Bootstrap org-wide defaults: community health, AI-agent policy, reusable workflows

.github/CODEOWNERS

@@ -0,0 +1,45 @@
+# CODEOWNERS for nyuchi/.github
+#
+# Docs:
+#   https://docs.github.com/en/repositories/managing-your-repositories-settings-and-features/customizing-your-repository/about-code-owners
+#
+# Everything in this repo is org-wide infrastructure: changes here
+# affect every public repository under Nyuchi Web Services. Reviews
+# require the org maintainers team by default, with tighter ownership
+# on security-adjacent files.
+#
+# NOTE: The team handles below (@nyuchi/maintainers,
+# @nyuchi/security, @nyuchi/platform) are the intended names.
+# If your org's actual teams are named differently, update this file
+# before enabling branch protection's "Require review from Code Owners"
+# setting.
+
+# --- Default owner -----------------------------------------------------------
+# Everything not matched below requires review from org maintainers.
+*                                       @nyuchi/maintainers
+
+# --- Security and policy -----------------------------------------------------
+# Changes to the security policy, contribution rules, or agent policy
+# affect every repo in the org. Require security team review.
+/SECURITY.md                            @nyuchi/maintainers @nyuchi/security
+/CODE_OF_CONDUCT.md                     @nyuchi/maintainers
+/CONTRIBUTING.md                        @nyuchi/maintainers
+/AGENTS.md                              @nyuchi/maintainers @nyuchi/security
+/ORG_SETTINGS.md                        @nyuchi/maintainers @nyuchi/security
+
+# --- CI and automation -------------------------------------------------------
+# Reusable workflows are referenced live by every consuming repo
+# via `uses:`, so a change here propagates immediately on the next
+# CI run in every adopter. Platform team review required.
+/.github/workflows/                     @nyuchi/maintainers @nyuchi/platform
+/.github/dependabot.yml                 @nyuchi/maintainers @nyuchi/platform
+/.github/dependabot.example.yml         @nyuchi/maintainers @nyuchi/platform
+
+# --- Issue and PR forms ------------------------------------------------------
+/.github/ISSUE_TEMPLATE/                @nyuchi/maintainers
+/.github/PULL_REQUEST_TEMPLATE.md       @nyuchi/maintainers
+
+# --- Org profile -------------------------------------------------------------
+# The landing page at github.com/nyuchi is public-facing; content
+# claims need marketing sign-off in addition to maintainer review.
+/profile/                               @nyuchi/maintainers @nyuchi/marketing

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,115 @@
+name: Bug report
+description: Report something that is broken or behaving unexpectedly.
+title: "bug: "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug report.
+
+        **Before you continue:**
+        - Please search [open and closed issues](../issues?q=is%3Aissue) to
+          avoid duplicates.
+        - For **security vulnerabilities**, do *not* open a public issue.
+          Follow [`SECURITY.md`](../../blob/main/SECURITY.md) instead.
+        - For **usage questions**, use
+          [Discussions](https://github.com/orgs/nyuchi/discussions), not
+          Issues.
+
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Preflight checks
+      options:
+        - label: I searched existing issues and this is not a duplicate.
+          required: true
+        - label: I have read the project's README and relevant docs.
+          required: true
+        - label: This is *not* a security vulnerability (those go via `SECURITY.md`).
+          required: true
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: One or two sentences describing the bug.
+      placeholder: When I do X, Y happens instead of Z.
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: |
+        A minimal, self-contained reproduction. If possible, link to a
+        repository, gist, or codesandbox that demonstrates the issue.
+      placeholder: |
+        1. Clone the repo at commit <sha>
+        2. Run `pnpm install && pnpm dev`
+        3. Navigate to /foo
+        4. Click "Bar"
+        5. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behaviour
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behaviour
+      description: What happened instead. Include error messages verbatim.
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: |
+        Include anything that might be relevant. Examples:
+        - OS and version (e.g. macOS 15.3, Ubuntu 24.04, Windows 11)
+        - Runtime and version (e.g. Node 20.10, Rust 1.85, Python 3.12, uv 0.5)
+        - Browser and version (for web UIs)
+        - Package version or commit SHA
+        - Deployment target (local, CI, Cloudflare Workers, etc.)
+      render: markdown
+      placeholder: |
+        - OS: macOS 15.3
+        - Node: 20.10.0
+        - pnpm: 9.12.0
+        - Package: @nyuchi/ui@1.4.2
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs, screenshots, or stack traces
+      description: Paste relevant output inside fenced code blocks. Redact secrets.
+      render: shell
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Anything else that might help — related issues, workarounds, hypotheses.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: conduct
+    attributes:
+      label: Code of Conduct
+      options:
+        - label: I agree to follow this project's [Code of Conduct](../../blob/main/CODE_OF_CONDUCT.md).
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,14 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Read the documentation
+    url: https://github.com/nyuchi/docs
+    about: Architecture notes, guides, and API references live in the docs repository.
+  - name: Browse the support knowledge base
+    url: https://github.com/nyuchi/support
+    about: FAQs, troubleshooting, and how-to articles before you open an issue.
+  - name: Ask a question or start a discussion
+    url: https://github.com/orgs/nyuchi/discussions
+    about: For usage questions and open-ended discussion, please use GitHub Discussions. Don't open an issue for support.
+  - name: Report a security vulnerability (private)
+    url: https://github.com/nyuchi/.github/blob/main/SECURITY.md
+    about: Do NOT open a public issue for security vulnerabilities. Follow SECURITY.md to report privately via GitHub Security Advisories.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,101 @@
+name: Feature request
+description: Suggest a new feature, enhancement, or change in behaviour.
+title: "feat: "
+labels: ["enhancement", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for suggesting a feature.
+
+        **Before you continue:**
+        - Please search [open and closed issues](../issues?q=is%3Aissue) and
+          [discussions](https://github.com/orgs/nyuchi/discussions) to
+          avoid duplicates.
+        - For open-ended ideas that aren't concrete enough to act on, please
+          start a [Discussion](https://github.com/orgs/nyuchi/discussions)
+          instead.
+
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Preflight checks
+      options:
+        - label: I searched existing issues and discussions; this is not a duplicate.
+          required: true
+        - label: This is a concrete proposal, not an open-ended idea.
+          required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: |
+        What problem are you trying to solve? Focus on the *user need*, not
+        the solution. "I want X" is not a problem statement; "when I do Y,
+        I have no way to Z" is.
+      placeholder: When I do Y, I have no way to Z, which means I have to work around it by...
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the change you'd like to see. Be specific about API, UX, or behaviour.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What other approaches did you consider, and why did you reject them?
+    validations:
+      required: false
+
+  - type: dropdown
+    id: scope
+    attributes:
+      label: Scope
+      description: How big is this change, roughly?
+      options:
+        - Small (single function, config, or flag)
+        - Medium (new component, module, or endpoint)
+        - Large (new package, major API change, or cross-cutting)
+        - Unknown
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: breaking
+    attributes:
+      label: Breaking change?
+      description: Would this change break existing users? If yes, explain in Additional context.
+      options:
+        - label: This proposal introduces a breaking change.
+          required: false
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Links to related issues, prior art in other projects, screenshots, mocks, etc.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: contribution
+    attributes:
+      label: Willing to contribute?
+      options:
+        - label: I'd be willing to open a PR to implement this (see `CONTRIBUTING.md`).
+          required: false
+
+  - type: checkboxes
+    id: conduct
+    attributes:
+      label: Code of Conduct
+      options:
+        - label: I agree to follow this project's [Code of Conduct](../../blob/main/CODE_OF_CONDUCT.md).
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,82 @@
+<!--
+  Thanks for contributing! Please make sure you've read CONTRIBUTING.md
+  before opening this PR:
+  https://github.com/nyuchi/.github/blob/main/CONTRIBUTING.md
+
+  Your PR title MUST follow Conventional Commits, e.g.:
+    feat(ui): add dark-mode toggle to settings
+    fix(auth): refresh token race condition
+    docs: clarify SECURITY.md reporting steps
+-->
+
+## Summary
+
+<!-- One or two sentences: what does this PR do and why? -->
+
+## Linked issue(s)
+
+<!-- Use "Closes #123" to auto-close an issue on merge. Use "Refs #123"
+     for related-but-not-closing issues. Remove this section if N/A. -->
+
+Closes #
+
+## Type of change
+
+<!-- Check all that apply. Must match your Conventional Commits type. -->
+
+- [ ] `feat` — user-visible new feature
+- [ ] `fix` — user-visible bug fix
+- [ ] `perf` — performance improvement
+- [ ] `refactor` — code change, no behaviour change
+- [ ] `docs` — documentation only
+- [ ] `test` — tests only
+- [ ] `build` — build system, packaging, dependencies
+- [ ] `ci` — CI configuration
+- [ ] `chore` — maintenance
+- [ ] `revert` — revert of a prior commit
+
+## Breaking change?
+
+- [ ] This PR introduces a breaking change.
+
+<!-- If yes: describe what breaks, who is affected, and the migration
+     path. Include the `BREAKING CHANGE:` footer in at least one commit. -->
+
+## How has this been tested?
+
+<!-- Describe the tests you ran. For UI changes, include screenshots or
+     screen recordings of the golden path and any relevant edge cases. -->
+
+## Checklist
+
+<!-- All boxes must be ticked before a maintainer will merge. These mirror
+     the requirements in CONTRIBUTING.md — they are not suggestions. -->
+
+- [ ] My PR **title** follows [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/).
+- [ ] All of my commits are **signed** and show "Verified" on GitHub
+      (GPG or SSH). See
+      [CONTRIBUTING.md § Signed commits](https://github.com/nyuchi/.github/blob/main/CONTRIBUTING.md#signed-commits-required).
+- [ ] All of my commits have a **DCO sign-off** (`Signed-off-by:` trailer,
+      added by `git commit -s`).
+- [ ] My branch name follows `<type>/<short-kebab-description>` (see
+      [CONTRIBUTING.md § Branch naming](https://github.com/nyuchi/.github/blob/main/CONTRIBUTING.md#branch-naming)).
+- [ ] I have **rebased** onto the latest default branch; no merge commits
+      from the base branch in this PR.
+- [ ] I have added or updated **tests** covering the change (or explained
+      below why tests aren't applicable).
+- [ ] I have updated **documentation** (README, inline docs, changelog,
+      migration notes) where relevant.
+- [ ] I ran the repo's local checks (lint, typecheck, tests) and they pass.
+- [ ] Any new **runtime dependencies** are justified in this PR description
+      (name, version, license, why).
+- [ ] If this is a breaking change, I have marked the box above and
+      included a `BREAKING CHANGE:` footer in at least one commit.
+
+## Screenshots / recordings
+
+<!-- Optional. Drag-and-drop images or .mov/.mp4 files here. -->
+
+## Additional notes
+
+<!-- Optional. Anything reviewers should know before looking at the diff:
+     deployment concerns, feature-flag state, follow-up PRs, etc. -->