@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Something in HyperDX is broken or behaving unexpectedly
+title: ''
+labels: bug
+---
+
+**What happened?**
+
+<!-- What you saw, and what you expected instead. -->
+
+**Steps to reproduce**
+
+1.
+2.
+3.
+
+**How are you running HyperDX?**
+
+<!--
+The all-in-one Docker image, Docker Compose, Helm, ClickHouse Cloud, or a local
+dev stack — and which version or image tag. If you brought your own ClickHouse,
+say which version.
+-->
+
+**Where does it show up?**
+
+<!--
+The UI (which page, and which browser), the API, the OpenTelemetry collector, or
+the CLI. A screenshot or a short video helps a lot for UI bugs.
+-->
+
+**Logs**
+
+<!--
+Anything relevant from the browser console, the API container, or the collector.
+Please redact API keys and connection strings.
+-->
@@ -0,0 +1,32 @@
+---
+name: Introduce yourself
+about: Say hello and get vouched so you can open pull requests
+title: 'Hello, I am <your GitHub handle>'
+labels: introduction
+---
+
+Tell us a bit about yourself before your first pull request. A couple of
+sentences is plenty.
+
+**Who are you?**
+
+**What would you like to work on?**
+
+<!--
+A bug that's biting you, something from
+https://github.com/hyperdxio/hyperdx/labels/good%20first%20issue, or your own
+idea. Not sure? Say so and we'll help you pick.
+-->
+
+**Anything we can help with?**
+
+<!--
+Dev setup, which package a change belongs in, or a steer on the approach before
+you write code. Ask here, or on Discord: https://discord.gg/FErRRKU78j
+-->
+
+---
+
+A maintainer will reply and vouch for you, usually within a day or two. Then you
+can open pull requests as normal. CONTRIBUTING.md has the dev setup if you want
+to get started in the meantime.
@@ -0,0 +1,74 @@
+# Vouched contributors for hyperdxio/hyperdx.
+#
+# Pull requests from GitHub users who are not in this list are closed
+# automatically by .github/workflows/vouch.yml. See CONTRIBUTING.md for how to
+# get vouched — it is deliberately easy.
+#
+# Org members and anyone else with write access are allowed regardless of this
+# list. The team is listed anyway so the file reads as a complete roster.
+#
+# Maintainers manage the list by commenting on any issue or PR:
+#   /vouch @user [reason]
+#   /denounce @user [reason]
+#   /unvouch @user
+#
+# Syntax (https://github.com/mitchellh/vouch):
+#   - One handle per line, without @, sorted alphabetically, lower case.
+#     Vouch lower-cases handles when it rewrites the file, and matching is
+#     case-insensitive, so seeding lower-case keeps bot edits to one line.
+#   - Denounce with a leading minus: -username [reason]
+#   - Optional platform prefix: github:username
+#
+# Seeded from the hyperdxio org plus every external contributor with two or
+# more merged pull requests as of August 2026.
+#
+# copilot is listed because vouch only auto-exempts logins ending in "[bot]".
+# GitHub's Copilot coding agent has the login "Copilot", so without an entry
+# its PRs would be closed.
+adityapimpalkar
+alex-fedotyev
+alok87
+aryainguz
+brandon-pereira
+colehpage
+copilot
+dhable
+dkong16
+elizabetdev
+ernestii
+fallintoplace
+fleon
+gingerwizard
+gyancr7
+jaggederest
+jeyrathnam
+jordan-simonovski
+juliojimenez
+jwhitaker-gridcog
+karl-power
+knudtty
+kyle-mally-ch
+leticiawebb
+lyhuang
+mark-omarov
+martincholuj
+michael-anastasakis
+mikeshi42
+mkaesz
+motsc
+niladrix719
+peter-leonov-ch
+pulpdrew
+rawatprince
+sanjams2
+shuvamk
+spencertorres
+teeohhem
+tommyzli
+tsushanth
+tylerhannan
+vineethasok
+vinzee
+wrn14897
+zeynelkoca
+zlareb1
@@ -0,0 +1,210 @@
+name: Vouch
+
+# Trust gate for outside contributions, built on https://github.com/mitchellh/vouch.
+#
+# Anyone with write access (org members, collaborators) and bots are always
+# allowed. For everyone else this does two things:
+#
+#   1. Volume. Outside contributors get one open PR at a time, three once they
+#      are on the vouch list. Anything over that is closed, asking them to
+#      finish what they have open first. Drafts don't count.
+#   2. Authenticity. A PR from someone not in .github/VOUCHED.td stays open but
+#      gets a `needs-vouch` label and a comment asking them to introduce
+#      themselves.
+#
+# Authors explicitly denounced in the list are always closed. Issues are NOT
+# gated — opening one is how a new contributor introduces themselves.
+#
+# Maintainers manage the list from any issue or PR comment. The keyword has to
+# be first on the first line:
+#   /vouch @user [reason]     /denounce @user [reason]     /unvouch @user
+#
+# The list edit arrives as a pull request because `main` is protected and
+# GITHUB_TOKEN cannot bypass that. Note the bot's PR does not trigger `Main` —
+# GitHub does not start workflow runs for events raised by GITHUB_TOKEN — so it
+# needs a maintainer approval rather than a green CI run. This is the same path
+# the changesets release PR already takes.
+
+on:
+  pull_request_target:
+    types: [opened, reopened, ready_for_review]
+  issue_comment:
+    types: [created]
+
+permissions: {}
+
+jobs:
+  check-pr:
+    # Drafts are skipped and re-checked on ready_for_review, matching
+    # external-contributor-alerts.yml so the two agree on what counts.
+    if: >-
+      github.event_name == 'pull_request_target' &&
+      !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      # require-vouch: false means only denounced authors are blocked. Everyone
+      # unvouched comes back as `allowed`, which the next step picks up. No
+      # checkout needed — the action reads VOUCHED.td from the default branch
+      # over the API, and the denounce message is upstream's, not a file here.
+      - id: vouch
+        uses: mitchellh/vouch/action/check-pr@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
+        with:
+          pr-number: ${{ github.event.pull_request.number }}
+          require-vouch: false
+          auto-close: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # One step covers both checks so an author who is unvouched *and* over
+      # the PR limit gets a single comment rather than two.
+      - uses: actions/github-script@v9
+        env:
+          VOUCH_STATUS: ${{ steps.vouch.outputs.status }}
+        with:
+          script: |
+            const LABEL = 'needs-vouch';
+            const { owner, repo } = context.repo;
+            const pr = context.payload.pull_request;
+            const status = process.env.VOUCH_STATUS;
+
+            // skipped = bot. closed = denounced, already handled upstream.
+            if (status === 'skipped' || status === 'closed') return;
+
+            // `vouched` covers both collaborators and listed outsiders, so it
+            // cannot tell us who is internal. Same check as
+            // external-contributor-alerts.yml, including the slow path that
+            // catches org members with concealed membership.
+            let internal = ['OWNER', 'MEMBER', 'COLLABORATOR'].includes(pr.author_association);
+            if (!internal) {
+              try {
+                const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner, repo, username: pr.user.login,
+                });
+                const p = data.user?.permissions ?? {};
+                internal = !!(p.admin || p.maintain || p.push || p.triage);
+              } catch (e) {
+                if (e.status !== 404) throw e; // 404 = not a collaborator => external
+              }
+            }
+            if (internal) { core.info(`#${pr.number} is internal; nothing to do.`); return; }
+
+            // Volume cap, per Jaeger's model: contributing more earns more
+            // concurrent PRs. Being on the vouch list is the reputation signal.
+            const allowance = status === 'vouched' ? 3 : 1;
+            const open = await github.paginate(github.rest.pulls.list, {
+              owner, repo, state: 'open', per_page: 100,
+            });
+            // Drafts do not count — they are not asking for review yet, which
+            // is the queue we are actually protecting.
+            const theirs = open.filter(p =>
+              p.user?.login === pr.user.login && p.number !== pr.number && !p.draft);
+
+            if (theirs.length >= allowance) {
+              const list = theirs.map(p => `#${p.number}`).join(', ');
+              await github.rest.issues.createComment({
+                owner, repo, issue_number: pr.number,
+                body: [
+                  `Hi @${pr.user.login}, thanks for this.`,
+                  ``,
+                  `We limit outside contributors to ${allowance} open pull request${allowance === 1 ? '' : 's'} at a time, and you already have ${list} open. Reviewing several changes from one author at once is more than we can give proper attention to, and it tends to mean none of them land.`,
+                  ``,
+                  `I have closed this one to keep the queue honest — **your branch and your work are untouched**. Once ${theirs.length === 1 ? 'that PR' : 'one of those'} is merged or closed, reopen this and it will go through.`,
+                ].join('\n'),
+              });
+              await github.rest.pulls.update({ owner, repo, pull_number: pr.number, state: 'closed' });
+              core.info(`Closed #${pr.number}: ${theirs.length} already open, allowance ${allowance}.`);
+              return;
+            }
+
+            if (status !== 'allowed') return; // vouched and within the limit
+
+            // The label doubles as the "already asked" marker so a reopen or a
+            // ready_for_review doesn't post the same comment a second time.
+            if (pr.labels?.some(l => l.name === LABEL)) {
+              core.info(`#${pr.number} already labelled; not commenting again.`);
+              return;
+            }
+
+            try {
+              await github.rest.issues.createLabel({
+                owner, repo, name: LABEL, color: 'FBCA04',
+                description: 'Author needs a maintainer to vouch for them',
+              });
+            } catch (e) {
+              if (e.status !== 422) throw e; // 422 = already exists
+            }
+            await github.rest.issues.addLabels({
+              owner, repo, issue_number: pr.number, labels: [LABEL],
+            });
+
+            const body = [
+              `Hi @${pr.user.login}, thanks for the pull request!`,
+              ``,
+              `Before we review code from a first-time contributor we ask that a maintainer vouches for you, and you're not on our list yet. **This PR stays open** — it just isn't in the review queue until someone vouches.`,
+              ``,
+              `To get vouched, open an issue saying hello and what you're working on:`,
+              ``,
+              `https://github.com/${owner}/${repo}/issues/new?template=introduce-yourself.md`,
+              ``,
+              `A maintainer will usually reply within a day or two, and then this PR gets picked up as normal. More detail in [our contributing guide](https://github.com/${owner}/${repo}/blob/${pr.base.repo.default_branch}/CONTRIBUTING.md#getting-vouched).`,
+            ].join('\n');
+            await github.rest.issues.createComment({
+              owner, repo, issue_number: pr.number, body,
+            });
+            core.info(`Labelled and commented on #${pr.number}.`);
+
+  manage:
+    # Role-gated before the runner starts. The action re-checks the commenter's
+    # permission authoritatively; this only stops anyone on the internet from
+    # spinning up a write-token runner by typing /vouch. `contains` rather than
+    # `startsWith` so a leading space doesn't silently drop a real command.
+    if: >-
+      github.event_name == 'issue_comment' &&
+      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'),
+      github.event.comment.author_association) &&
+      (contains(github.event.comment.body, '/vouch') ||
+       contains(github.event.comment.body, '/unvouch') ||
+       contains(github.event.comment.body, '/denounce'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # Keyed per comment. A shared group would let a newly queued run cancel a
+    # pending one, silently dropping a vouch; each run cuts its own branch, so
+    # there is nothing to serialise.
+    concurrency:
+      group: vouch-manage-${{ github.event.comment.id }}
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: mitchellh/vouch/action/manage-by-issue@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
+        with:
+          issue-id: ${{ github.event.issue.number }}
+          comment-id: ${{ github.event.comment.id }}
+          vouch-keyword: /vouch
+          denounce-keyword: /denounce
+          unvouch-keyword: /unvouch
+          pull-request: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # The action is silent on every failure path — no comment, no reaction —
+      # and issue_comment runs are not surfaced on the issue timeline, so a
+      # maintainer would otherwise assume a failed /vouch worked.
+      - if: failure()
+        uses: actions/github-script@v9
+        with:
+          script: |
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: context.payload.issue.number,
+              body: `The vouch command failed. [See the run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}) — the list was not changed.`,
+            });