Initial Coworker app scaffold

docs/agent-handoff.md

@@ -0,0 +1,17 @@
+# Agent Handoff
+
+## Current State
+
+Coworker was scaffolded from an empty repository as an Electron + React + TypeScript app with a shared core package.
+
+## Next Steps
+
+- Push the scaffold to Gitea.
+- Let Gitea Actions install dependencies, run checks, build the app, and produce the first Windows NSIS installer.
+- If the installer workflow fails, inspect runner logs and fix the workflow or dependency issue in scope.
+
+## Known Risks
+
+- The first installer is unsigned.
+- MSI packaging is intentionally deferred until the NSIS `.exe` pipeline is stable.
+- Full model downloading/serving is deferred; v1 connects to Ollama, LM Studio, and custom OpenAI-compatible endpoints.

docs/release-checklist.md

@@ -0,0 +1,10 @@
+# Release Checklist
+
+- [ ] `CHANGELOG.md` contains the release entry.
+- [ ] Gitea build workflow passed.
+- [ ] Release dry-run workflow passed.
+- [ ] `release/Coworker-Setup-<version>.exe` exists.
+- [ ] `release/SHA256SUMS.txt` exists and matches the installer.
+- [ ] Installer does not include repository maintenance files such as `.codex/`, `.gitea/`, or `docs/agent-handoff.md`.
+- [ ] Release notes mention that the first installer is unsigned.
+- [ ] Tag uses `v<version>`.

docs/release-notes.md

@@ -0,0 +1,17 @@
+# Release Notes
+
+## Coworker 0.1.0
+
+Initial Windows-first local AI coding app scaffold.
+
+Highlights:
+
+- Electron desktop app with Codex-style workspace shell.
+- Local model provider settings for Ollama, LM Studio, and custom endpoints.
+- Brain memory and skills.
+- Optional paired Web/PWA access for iPhone and iPad.
+- Gitea Actions pipeline for Windows setup `.exe`.
+
+Known limitation:
+
+- Installer is unsigned until code signing is configured.

docs/security-review.md

@@ -0,0 +1,19 @@
+# Security Review
+
+## Current State
+
+Coworker starts from a local-first security model:
+
+- Web/PWA access is opt-in.
+- Pairing tokens are hashed before storage.
+- Workspace file access is path-confined.
+- Model endpoints are user-configured local or OpenAI-compatible URLs.
+
+## Required Checks Before Release
+
+- Verify web access is disabled by default.
+- Verify unauthenticated web API requests return `401`.
+- Verify paired device tokens are not stored in plaintext.
+- Verify workspace reads reject path traversal.
+- Verify build artifacts exclude local app data and repository maintenance files.
+- Run scheduled security scan in Gitea Actions.