Modernize AgentFence repository presentation and documentation

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,79 @@
+name: Bug report
+description: Report a reproducible AgentFence problem without sharing private configuration.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. Use synthetic inputs and do not paste credentials, private paths, raw reports, or unfixed security details. Report vulnerabilities through GitHub private vulnerability reporting.
+
+  - type: input
+    id: agentfence-version
+    attributes:
+      label: AgentFence version
+      placeholder: 0.2.0
+    validations:
+      required: true
+
+  - type: input
+    id: node-version
+    attributes:
+      label: Node.js version
+      description: Output of `node --version`.
+      placeholder: v24.21.0
+    validations:
+      required: true
+
+  - type: dropdown
+    id: operating-system
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: command
+    attributes:
+      label: Command
+      description: Provide the exact AgentFence command after removing private paths or values.
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: Include safe error codes or sanitized output only.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Synthetic reproduction
+      description: Provide the smallest synthetic configuration that reproduces the problem.
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Data-safety confirmation
+      options:
+        - label: I removed credentials, private configuration, private paths, raw reports, and other sensitive data.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/Adulph3/AgentFence/security/advisories/new
+    about: Privately report unintended execution, data exposure, scope escape, or another security-sensitive defect.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,45 @@
+name: Feature request
+description: Propose a focused improvement to AgentFence's static audit scope or developer experience.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Describe the observable configuration problem first. AgentFence will not add execution of scanned content, live MCP access, telemetry, or remote analysis.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What review or automation problem is difficult today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Describe the desired static behavior, including relevant configuration fields or output.
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Compatibility evidence
+      description: Link to official vendor documentation when proposing a new adapter or field interpretation.
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Scope confirmation
+      options:
+        - label: This request can preserve no-execution, zero-runtime-network, read-only-default, deterministic, and safe-output behavior.
+          required: true

.github/pull_request_template.md

@@ -0,0 +1,28 @@
+## Summary
+
+Describe the problem and the smallest change that solves it.
+
+## Security and compatibility impact
+
+- Does this change discovery, parsing, adapters, rules, scoring, schemas, reports, dependencies, or public APIs?
+- Which documented vendor behavior or project invariant supports the change?
+- What limitations remain?
+
+## Validation
+
+- [ ] `npm run typecheck`
+- [ ] `npm run lint`
+- [ ] `npm test`
+- [ ] `npm run test:coverage` when security/scoring behavior changes
+- [ ] `npm run build`
+- [ ] `npm pack --dry-run --ignore-scripts` when package contents change
+- [ ] Synthetic positive, negative, adversarial, and redaction cases were added where applicable
+
+## Safety checklist
+
+- [ ] Scanned content is never executed or imported
+- [ ] `scan` and `doctor` initiate no application network activity
+- [ ] No telemetry, backend, remote AI, or live MCP access was added
+- [ ] Default scanning remains read-only and bounded
+- [ ] Output contains no raw secrets, commands, URLs, parser errors, names, or paths
+- [ ] This PR contains no credentials, private configuration, raw private reports, or machine-specific data

CONTRIBUTING.md

@@ -1,12 +1,65 @@
 # Contributing
 
-Use only synthetic offline fixtures. Review every dependency and preserve the zero-network/no-execution and safe-output invariants. Run `npm ci --ignore-scripts`, `npm run typecheck`, `npm run lint`, `npm test`, `npm run build`, and package checks. Rule changes require positive, negative, adversarial, redaction, and deterministic tests.
-
-Do not add runtime rule loading, plugins, vendor SDKs, remote fixtures, real
-credentials, or input-controlled imports. Keep raw parsed data inside parsing and
-analysis boundaries; public DTOs and test assertions must use safe projections.
-For a rule change, update the compiled registry metadata, its fixed remediation and
-bundled HTTPS reference, then add executable positive, negative, adversarial and
-redaction coverage. Review dependency purpose, version, license, lifecycle scripts
-and transitive impact before changing the lockfile. Do not weaken a test solely to
-make a gate pass.
+Thanks for helping improve AgentFence. Keep changes focused, reproducible, and grounded in observable configuration behavior.
+
+## Before you start
+
+- Read `AGENTS.md`, `AGENTFENCE_MASTER_PLAN.md`, and `docs/PROGRESS.md`.
+- Use Node.js 22 or 24; Node.js 24 is recommended.
+- Use only synthetic offline fixtures. Never commit credentials, personal configuration, raw private reports, or machine-specific paths.
+- For a suspected vulnerability, use [private vulnerability reporting](https://github.com/Adulph3/AgentFence/security/advisories/new) instead of a public issue.
+
+## Development setup
+
+```bash
+git clone https://github.com/Adulph3/AgentFence.git
+cd AgentFence
+npm ci --ignore-scripts
+```
+
+Run the quality gates before opening a pull request:
+
+```bash
+npm run typecheck
+npm run lint
+npm test
+npm run test:coverage
+npm run build
+npm pack --dry-run --ignore-scripts
+```
+
+Do not weaken a test to make a gate pass. Fix the defect or document a genuine platform/evidence limitation.
+
+## Project invariants
+
+Every change must preserve:
+
+- no execution of scanned instructions, hooks, commands, packages, or configuration;
+- no application-initiated runtime network access, telemetry, backend, or remote AI;
+- read-only scanning unless the operator explicitly requests a new report file;
+- bounded acquisition and parsing;
+- deterministic analysis for identical complete inputs; and
+- safe output that does not reproduce raw secrets, commands, URLs, parser errors, names, or paths.
+
+Do not add runtime rule loading, plugins, vendor SDKs, remote fixtures, input-controlled imports, or a redaction bypass.
+
+## Rule and adapter changes
+
+A detector change needs positive, negative, adversarial, redaction, and deterministic coverage. Update the compiled registry metadata, fixed remediation, bundled HTTPS reference, and detector documentation together.
+
+An adapter change must be based on documented vendor semantics and include bounded compatibility fixtures. Unknown behavior should remain an explicit coverage limitation rather than a guessed effective configuration.
+
+## Dependency changes
+
+Explain the dependency's purpose and review its exact version, license, lifecycle scripts, transitive graph, runtime capabilities, and effect on the no-network/no-execution boundary. Keep the lockfile and `THIRD_PARTY_NOTICES.md` consistent.
+
+## Pull requests
+
+Keep pull requests small enough to review. Describe:
+
+- the problem and intended behavior;
+- security-boundary or schema impact;
+- tests and platforms exercised; and
+- remaining limitations or follow-up work.
+
+Do not paste secret-bearing output into the PR. A maintainer may request additional platform or adversarial coverage for security-sensitive changes.