feat(release): add public registration polish gates

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -26,4 +26,4 @@ body:
         - label: This is backend-only.
         - label: This does not require storing user PATs.
         - label: This does not expose wallet details, raw trust scores, or private rankings publicly.
-        - label: This does not auto-label, auto-close, or auto-merge contributor work.
+        - label: This does not auto-close, auto-merge, rewrite contributor work, or label PRs outside the confirmed-miner policy.

.github/pull_request_template.md

@@ -5,10 +5,12 @@
 ## Validation
 
 - [ ] `npm run test:ci`
+- [ ] `npm run changelog:check`
 
 ## Safety
 
 - [ ] Backend-only change
 - [ ] No secrets, wallet details, user PATs, raw trust scores, or private rankings exposed
 - [ ] Public text avoids compensation-seeking or optimization-tactic language
 - [ ] OpenAPI/MCP behavior updated where needed
+- [ ] Public docs/changelogs updated where needed

.github/workflows/ci.yml

@@ -20,6 +20,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
 
       - name: Setup Node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
@@ -30,6 +33,12 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Check whitespace
+        run: git diff --check
+
+      - name: Lint workflows
+        run: npm run actionlint
+
       - name: Typecheck
         run: npm run typecheck
 
@@ -42,5 +51,11 @@ jobs:
       - name: MCP package check
         run: npm run build:mcp && npm run test:mcp-pack
 
+      - name: Docs check
+        run: npm run docs:check && npm run docs:build
+
+      - name: Changelog check
+        run: npm run changelog:check
+
       - name: Audit dependencies
         run: npm audit --audit-level=moderate

.github/workflows/npm-publish.yml

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          fetch-depth: 0
 
       - name: Setup Node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
@@ -47,10 +49,20 @@ jobs:
           set -euo pipefail
           PACK_JSON="$(npm pack --workspace @jsonbored/gittensory-mcp --json)"
           TARBALL="$(node -e 'const fs=require("fs"); const input=fs.readFileSync(0,"utf8"); process.stdout.write(JSON.parse(input)[0].filename)' <<< "$PACK_JSON")"
+          UNEXPECTED_FILES="$(tar -tzf "$TARBALL" | grep -Ev '^(package/(bin|lib)/|package/(package.json|README.md|CHANGELOG.md|LICENSE))$' || true)"
+          if [ -n "$UNEXPECTED_FILES" ]; then
+            printf '%s\n' "$UNEXPECTED_FILES"
+            echo "Unexpected file in package tarball"
+            exit 1
+          fi
+          if tar -xOf "$TARBALL" | grep -E '(BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY|github_pat_|gh[pousr]_|gts_[0-9a-f]{64}|[A-Z0-9_]*(TOKEN|SECRET|PRIVATE_KEY)=)'; then
+            echo "Secret-like content found in package tarball"
+            exit 1
+          fi
           TMP="$(mktemp -d)"
           npm --prefix "$TMP" init -y >/dev/null
           npm --prefix "$TMP" install "$PWD/$TARBALL" >/dev/null
           "$TMP/node_modules/.bin/gittensory-mcp" --help >/dev/null
 
       - name: Publish with npm trusted publishing
-        run: npx -y npm@11.15.0 publish --workspace @jsonbored/gittensory-mcp --access public
+        run: npx -y npm@11.15.0 publish --workspace @jsonbored/gittensory-mcp --access public --provenance

CHANGELOG.md

@@ -0,0 +1,59 @@
+# Changelog
+
+## Unreleased
+
+
+### CI
+
+- Trigger pages deploy
+
+- Retrigger github pages deploy
+
+
+
+### Chores
+
+- Configure gittensory app id
+
+- Prepare public gittensory launch
+
+
+
+### Docs
+
+- Align public docs with gittensor aesthetic
+
+- Remove worker preview URLs from public docs
+
+- Publish static github pages artifact
+
+
+
+### Features
+
+- Scaffold gittensory advisory API
+
+- Add backend intelligence APIs
+
+- Expose MCP and PR intelligence
+
+- Add install site and mcp diagnostics
+
+- Add situational score projections
+
+- Add public registration polish gates
+
+
+
+### Fixes
+
+- Gate public PR visibility for confirmed miners
+
+
+
+### Tests
+
+- Raise backend regression coverage
+
+
+

CONTRIBUTING.md

@@ -19,7 +19,7 @@ Out of scope:
 - frontend UI work
 - public leaderboards
 - public wallet or raw trust-score exposure
-- auto-labeling, auto-closing, auto-merging, or mutating contributor work
+- auto-closing, auto-merging, rewriting contributor work, or applying labels outside the explicit confirmed-miner GitHub App policy
 - storing contributor PATs
 - public text that implies compensation estimates or optimization tactics
 
@@ -29,6 +29,7 @@ Out of scope:
 - Add or update tests for behavior changes.
 - Keep API and MCP responses structured and machine-readable.
 - Keep public GitHub comments advisory, sanitized, and non-spammy.
+- Keep GitHub App labels limited to configured labels for officially confirmed Gittensor miner PRs.
 - Prefer deterministic, evidence-based rules over opaque scoring.
 - Use Conventional Commit style for release-quality changelog output.