traces tell you what happened. ControlSurface helps you decide what to do next.**
@@ -110,14 +120,6 @@ Group recurring production failures by execution signature and open a representa
   </tr>
 </table>
 
-<details>
-<summary><strong>Watch the 12-second real-product walkthrough</strong></summary>
-<br>
-<p align="center">
-  <img src="docs/assets/readme/hero-demo.gif" width="100%" alt="ControlSurface production health to verified release walkthrough">
-</p>
-</details>
-
 ## What ControlSurface does
 
 | Area | Working capability |

ROADMAP.md

@@ -26,9 +26,8 @@ Remaining release work is intentionally narrow:
 
 1. Run GitHub Actions on the exact candidate commit in the remote repository.
 2. Review the final staged diff and repeat secret/naming scans after staging.
-3. Capture a concise real-product hero demo from the synthetic refund workflow.
-4. Complete artifact-specific license/SBOM review before publishing Python or container artifacts.
-5. Tag `v0.1.0-rc.1` only after the remote pipeline is green.
+3. Complete artifact-specific license/SBOM review before publishing Python or container artifacts.
+4. Tag `v0.1.0-rc.1` only after the exact remote candidate is green and the final launch review is approved.
 
 ## v0.2: always-on reliability automation
 

SUPPORT.md

@@ -0,0 +1,19 @@
+# Support
+
+ControlSurface is an early open-source release candidate. The fastest path to useful help is to choose the channel that matches the problem.
+
+## Questions and setup help
+
+Use [GitHub Discussions](https://github.com/DevChiniwala/ControlSurface/discussions/categories/q-a) for installation, configuration, instrumentation, and workflow questions. Include the ControlSurface version, deployment method, operating system, and sanitized diagnostics.
+
+## Reproducible defects
+
+Open a [bug report](https://github.com/DevChiniwala/ControlSurface/issues/new?template=bug.yml) when current behavior differs from documented behavior and can be reproduced. Search existing issues first.
+
+## Security vulnerabilities
+
+Follow [SECURITY.md](SECURITY.md) and use a [private security advisory](https://github.com/DevChiniwala/ControlSurface/security/advisories/new). Never publish a credential, exploit, sensitive trace, prompt, model output, customer record, or other private telemetry in an issue or discussion.
+
+## Operational emergencies
+
+The public repository does not provide a commercial support SLA or an emergency response channel. Operators remain responsible for backups, retention, access controls, TLS termination, and recovery procedures described in [docs/OPERATIONS.md](docs/OPERATIONS.md).