chore(governance): auto-seed org templates from Quantum-L9/.github

.biomeignore

@@ -0,0 +1,6 @@
+# Biome path exclusions (gitignore syntax).
+# Biome 2.5 reads files.includes in biome.json, not this file — keep generated trees in both.
+
+coverage/
+dist/
+.l9/

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[*.py]
+indent_size = 4
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab

.github/ISSUE_TEMPLATE/1-bug.yml

@@ -0,0 +1,66 @@
+name: 🐛 Bug
+description: Something behaves incorrectly and you can show it.
+title: "bug: "
+labels: ["type:bug", "needs:triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        CI pipeline failures go to
+        [l9-ci-debt-resolver](https://github.com/Quantum-L9/l9-ci-debt-resolver/issues/new)
+        instead — that component owns failure diagnosis.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: The symptom you observed, in one or two sentences. Not your theory.
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Error output
+      description: Traceback, failing assertion, or log line. Redact secrets.
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction
+      description: Steps from a clean checkout. Best effort is fine.
+      render: shell
+
+  - type: input
+    id: version
+    attributes:
+      label: Version / commit
+      description: Release tag or SHA if you have it.
+
+  - type: dropdown
+    id: severity
+    attributes:
+      label: Severity
+      description: Routes triage. Advisory only — nothing is blocked by this.
+      options:
+        - S4 — cosmetic
+        - S3 — degraded, workaround exists
+        - S2 — major function broken, no workaround
+        - S1 — production down, data loss, or security exposure
+    validations:
+      required: true
+
+  - type: input
+    id: regression
+    attributes:
+      label: Last known good version
+      description: If set, implies a bisect range. Leave blank if unknown.
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Anything else
+      description: Suspected cause, related issues, workaround in use.

.github/ISSUE_TEMPLATE/2-feature.yml

@@ -0,0 +1,58 @@
+name: ✨ Feature
+description: Propose a capability that does not exist yet.
+title: "feat: "
+labels: ["type:feature", "needs:triage"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: The pain, not the solution. Who is blocked, and on what?
+    validations:
+      required: true
+
+  - type: textarea
+    id: today
+    attributes:
+      label: What you do today
+      description: Current workaround and its cost.
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: What should exist. Include the interface if you know it.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: owner
+    attributes:
+      label: Which component should own this?
+      description: Prevents governance from absorbing CI concerns.
+      options:
+        - this repo (org governance / community health)
+        - l9-ci-sdk or l9-ci-core (test, lint, build execution)
+        - l9-ci-debt-resolver (CI failure diagnosis or remediation)
+        - l9-ci-debt-intelligence (CI debt measurement)
+        - unsure
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Options you rejected and why.
+
+  - type: dropdown
+    id: scope
+    attributes:
+      label: Scope
+      options:
+        - S — under a day
+        - M — a few days, one repo
+        - L — multi-repo or migration
+        - XL — needs a design doc first
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/3-task.yml

@@ -0,0 +1,36 @@
+name: 🔧 Task
+description: Known work with a known solution — chore, refactor, infra, docs.
+title: "chore: "
+labels: ["type:task"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Why this work exists. What degrades if it is never done?
+    validations:
+      required: true
+
+  - type: textarea
+    id: work
+    attributes:
+      label: Work
+      value: |
+        - [ ]
+        - [ ]
+    validations:
+      required: true
+
+  - type: dropdown
+    id: kind
+    attributes:
+      label: Kind
+      options: [chore, refactor, infra / IaC, governance, docs, dependency bump]
+    validations:
+      required: true
+
+  - type: input
+    id: blocks
+    attributes:
+      label: Blocks / blocked by
+      placeholder: "blocked by #12, blocks #34"

.github/ISSUE_TEMPLATE/4-incident.yml

@@ -0,0 +1,90 @@
+name: 🚨 Incident
+description: Production is degraded or down. File first, investigate second.
+title: "incident: "
+labels: ["type:incident", "sev:untriaged", "priority:P0"]
+assignees: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Page first, file second.** If customers are affected and nobody is paged,
+        stop and page on-call. This issue is the written record, not the alarm.
+        If this is a security compromise, use a private advisory instead — not this form.
+
+  - type: input
+    id: started
+    attributes:
+      label: Detected at (UTC)
+      placeholder: "2026-07-28T15:04:00Z"
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Customer-visible symptom. What is broken, for whom, since when?
+    validations:
+      required: true
+
+  - type: dropdown
+    id: severity
+    attributes:
+      label: Severity
+      options:
+        - S1 — full outage, data loss, or security exposure
+        - S2 — major degradation, no workaround
+        - S3 — partial degradation, workaround in place
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Signal
+      description: Alert name, dashboard link, error rate, sample traceback.
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: impact
+    attributes:
+      label: Blast radius
+      description: Services, regions, tenants, and estimated request or user count.
+    validations:
+      required: true
+
+  - type: textarea
+    id: mitigation
+    attributes:
+      label: Mitigation in progress
+      description: What is being done right now. Update this field as it evolves.
+    validations:
+      required: true
+
+  - type: input
+    id: suspect
+    attributes:
+      label: Suspected trigger
+      description: Deploy, PR, config change, or upstream provider. Link it.
+      placeholder: "#1184, deployed 14:52Z"
+
+  - type: input
+    id: commander
+    attributes:
+      label: Incident commander
+      placeholder: "@handle"
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: gates
+    attributes:
+      label: Response checklist
+      options:
+        - label: On-call paged.
+          required: true
+        - label: Status page or stakeholder comms updated, or explicitly not needed.
+        - label: Timeline is being kept in the comments below.
+        - label: Postmortem issue will be opened within 48h of resolution.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,18 @@
+# Quantum-L9 org-wide issue template chooser config.
+# https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository
+#
+# Advisory URL is rewritten per consumer by ops/build-seed-payload.js
+# (same SSOT as SECURITY.md). Do not add a fourth security URL.
+
+blank_issues_enabled: false
+
+contact_links:
+  - name: Security Vulnerability Report
+    url: https://github.com/Quantum-L9/LLM-Router/security/advisories/new
+    about: Do not open a public issue for security vulnerabilities. Follow SECURITY.md instead.
+  - name: Governance / CANONICAL_LAW Question
+    url: https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md
+    about: For questions about governance policy, symlink contracts, or CANONICAL_LAW.md, read the policy source of truth first.
+  - name: CI Kernel API Contract
+    url: https://github.com/Quantum-L9/.github/blob/main/workflow-interface-registry.yml
+    about: For questions about kernel inputs/outputs/versioning, check the machine-readable registry before filing an issue.

.github/ISSUE_TEMPLATE/seed-ci-failure.yml

@@ -0,0 +1,57 @@
+name: Seed / auto-seed CI failure
+description: A red governance seed or auto-seed PR — ticket, not a chat
+title: "[Seed CI]: "
+labels: ["ci-failure", "triage"]
+assignees: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this when an org seed / auto-seed PR is red (Biome, labels, Semgrep
+        install, lockfile cache, required-check collision). For a code bug that
+        happens to fail tests, use Bug Report. For a kernel failure on a
+        feature PR, use CI Pipeline Failure.
+
+  - type: input
+    id: repository
+    attributes:
+      label: Repository
+      description: owner/name of the consumer that received the seed
+      placeholder: Quantum-L9/example-repo
+    validations:
+      required: true
+
+  - type: input
+    id: sha
+    attributes:
+      label: SHA
+      description: Commit SHA of the failing seed head
+      placeholder: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    validations:
+      required: true
+
+  - type: input
+    id: check_url
+    attributes:
+      label: Failing check URL
+      description: Full Actions run or check-run URL
+      placeholder: "https://github.com/Quantum-L9/example-repo/actions/runs/XXXXXXXXX"
+    validations:
+      required: true
+
+  - type: input
+    id: check_name
+    attributes:
+      label: Failing check name
+      placeholder: "L9 Analysis / Biome (format + lint) — SDK-owned / Node Test Suite"
+    validations:
+      required: true
+
+  - type: textarea
+    id: error-output
+    attributes:
+      label: Error Output
+      description: Paste the relevant error section from the failed step.
+      render: shell
+    validations:
+      required: true