build: adopt Node 24 and begin post-release quality frontier

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,27 @@
+name: Bug report
+description: Report a reproducible problem in the maintained Authentext skill surface.
+title: '[Bug] '
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: Do not report security vulnerabilities here; use private vulnerability reporting.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What happened, and what did you expect?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Include the smallest safe input, command, and revision that reproduce the issue.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence
+      description: Include relevant validation output without secrets or sensitive text.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/edithatogo/authentext/security/advisories/new
+    about: Use private vulnerability reporting instead of a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,24 @@
+name: Feature request
+description: Propose an evidence-based improvement to the maintained skill contract.
+title: '[Feature] '
+labels: [enhancement]
+body:
+  - type: textarea
+    id: need
+    attributes:
+      label: User need
+      description: What concrete task or failure mode should this address?
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Proposed outcome
+      description: Describe observable behavior, not only an implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence and compatibility
+      description: Link examples or standards and note portable versus host-specific impact.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,16 @@
+## Outcome
+
+<!-- What changes for users or maintainers? -->
+
+## Evidence
+
+<!-- List relevant local commands and hosted checks. -->
+
+- [ ] Generated outputs are synchronized where applicable.
+- [ ] Validation, lint, tests, and audit appropriate to this change pass.
+- [ ] Technical literals, URLs, paths, identifiers, and code remain intact.
+- [ ] No release, publication, credential, or external-service action is implied.
+
+## Scope
+
+<!-- Link issues/Conductor phases and record explicit exclusions or gates. -->

.github/actions/setup-maintainer-env/action.yml

@@ -5,7 +5,7 @@ inputs:
   node-version:
     description: Node.js version to install.
     required: false
-    default: '20'
+    default: '24'
   python-version:
     description: Optional Python version to install.
     required: false

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Set up shared maintainer toolchain
         uses: ./.github/actions/setup-maintainer-env
         with:
-          node-version: '20'
+          node-version: '24'
           install-vale: 'true'
           npm-ci: 'true'
 
@@ -33,5 +33,15 @@ jobs:
       - name: Run Node tests
         run: npm test
 
+      - name: Generate Node coverage evidence
+        run: npm run test:coverage
+
+      - name: Upload coverage evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: node-coverage
+          path: coverage/
+          if-no-files-found: error
+
       - name: Verify sync outputs
         run: npm run check:sync

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Set up shared maintainer toolchain
         uses: ./.github/actions/setup-maintainer-env
         with:
-          node-version: '20'
+          node-version: '24'
           install-vale: 'true'
           npm-ci: 'true'
 

.github/workflows/self-improvement.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Set up shared maintainer toolchain
         uses: ./.github/actions/setup-maintainer-env
         with:
-          node-version: '20'
+          node-version: '24'
           install-vale: 'false'
           npm-ci: 'true'
 

.github/workflows/skill-distribution.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Set up Node
         uses: ./.github/actions/setup-maintainer-env
         with:
-          node-version: '20'
+          node-version: '24'
           install-vale: 'false'
           npm-ci: 'true'
 
@@ -102,7 +102,7 @@ jobs:
       - name: Setup Node
         uses: ./.github/actions/setup-maintainer-env
         with:
-          node-version: '20'
+          node-version: '24'
           install-vale: 'true'
           npm-ci: 'true'
 

.gitignore

@@ -9,6 +9,7 @@ htmlcov/
 
 # Node / JS
 node_modules/
+coverage/
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*

CONTRIBUTING.md

@@ -1,21 +1,36 @@
 # Contributing to Authentext
 
-Thanks for contributing! Please run local validation before opening a PR to reduce CI noise.
+Authentext is an Agent Skills source repository. Changes should stay within the
+maintained surface described in `AGENTS.md`; `experiments/` and archived
+Conductor tracks are not supported runtime targets.
 
-Recommended steps:
+## Development baseline
+
+Use Node.js 24 or newer, then install the locked dependencies:
 
 ```bash
-# Ensure build outputs are up to date
-npm install
-npm run sync
+npm ci
+```
 
-# Run skill validation (Skillshare dry-run + optional AIX validation)
-./scripts/validate-skill.sh
+Before opening a pull request, run:
+
+```bash
+npm run sync
+npm run validate
+npm run validate:hosts
+npm run lint:all
+npm test
+npm run test:coverage
+npm audit --audit-level=moderate
 ```
 
-If CI fails on the skill distribution job, inspect the job logs and run the same commands locally. The job may fail due to:
+Generated `SKILL.md`, `SKILL_PROFESSIONAL.md`, references, and root manifests
+must be produced with `npm run sync`, not edited independently of their canonical
+`src/` fragments.
 
-- A new `SKILL.md` formatting issue
-- Tooling changes in Skillshare/AIX
+## Pull requests
 
-If you need help, open an issue referencing the failing workflow and include the workflow logs.
+Keep changes focused, explain the user-facing or maintenance outcome, and attach
+the commands or hosted runs that support the claim. Automated checks and
+self-review are the merge gates for this solo-maintainer repository; no second
+reviewer, team assignment, or CODEOWNERS approval is required.

SECURITY.md

@@ -1,78 +1,25 @@
 # Security Policy
 
-## Reporting a Vulnerability
+## Supported versions
 
-We take the security of Authentext seriously. If you believe you've found a security vulnerability, please follow these guidelines:
+Security fixes target the latest tagged release and the current `main` branch.
+Older releases are not maintained unless a notice says otherwise.
 
-### How to Report
+## Reporting a vulnerability
 
-**Preferred Method:** Use GitHub's private vulnerability reporting feature:
+Do not disclose a suspected vulnerability in a public issue. Use GitHub's
+[private vulnerability report](https://github.com/edithatogo/authentext/security/advisories/new)
+with reproduction steps, affected versions or revisions, likely impact, and any
+suggested mitigation.
 
-1. Go to the [Security tab](https://github.com/edithatogo/authentext-next/security)
-2. Click "Report a vulnerability"
-3. Provide details about the vulnerability
+Reports are acknowledged as maintainer availability permits. Response and
+resolution times depend on validated severity and are not guaranteed service
+levels. Coordinated disclosure and responsible research are welcome; do not
+access other people's data, degrade services, or test outside systems you own or
+are authorized to assess.
 
-**Alternative Method:** If you cannot use GitHub's feature, you may create an issue with the `[security]` label prefix, but note that this will be publicly visible.
+## Scope
 
-### What to Include
-
-Please provide as much information as possible:
-
-- Description of the vulnerability
-- Steps to reproduce
-- Affected versions
-- Potential impact
-- Any suggested fixes (optional)
-
-### Response Timeline
-
-- **Initial Response:** Within 48 hours
-- **Status Update:** Within 5 business days
-- **Resolution Target:** Depends on severity (see below)
-
-### Severity Levels
-
-| Severity | Response Time | Resolution Target |
-| :--- | :--- | :--- |
-| Critical | 24 hours | 7 days |
-| High | 48 hours | 14 days |
-| Medium | 5 days | 30 days |
-| Low | 10 days | Next release |
-
-### What to Expect
-
-1. **Acknowledgment:** We'll confirm receipt of your report within 48 hours
-2. **Assessment:** Our team will evaluate the vulnerability and determine severity
-3. **Communication:** We'll keep you informed of our progress
-4. **Resolution:** Once fixed, we'll notify you and optionally credit you (with your permission)
-
-### Supported Versions
-
-| Version | Supported |
-|---------|-----------|
-| 2.3.x   | ✅ Yes    |
-| 2.2.x   | ✅ Yes    |
-| < 2.2   | ❌ No     |
-
-### Security Best Practices for Users
-
-While we work to keep Authentext secure, please also follow these best practices:
-
-1. **Keep Updated:** Always use the latest version
-2. **Review Permissions:** Only grant necessary tool access
-3. **Validate Input:** Be cautious with untrusted text input
-4. **Report Issues:** Don't hesitate to report potential vulnerabilities
-
-### Security Research
-
-We welcome responsible security research. If you're conducting security research on Authentext:
-
-- Please coordinate with us first
-- Avoid testing on production systems
-- Respect user privacy and data
-
----
-
-**Last Updated:** 2026-03-03
-
-**Contact:** For security questions, please use the vulnerability reporting system above.
+The supported contract is the maintained repository surface described in
+`AGENTS.md`. Archived Conductor history, `experiments/`, third-party clients, and
+downstream copies are outside the supported security boundary.