docs: align README and GitHub community storefront

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,79 @@
+name: Bug Report
+description: Report a defect, harness failure, or demo regression
+title: "[bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Include commands you ran and their output when possible.
+        CorpOS is a reference implementation — see [SECURITY.md](https://github.com/SafetyMP/CorpOS/blob/main/SECURITY.md).
+
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: Clear description of the bug
+      placeholder: Company day fails with exception settle not recorded...
+    validations:
+      required: true
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - packages/core (firm / policy / company day)
+        - packages/mcp-knowledge
+        - apps/api
+        - apps/console
+        - harness / CI
+        - docs
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Steps to reproduce
+      description: Commands or workflow steps
+      placeholder: |
+        1. npm install && npm run build
+        2. npm run scenario
+        3. …
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs or output
+      description: Paste relevant stderr, CI link, or JSON result
+      render: shell
+
+  - type: dropdown
+    id: environment
+    attributes:
+      label: Environment
+      options:
+        - Local (npm run dev / start)
+        - Docker
+        - GitHub Actions CI
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Branch, commit, or release tag
+      placeholder: main, abc1234

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/SafetyMP/CorpOS/security/advisories/new
+    about: Report privately via GitHub Security Advisories — never post undisclosed vulnerabilities as public issues.
+  - name: Contributing guide
+    url: https://github.com/SafetyMP/CorpOS/blob/main/CONTRIBUTING.md
+    about: Local setup, harness verify, and pull request expectations.
+  - name: Thesis / product intent
+    url: https://github.com/SafetyMP/CorpOS/blob/main/docs/future-of-the-firm.md
+    about: Why CorpOS models an autonomous company and how humans govern by exception.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,59 @@
+name: Feature Request
+description: Propose a capability aligned with the autonomous-company reference
+title: "[feature]: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Read the [thesis](https://github.com/SafetyMP/CorpOS/blob/main/docs/future-of-the-firm.md) and
+        [ADRs](https://github.com/SafetyMP/CorpOS/tree/main/docs/adr) before filing.
+        CorpOS stays a reference architecture — proposals that imply production SaaS
+        hardening should say so explicitly.
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - packages/core (firm / policy / trust / audit)
+        - packages/mcp-knowledge
+        - apps/api
+        - apps/console
+        - harness / CI / supply chain
+        - docs / ADRs
+        - Unsure / needs triage
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or use case
+      description: What problem does this solve for the reference demo or architecture story?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: High-level approach; link an ADR or issue if applicable
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Optional
+
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Scope checklist
+      options:
+        - label: I understand CorpOS is a reference implementation, not production SaaS
+          required: true
+        - label: I am willing to include tests or harness updates if applicable
+          required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,29 @@
+<!-- Thanks for contributing! Provide a short summary above. -->
+
+## Summary
+
+<!-- What does this change do, and why? Reference an issue if applicable. -->
+
+## Change type
+
+- [ ] feat — new capability
+- [ ] fix — bug fix
+- [ ] refactor — no behavior change
+- [ ] docs — documentation only
+- [ ] test — tests only
+- [ ] chore — tooling, deps, CI
+
+## Checklist
+
+- [ ] `./scripts/harness/verify.sh` is green locally.
+- [ ] New behavior is covered by a test where applicable.
+- [ ] No Express or `better-sqlite3` introduced.
+- [ ] No secrets, `*.db`, `.env`, or `dist/` staged.
+- [ ] Reference-architecture posture preserved (README / SECURITY scope language not weakened).
+- [ ] If this introduces or reverses a decision, an ADR is added/updated in `docs/adr/`.
+- [ ] If the ops console UI changed materially, README screenshots were regenerated (`npm run screenshots`).
+
+## Security
+
+If this change fixes a security vulnerability, **stop** and follow
+[SECURITY.md](../SECURITY.md) instead of opening a public PR.

CODE_OF_CONDUCT.md

@@ -0,0 +1,86 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that create an open, welcoming, diverse,
+inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the repository maintainers via [GitHub Security Advisories on the
+CorpOS repository](https://github.com/SafetyMP/CorpOS/security/advisories/new)
+(for security-sensitive reports) or by contacting the SafetyMP maintainers
+through the organization profile. All complaints will be reviewed and
+investigated promptly and fairly. All community leaders are obligated to respect
+the privacy and security of the reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+1. **Correction** — private, written warning for first offence.
+2. **Warning** — warning with consequences for continued behavior.
+3. **Temporary Ban** — temporary ban from interaction for a specified period.
+4. **Permanent Ban** — permanent ban from all community interaction.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+<https://www.contributor-covenant.org/version/2/1/code_of_conduct.html>.
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://mozilla.org/en-US/about/governance/policies/participation/).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+<https://www.contributor-covenant.org/faq>. Translations are available at
+<https://www.contributor-covenant.org/translations>.

CONTRIBUTING.md

@@ -0,0 +1,92 @@
+# Contributing to CorpOS
+
+Thanks for your interest in improving CorpOS — a reference implementation of an
+autonomous company (firm model, work contracts, and a policy-gated control
+plane). This document explains how to set up the project and what is expected of
+a contribution.
+
+## Reference posture (read first)
+
+CorpOS is a **reference / educational implementation**, **not** a
+production-hardened multi-tenant SaaS. Contributions must not:
+
+- Soften or remove the reference-architecture scope language in the README or
+  [SECURITY.md](SECURITY.md).
+- Imply production guarantees (multi-tenant isolation, production OIDC/TLS, real
+  payment providers) that the codebase does not provide.
+- Commit secrets, live credentials, or real customer data.
+
+Please also follow the [Code of Conduct](CODE_OF_CONDUCT.md).
+
+## Prerequisites
+
+- **Node.js ≥ 22** (see [`.nvmrc`](.nvmrc); CI covers 22 and 24).
+- npm **10.9.2** via Corepack (`packageManager` in [`package.json`](package.json)).
+
+## Setup
+
+```bash
+npm install
+npm run build
+./scripts/harness/verify.sh   # typecheck · test · lint · format:check · stack guards
+```
+
+A contribution is not finished until `./scripts/harness/verify.sh` is green
+locally. CI runs the same gate on every pull request.
+
+Useful commands:
+
+```bash
+npm run dev            # ops console on $PORT or 3000
+npm test
+npm run scenario
+npm run audit:verify
+```
+
+## Architecture rules (must respect)
+
+- Workspaces: firm logic in [`packages/core`](packages/core), MCP knowledge in
+  [`packages/mcp-knowledge`](packages/mcp-knowledge), HTTP in
+  [`apps/api`](apps/api), ops UI in [`apps/console`](apps/console).
+- **ToolGateway** is the sole chokepoint for consequential tools; unknown tools
+  fail closed.
+- Do **not** introduce Express or `better-sqlite3` (enforced by the harness).
+- Prefer Drizzle + libsql, Hono, and the official MCP SDK for new integration
+  surfaces.
+
+## Decisions
+
+Non-trivial architectural decisions are recorded as ADRs in
+[`docs/adr/`](docs/adr/). If your change introduces or reverses a decision, add
+or update an ADR.
+
+## Screenshots
+
+If you change the ops console layout materially, regenerate README assets:
+
+```bash
+npm run build && npm run start   # or PORT=3100 npm run start
+npm run screenshots              # see docs/assets/README.md
+```
+
+## Commits & pull requests
+
+- Conventional-commit-ish titles: `feat(core): trust unlock after company day`.
+- Small, reviewable diffs — one logical change per PR.
+- Never commit secrets, `*.db` files, `.env`, or `dist/`.
+- Open a pull request against `main`; fill in the PR template; CI must pass
+  before merge.
+
+## OSS supply-chain health
+
+| Check                 | Where                                                                |
+| --------------------- | -------------------------------------------------------------------- |
+| **OpenSSF Scorecard** | [`.github/workflows/scorecard.yml`](.github/workflows/scorecard.yml) |
+| **CodeQL**            | [`.github/workflows/codeql.yml`](.github/workflows/codeql.yml)       |
+| **Dependabot**        | [`.github/dependabot.yml`](.github/dependabot.yml)                   |
+| **Local verify**      | `./scripts/harness/verify.sh`                                        |
+
+## License
+
+By contributing, you agree that your contributions are licensed under the
+[Apache License 2.0](LICENSE).