docs: establish the IPI open-source foundation

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,84 @@
+name: Bug report
+description: Report a reproducible defect in an IPI component
+title: "bug: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for helping improve IPI. Search existing reports first.
+        Do not report vulnerabilities here; use the private Security process.
+
+  - type: input
+    id: component
+    attributes:
+      label: Component
+      description: Repository, package, application, module, or endpoint
+      placeholder: ipicoin/repository — component
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Release, commit SHA, build identifier, or network identity
+      placeholder: Commit SHA or exact version
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What should have happened?
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What happened instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Minimal reproduction
+      description: Exact steps, commands, inputs, and configuration with secrets removed
+      placeholder: |
+        1. Start from...
+        2. Run...
+        3. Observe...
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Operating system, architecture, runtime, dependencies, and relevant network configuration
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Logs and evidence
+      description: Paste the smallest useful output after removing secrets and personal data
+      render: shell
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Submission checks
+      options:
+        - label: I searched existing issues and Discussions.
+          required: true
+        - label: This report contains no secret, private key, seed phrase, or personal data.
+          required: true
+        - label: This is not a security vulnerability.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,14 @@
+blank_issues_enabled: false
+
+contact_links:
+  - name: Questions and design discussions
+    url: https://github.com/orgs/ipicoin/discussions
+    about: Ask for help or discuss an idea before opening an implementation issue.
+
+  - name: Report a security vulnerability
+    url: https://github.com/ipicoin/.github/security/advisories/new
+    about: Send suspected vulnerabilities privately. Do not open a public issue.
+
+  - name: Read the IPI proposal process
+    url: https://github.com/ipicoin/.github/tree/main/ipi
+    about: Use an IPI Improvement Proposal for protocol, compatibility, trust, or governance changes.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,68 @@
+name: Feature request
+description: Propose a bounded improvement grounded in a concrete problem
+title: "feat: "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Describe the problem before the solution. Protocol, compatibility,
+        governance, or cross-repository changes may require an IPI proposal.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Who is affected, what cannot be done, and what evidence shows the need?
+    validations:
+      required: true
+
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Define observable success without prescribing unnecessary implementation details
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed approach
+      description: Describe a bounded approach, public interfaces, and relevant constraints
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives
+      description: Include existing workarounds and the option of making no change
+    validations:
+      required: true
+
+  - type: textarea
+    id: independence
+    attributes:
+      label: Independence, security, and operational impact
+      description: Does this add a coordinator, key holder, provider, oracle, service, or other required dependency?
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: contribution
+    attributes:
+      label: Contribution
+      options:
+        - label: I can help specify this change.
+        - label: I can help implement or test this change.
+        - label: I can help document this change.
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Submission checks
+      options:
+        - label: I searched existing issues, Discussions, and IPI proposals.
+          required: true
+        - label: I described a problem and a verifiable outcome.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,46 @@
+## Summary
+
+Describe the problem and the outcome of this change.
+
+## Why this belongs in IPI
+
+Explain the user, operator, protocol, or contributor need. Link the issue,
+Discussion, or IPI proposal.
+
+Closes:
+
+## Change type
+
+- [ ] Bug fix
+- [ ] Feature
+- [ ] Documentation
+- [ ] Refactor or maintenance
+- [ ] Security hardening with no embargoed details
+- [ ] IPI proposal or implementation
+- [ ] Breaking or migration-requiring change
+
+## Verification
+
+List the exact checks, tests, environments, and results. Attach reproducible
+evidence for performance or independence claims.
+
+## Compatibility and operations
+
+Describe API, consensus, data, dependency, deployment, upgrade, rollback, and
+operator effects. Write “none” only after considering each area.
+
+## Security and privacy
+
+Identify changed trust boundaries, privileged roles, keys, data exposure, or
+failure modes. Do not disclose an unpatched vulnerability here.
+
+## Checklist
+
+- [ ] I kept the change focused and reviewed the complete diff.
+- [ ] Tests cover the behavior or I explained why no test applies.
+- [ ] Documentation and migration guidance are updated.
+- [ ] No secret, seed phrase, private key, personal data, or private endpoint is included.
+- [ ] Third-party licenses, notices, and upstream attribution are preserved.
+- [ ] Claims are supported by a reproducible method and evidence.
+- [ ] A required IPI proposal is linked, or this change does not require one.
+- [ ] I read the Code of Conduct and contributor guidance.

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    labels:
+      - dependencies
+      - github-actions
+    open-pull-requests-limit: 5

.github/workflows/blank.yml

@@ -1,36 +1,26 @@
-# This is a basic workflow to help you get started with Actions
+name: Community standards
 
-name: CI
-
-# Controls when the workflow will run
 on:
-  # Triggers the workflow on push or pull request events but only for the "main" branch
-  push:
-    branches: [ "main" ]
   pull_request:
-    branches: [ "main" ]
+  push:
+    branches:
+      - main
 
-  # Allows you to run this workflow manually from the Actions tab
-  workflow_dispatch:
+permissions:
+  contents: read
+
+concurrency:
+  group: community-standards-${{ github.ref }}
+  cancel-in-progress: true
 
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
-  # This workflow contains a single job called "build"
-  build:
-    # The type of runner that the job will run on
+  validate:
+    name: Community standards
     runs-on: ubuntu-latest
-
-    # Steps represent a sequence of tasks that will be executed as part of the job
+    timeout-minutes: 5
     steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v4
-
-      # Runs a single command using the runners shell
-      - name: Run a one-line script
-        run: echo Hello, world!
+      - name: Check out the repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      # Runs a set of commands using the runners shell
-      - name: Run a multi-line script
-        run: |
-          echo Add other actions to build,
-          echo test, and deploy your project.
+      - name: Validate community and proposal files
+        run: python3 scripts/check_community.py

AGENTS.md

@@ -1 +1,103 @@
-# SELF-IMPROOVE AND SPREAD YOUR BEST KNOWN CONTENTS OF THIS GUIDEFILES
+# Working in the IPI GitHub organization
+
+These instructions apply to automated coding agents and human contributors
+working in this repository.
+
+## Mission
+
+Help IPI become protocol infrastructure that unrelated people can operate,
+verify, reproduce, and extend. Prefer working evidence over slogans. Keep the
+current distinction between implemented, experimental, planned, and unknown
+behavior visible.
+
+Read before changing the repository:
+
+1. [README.md](README.md)
+2. [CONTRIBUTING.md](CONTRIBUTING.md)
+3. [GOVERNANCE.md](GOVERNANCE.md)
+4. [SECURITY.md](SECURITY.md)
+5. [LICENSING.md](LICENSING.md)
+6. [IPI-0000](ipi/IPI-0000.md) and, for independence claims,
+   [IPI-0001](ipi/IPI-0001.md)
+
+More specific AGENTS.md files override this file within their directories.
+
+## Non-negotiable safeguards
+
+- Never publish a secret, seed phrase, private key, access token, recovery code,
+  private endpoint, customer record, or unrelated personal data.
+- Never push directly to a protected default branch. Use a focused feature
+  branch and a pull request.
+- Do not delete repositories, branches, tags, releases, or history unless the
+  user explicitly authorizes that exact destructive action.
+- Do not rewrite public history to hide a leaked secret; rotate the secret first
+  and follow the private security process.
+- Do not relicense or remove third-party attribution without documented rights.
+- Do not describe a component as production-ready, independent, audited,
+  decentralized, or performance-leading without reproducible evidence.
+- Preserve unrelated user changes in a dirty working tree.
+
+## Bringing code into an IPI repository
+
+Before publishing code:
+
+1. Identify the correct destination repository and read its local instructions.
+2. Inspect Git status, branches, remotes, commit history, and existing user
+   changes.
+3. Inventory licenses, upstream origins, generated files, large binaries, and
+   contributor notices.
+4. Scan the complete candidate tree and history for credentials and private
+   information without printing discovered secret values.
+5. Confirm that the destination license is explicit and compatible. If it is
+   missing or uncertain, stop before publishing and open a licensing decision.
+6. Run the repository's tests, linters, builds, and security checks.
+7. Create a narrowly named branch from the current default branch.
+8. Make small attributable commits with clear subjects.
+9. Push only the feature branch and open a pull request using the template.
+10. Link the relevant issue, Discussion, or IPI proposal and include exact test
+    results, compatibility effects, known limitations, and rollback notes.
+
+If the source is an existing Git repository, preserve its useful history and
+upstream relationship instead of copying an unattributed snapshot. Never merge
+unrelated histories merely to make a push succeed.
+
+## Change classification
+
+Use an ordinary pull request for local fixes, tests, documentation, and
+implementation of an already accepted design. Start or update an IPI
+Improvement Proposal for consensus, cryptography, accounts, public interfaces,
+compatibility, governance, trust assumptions, or coordinated changes across
+repositories.
+
+Security-sensitive work follows [SECURITY.md](SECURITY.md) and may require a
+private fork or security advisory instead of a public branch.
+
+## Required validation
+
+For this repository, run:
+
+~~~shell
+python3 scripts/check_community.py
+git diff --check
+~~~
+
+For another repository, run every check documented there. Do not claim a check
+passed if it was skipped, unavailable, flaky, or run against a different
+revision.
+
+## Pull request handoff
+
+The final handoff must state:
+
+- the branch and commit;
+- the files and behavior changed;
+- the exact validation performed and its result;
+- security, privacy, license, migration, and operational effects;
+- anything not verified; and
+- the next safe action required from a maintainer.
+
+Do not merge your own material change as its only reviewer unless an
+organization owner has explicitly authorized a documented bootstrap change and
+the branch rules allow it. If the project does not yet have an independent
+reviewer, keep technical proposals in Draft, state the limitation plainly, and
+record the bootstrap authorization in the pull request.