s1korrrr · Jul 20, 2026 · Jul 20, 2026 · Jul 20, 2026
@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
@@ -0,0 +1,5 @@
+* text=auto eol=lf
+
+*.icns binary
+*.png binary
+*.zip binary
@@ -0,0 +1,10 @@
+# Default owner and security-sensitive release surfaces.
+* @s1korrrr
+/Sources/DevScopeCore/ @s1korrrr
+/Sources/DevScope/Infrastructure/ @s1korrrr
+/Sources/DevScope/Stores/ @s1korrrr
+/config/ @s1korrrr
+/script/ @s1korrrr
+/.github/workflows/ @s1korrrr
+/SECURITY.md @s1korrrr
+/PRIVACY.md @s1korrrr
@@ -0,0 +1,2 @@
+custom:
+  - https://buymeacoffee.com/s1korrrr
@@ -0,0 +1,53 @@
+name: Bug report
+description: Report a reproducible DevScope defect without sensitive process data.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Do not report security vulnerabilities here. Redact usernames, commands,
+        process arguments, project names, credentials, and private paths.
+  - type: input
+    id: version
+    attributes:
+      label: DevScope version or commit
+      placeholder: 0.1.0 or commit SHA
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: macOS and Mac architecture
+      placeholder: macOS 15.x, Apple silicon
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Minimal reproduction
+      description: Use only fixture processes or automation data you can safely modify.
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Safety checks
+      options:
+        - label: I removed secrets and sensitive process, command, and path data.
+          required: true
+        - label: This is not a vulnerability report.
+          required: true
@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/rsitech-ai/devscope/security/advisories/new
+    about: Report suspected vulnerabilities privately. Do not open a public issue.
+  - name: Support and privacy guidance
+    url: https://github.com/rsitech-ai/devscope/blob/main/SUPPORT.md
+    about: Read the support and data-redaction guidance before sharing diagnostics.
@@ -0,0 +1,38 @@
+name: Feature request
+description: Propose a focused improvement to DevScope.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user problem is not handled today?
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Describe the result rather than a required implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: safety
+    attributes:
+      label: Security, privacy, and destructive-action impact
+      description: Note any new data access, process control, automation mutation, or network behavior.
+    validations:
+      required: true
+  - type: dropdown
+    id: distribution
+    attributes:
+      label: Distribution surface
+      options:
+        - Full-feature direct download
+        - Sandbox-compatible build
+        - Both, with explicitly different behavior
+        - Not applicable
+    validations:
+      required: true
@@ -0,0 +1,37 @@
+## Outcome
+
+<!-- What user or maintainer outcome does this change produce? -->
+
+## Related issue
+
+<!-- Link an issue, or write "None" and explain why no issue is needed. -->
+
+## Change type
+
+- [ ] Bug fix
+- [ ] Feature
+- [ ] Documentation
+- [ ] CI, packaging, or maintenance
+- [ ] Security or privacy hardening
+
+## Risk and boundaries
+
+<!-- Note security, privacy, destructive-action, compatibility, or distribution impact. -->
+
+## Breaking-change impact
+
+<!-- State "None" or describe the affected API, behavior, migration, and release-note impact. -->
+
+## Verification
+
+- [ ] Added or updated focused tests for behavior changes
+- [ ] `./script/check_open_source_readiness.sh`
+- [ ] `swift test -Xswiftc -warnings-as-errors`
+- [ ] `swift build -c release -Xswiftc -warnings-as-errors`
+- [ ] Relevant exact-app or package smoke completed
+- [ ] Public docs and changelog updated when guarantees changed
+- [ ] No secrets, private paths, unredacted logs, generated bundles, or unrelated changes included
+
+## Evidence
+
+<!-- Commands, concise results, screenshots with sensitive data redacted, and known unverified gates. -->
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions
@@ -0,0 +1,82 @@
+name: Release Gates
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-gates-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  macos:
+    name: macOS ${{ matrix.architecture }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-26
+            architecture: arm64
+          - runner: macos-26-intel
+            architecture: x86_64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Record Apple toolchain
+        run: |
+          xcodebuild -version
+          swift --version
+
+      - name: Validate shell scripts
+        run: bash -n script/*.sh
+
+      - name: Validate public-source readiness
+        run: ./script/check_open_source_readiness.sh
+
+      - name: Verify process runner under constrained executor
+        env:
+          LIBDISPATCH_COOPERATIVE_POOL_STRICT: "1"
+        run: |
+          swift test -Xswiftc -warnings-as-errors \
+            --filter SystemAutomationCommandRunnerTests/testExecutionTimeoutTerminatesTheSpawnedProcessGroupAndFailsClosed
+          swift test -Xswiftc -warnings-as-errors \
+            --filter SystemAutomationCommandRunnerTests/testCancellationKillsPipeHoldingDescendantAfterLeaderExits
+
+      - name: Run tests with warnings as errors
+        run: swift test -Xswiftc -warnings-as-errors
+
+      - name: Build Release with warnings as errors
+        run: swift build -c release -Xswiftc -warnings-as-errors
+
+      - name: Build and validate sandbox release bundle
+        env:
+          DEVSCOPE_DIST_DIR: ${{ runner.temp }}/devscope-release
+        run: |
+          app_path="$(./script/build_release_bundle.sh)"
+          DEVSCOPE_REQUIRE_SANDBOX=1 ./script/validate_release_bundle.sh "$app_path"
+          file "$app_path/Contents/MacOS/DevScope"
+
+      - name: Build and validate full-access release bundle
+        env:
+          DEVSCOPE_DIST_DIR: ${{ runner.temp }}/devscope-full-access
+          DEVSCOPE_ENTITLEMENTS: ${{ github.workspace }}/config/DevScopeDeveloperID.entitlements
+        run: |
+          app_path="$(./script/build_release_bundle.sh)"
+          DEVSCOPE_REQUIRE_SANDBOX=0 \
+          DEVSCOPE_REQUIRE_APPLE_EVENTS=1 \
+          ./script/validate_release_bundle.sh "$app_path"
+          file "$app_path/Contents/MacOS/DevScope"
+
+      - name: Verify tracked files stayed clean
+        run: git diff --exit-code
@@ -0,0 +1,45 @@
+name: Secret Scan
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: secret-scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gitleaks:
+    name: Full-history Gitleaks scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Check out full history
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Download checksum-pinned Gitleaks CLI
+        env:
+          GITLEAKS_VERSION: 8.30.1
+          GITLEAKS_LINUX_X64_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+        run: |
+          archive="$RUNNER_TEMP/gitleaks.tar.gz"
+          curl --fail --location --silent --show-error \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            --output "$archive"
+          echo "$GITLEAKS_LINUX_X64_SHA256  $archive" | sha256sum --check --strict
+          tar -xzf "$archive" -C "$RUNNER_TEMP" gitleaks
+          "$RUNNER_TEMP/gitleaks" version
+
+      - name: Scan complete repository history
+        run: |
+          "$RUNNER_TEMP/gitleaks" git --redact --no-banner --no-color .
@@ -0,0 +1,19 @@
+title = "DevScope Gitleaks configuration"
+
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Synthetic credential-redaction fixtures in security regression tests"
+condition = "AND"
+regexTarget = "line"
+targetRules = ["curl-auth-header", "curl-auth-user"]
+paths = [
+  '''(^|/)Tests/DevScopeCoreTests/ProcessPresentationTests\.swift$''',
+  '''(^|/)Tests/DevScopeCoreTests/AutomationManagerTests\.swift$''',
+]
+regexes = [
+  '''SYNTH_[A-Z0-9_]+''',
+  '''curl\s+(?:-u|--user)\s+(?:'user:curl secret'|user:curlsecret|user:curl --header-shaped secret;stillsecret)''',
+  '''Authorization: secret-value''',
+]
@@ -0,0 +1,45 @@
+# Changelog
+
+All notable changes to DevScope are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases use
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Changed
+
+- Recorded Rafal Sikora as copyright owner and RSI Tech as the public
+  maintainer, with `rsitech.ai` and `info@rsitech.ai` as the project routes.
+- Updated release evidence to distinguish the installed Developer ID identity
+  from the still-missing notarization credentials and Keychain profile.
+
+## [0.1.0-preview.1] - 2026-07-20
+
+### Added
+
+- Apache-2.0 licensing and an explicit open-source publication contract.
+- Contribution, governance, security, privacy, support, and conduct policies.
+- Deterministic public-source readiness validation.
+- Installation, update, uninstall, troubleshooting, and maintainer release procedures.
+- CI validation for both sandbox and full-access bundle policies.
+- Fresh-history publication under the `rsitech-ai` GitHub organization.
+- A reproducible checksummed community-preview packager with an embedded
+  unnotarized-build warning.
+
+### Fixed
+
+- Recovery-cache payload limits now account for JSON escaping and reject oversized encoded metadata before writing, so every accepted save remains readable.
+- Sensitive HTTP header redaction now removes complete Digest, AWS signature, proxy-authorization, and cookie values.
+- Partial filesystem mutations now expose exact local recovery locations with Copy Path and Reveal in Finder actions.
+- Table context-menu command copying now updates the same durable redacted recovery payload as the command bar.
+- Development staging now re-signs the completed app bundle so Info.plist and resources are covered.
+- Release app bundles now embed Apache-2.0 and third-party notice files.
+
+### Added
+
+- Native macOS running-activity inspection with process hierarchy and live resource metrics.
+- Local process actions with explicit TERM, tree-termination, and force-kill boundaries.
+- Automation inventory and management for supported local launchd, login-item, and cron sources.
+- Optional on-device Foundation Models enrichment with deterministic scanner facts as authority.
+- Local recovery for bounded copied-command and export data.
+- Universal local and sandbox validation paths for Apple silicon and Intel slices.