chore: establish public launch governance

.github/ISSUE_TEMPLATE/alpha_feedback.yml

@@ -0,0 +1,68 @@
+name: Alpha evaluation feedback
+description: Share structured feedback from the public-alpha evaluation
+title: "alpha feedback: "
+labels:
+  - alpha-feedback
+body:
+  - type: input
+    id: evaluator
+    attributes:
+      label: Evaluator perspective
+      placeholder: Quantum developer, security engineer, researcher, or other
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      placeholder: Windows WSL, Python 3.12
+    validations:
+      required: true
+  - type: input
+    id: install_time
+    attributes:
+      label: Installation time
+      placeholder: 8 minutes
+    validations:
+      required: true
+  - type: input
+    id: verified_time
+    attributes:
+      label: Time to first verified chain
+      placeholder: 12 minutes
+    validations:
+      required: true
+  - type: textarea
+    id: confusion
+    attributes:
+      label: Where did you become confused?
+    validations:
+      required: true
+  - type: textarea
+    id: skepticism
+    attributes:
+      label: Which claim felt least credible?
+    validations:
+      required: true
+  - type: textarea
+    id: understanding
+    attributes:
+      label: Explain the Evidence Graph and trust boundary
+    validations:
+      required: true
+  - type: textarea
+    id: workflow
+    attributes:
+      label: What real workflow would you test next?
+    validations:
+      required: true
+  - type: dropdown
+    id: continue
+    attributes:
+      label: Would you continue evaluating QuantumD?
+      options:
+        - "Yes"
+        - "Maybe"
+        - "No"
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,51 @@
+name: Bug report
+description: Report a reproducible QuantumD defect
+title: "bug: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not include credentials, private keys, confidential evidence, or vulnerability details. Security reports must follow SECURITY.md.
+  - type: input
+    id: version
+    attributes:
+      label: QuantumD version
+      placeholder: 0.7.4a0
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Operating system and Python version
+      placeholder: Ubuntu 24.04, Python 3.12
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command or workflow
+      description: Provide the exact sanitized command
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Include sanitized steps and logs
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,2 @@
+blank_issues_enabled: false
+contact_links: []

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,33 @@
+name: Feature request
+description: Propose a focused QuantumD capability
+title: "feature: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What execution-integrity or verification problem exists?
+    validations:
+      required: true
+  - type: textarea
+    id: workflow
+    attributes:
+      label: Current workflow
+      description: How is the problem handled today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+    validations:
+      required: true
+  - type: textarea
+    id: trust
+    attributes:
+      label: Trust-boundary impact
+      description: What identities, evidence, networks, approvals, or hardware are involved?
+    validations:
+      required: true

.github/pull_request_template.md

@@ -0,0 +1,23 @@
+## Summary
+
+Describe the focused change.
+
+## Trust-boundary impact
+
+- [ ] No trust-boundary change
+- [ ] Trust-boundary change is explained below
+- [ ] Fail-closed behavior is preserved
+- [ ] No new hardware or network action is introduced unexpectedly
+
+## Validation
+
+- [ ] Tests added or updated
+- [ ] `python -m pytest -q` passes
+- [ ] Documentation builds with `mkdocs build --strict`
+- [ ] `bash scripts/public_alpha_acceptance.sh` passes
+- [ ] No credentials, private keys, or generated identities are included
+- [ ] Third-party GitHub Actions are pinned to commit SHAs
+
+## Evidence
+
+Include relevant sanitized output and explain any new or changed evidence fields.

.github/workflows/ci.yml

@@ -23,10 +23,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
           cache: pip
@@ -93,7 +93,7 @@ jobs:
       - name: Public alpha wheel quickstart acceptance
         run: bash scripts/public_alpha_acceptance.sh
       - name: Upload validated distributions
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: quantumd-distributions-${{ github.sha }}
           path: dist/*

.github/workflows/docs.yml

@@ -29,10 +29,10 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
           cache: pip
@@ -47,7 +47,7 @@ jobs:
         run: python -m mkdocs build --strict
 
       - name: Upload rendered site
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: quantumd-documentation-site
           path: site/

.github/workflows/publish-testpypi.yml

@@ -21,10 +21,10 @@ jobs:
 
     steps:
       - name: Check out release commit
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
           cache: pip
@@ -267,7 +267,7 @@ jobs:
           echo "Manual release fail-closed check: PASS"
 
       - name: Upload verified release distributions
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: release-distributions
           path: dist/*
@@ -293,7 +293,7 @@ jobs:
 
     steps:
       - name: Retrieve verified distributions
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: release-distributions
           path: dist/

ALPHA_TESTING.md

@@ -0,0 +1,114 @@
+# QuantumD Alpha Evaluation
+
+QuantumD is recruiting five early technical evaluators to test whether a
+stranger can understand, install, run, and assess the execution-integrity
+model without founder assistance.
+
+## Evaluator profiles
+
+The initial group should include:
+
+1. a quantum developer
+2. a software-supply-chain or security engineer
+3. an ML, data, or scientific-computing engineer
+4. a technical leader from an audit-exposed environment
+5. an educator, researcher, or advanced technical student
+
+## Evaluation rule
+
+Complete the installation and quickstart without a live walkthrough. Record
+where the documentation creates confusion, skepticism, or unnecessary work.
+
+## Secure TestPyPI installation
+
+Create an isolated environment:
+
+```bash
+python3.12 -m venv .venv
+source .venv/bin/activate
+python -m pip install --upgrade pip
+```
+
+Download the exact QuantumD wheel from TestPyPI without resolving dependencies
+from that index:
+
+```bash
+python -m pip download \
+  --no-deps \
+  --only-binary=:all: \
+  --index-url https://test.pypi.org/simple/ \
+  quantumd==0.7.4a0
+```
+
+Install the downloaded wheel. Its dependencies will resolve from the default
+Python Package Index:
+
+```bash
+python -m pip install \
+  ./quantumd-0.7.4a0-py3-none-any.whl
+```
+
+Run the first governed local workflow:
+
+```bash
+quantumd quickstart my-first-quantumd-project
+```
+
+Inspect the environment and independently verify the evidence:
+
+```bash
+quantumd doctor my-first-quantumd-project
+
+quantumd verify-chain \
+  my-first-quantumd-project \
+  --latest
+```
+
+## Expected security boundary
+
+The local quickstart should report:
+
+```text
+Trust mode:             LOCAL_DEVELOPMENT
+Trust scope:            LOCAL_SIMULATION_ONLY
+Hardware authorization: PROHIBITED
+KMS signing used:       False
+IBM contacted:          False
+Hardware action:        None
+```
+
+Independent verification should end with:
+
+```text
+[STATUS] COMPLETE EVIDENCE CHAIN VERIFIED
+IBM contacted:   False
+KMS contacted:   False
+Hardware action: None
+```
+
+## Feedback questions
+
+Please report:
+
+1. How long did installation take?
+2. How long until the first verified chain?
+3. Where did you become confused?
+4. Which claim felt least credible?
+5. Could you explain the Evidence Graph in your own words?
+6. Could you explain the local trust boundary?
+7. What existing tool did QuantumD remind you of?
+8. What real workflow would you test next?
+9. What evidence would an auditor or reviewer need?
+10. Would you continue evaluating QuantumD? Why or why not?
+
+## What not to share
+
+Do not include:
+
+- live credentials
+- private keys
+- cloud account identifiers
+- IBM tokens
+- confidential workloads
+- sensitive evidence
+- regulated or classified information