Release SFTGuard v0.1

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,67 @@
+name: Bug report
+description: Report a reproducible problem using synthetic or sanitized data.
+title: "[Bug]: "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not attach private datasets, prompts, responses, credentials, model weights, or unsanitized Regression Cards. Use [private vulnerability reporting](https://github.com/Labeeb2339/sftguard/security/advisories/new) for a security or privacy failure.
+  - type: input
+    id: version
+    attributes:
+      label: SFTGuard version or commit
+      placeholder: 0.1.0 or a full Git commit
+    validations:
+      required: true
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - Python CLI or library
+        - Dataset audit
+        - Tokenizer or loss mask
+        - Regression Card or gate
+        - Static report viewer
+        - CI or packaging
+        - Documentation
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Sanitized environment
+      description: Operating system, Python or Node version, and relevant package versions. Remove usernames and private paths.
+      placeholder: Windows 11, Python 3.12.4
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Reproduction steps
+      description: Use the smallest synthetic fixture that demonstrates the problem.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: Quote only sanitized output; do not paste a real record or secret candidate.
+    validations:
+      required: true
+  - type: checkboxes
+    id: privacy
+    attributes:
+      label: Privacy check
+      options:
+        - label: I used synthetic or sanitized data and removed credentials, raw records, local usernames, and private paths.
+          required: true
+        - label: This report is not a vulnerability or private-data exposure that should be submitted privately.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Private security report
+    url: https://github.com/Labeeb2339/sftguard/security/advisories/new
+    about: Report vulnerabilities, secret exposure, or private-data leakage without opening a public issue.
+  - name: Safe sharing guidance
+    url: https://github.com/Labeeb2339/sftguard/blob/main/docs/SHARING.md
+    about: Check what can be included safely in a public issue or reproduction.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,46 @@
+name: Feature request
+description: Propose a bounded addition to SFTGuard's correctness or regression contract.
+title: "[Feature]: "
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        SFTGuard does not train models, predict final fine-tuning performance, certify safety, or automatically publish reports. Explain how the proposal fits the local-first, fail-closed boundary.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem and user evidence
+      description: Describe the observable pipeline failure or missing release evidence.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Include the expected PASS, FAIL, and ABSTAIN behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: validation
+    attributes:
+      label: Validation plan
+      description: State the synthetic fixture, negative control, and measurable gate.
+    validations:
+      required: true
+  - type: textarea
+    id: privacy
+    attributes:
+      label: Privacy and sharing impact
+      description: Identify any new input, artifact field, network access, or disclosure risk.
+    validations:
+      required: true
+  - type: checkboxes
+    id: boundaries
+    attributes:
+      label: Boundary check
+      options:
+        - label: The proposal does not require posting private data or reports to an external service.
+          required: true
+        - label: Missing or untrustworthy evidence will not be converted into PASS.
+          required: true

.github/dependabot.yml

@@ -0,0 +1,37 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "03:00"
+      timezone: Asia/Kuala_Lumpur
+    open-pull-requests-limit: 5
+    labels: [dependencies, python]
+
+  - package-ecosystem: npm
+    directory: /web
+    schedule:
+      interval: weekly
+      day: monday
+      time: "03:15"
+      timezone: Asia/Kuala_Lumpur
+    open-pull-requests-limit: 5
+    labels: [dependencies, web]
+    groups:
+      npm-minor-and-patch:
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "03:30"
+      timezone: Asia/Kuala_Lumpur
+    open-pull-requests-limit: 5
+    labels: [dependencies, github-actions]
+    groups:
+      actions-minor-and-patch:
+        update-types: [minor, patch]

.github/pull_request_template.md

@@ -0,0 +1,24 @@
+## Change
+
+Describe the user-visible behavior and why it belongs inside SFTGuard's bounded
+correctness or regression contract.
+
+## Evidence
+
+List the deterministic tests, synthetic fixtures, commands, and observed
+results. Do not attach private datasets or an unsanitized report.
+
+## Privacy and security
+
+Describe new inputs, outputs, paths, dependencies, or network behavior. State
+whether any artifact schema or safe-sharing guidance changed.
+
+## Checklist
+
+- [ ] Python tests pass on the supported versions, when applicable.
+- [ ] The Node 22 viewer checks and production build pass, when applicable.
+- [ ] New behavior has a deterministic synthetic test and negative control.
+- [ ] `PASS`, `FAIL`, and `ABSTAIN` remain distinct and fail closed.
+- [ ] Artifacts and fixtures contain no raw private records, credentials, or model weights.
+- [ ] No telemetry, automatic upload, or automatic posting was introduced.
+- [ ] Documentation and the frozen evidence boundary remain accurate.

.github/release.yml

@@ -0,0 +1,24 @@
+changelog:
+  exclude:
+    labels:
+      - skip-changelog
+  categories:
+    - title: Security and privacy
+      labels:
+        - security
+        - privacy
+    - title: Detectors and regression gates
+      labels:
+        - detector
+        - regression
+    - title: Viewer and reports
+      labels:
+        - web
+        - reporting
+    - title: Documentation and maintenance
+      labels:
+        - documentation
+        - dependencies
+    - title: Other changes
+      labels:
+        - "*"

.github/workflows/ci.yml

@@ -0,0 +1,79 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  python:
+    name: Python ${{ matrix.python-version }} / ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Install package and test tools
+        run: >-
+          python -m pip install --upgrade pip
+          && python -m pip install -e ".[dev]" build
+      - name: Check installed dependencies
+        run: python -m pip check
+      - name: Compile Python sources
+        run: python -m compileall -q src tests scripts
+      - name: Lint and format-check Python
+        run: >-
+          python -m ruff check src tests/python scripts
+          && python -m ruff format --check src tests/python scripts
+      - name: Run Python tests
+        run: python -m pytest
+      - name: Verify checked-in evidence integrity
+        if: ${{ hashFiles('evidence/v0.1.0-confirmatory.json') != '' }}
+        run: python scripts/confirmatory_evidence.py verify --integrity-only
+      - name: Replay evidence from the implementation commit
+        if: ${{ matrix.python-version == '3.11' && hashFiles('evidence/v0.1.0-confirmatory.json') != '' }}
+        run: python scripts/confirmatory_evidence.py verify
+      - name: Smoke-test the CLI
+        run: sftguard --help
+      - name: Build source and wheel distributions
+        run: python -m build
+
+  web:
+    name: Node 22 / ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+      - name: Install locked dependencies
+        run: npm ci
+      - name: Type-check, test, and build the viewer
+        run: npm run check

.github/workflows/codeql.yml

@@ -0,0 +1,34 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "37 4 * * 4"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript-typescript]
+    steps:
+      - uses: actions/checkout@v7
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+      - name: Analyze
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:${{ matrix.language }}

.github/workflows/dependency-audit.yml

@@ -0,0 +1,58 @@
+name: Dependency audit
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - pyproject.toml
+      - web/package.json
+      - web/package-lock.json
+      - .github/workflows/dependency-audit.yml
+  pull_request:
+    paths:
+      - pyproject.toml
+      - web/package.json
+      - web/package-lock.json
+      - .github/workflows/dependency-audit.yml
+  schedule:
+    - cron: "19 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  python:
+    name: Python dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Install the project auditor
+        run: >-
+          python -m pip install --upgrade pip
+          && python -m pip install pip-audit
+      - name: Audit declared project dependencies
+        run: python -m pip_audit --strict .
+
+  web:
+    name: npm dependency audit
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+      - name: Install locked dependencies
+        run: npm ci
+      - name: Audit production and development dependencies
+        run: npm audit --audit-level=high