chore: harden the public release

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,34 @@
+name: Bug report
+description: Report reproducible incorrect behavior
+title: "bug: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: Do not include credentials, private API descriptions, or customer response data.
+  - type: input
+    id: version
+    attributes:
+      label: Kāhea version
+      placeholder: "0.1.0"
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: Operating system and architecture
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Include a redacted source, command, and stable exit code.
+    validations:
+      required: true
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed and expected behavior
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Private vulnerability report
+    url: https://github.com/copyleftdev/kahea/security/advisories/new
+    about: Report suspected security vulnerabilities privately.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,23 @@
+name: Feature request
+description: Propose a bounded addition or contract change
+title: "feature: "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What agent or API workflow cannot be handled safely today?
+    validations:
+      required: true
+  - type: textarea
+    id: contract
+    attributes:
+      label: Proposed contract
+      description: Describe inputs, outputs, policy implications, and fail-closed behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      rust-dependencies:
+        patterns: ["*"]
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]

.github/workflows/ci.yml

@@ -7,14 +7,16 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
         with:
+          toolchain: 1.95.0
           components: rustfmt, clippy
       - uses: Swatinem/rust-cache@v2
       - run: sudo apt-get update && sudo apt-get install -y jq
@@ -27,8 +29,10 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: 1.95.0
       - uses: Swatinem/rust-cache@v2
       # Without --no-fail-fast the first failing binary hides every later one,
       # which turns a platform difference into several sequential CI rounds.
@@ -37,10 +41,25 @@ jobs:
   dependency-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: rustsec/audit-check@v2
+      - uses: actions/checkout@v6
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          rust-version: "1.95.0"
+          command: check advisories
+
+  supply-chain:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: EmbarkStudios/cargo-deny-action@v2
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          rust-version: "1.95.0"
+          command: check bans licenses sources
+      - uses: gitleaks/gitleaks-action@v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 # Mutation testing is deliberately not a CI job. Every mutant rebuilds the
 # workspace and reruns its whole suite, so a full sweep runs for hours of

.github/workflows/release.yml

@@ -0,0 +1,111 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: 1.95.0
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: sudo apt-get update && sudo apt-get install -y jq
+      - name: Verify tag matches the workspace version
+        shell: bash
+        run: |
+          version=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "kahea") | .version')
+          test "$GITHUB_REF_NAME" = "v$version"
+      - run: scripts/gates.sh
+      - name: Generate release metadata
+        shell: bash
+        run: |
+          cargo install --locked --version 0.5.9 cargo-cyclonedx
+          cargo install --locked --version 0.9.1 --features cli cargo-about
+          scripts/sbom.sh
+          cargo about generate about.hbs > artifacts/THIRD_PARTY_LICENSES.html
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-metadata
+          path: artifacts/*
+          if-no-files-found: error
+
+  build:
+    needs: verify
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: 1.95.0
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo build --release --locked -p kahea
+      - uses: actions/download-artifact@v7
+        with:
+          name: release-metadata
+          path: release-metadata
+      - name: Package Unix binary
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          archive_base="kahea-${RUNNER_OS}-${RUNNER_ARCH}"
+          mkdir -p "stage/$archive_base" dist
+          cp target/release/kahea README.md LICENSE CHANGELOG.md "stage/$archive_base/"
+          cp release-metadata/kahea.cdx.json release-metadata/THIRD_PARTY_LICENSES.html "stage/$archive_base/"
+          tar -C stage -czf "dist/$archive_base.tar.gz" "$archive_base"
+          (cd dist && shasum -a 256 "$archive_base.tar.gz" > "$archive_base.tar.gz.sha256")
+      - name: Package Windows binary
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $archiveBase = "kahea-$env:RUNNER_OS-$env:RUNNER_ARCH"
+          $stage = "stage/$archiveBase"
+          New-Item -ItemType Directory -Force -Path $stage, dist | Out-Null
+          Copy-Item target/release/kahea.exe, README.md, LICENSE, CHANGELOG.md -Destination $stage
+          Copy-Item release-metadata/kahea.cdx.json, release-metadata/THIRD_PARTY_LICENSES.html -Destination $stage
+          $archive = "dist/$archiveBase.zip"
+          Compress-Archive -Path $stage -DestinationPath $archive
+          $hash = (Get-FileHash -Algorithm SHA256 $archive).Hash.ToLowerInvariant()
+          "$hash  $archiveBase.zip" | Set-Content -NoNewline "$archive.sha256"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: kahea-${{ runner.os }}-${{ runner.arch }}
+          path: dist/*
+          if-no-files-found: error
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/download-artifact@v7
+        with:
+          path: dist
+          pattern: kahea-*
+          merge-multiple: true
+      - uses: actions/download-artifact@v7
+        with:
+          name: release-metadata
+          path: dist
+      - uses: actions/attest@v4
+        with:
+          subject-path: dist/*
+      - name: Publish GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "$GITHUB_REF_NAME" dist/* --generate-notes --title "$GITHUB_REF_NAME"

.gitignore

@@ -3,3 +3,4 @@
 /mutants.out
 *.tmp
 /mutants.out.old
+/artifacts

.gitleaksignore

@@ -0,0 +1,2 @@
+# Intentional path-traversal rejection fixture, not a credential.
+88607a6e43d41de738a8846bc710b03dba5188b0:crates/kahea-mcp/src/lib.rs:generic-api-key:633

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## 0.1.0
 
+- Added a tag-driven GitHub Release pipeline for native Linux, macOS, and Windows binaries with SHA-256 checksums, CycloneDX SBOMs, third-party license notices, and signed build provenance.
+- Added public-project release hygiene: a pinned and verified Rust 1.95 MSRV, non-publishable workspace crates, license and source policy, full-history secret scanning, Dependabot, issue forms, contribution/support/conduct guidance, and an explicit security-reporting policy.
 - Added a schema-conformance suite for the case generator: every positive body and parameter is validated against the declared contract by an independent checker, declared bounds are shown to be explored across seeds, and every negative case is proven to violate the schema in the way its strategy names.
 - Added a cookie-parameter fixture and contracts for it: cookies reach the wire as one sorted header, omitting or corrupting one cookie leaves its neighbour untouched, dropping one required query parameter keeps the others, and a server as strict as the contract agrees with every generated case. Cookie mutation had no fixture anywhere and had never executed.
 - Added a generator-surface fixture and two byte-exact campaign goldens covering every schema construct the bounded generator supports, plus the optional-inclusion and supplied-baseline paths a single golden cannot reach. Goldens regenerate with `KAHEA_UPDATE_GOLDEN=1` and report the case that drifted rather than only a changed digest.

CODE_OF_CONDUCT.md

@@ -0,0 +1,15 @@
+# Code of Conduct
+
+Kāhea adopts the
+[Contributor Covenant, version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+
+Project spaces should be respectful, technically constructive, and safe for people of every
+background and experience level. Harassment, personal attacks, discriminatory conduct, doxxing,
+and deliberate disruption are not acceptable.
+
+Moderation concerns may be raised with the repository maintainer through their GitHub profile.
+Platform abuse may also be reported through GitHub's abuse-reporting tools. Do not post sensitive
+personal details in a public issue.
+
+Maintainers may edit, remove, or reject contributions and may temporarily or permanently restrict
+participation when conduct is harmful to the project or its community.

CONTRIBUTING.md

@@ -0,0 +1,41 @@
+# Contributing to Kāhea
+
+Kāhea welcomes focused bug reports, documentation improvements, new fixtures, and changes that
+strengthen deterministic planning, policy enforcement, or evidence integrity.
+
+## Before opening a change
+
+- Use a public issue for bugs and feature proposals. Use private vulnerability reporting for
+  security issues.
+- Keep changes scoped. A source-format feature should include its normalization and failure-mode
+  contracts; a protocol change should include byte-stable envelope coverage.
+- Never commit credentials, captured customer payloads, or fixtures that contact public services.
+
+## Development setup
+
+Install Rust 1.95 or newer, `jq`, and `cargo-audit`. The repository toolchain file installs the
+required Rust version, rustfmt, and Clippy.
+
+```bash
+scripts/gates.sh
+```
+
+Changes to `kahea-core`, `kahea-plan`, `kahea-conformance`, or `kahea-ingest` should also run the
+resource-bounded mutation gate:
+
+```bash
+scripts/mutation-gate.sh
+```
+
+The full mutation sweep is intentionally local because it is expensive. Narrow iterations with
+`KAHEA_MUTANT_PACKAGES` or `KAHEA_MUTANT_EXTRA`, then run the complete affected package before
+requesting review.
+
+## Pull requests
+
+- Explain the user-visible contract, the failure mode, and how it was verified.
+- Update `CHANGELOG.md` for user-visible behavior.
+- Keep formatting and Clippy warning-free.
+- Contributions are licensed under Apache-2.0 as described by the repository license.
+
+By participating, you agree to follow the project code of conduct.

Cargo.toml

@@ -16,9 +16,12 @@ members = [
 [workspace.package]
 version = "0.1.0"
 edition = "2024"
-rust-version = "1.85"
+rust-version = "1.95"
 license = "Apache-2.0"
 repository = "https://github.com/copyleftdev/kahea"
+homepage = "https://github.com/copyleftdev/kahea"
+description = "Local-first deterministic API invocation kernel for coding agents"
+publish = false
 
 [workspace.dependencies]
 blake3 = "1.8.2"

README.md

@@ -12,12 +12,31 @@ Kāhea is a local-first, deterministic API invocation kernel for coding agents.
 
 It turns OpenAPI descriptions, request captures, and Arazzo workflows into integrity-sealed request plans. Invocation is a separate operation guarded by exact capability grants; responses become typed observations and content-addressed evidence.
 
-## Build and verify
+## Install
+
+Download the archive for your operating system and architecture from
+[GitHub Releases](https://github.com/copyleftdev/kahea/releases). Every archive is accompanied by
+a SHA-256 checksum, a CycloneDX SBOM, and GitHub build provenance. Verify the checksum before
+installing and verify provenance with:
+
+```bash
+gh attestation verify kahea-ARCHIVE --repo copyleftdev/kahea
+```
+
+Kāhea does not run an installer or modify shell configuration. Extract the archive and place the
+`kahea` binary somewhere on `PATH`.
 
-Kāhea requires Rust 1.85 or newer.
+To build from source, install Rust 1.95 or newer:
 
 ```bash
 cargo build --release -p kahea
+```
+
+## Build and verify
+
+The repository pins the release toolchain in `rust-toolchain.toml`.
+
+```bash
 scripts/gates.sh
 # Requires cargo-mutants; run locally, not in CI.
 scripts/mutation-gate.sh

SECURITY.md

@@ -1,6 +1,19 @@
 # Security
 
-Please report suspected vulnerabilities privately to the repository maintainers. Do not include live credentials, customer response bodies, or exploit traffic against systems you do not own.
+## Supported versions
+
+| Version | Supported |
+|---|---|
+| Latest GitHub release | Yes |
+| Older releases and unreleased commits | Best effort |
+
+Report suspected vulnerabilities through
+[GitHub private vulnerability reporting](https://github.com/copyleftdev/kahea/security/advisories/new).
+Do not open a public issue for a suspected vulnerability. Do not include live credentials, customer
+response bodies, or exploit traffic against systems you do not own.
+
+Maintainers will acknowledge a report within five business days, keep the reporter informed while
+validating it, and coordinate disclosure after a fix is available. No bounty is currently offered.
 
 Kāhea treats API descriptions, configuration, DNS, redirects, and remote responses as untrusted. Planning is no-network; invocation requires sealed plans and exact grants. Redirects and ambient proxies are disabled, resolved addresses are pinned after policy evaluation, and secret material is resolved only at invocation. See the security model and limitations in the README before deploying Kāhea with sensitive APIs.