chore: polish badges and contribution controls

Refresh README badges, scope code ownership to protected surfaces, improve provider contribution templates, and route Vercel deploys through GitHub environments.

Author: jesseoue

.github/CODEOWNERS

@@ -1,5 +1,8 @@
-* @jesseoue
-
-# The hosted web app is maintainer-owned. External contributors should avoid
-# changing it unless coordinated with @jesseoue.
+# The hosted web app and repository automation are maintainer-owned.
+# Registry modules, provider adapters, recipes, presets, docs, and examples are
+# intentionally open for community and provider contributions through PRs.
 apps/web/** @jesseoue
+.github/** @jesseoue
+vercel.json @jesseoue
+package.json @jesseoue
+pnpm-lock.yaml @jesseoue

.github/ISSUE_TEMPLATE/module_request.yml

@@ -22,3 +22,20 @@ body:
     attributes:
       label: Systems involved
       description: UI, routes, schemas, env, docs, tests, maintenance skills, providers.
+  - type: dropdown
+    id: readiness
+    attributes:
+      label: Expected readiness
+      description: Is this a roadmap stub or an installable source module?
+      options:
+        - stub
+        - experimental
+        - ready
+        - stable
+    validations:
+      required: true
+  - type: textarea
+    id: workflow
+    attributes:
+      label: Recipe or install order
+      description: Which recipe, preset, or install stage should include this module?

.github/ISSUE_TEMPLATE/provider_request.yml

@@ -32,3 +32,20 @@ body:
     attributes:
       label: Notes
       description: What should the adapter do?
+  - type: textarea
+    id: install-surface
+    attributes:
+      label: Install surface
+      description: Which source files, routes, env vars, docs, checklist items, and maintenance skills should this adapter include?
+      placeholder: "Client/helper files, webhook routes, console page, env keys, docs, tests/checklist, shared provider skill..."
+  - type: dropdown
+    id: readiness
+    attributes:
+      label: Expected readiness
+      options:
+        - stub
+        - experimental
+        - ready
+        - stable
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,17 +2,24 @@
 
 ## Test Plan
 
+- [ ] `pnpm check`
 - [ ] Typecheck
 - [ ] Lint
 - [ ] Tests
 - [ ] Build
 - [ ] Fresh install/demo path
 
+## Registry Changes
+
+- [ ] Module status is honest (`ready` has files, `stub` has no source payload)
+- [ ] Recipe or preset install order updated if this changes a workflow
+- [ ] Shared provider skill referenced when provider SDK/API behavior is involved
+- [ ] Generated registry output updated if manifests changed
+
 ## Public Safety
 
 - [ ] No secrets or local env files
 - [ ] No private company/customer references
 - [ ] Docs updated
 - [ ] Maintenance skill updated if module behavior changed
-- [ ] Generated registry output updated if manifests changed
 - [ ] Screenshots/GIFs contain demo data only

.github/workflows/deploy-vercel.yml

@@ -19,6 +19,10 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    environment: ${{ inputs.environment }}
+    concurrency:
+      group: deploy-vercel-${{ inputs.environment }}
+      cancel-in-progress: false
     env:
       VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
       VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}

CONTRIBUTING.md

@@ -27,11 +27,26 @@ pnpm dev:web
 A module should include:
 
 - `module.json`
-- source files or planned file paths
+- source files when the module is `ready`, `experimental`, or `stable`
 - `docs.md`
 - `skill/SKILL.md`
 - `tests/checklist.md`
 
+Use `stub` for modules that document a real SaaS capability but do not install source yet. Use `ready` only when the module has installable source files and passes registry validation.
+
+## Provider Adapters
+
+Provider contributions are welcome. Keep adapters optional and focused:
+
+- Add provider-specific code in its own module instead of coupling it to source-owned defaults.
+- Reference shared provider skills from `registry/skills/<provider>/SKILL.md` when possible.
+- Document required environment variables, dashboard resources, webhook setup, and smoke-test steps.
+- Do not commit provider credentials, project IDs, customer data, `.env*`, or generated local state.
+
+## Recipes And Presets
+
+Recipes explain install order and architecture. Presets install bundles. If your provider belongs in a larger workflow, update the relevant recipe or preset and regenerate `public/r`.
+
 ## Pull Requests
 
 Each PR should focus on one phase or one module.

README.md

@@ -3,8 +3,16 @@
 Install production SaaS modules as editable source code.
 
 [![CI](https://github.com/jesseoue/stackfoundry/actions/workflows/ci.yml/badge.svg)](https://github.com/jesseoue/stackfoundry/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/jesseoue/stackfoundry/actions/workflows/codeql.yml/badge.svg)](https://github.com/jesseoue/stackfoundry/actions/workflows/codeql.yml)
+[![Dependency Review](https://github.com/jesseoue/stackfoundry/actions/workflows/dependency-review.yml/badge.svg)](https://github.com/jesseoue/stackfoundry/actions/workflows/dependency-review.yml)
+[![Release](https://img.shields.io/github/v/release/jesseoue/stackfoundry?label=release)](https://github.com/jesseoue/stackfoundry/releases)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
-[![Status: Experimental](https://img.shields.io/badge/status-experimental-orange.svg)](./ROADMAP.md)
+![Next.js](https://img.shields.io/badge/Next.js-16-black)
+![Vercel](https://img.shields.io/badge/deploy-Vercel-black)
+![Modules](https://img.shields.io/badge/modules-294-orange)
+![Recipes](https://img.shields.io/badge/recipes-9-purple)
+![Presets](https://img.shields.io/badge/presets-13-teal)
+![Inspired by shadcn](https://img.shields.io/badge/inspired%20by-shadcn-111111)
 
 StackFoundry is a public source registry for the product plumbing most SaaS teams rebuild: billing, auth, API keys, webhooks, docs, analytics, notifications, operations, provider adapters, and launch readiness.