OSPO readiness: defect ledger, multi-targeting, and preview validation

.github/CODEOWNERS

@@ -0,0 +1,13 @@
+# Code owners for Rapp.
+#
+# Listed owners are automatically requested for review on pull requests that
+# touch matching paths. See https://docs.github.com/articles/about-code-owners
+
+* @Digvijay
+
+# Governance, security, and release-critical paths require owner review.
+/.github/                   @Digvijay
+/SECURITY.md                @Digvijay
+/CODE_OF_CONDUCT.md         @Digvijay
+/SUPPORT.md                 @Digvijay
+/LICENSE                    @Digvijay

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,70 @@
+name: Bug report
+description: Report a defect so it can be reproduced and fixed
+title: "[Bug]: "
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for filing a report. Please do not report security vulnerabilities here —
+        see SECURITY.md for the private reporting process.
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: Describe the actual behaviour, including any exception and stack trace.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Minimal reproduction
+      description: The smallest code or repository that reproduces the issue.
+      render: csharp
+    validations:
+      required: true
+
+  - type: input
+    id: package-version
+    attributes:
+      label: Package version
+      placeholder: e.g. 1.2.0
+    validations:
+      required: true
+
+  - type: input
+    id: dotnet-version
+    attributes:
+      label: .NET SDK version
+      description: Output of `dotnet --version`
+    validations:
+      required: true
+
+  - type: dropdown
+    id: deployment
+    attributes:
+      label: Compilation mode
+      options:
+        - JIT (default)
+        - Native AOT
+        - Trimmed, not AOT
+        - Not sure
+    validations:
+      required: true
+
+  - type: input
+    id: os
+    attributes:
+      label: Operating system and architecture
+      placeholder: e.g. Ubuntu 24.04 x64, Windows 11 arm64
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,33 @@
+name: Feature request
+description: Propose a change or new capability
+title: "[Feature]: "
+labels: ["enhancement", "needs-triage"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the underlying need rather than a specific implementation.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+
+  - type: checkboxes
+    id: constraints
+    attributes:
+      label: Design constraints acknowledged
+      options:
+        - label: This proposal does not require runtime reflection on a supported code path
+        - label: This proposal remains compatible with Native AOT and trimming
+        - label: I am willing to help implement this

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,20 +1,34 @@
-# Description
+## Summary
 
-Please include a summary of the change and which issue is fixed.
+<!-- What does this change do, and why? -->
+
+## Related issue
+
+<!-- e.g. Fixes #123 -->
 
 ## Type of change
 
-- [ ] Bug fix (non-breaking change which fixes an issue)
-- [ ] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] Documentation update
+- [ ] Bug fix (non-breaking)
+- [ ] New feature (non-breaking)
+- [ ] Breaking change
+- [ ] Documentation only
+- [ ] Build, CI, or release tooling
+
+## Checklist
+
+- [ ] Tests cover the change, and the full suite passes locally
+- [ ] Public API changes are documented and follow semantic versioning
+- [ ] Native AOT and trimming compatibility is preserved (no new runtime reflection on a supported path)
+- [ ] No new build warnings
+- [ ] Documentation updated where behaviour changed
+- [ ] `CHANGELOG.md` updated for user-visible changes
+- [ ] No new TODOs without a tracking issue
+
+## Performance impact
+
+<!-- If this touches a hot path or generated code, state the measured impact and how it was measured.
+     Claims about performance must be backed by reproducible benchmark output. -->
 
-## Checklist:
+## Security impact
 
-- [ ] My code follows the style guidelines of this project
-- [ ] I have performed a self-review of my own code
-- [ ] I have commented my code, particularly in hard-to-understand areas
-- [ ] I have made corresponding changes to the documentation
-- [ ] My changes generate no new warnings
-- [ ] I have added tests that prove my fix is effective or that my feature works
-- [ ] New and existing unit tests pass locally with my changes
+<!-- Does this change affect input handling, generated code, serialization, or a trust boundary? -->

.github/dependabot.yml

@@ -5,8 +5,25 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+    groups:
+      microsoft-extensions:
+        patterns:
+          - "Microsoft.Extensions.*"
+          - "Microsoft.AspNetCore.*"
+      opentelemetry:
+        patterns:
+          - "OpenTelemetry*"
+      test-dependencies:
+        patterns:
+          - "xunit*"
+          - "Microsoft.NET.Test.Sdk"
+          - "coverlet.*"
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "monthly"
-    open-pull-requests-limit: 10
+      interval: "weekly"
+    labels:
+      - "dependencies"

.github/workflows/aot-validation.yml

@@ -0,0 +1,157 @@
+name: Native AOT validation
+
+# Proves the Native AOT claim instead of asserting it.
+#
+# The previous version of this workflow published Samples/ConsoleApp with
+# -p:TreatWarningsAsErrors=true, which conflated two different claims: "Rapp is AOT-safe" and
+# "everything Rapp depends on is AOT-safe". The second is false — MemoryPack 1.21.4 ships a
+# reflective formatter provider and Microsoft.Extensions.Caching.Hybrid 10.3.0 falls back to
+# System.Text.Json reflection — so the gate failed on code this repository does not own, and there
+# was no way to fix it without either vendoring dependencies or silencing warning codes globally.
+#
+# It now gates on the *origin* of each warning rather than its code. Warning codes are not owned by
+# an assembly: NoWarn IL3050 to silence MemoryPack and you have silenced it for Rapp too, which is
+# the one place it would have mattered. Asserting that no warning names a Rapp type says exactly
+# what the README claims and cannot be weakened by adding a code to a list.
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [ "main", "master" ]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  aot-probe:
+    name: AOT probe (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ ubuntu-latest, windows-latest ]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Install AOT native toolchain (Linux)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y clang zlib1g-dev
+
+      # ILC warnings are left non-fatal on purpose. If they were errors, compilation would stop and
+      # the probe could never be run — and running it is the only thing that proves the reflective
+      # fallbacks are unreachable at runtime rather than merely unproven at compile time. The strict
+      # assertion happens in the next step, against the captured log.
+      - name: Publish the AOT probe
+        shell: bash
+        run: |
+          set -o pipefail
+          dotnet publish tools/Rapp.AotProbe/Rapp.AotProbe.csproj \
+            --configuration Release \
+            --framework net10.0 \
+            -p:TrimmerSingleWarn=false \
+            -p:TreatWarningsAsErrors=false \
+            --output ./aot-output \
+            2>&1 | tee ./ilc.log
+
+      - name: Fail if any trim or AOT warning originates in Rapp
+        shell: bash
+        run: |
+          set -e
+          # ILC formats diagnostics as "ILC : Trim analysis warning IL2026: <origin>: <detail>".
+          # Anchoring on the code and colon means we match the originating symbol, not a mention of
+          # Rapp somewhere later in the message text.
+          if grep -E 'IL[0-9]{4}: Rapp' ./ilc.log > ./rapp-warnings.log; then
+            echo "::error::Trim or AOT warnings originate in Rapp's own code. Rapp claims to be AOT-safe; fix the code or correct the claim."
+            cat ./rapp-warnings.log
+            exit 1
+          fi
+          echo "No trim or AOT warnings originate in Rapp."
+
+      - name: Execute the native binary
+        shell: bash
+        run: |
+          set -e
+          binary=$(find ./aot-output -maxdepth 1 -type f \( -perm -u+x -o -name '*.exe' \) ! -name '*.pdb' ! -name '*.json' ! -name '*.dbg' | head -n 1)
+          if [ -z "$binary" ]; then
+            echo "::error::No native executable was produced."
+            ls -R ./aot-output
+            exit 1
+          fi
+          echo "Running $binary"
+          "$binary"
+
+      - name: Summarise
+        if: always()
+        shell: bash
+        run: |
+          {
+            echo "### Native AOT probe (${{ matrix.os }})"
+            echo
+            echo "Warnings by originating assembly:"
+            echo '```'
+            grep -oE 'IL[0-9]{4}: [A-Za-z0-9_.]+' ./ilc.log 2>/dev/null \
+              | sed -E 's/IL[0-9]{4}: //' \
+              | cut -d. -f1 \
+              | sort | uniq -c | sort -rn || echo "none"
+            echo '```'
+            echo
+            echo "Native output:"
+            echo '```'
+            ls -lh ./aot-output 2>/dev/null | head -n 25 || echo "none"
+            echo '```'
+          } >> $GITHUB_STEP_SUMMARY
+
+  trim-analysis:
+    name: Trimming and AOT analyzers
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      # Scoped to the project that actually ships. Running this across Rapp.sln measured the
+      # benchmark, playground and dashboard projects too, none of which are published as packages.
+      - name: Build shipping project with AOT and trim analyzers as errors
+        run: >
+          dotnet build src/Rapp/Rapp.csproj
+          --configuration Release
+          -p:EnableAotAnalyzer=true
+          -p:EnableTrimAnalyzer=true
+          -p:EnableSingleFileAnalyzer=true
+          -p:WarningsAsErrors=IL2026%3BIL2046%3BIL2062%3BIL2067%3BIL2070%3BIL2072%3BIL2075%3BIL2087%3BIL2091%3BIL3050%3BIL3051%3BIL3052%3BIL3053
+
+  samples-advisory:
+    name: Samples AOT (advisory)
+    runs-on: ubuntu-latest
+    # Advisory, not a gate. The samples exercise dependencies Rapp does not own, so their AOT
+    # warnings describe MemoryPack and HybridCache rather than Rapp. Kept visible so a regression
+    # in a sample is noticed, without letting a third-party annotation gap block the repository.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Install AOT native toolchain
+        run: sudo apt-get update && sudo apt-get install -y clang zlib1g-dev
+
+      - name: Publish the console sample
+        run: >
+          dotnet publish Samples/ConsoleApp/ConsoleApp.csproj
+          --configuration Release
+          --framework net10.0
+          -p:TreatWarningsAsErrors=false
+          --output ./sample-output

.github/workflows/benchmarks.yml

@@ -42,7 +42,7 @@ jobs:
         dotnet run -c Release --no-build -- --exporters markdown csv html
 
     - name: Store benchmark results
-      uses: actions/upload-artifact@v6
+      uses: actions/upload-artifact@v7
       with:
         name: benchmark-results
         path: |