Harden Runtime Grid evidence and OSS boundary

.github/ISSUE_TEMPLATE/bounded-adapter.yml

@@ -0,0 +1,35 @@
+name: Bounded adapter proposal
+description: Propose one deterministic job adapter without expanding the control plane.
+title: "[adapter] "
+labels: ["adapter"]
+body:
+  - type: input
+    id: owner
+    attributes:
+      label: Workflow owner and public contract
+      description: Link to the independently owned workflow or fixture contract.
+    validations:
+      required: true
+  - type: textarea
+    id: boundary
+    attributes:
+      label: Adapter boundary
+      description: Define input, output, timeout, retry, cost, and redaction behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Proposed evidence
+      description: Describe deterministic fixtures, failure cases, and verification.
+    validations:
+      required: true
+  - type: checkboxes
+    id: non_goals
+    attributes:
+      label: Scope agreement
+      options:
+        - label: This proposal does not add a new scheduler or hosted control plane.
+          required: true
+        - label: Model output will not control retry, budget, or terminal-state policy.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Private security report
+    url: https://github.com/ashishki/Agent-Runtime-Grid/security/advisories/new
+    about: Report vulnerabilities without disclosing sensitive details publicly.

.github/ISSUE_TEMPLATE/evidence-integrity.yml

@@ -0,0 +1,26 @@
+name: Evidence integrity defect
+description: Report a checksum, manifest, report, or claim-verification mismatch.
+title: "[evidence] "
+labels: ["evidence"]
+body:
+  - type: textarea
+    id: artifact
+    attributes:
+      label: Artifact and revision
+      description: Identify the artifact, source revision, and command that produced it.
+    validations:
+      required: true
+  - type: textarea
+    id: mismatch
+    attributes:
+      label: Verification mismatch
+      description: Show expected versus observed hashes or semantics without private data.
+    validations:
+      required: true
+  - type: textarea
+    id: impact
+    attributes:
+      label: Claim impact
+      description: State exactly which conclusion is no longer supported.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/runtime-defect.yml

@@ -0,0 +1,35 @@
+name: Runtime defect
+description: Reproduce a bounded lifecycle, queue, storage, or worker defect.
+title: "[defect] "
+labels: ["bug"]
+body:
+  - type: textarea
+    id: invariant
+    attributes:
+      label: Violated invariant
+      description: State the expected deterministic runtime rule.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Include revision, command, sanitized inputs, and observed output.
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Python, Postgres, Redis, OS, and container versions.
+    validations:
+      required: true
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Safety checks
+      options:
+        - label: The report contains no secrets or private data.
+          required: true
+        - label: The reproduction does not target production infrastructure.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,14 @@
+## Invariant and scope
+
+Describe the bounded runtime invariant or documentation contract changed.
+
+## Reproduction and verification
+
+List the failing-before/passing-after test and the full local checks run.
+
+## Evidence and safety
+
+- [ ] No secrets, private data, generated reports, or absolute local paths are committed.
+- [ ] Claims and known limits remain accurate.
+- [ ] Database tests target only the local project/test database.
+- [ ] License review was updated if dependencies changed.

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres:16
+        image: postgres:16.14-alpine3.24@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
         env:
           POSTGRES_USER: testuser
           POSTGRES_PASSWORD: testpassword
@@ -27,7 +27,7 @@ jobs:
           - 5432:5432
 
       redis:
-        image: redis:7-alpine
+        image: redis:7.2.14-alpine3.21@sha256:dfa18828cbc07b3ae6a95ec7343f6c214fdee2d836197b4be8e9904420762cd8
         options: >-
           --health-cmd "redis-cli ping"
           --health-interval 10s
@@ -37,10 +37,10 @@ jobs:
           - 6379:6379
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
           cache: "pip"

CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+All notable changes are documented here. The project follows Semantic
+Versioning after its first tagged release.
+
+## Unreleased
+
+- Narrowed the supported surface to the local CLI/library runtime.
+- Removed non-running API/worker services and unconnected dashboards from the
+  default Compose topology.
+- Added persistent finalization-conflict accounting distinct from terminal-event
+  invariant violations.
+- Added explicit, local-only destructive reset controls.
+- Added Apache-2.0 licensing and bounded contribution/security surfaces.

CONTRIBUTING.md

@@ -0,0 +1,37 @@
+# Contributing
+
+Agent Runtime Grid accepts narrow, reproducible changes within its local runtime
+boundary. Good contributions fix a demonstrated lifecycle defect, add a bounded
+job adapter, strengthen evidence verification, or correct documentation.
+
+Broad orchestration frameworks, hosted-control-plane features, provider demos,
+and claims without reproducible evidence are out of scope.
+
+## Local setup
+
+```bash
+python3 -m venv .venv
+PATH=.venv/bin:$PATH python -m pip install -e . -r requirements-dev.txt
+docker-compose up -d postgres redis
+PATH=.venv/bin:$PATH ruff check src tests
+PATH=.venv/bin:$PATH ruff format --check src tests
+PATH=.venv/bin:$PATH python -m pytest -q
+```
+
+The integration suite creates and drops tables in the local
+`agent_runtime_grid` or `agent_runtime_grid_test` database. Never point tests or
+proof commands at production data.
+
+## Change contract
+
+1. Open a focused issue using the closest template.
+2. Add a failing regression test before changing behavior.
+3. Keep deterministic control decisions outside model/provider code.
+4. Do not commit credentials, customer data, generated reports, or absolute
+   local paths.
+5. Update known limits and evidence semantics when a claim changes.
+6. Run the full lint, format, and test commands above.
+
+Pull requests should describe the invariant, the reproduction, the expected
+failure before the change, and the verification after it. A passing test alone
+does not justify a new product claim.