ci: adopt artifact-driven SDLC gates

.github/CODEOWNERS

@@ -0,0 +1,12 @@
+# Sensitive SDLC, dependency, permission, signing, and release controls.
+/.github/workflows/ @IchenDEV
+/Resources/OpenType.entitlements @IchenDEV
+/Package.swift @IchenDEV
+/Package.resolved @IchenDEV
+/scripts/build-app.sh @IchenDEV
+/scripts/create-signing-cert.sh @IchenDEV
+/scripts/verify-release-artifact.sh @IchenDEV
+/scripts/sdlc.py @IchenDEV
+/docs/sdlc/ @IchenDEV
+/AGENTS.md @IchenDEV
+/CLAUDE.md @IchenDEV

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/IchenDEV/utter/security/advisories/new
+    about: Report vulnerabilities privately; do not include secrets in a public issue.

.github/ISSUE_TEMPLATE/incident.yml

@@ -0,0 +1,58 @@
+name: Production incident
+description: Record impact, containment, and the corrective feedback loop.
+title: "[Incident]: "
+labels:
+  - incident
+body:
+  - type: dropdown
+    id: severity
+    attributes:
+      label: Severity
+      options:
+        - SEV-1 — widespread or critical safety/security impact
+        - SEV-2 — major feature unavailable or serious degradation
+        - SEV-3 — limited degradation with a workaround
+    validations:
+      required: true
+  - type: textarea
+    id: impact
+    attributes:
+      label: Impact
+      description: Include affected users/systems, duration, and known data or privacy impact.
+    validations:
+      required: true
+  - type: textarea
+    id: detection
+    attributes:
+      label: Detection signal and timeline
+      description: State the deterministic signal when available and list key events with times.
+    validations:
+      required: true
+  - type: textarea
+    id: containment
+    attributes:
+      label: Containment and current state
+      description: Record actions, approval boundaries, and whether the incident is still active.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Cause evidence and unknowns
+      description: Separate confirmed facts from hypotheses and unknowns.
+    validations:
+      required: true
+  - type: textarea
+    id: corrective_intent
+    attributes:
+      label: Corrective intent
+      description: Link the follow-up intent or change bundle and name its owner.
+    validations:
+      required: true
+  - type: textarea
+    id: regression_control
+    attributes:
+      label: Regression control
+      description: Name the new test, guardrail, eval case, or why automation is not possible.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/intent.yml

@@ -0,0 +1,58 @@
+name: Product or engineering intent
+description: Propose an observable outcome before implementation starts.
+title: "[Intent]: "
+labels:
+  - intent
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What is happening now, and what evidence shows it is a problem?
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Describe the user or system result, not the implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: affected
+    attributes:
+      label: Affected users and systems
+    validations:
+      required: true
+  - type: textarea
+    id: constraints
+    attributes:
+      label: Constraints and non-goals
+      description: Include privacy, permissions, compatibility, cost, schedule, and explicit exclusions.
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: Use observable, testable criteria.
+      placeholder: "- When ..., then ..."
+    validations:
+      required: true
+  - type: textarea
+    id: open_questions
+    attributes:
+      label: Open questions
+      description: Record unresolved decisions or write None.
+    validations:
+      required: true
+  - type: dropdown
+    id: risk
+    attributes:
+      label: Initial risk
+      options:
+        - Low — isolated and reversible
+        - Medium — user-visible, dependency, model, UI, or automation change
+        - High — privacy, permission, security, release, destructive, or public API change
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,28 @@
+## Outcome
+
+<!-- State the observable user/system outcome. Link the originating issue. -->
+
+## SDLC bundle and risk
+
+- Bundle: `docs/sdlc/changes/...`
+- Risk: trivial / low / medium / high
+- Human decisions still required:
+
+## Verification
+
+<!-- Link committed evidence. Do not claim checks that were not run. -->
+
+- [ ] `python3 scripts/sdlc.py validate --worktree`
+- [ ] `bash scripts/ci-basic-checks.sh`
+- [ ] `swift test`
+- [ ] Release-style app build when packaging/runtime is affected
+- [ ] Real-window light/dark and narrow-width QA when macOS UI is affected
+- [ ] Privacy, permission, external-service, and failure paths checked when affected
+
+## Residual risk and rollback
+
+<!-- Write None only when there is genuinely no known residual risk. -->
+
+## Reviewer focus
+
+<!-- Point reviewers to the highest-risk assumption, boundary, or behavior. -->

.github/workflows/pr.yml

@@ -11,22 +11,52 @@ permissions:
   contents: read
 
 concurrency:
-  group: pr-${{ github.ref }}
+  group: pr-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
-  basic-checks:
-    name: Basic linked rules
+  quality:
+    name: Contract & Tests
     runs-on: macos-26
+    timeout-minutes: 45
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
-      - name: Run basic linked rules
+      - name: Validate changed SDLC artifacts
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.base_ref }}
+          BEFORE_SHA: ${{ github.event.before }}
+        run: |
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            python3 scripts/sdlc.py validate --base "origin/$BASE_REF"
+          elif [ "$EVENT_NAME" = "push" ]; then
+            if [ -z "$BEFORE_SHA" ] || [[ "$BEFORE_SHA" =~ ^0+$ ]]; then
+              echo "Push event has no usable previous SHA; refusing schema-only validation"
+              exit 1
+            fi
+            git fetch --no-tags origin "$BEFORE_SHA"
+            git cat-file -e "$BEFORE_SHA^{commit}"
+            python3 scripts/sdlc.py validate --push-base "$BEFORE_SHA"
+          else
+            python3 scripts/sdlc.py validate
+          fi
+
+      - name: Run linked repository checks
         run: bash ./scripts/ci-basic-checks.sh
 
+      - name: Ensure Metal toolchain
+        run: xcodebuild -downloadComponent MetalToolchain
+
+      - name: Run unit tests
+        run: swift test
+
   build:
-    name: Build Utter
+    name: Release-style App Build
     runs-on: macos-26
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
 
@@ -36,5 +66,22 @@ jobs:
       - name: Ensure Metal toolchain
         run: xcodebuild -downloadComponent MetalToolchain
 
-      - name: Build app bundle
+      - name: Build and verify app bundle
         run: ./scripts/build-app.sh --app-only --sign=-
+
+  gate:
+    name: SDLC Gate
+    if: ${{ always() }}
+    needs: [quality, build]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every SDLC job
+        env:
+          QUALITY_RESULT: ${{ needs.quality.result }}
+          BUILD_RESULT: ${{ needs.build.result }}
+        run: |
+          if [ "$QUALITY_RESULT" != "success" ] || [ "$BUILD_RESULT" != "success" ]; then
+            echo "Contract/tests: $QUALITY_RESULT"
+            echo "App build: $BUILD_RESULT"
+            exit 1
+          fi