Initial commit

files/AGENTS.md

@@ -0,0 +1,88 @@
+# Agent Instructions
+
+## Project
+
+PROJECT_NAME: PROJECT_DESCRIPTION
+
+## Repository Rules
+
+- Start by reading `manifest.json`, then the workflow file that matches the task: `new-repository.md` for fresh repos or `existing-project.md` for retrofit work.
+- Use the matching `profiles/*.md` file when the repository stack is detected. Profiles are guidance, not permission to ignore existing project conventions.
+- Conserve context tokens: search with `rg` or targeted file lists first, read only the files needed for the task, summarize large outputs instead of pasting them, and avoid loading generated folders, dependency folders, build outputs, or full logs unless they are directly relevant.
+- Follow the `manifest.json` copy map for source and target paths. Do not invent alternate locations unless the target repository already has an equivalent convention.
+- Prefer existing project patterns over new abstractions.
+- Keep changes scoped to the user's request.
+- Do not commit secrets, `.env` files, private keys, certificates, or tokens.
+- Do not rewrite history or run destructive git commands unless explicitly requested.
+- Do not create a release unless explicitly requested.
+- At the start of every user-requested task, briefly check the repository for upstream updates and apply them immediately with a safe fast-forward pull when the working tree is clean. If local changes exist, do not overwrite them; fetch or report the blocker before editing.
+- Check `git status --short` before editing and before finishing. Preserve unrelated user changes.
+- Replace all applicable placeholders. Remove non-applicable placeholder sections instead of leaving fake values.
+- Derive `REPOSITORY_OWNER` and `REPOSITORY_NAME` from the target repository remote or `GITHUB_REPOSITORY`. Never reuse the owner from this template repository.
+- If `GITEA_TOKEN` is available locally, use it only for read-only Gitea API checks such as private repository metadata, package-read visibility, and Actions run status. Never print, commit, or store the token.
+- When you find a real, actionable follow-up that is outside the current scope or can be worked on independently, create a tracker issue so humans or other agents can pick it up later or in parallel. Do not create issues for work you can safely finish in the current task. If no issue tracker is available, update `docs/agent-handoff.md` instead.
+- Keep issues scoped and actionable: include the observed problem, impact, affected files or commands, suggested next steps, and any verification already performed. Never include secrets, tokens, private data, or sensitive logs in public issues.
+- After pushing commits that trigger a Gitea workflow, poll the workflow run until it succeeds. If it fails or is cancelled, inspect the failing job/logs, fix the issue when in scope, push again, and repeat the workflow check loop. Fixing and pushing a workflow failure is not a stopping point.
+- When the project uses `blueprint.md` and `blueprint.json` for README generation, keep the rainbow `{{ template:section-line }}` divider between major README sections. Do not replace it with plain `---` unless the target renderer cannot display inline images.
+- If README blueprint files are changed, regenerate or update `README.md` in the same change and verify the generated output renders reasonably.
+- For releasable projects, add or preserve `.gitea/workflows/security-scan.yml` using `files/security-scan-gitea.yml` unless the repository already has equivalent scheduled security automation.
+- For active projects, add or preserve `.gitea/workflows/repo-cleanup.yml` using `files/repo-cleanup-gitea.yml` unless the repository already has equivalent cleanup checks.
+- Add or preserve `.gitea/workflows/dependency-check.yml`, `.gitea/workflows/release-dry-run.yml`, and `.gitea/workflows/template-compliance.yml` when the repository is active, releasable, or intended as a Codex-maintained project.
+- Repository cleanup automation must be non-destructive. Do not delete branches, packages, releases, or tracked files without explicit user approval.
+- Dependency, compliance, and release dry-run automation must report findings only. Do not auto-update dependencies, auto-open PRs, create tags, publish packages, or create releases without explicit user approval.
+- Gitea Actions artifacts are not Gitea Package Registry packages. If the user expects a package/download entry, add an explicit registry publish step and verify the package URL after the workflow succeeds.
+- Keep Codex kit files in source control when they are useful for agents, but exclude them from user-facing release, package, installer, archive, and GitHub/Gitea upload artifacts unless the user explicitly asks to ship repository-maintenance files.
+
+## Commands
+
+Use these commands when available:
+
+```bash
+LINT_COMMAND
+TEST_COMMAND
+BUILD_COMMAND
+AUDIT_COMMAND
+```
+
+If a command is missing, inspect the project and document the closest safe alternative in `.codex/project.md`.
+
+Keep `.codex/project.md` and this `AGENTS.md` aligned when commands, artifact paths, or release rules change.
+
+## Artifacts
+
+Expected artifact output:
+
+```text
+ARTIFACT_OUTPUT_DIRECTORY
+```
+
+Expected artifact names:
+
+```text
+ARTIFACT_NAME
+```
+
+## Security Notes
+
+- Review `docs/security-review.md` before release work.
+- Fill `docs/security-review.md` with actual checked commands and results when performing release-readiness work.
+- Review scheduled security workflow failures before changing code. Treat matches as leads: they may be true positives, documentation examples, or test fixtures.
+- Review repository cleanup workflow failures as maintenance leads. Document intentional exceptions instead of blindly deleting files.
+- Review dependency and template compliance workflow failures as maintenance leads. Preserve project-specific conventions when they are documented.
+- Treat generated credentials and config files as sensitive.
+- Keep external network calls documented.
+- Prefer local processing for user data.
+- Keep CI publishing secrets in repository or organization secrets, not in tracked files. `REGISTRY_TOKEN` is the default package publishing secret name for the Gitea workflow template.
+- Use URL-safe package filenames when publishing to a registry. Do not put raw artifact names with spaces or punctuation directly into upload URLs.
+- Do not include Codex kit metadata such as `AGENTS.md`, `.codex/`, `blueprint.md`, `blueprint.json`, template workflow files, or agent handoff notes in downloadable release artifacts unless explicitly requested.
+- Ensure `.gitignore` covers local config, build outputs, logs, temporary files, and secret material for the detected stack.
+
+## Finish Checklist
+
+- `git diff --check` passes.
+- The cheapest reliable verification command has been run, or the reason it could not be run is documented.
+- README, changelog, security review, and release checklist are updated when the change touches release behavior.
+- `docs/agent-handoff.md` is updated when work is interrupted, risky, or spans multiple sessions.
+- Independent follow-up work has tracker issues, or `docs/agent-handoff.md` explains why issues could not be created.
+- Any pushed Gitea workflow has been polled to success or a concrete blocker has been reported.
+

files/CHANGELOG.md

@@ -0,0 +1,8 @@
+# Changelog
+
+All notable changes to this project are documented here.
+
+## Unreleased
+
+- Initial project setup.
+

files/CONTRIBUTING.md

@@ -0,0 +1,48 @@
+# Contributing
+
+## Working Rules
+
+- Keep changes scoped to the issue or user request.
+- Prefer existing project patterns.
+- Do not commit secrets, generated credentials, local `.env` files, or private keys.
+- Do not create releases unless explicitly requested.
+- Preserve unrelated user changes.
+- Create focused issues for real follow-up work that is outside the current change or can be worked on independently. Do not put secrets, tokens, private data, or sensitive logs in public issues.
+
+## Before Committing
+
+Run the cheapest reliable verification commands for this project:
+
+```bash
+LINT_COMMAND
+TEST_COMMAND
+BUILD_COMMAND
+```
+
+Also run:
+
+```bash
+git diff --check
+```
+
+If a command cannot run, document why in the final response or handoff notes.
+
+## Pull Requests
+
+Pull requests should include:
+
+- summary of changes,
+- verification performed,
+- known risks or skipped checks,
+- artifact/download notes when relevant.
+
+## Releases
+
+Before release work, update:
+
+```text
+CHANGELOG.md
+docs/release-checklist.md
+docs/security-review.md
+README.md
+```

files/SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+| --- | --- |
+| Latest | Yes |
+
+## Reporting A Vulnerability
+
+Please report security issues privately to the project owner.
+
+Do not include secrets, production data, or private credentials in public issues.
+
+## Project Security Principles
+
+- Keep secrets out of the repository.
+- Prefer local processing for user data.
+- Document external network calls.
+- Keep release artifacts reproducible through CI.
+- Run dependency audits before releases.
+

files/agent-handoff.md

@@ -0,0 +1,42 @@
+# Agent Handoff
+
+Use this file when a task spans multiple sessions, has unresolved follow-up work, or changes release behavior.
+
+Prefer focused tracker issues for independent follow-up work when an issue tracker is available. Use this handoff file when issues cannot be created, when the context is too sensitive for a public issue, or when a task needs a compact session summary.
+
+## Current State
+
+```text
+PENDING
+```
+
+## Changes Made
+
+- PENDING
+
+## Verification
+
+| Check | Result |
+| --- | --- |
+| `git diff --check` | PENDING |
+| `LINT_COMMAND` | PENDING |
+| `TEST_COMMAND` | PENDING |
+| `BUILD_COMMAND` | PENDING |
+
+## Open Questions
+
+- PENDING
+
+## Next Steps
+
+- PENDING
+
+## Follow-up Issues
+
+| Issue | Status |
+| --- | --- |
+| PENDING | PENDING |
+
+## Risks
+
+- PENDING

files/blueprint.json

@@ -0,0 +1,29 @@
+{
+  "ids": {
+    "github": "REPOSITORY_OWNER/REPOSITORY_NAME"
+  },
+  "badges": [
+    {
+      "alt": "Build",
+      "img": "https://img.shields.io/badge/build-Gitea%20Runner-2563eb",
+      "url": "https://git.wilkensxl.de/REPOSITORY_OWNER/REPOSITORY_NAME/actions"
+    },
+    {
+      "alt": "Version",
+      "img": "https://img.shields.io/badge/version-0.1.0-111827",
+      "url": "https://git.wilkensxl.de/REPOSITORY_OWNER/REPOSITORY_NAME/releases"
+    }
+  ],
+  "headingPrefix": {
+    "1": "",
+    "2": ""
+  },
+  "line": "rainbow",
+  "templates": [
+    {
+      "name": "section-line",
+      "template": "<p align=\"center\"><img src=\"https://raw.githubusercontent.com/andreasbm/readme/master/assets/lines/rainbow.png\" alt=\"-----------------------------------------------------\" width=\"100%\"></p>"
+    }
+  ],
+  "text": "PROJECT_DESCRIPTION"
+}

files/blueprint.md

@@ -0,0 +1,76 @@
+{{ template:title }}
+
+{{ template:badges }}
+
+{{ template:section-line }}
+{{ template:table-of-contents }}
+
+{{ template:section-line }}
+## Overview
+
+PROJECT_DESCRIPTION
+
+{{ template:section-line }}
+## Features
+
+| Area | Description |
+| --- | --- |
+| Core | Describe the main project capability |
+| Workflow | Describe the primary user or developer workflow |
+| Build | Describe how artifacts are produced |
+| Security | Describe the default security posture |
+
+{{ template:section-line }}
+## Installation
+
+```bash
+INSTALL_COMMAND
+```
+
+{{ template:section-line }}
+## Development
+
+```bash
+DEV_COMMAND
+LINT_COMMAND
+TEST_COMMAND
+BUILD_COMMAND
+```
+
+{{ template:section-line }}
+## Downloads
+
+| Variant | Download |
+| --- | --- |
+| Latest artifact | [Download latest](DOWNLOAD_URL) |
+
+Private repositories may require an active session or a token with package read access.
+
+{{ template:section-line }}
+## Security
+
+Security posture:
+
+| Area | State |
+| --- | --- |
+| Secrets | Secrets must not be committed |
+| Dependency audit | CI should run the project dependency audit |
+| User data | User data should stay local unless explicitly documented |
+| External services | Network calls should be documented |
+
+See `SECURITY.md` and `docs/security-review.md`.
+
+{{ template:section-line }}
+## Release
+
+Release readiness is tracked in `docs/release-checklist.md`.
+
+{{ template:section-line }}
+## Project Info
+
+| Field | Value |
+| --- | --- |
+| Author | `AUTHOR_NAME` |
+| Repository | `REPOSITORY_OWNER/REPOSITORY_NAME` |
+| Stack | `PROJECT_STACK` |
+| README workflow | Blueprint workflow based on `andreasbm/readme` |

files/build-gitea.yml

@@ -0,0 +1,111 @@
+name: Build
+
+on:
+  push:
+    branches:
+      - main
+      - master
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Replace this runtime setup block with the stack this project uses.
+      # Examples:
+      # - Node: actions/setup-node@v4
+      # - Python: actions/setup-python@v5
+      # - Go: actions/setup-go@v5
+      # - Rust: dtolnay/rust-toolchain@stable
+      - name: Setup runtime
+        run: echo "Configure PROJECT_STACK runtime here"
+
+      - name: Install dependencies
+        run: INSTALL_COMMAND
+
+      - name: Audit dependencies
+        run: AUDIT_COMMAND
+
+      - name: Lint
+        run: LINT_COMMAND
+
+      - name: Test
+        run: TEST_COMMAND
+
+      - name: Build
+        run: BUILD_COMMAND
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: PROJECT_NAME-artifacts
+          path: |
+            ARTIFACT_OUTPUT_DIRECTORY/**
+
+      - name: Publish latest package
+        if: ${{ env.REGISTRY_TOKEN != '' }}
+        shell: bash
+        run: |
+          app_version="PROJECT_VERSION"
+          package_version="${app_version}-${GITHUB_SHA::7}"
+          package_name="PACKAGE_NAME"
+          repository_owner="${GITHUB_REPOSITORY_OWNER:-${GITHUB_REPOSITORY%%/*}}"
+          if [ -z "${repository_owner}" ] || [ "${repository_owner}" = "${GITHUB_REPOSITORY}" ]; then
+            repository_owner="REPOSITORY_OWNER"
+          fi
+          gitea_server="${GITHUB_SERVER_URL:-https://git.wilkensxl.de}"
+          gitea_server="${gitea_server%/}"
+          package_dir="package-registry"
+          latest_url="${gitea_server}/api/packages/${repository_owner}/generic/${package_name}/latest"
+
+          mapfile -d '' artifacts < <(find ARTIFACT_OUTPUT_DIRECTORY -maxdepth 1 -type f -print0)
+          if [ "${#artifacts[@]}" -eq 0 ]; then
+            echo "No package artifacts found in ARTIFACT_OUTPUT_DIRECTORY"
+            exit 1
+          fi
+
+          rm -rf "${package_dir}"
+          mkdir -p "${package_dir}/versioned" "${package_dir}/latest"
+
+          for artifact in "${artifacts[@]}"; do
+            extension=""
+            base_name="$(basename "$artifact")"
+            stem="$base_name"
+            if [[ "$base_name" == *.* ]]; then
+              extension=".${base_name##*.}"
+              stem="${base_name%.*}"
+            fi
+            safe_stem="$(echo "$stem" | tr -cs 'A-Za-z0-9._-' '-' | sed 's/^-//; s/-$//')"
+            safe_name="${safe_stem}-${package_version}${extension}"
+            cp "$artifact" "${package_dir}/versioned/${safe_name}"
+
+            curl --fail-with-body \
+              --user "${repository_owner}:${REGISTRY_TOKEN}" \
+              --upload-file "${package_dir}/versioned/${safe_name}" \
+              "${gitea_server}/api/packages/${repository_owner}/generic/${package_name}/${package_version}/${safe_name}"
+          done
+
+          curl --silent --show-error --user "${repository_owner}:${REGISTRY_TOKEN}" --request DELETE "${latest_url}" || true
+
+          for artifact in "${artifacts[@]}"; do
+            extension=""
+            base_name="$(basename "$artifact")"
+            stem="$base_name"
+            if [[ "$base_name" == *.* ]]; then
+              extension=".${base_name##*.}"
+              stem="${base_name%.*}"
+            fi
+            safe_stem="$(echo "$stem" | tr -cs 'A-Za-z0-9._-' '-' | sed 's/^-//; s/-$//')"
+            safe_name="${safe_stem}-latest${extension}"
+            cp "$artifact" "${package_dir}/latest/${safe_name}"
+
+            curl --fail-with-body \
+              --user "${repository_owner}:${REGISTRY_TOKEN}" \
+              --upload-file "${package_dir}/latest/${safe_name}" \
+              "${latest_url}/${safe_name}"
+          done

files/dependency-check-gitea.yml

@@ -0,0 +1,114 @@
+name: Scheduled Dependency Check
+
+on:
+  schedule:
+    - cron: "29 3 * * 2"
+  workflow_dispatch:
+
+jobs:
+  dependency-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Detect project stack
+        id: detect
+        shell: bash
+        run: |
+          stacks=""
+
+          [ -f package.json ] && stacks="${stacks} node"
+          { [ -f pyproject.toml ] || [ -f requirements.txt ]; } && stacks="${stacks} python"
+          [ -f Cargo.toml ] && stacks="${stacks} rust"
+          [ -f go.mod ] && stacks="${stacks} go"
+          { [ -f Dockerfile ] || [ -f compose.yml ] || [ -f docker-compose.yml ]; } && stacks="${stacks} docker"
+
+          echo "stacks=${stacks:-generic}" >> "$GITHUB_OUTPUT"
+          echo "Detected stacks:${stacks:- generic}"
+
+      - name: Node dependency report
+        if: contains(steps.detect.outputs.stacks, 'node')
+        shell: bash
+        run: |
+          if [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; then
+            npm ci
+          else
+            npm install --package-lock-only --ignore-scripts
+          fi
+
+          echo "Security audit:"
+          npm audit --omit=dev --audit-level=high
+
+          echo
+          echo "Outdated dependencies:"
+          npm outdated || true
+
+      - name: Python dependency report
+        if: contains(steps.detect.outputs.stacks, 'python')
+        shell: bash
+        run: |
+          python -m pip install --upgrade pip pip-audit
+
+          echo "Security audit:"
+          if [ -f requirements.txt ]; then
+            pip-audit -r requirements.txt
+          else
+            pip-audit
+          fi
+
+          echo
+          echo "Outdated packages:"
+          python -m pip list --outdated || true
+
+      - name: Rust dependency report
+        if: contains(steps.detect.outputs.stacks, 'rust')
+        shell: bash
+        run: |
+          cargo install cargo-audit cargo-outdated --locked
+
+          echo "Security audit:"
+          cargo audit
+
+          echo
+          echo "Outdated crates:"
+          cargo outdated || true
+
+      - name: Go dependency report
+        if: contains(steps.detect.outputs.stacks, 'go')
+        shell: bash
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+
+          echo "Security audit:"
+          govulncheck ./...
+
+          echo
+          echo "Available dependency updates:"
+          go list -u -m all || true
+
+      - name: Docker base image report
+        if: contains(steps.detect.outputs.stacks, 'docker')
+        shell: bash
+        run: |
+          echo "Docker image references:"
+          grep -RInE --exclude-dir=.git --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=build '^\s*FROM\s+' Dockerfile* . 2>/dev/null || true
+
+          echo
+          echo "Review Docker base images manually for pinned versions, official sources, and current security status."
+
+      - name: Dependency guidance
+        shell: bash
+        run: |
+          cat <<'EOF'
+          Dependency check completed.
+
+          This workflow reports vulnerabilities and available updates. It does
+          not modify dependency files, create pull requests, or publish packages.
+
+          Recommended manual follow-up:
+          - update dependencies in a focused branch,
+          - run the project test/build commands,
+          - review lockfile diffs carefully,
+          - document intentionally held versions.
+          EOF

files/gitignore.template

@@ -0,0 +1,46 @@
+# Dependencies
+node_modules/
+vendor/
+.venv/
+venv/
+__pycache__/
+
+# Build outputs
+dist/
+build/
+out/
+release/
+target/
+bin/
+obj/
+
+# Logs and temporary files
+*.log
+*.tmp
+*.temp
+.cache/
+.turbo/
+.vite/
+.pytest_cache/
+
+# Local environment and secrets
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.pfx
+*.p12
+*.crt
+*.cer
+*.token
+secrets/
+
+# OS and editor files
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/
+*.swp
+*.swo
+

files/project.md

@@ -0,0 +1,73 @@
+# Codex Project Notes
+
+## Project
+
+`PROJECT_NAME` is `PROJECT_DESCRIPTION`
+
+Repository:
+
+```text
+REPOSITORY_OWNER/REPOSITORY_NAME
+```
+
+## Commands
+
+Use these commands as the source of truth:
+
+```text
+LINT_COMMAND
+TEST_COMMAND
+BUILD_COMMAND
+AUDIT_COMMAND
+README_COMMAND
+```
+
+If a command does not exist, document the closest safe alternative. Do not invent commands that cannot run.
+
+## Stack
+
+```text
+PROJECT_STACK
+```
+
+Package manager or build tool:
+
+```text
+PACKAGE_MANAGER
+```
+
+## Build Artifacts
+
+Release artifacts are produced in:
+
+```text
+ARTIFACT_OUTPUT_DIRECTORY
+```
+
+Expected files:
+
+```text
+ARTIFACT_NAME
+```
+
+## Security Rules
+
+- Do not commit secrets, tokens, `.env` files, certificates, or private keys.
+- Treat generated credentials as sensitive.
+- Prefer local generation and local processing for user data.
+- Keep dependency audit results visible in CI where possible.
+- Do not add external network calls unless the feature explicitly requires them.
+
+## Release Rules
+
+Before a release:
+
+1. run the release checklist,
+2. verify CI is green,
+3. verify download links,
+4. update README and changelog,
+5. verify release artifacts exclude Codex kit metadata such as `AGENTS.md`, `.codex/`, `blueprint.md`, `blueprint.json`, template workflows, and agent handoff notes unless the user explicitly wants those shipped,
+6. create a tag,
+7. create the release.
+
+Do not create releases unless the user explicitly asks for a release.

files/release-checklist.md

@@ -0,0 +1,36 @@
+# Release Checklist
+
+## Version
+
+- [ ] Version number updated.
+- [ ] Changelog updated.
+- [ ] README regenerated if blueprint files changed.
+
+## Quality
+
+- [ ] Working tree is clean.
+- [ ] Lint/type checks pass.
+- [ ] Tests pass or missing tests are documented.
+- [ ] Build succeeds in CI.
+
+## Security
+
+- [ ] Security review is current.
+- [ ] Dependency audit is clean or documented.
+- [ ] No secrets are committed.
+- [ ] Release artifacts do not contain local config files.
+
+## Artifacts
+
+- [ ] Artifacts are uploaded.
+- [ ] User-facing artifacts exclude Codex kit metadata such as `AGENTS.md`, `.codex/`, `blueprint.md`, `blueprint.json`, template workflows, and agent handoff notes unless explicitly requested.
+- [ ] Download links work.
+- [ ] Package registry links work if used.
+- [ ] Installer/portable/archive naming is clear.
+
+## Release
+
+- [ ] Git tag created.
+- [ ] Release notes written.
+- [ ] Release published.
+- [ ] Post-release download smoke test completed.

files/release-dry-run-gitea.yml

@@ -0,0 +1,133 @@
+name: Release Dry Run
+
+on:
+  push:
+    branches:
+      - main
+      - master
+  workflow_dispatch:
+
+jobs:
+  release-dry-run:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Inspect release metadata
+        shell: bash
+        run: |
+          missing=0
+
+          required_docs=(
+            "README.md"
+            "CHANGELOG.md"
+            "SECURITY.md"
+            "docs/release-checklist.md"
+          )
+
+          for file in "${required_docs[@]}"; do
+            if [ ! -f "$file" ]; then
+              echo "Missing release document: $file"
+              missing=1
+            fi
+          done
+
+          placeholder_paths=(README.md AGENTS.md .codex docs .gitea)
+          placeholder_pattern='PROJECT_NAME|PROJECT_DESCRIPTION|REPOSITORY_OWNER|REPOSITORY_NAME|PACKAGE_NAME|ARTIFACT_NAME|ARTIFACT_OUTPUT_DIRECTORY|DOWNLOAD_URL|CI_URL|RELEASES_URL|BUILD_COMMAND|TEST_COMMAND|LINT_COMMAND|AUDIT_COMMAND|COMMIT_OR_VERSION'
+
+          for path in "${placeholder_paths[@]}"; do
+            [ -e "$path" ] || continue
+            if grep -RInE --exclude-dir=.git "$placeholder_pattern" "$path"; then
+              echo "Unresolved template placeholders found."
+              missing=1
+            fi
+          done
+
+          if [ "$missing" -eq 1 ]; then
+            exit 1
+          fi
+
+      - name: Detect project stack
+        id: detect
+        shell: bash
+        run: |
+          stacks=""
+
+          [ -f package.json ] && stacks="${stacks} node"
+          { [ -f pyproject.toml ] || [ -f requirements.txt ]; } && stacks="${stacks} python"
+          [ -f Cargo.toml ] && stacks="${stacks} rust"
+          [ -f go.mod ] && stacks="${stacks} go"
+
+          echo "stacks=${stacks:-generic}" >> "$GITHUB_OUTPUT"
+          echo "Detected stacks:${stacks:- generic}"
+
+      - name: Node release checks
+        if: contains(steps.detect.outputs.stacks, 'node')
+        shell: bash
+        run: |
+          if [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; then
+            npm ci
+          else
+            npm install
+          fi
+
+          node -e "const p=require('./package.json'); if(!p.name||!p.version){throw new Error('package.json needs name and version')}; console.log(p.name+'@'+p.version)"
+
+          npm run lint --if-present
+          npm test --if-present
+          npm run build --if-present
+          npm run release:check --if-present
+
+      - name: Python release checks
+        if: contains(steps.detect.outputs.stacks, 'python')
+        shell: bash
+        run: |
+          python -m pip install --upgrade pip
+
+          if [ -f requirements.txt ]; then
+            python -m pip install -r requirements.txt
+          fi
+
+          if [ -f pyproject.toml ]; then
+            python -m pip install build
+            python -m build
+          else
+            echo "No pyproject.toml found; skipped Python package build."
+          fi
+
+      - name: Rust release checks
+        if: contains(steps.detect.outputs.stacks, 'rust')
+        shell: bash
+        run: |
+          cargo test
+          cargo build --release
+
+      - name: Go release checks
+        if: contains(steps.detect.outputs.stacks, 'go')
+        shell: bash
+        run: |
+          go test ./...
+          go build ./...
+
+      - name: Artifact report
+        shell: bash
+        run: |
+          echo "Potential release artifacts:"
+          find . \
+            -path ./.git -prune -o \
+            -path ./node_modules -prune -o \
+            -path './dist/*' -type f -print -o \
+            -path './build/*' -type f -print -o \
+            -path './release/*' -type f -print -o \
+            -path './target/release/*' -type f -print \
+            | sed 's#^\./##' \
+            | head -200
+
+          cat <<'EOF'
+
+          Release dry run completed.
+
+          This workflow verifies release readiness. It does not create tags,
+          releases, packages, or upload artifacts.
+          EOF

files/release-notes.md

@@ -0,0 +1,31 @@
+# PROJECT_NAME PROJECT_VERSION
+
+## Downloads
+
+| Variant | Download |
+| --- | --- |
+| Latest artifact | DOWNLOAD_URL |
+
+## Highlights
+
+- PENDING
+
+## Security
+
+- Dependency audit: PENDING
+- Secret handling: PENDING
+- External network calls: PENDING
+
+## Verification
+
+| Check | Result |
+| --- | --- |
+| `LINT_COMMAND` | PENDING |
+| `TEST_COMMAND` | PENDING |
+| `BUILD_COMMAND` | PENDING |
+| Artifact download | PENDING |
+
+## Notes
+
+PENDING
+

files/repo-cleanup-gitea.yml

@@ -0,0 +1,139 @@
+name: Scheduled Repository Cleanup Check
+
+on:
+  schedule:
+    - cron: "43 3 * * 1"
+  workflow_dispatch:
+
+jobs:
+  cleanup-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check ignored and untracked generated files
+        shell: bash
+        run: |
+          echo "Ignored files that would be skipped by git:"
+          git status --ignored --short || true
+
+          echo
+          echo "Tracked generated files check:"
+          generated_patterns=(
+            '(^|/)node_modules/'
+            '(^|/)dist/'
+            '(^|/)build/'
+            '(^|/)out/'
+            '(^|/)release/'
+            '(^|/)target/'
+            '(^|/)coverage/'
+            '\.log$'
+            '\.tmp$'
+            '\.temp$'
+          )
+
+          found=0
+          tracked_files="$(git ls-files)"
+          for pattern in "${generated_patterns[@]}"; do
+            if echo "$tracked_files" | grep -Ei "$pattern"; then
+              found=1
+            fi
+          done
+
+          if [ "$found" -eq 1 ]; then
+            echo "Generated files appear to be tracked. Review .gitignore and remove generated outputs from version control if appropriate."
+            exit 1
+          fi
+
+      - name: Check large tracked files
+        shell: bash
+        run: |
+          limit_bytes="${LARGE_FILE_LIMIT_BYTES:-5242880}"
+          found=0
+
+          while IFS= read -r file; do
+            [ -f "$file" ] || continue
+            size="$(wc -c < "$file")"
+            if [ "$size" -gt "$limit_bytes" ]; then
+              echo "${file} is ${size} bytes, above limit ${limit_bytes}."
+              found=1
+            fi
+          done < <(git ls-files)
+
+          if [ "$found" -eq 1 ]; then
+            echo "Large tracked files found. Move release artifacts to packages/releases or document why they belong in git."
+            exit 1
+          fi
+
+      - name: Check local config and secret-prone files
+        shell: bash
+        run: |
+          found=0
+
+          risky_patterns=(
+            '^\.env$'
+            '^\.env\.'
+            '\.pfx$'
+            '\.p12$'
+            '\.pem$'
+            '\.key$'
+            '\.token$'
+            '(^|/)secrets/'
+          )
+
+          tracked_files="$(git ls-files)"
+          for pattern in "${risky_patterns[@]}"; do
+            if echo "$tracked_files" | grep -Ei "$pattern" | grep -vE '^\.env\.example$'; then
+              found=1
+            fi
+          done
+
+          if [ "$found" -eq 1 ]; then
+            echo "Secret-prone local config files are tracked. Review immediately."
+            exit 1
+          fi
+
+      - name: Check stale branches
+        shell: bash
+        run: |
+          git fetch --all --prune
+
+          protected='^(main|master|develop|dev|release|staging|production)$'
+          cutoff="$(date -u -d '90 days ago' +%s)"
+          found=0
+
+          while IFS='|' read -r branch timestamp; do
+            branch="${branch#origin/}"
+            [ "$branch" = "HEAD" ] && continue
+            echo "$branch" | grep -Eq "$protected" && continue
+
+            if [ "$timestamp" -lt "$cutoff" ]; then
+              echo "Stale remote branch candidate: ${branch}"
+              found=1
+            fi
+          done < <(git for-each-ref refs/remotes/origin --format='%(refname:short)|%(committerdate:unix)')
+
+          if [ "$found" -eq 1 ]; then
+            echo "Stale branch candidates found. Review manually before deleting anything."
+            exit 1
+          fi
+
+      - name: Cleanup guidance
+        shell: bash
+        run: |
+          cat <<'EOF'
+          Repository cleanup check completed.
+
+          This workflow reports cleanup candidates. It does not delete branches,
+          packages, releases, or files automatically.
+
+          Recommended manual follow-up:
+          - remove generated files from git,
+          - update .gitignore,
+          - move large artifacts to releases or package registry,
+          - review stale branches,
+          - document intentional exceptions.
+          EOF

files/security-review.md

@@ -0,0 +1,54 @@
+# Security Review
+
+## Scope
+
+Project:
+
+```text
+PROJECT_NAME
+```
+
+Reviewed version or commit:
+
+```text
+COMMIT_OR_VERSION
+```
+
+## Code Patterns Checked
+
+- [ ] No `eval`.
+- [ ] No dynamic `Function` constructor.
+- [ ] No unsafe HTML injection.
+- [ ] No unexpected shell execution.
+- [ ] No unexpected external network calls.
+- [ ] No secrets committed.
+- [ ] No unsafe file writes outside expected user-selected paths.
+
+## Dependency Review
+
+Command:
+
+```bash
+AUDIT_COMMAND
+```
+
+Result:
+
+```text
+PENDING
+```
+
+## Runtime Review
+
+- [ ] Least-privilege runtime configuration.
+- [ ] External URLs documented.
+- [ ] Local data storage documented.
+- [ ] Sensitive data is not persisted unless explicitly required.
+
+## Release Notes
+
+Known residual risks:
+
+```text
+None documented yet.
+```

files/security-scan-gitea.yml

@@ -0,0 +1,174 @@
+name: Scheduled Security Scan
+
+on:
+  schedule:
+    - cron: "17 3 * * 1"
+  workflow_dispatch:
+
+jobs:
+  security-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Detect project stack
+        id: detect
+        shell: bash
+        run: |
+          stacks=""
+
+          [ -f package.json ] && stacks="${stacks} node"
+          { [ -f pyproject.toml ] || [ -f requirements.txt ]; } && stacks="${stacks} python"
+          [ -f Cargo.toml ] && stacks="${stacks} rust"
+          [ -f go.mod ] && stacks="${stacks} go"
+          { [ -f Dockerfile ] || [ -f compose.yml ] || [ -f docker-compose.yml ]; } && stacks="${stacks} docker"
+
+          echo "stacks=${stacks:-generic}" >> "$GITHUB_OUTPUT"
+          echo "Detected stacks:${stacks:- generic}"
+
+      - name: Node production dependency audit
+        if: contains(steps.detect.outputs.stacks, 'node')
+        run: npm audit --omit=dev --audit-level=high
+
+      - name: Python dependency audit
+        if: contains(steps.detect.outputs.stacks, 'python')
+        shell: bash
+        run: |
+          python -m pip install --upgrade pip pip-audit
+          if [ -f requirements.txt ]; then
+            pip-audit -r requirements.txt
+          else
+            pip-audit
+          fi
+
+      - name: Rust dependency audit
+        if: contains(steps.detect.outputs.stacks, 'rust')
+        shell: bash
+        run: |
+          cargo install cargo-audit --locked
+          cargo audit
+
+      - name: Go vulnerability scan
+        if: contains(steps.detect.outputs.stacks, 'go')
+        shell: bash
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+
+      - name: Suspicious code pattern scan
+        shell: bash
+        run: |
+          grep_excludes=(
+            --exclude-dir=.git
+            --exclude-dir=node_modules
+            --exclude-dir=dist
+            --exclude-dir=build
+            --exclude-dir=release
+            --exclude=security-scan.yml
+          )
+
+          patterns=(
+            'eval\s*\('
+            'new Function\s*\('
+            'dangerouslySetInnerHTML'
+            'innerHTML\s*='
+            'child_process'
+            'exec\s*\('
+            'spawn\s*\('
+            'shell\.openExternal'
+            'nodeIntegration:\s*true'
+            'webSecurity:\s*false'
+            'allowRunningInsecureContent:\s*true'
+            'curl .*sh'
+            'wget .*sh'
+          )
+
+          found=0
+          for pattern in "${patterns[@]}"; do
+            if grep -RInE "${grep_excludes[@]}" "$pattern" .; then
+              found=1
+            fi
+          done
+
+          if [ "$found" -eq 1 ]; then
+            echo "Suspicious code patterns were found. Review the matches above."
+            exit 1
+          fi
+
+      - name: Secret and config leak scan
+        shell: bash
+        run: |
+          grep_excludes=(
+            --exclude-dir=.git
+            --exclude-dir=node_modules
+            --exclude-dir=dist
+            --exclude-dir=build
+            --exclude-dir=release
+            --exclude=security-scan.yml
+          )
+
+          patterns=(
+            'BEGIN (RSA |EC |OPENSSH |)PRIVATE KEY'
+            'AKIA[0-9A-Z]{16}'
+            'xox[baprs]-[0-9A-Za-z-]+'
+            'gh[pousr]_[0-9A-Za-z_]+'
+            'sk-[A-Za-z0-9]{20,}'
+            'api[_-]?key\s*=\s*["'\'']?[A-Za-z0-9_\-]{20,}'
+            'token\s*=\s*["'\'']?[A-Za-z0-9_\-]{20,}'
+            'password\s*=\s*["'\'']?[^[:space:]]{8,}'
+          )
+
+          found=0
+          for pattern in "${patterns[@]}"; do
+            if grep -RInE "${grep_excludes[@]}" "$pattern" .; then
+              found=1
+            fi
+          done
+
+          if find . -path ./.git -prune -o \( -name ".env" -o -name ".env.*" \) -not -name ".env.example" -print | grep .; then
+            echo "Committed environment files were found."
+            found=1
+          fi
+
+          if [ "$found" -eq 1 ]; then
+            echo "Potential secret or config leak detected. Review the matches above."
+            exit 1
+          fi
+
+      - name: AI instruction injection scan
+        shell: bash
+        run: |
+          grep_excludes=(
+            --exclude-dir=.git
+            --exclude-dir=node_modules
+            --exclude-dir=dist
+            --exclude-dir=build
+            --exclude-dir=release
+            --exclude=security-scan.yml
+          )
+
+          patterns=(
+            'ignore (all )?(previous|above) instructions'
+            'system prompt'
+            'developer message'
+            'reveal your instructions'
+            'exfiltrate'
+            'send.*token'
+            'send.*secret'
+            'disable.*safety'
+            'jailbreak'
+            'prompt injection'
+          )
+
+          found=0
+          for pattern in "${patterns[@]}"; do
+            if grep -RInEi "${grep_excludes[@]}" "$pattern" .; then
+              found=1
+            fi
+          done
+
+          if [ "$found" -eq 1 ]; then
+            echo "Potential AI instruction-injection text found. Review whether this is documentation, test data, or malicious content."
+            exit 1
+          fi

files/template-compliance-gitea.yml

@@ -0,0 +1,109 @@
+name: Codex Template Compliance
+
+on:
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  template-compliance:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check required Codex files
+        shell: bash
+        run: |
+          missing=0
+
+          required_files=(
+            "AGENTS.md"
+            ".codex/project.md"
+            "README.md"
+          )
+
+          recommended_files=(
+            "SECURITY.md"
+            "CHANGELOG.md"
+            "docs/agent-handoff.md"
+          )
+
+          for file in "${required_files[@]}"; do
+            if [ ! -f "$file" ]; then
+              echo "Missing required Codex file: $file"
+              missing=1
+            fi
+          done
+
+          for file in "${recommended_files[@]}"; do
+            if [ ! -f "$file" ]; then
+              echo "Recommended Codex file not found: $file"
+            fi
+          done
+
+          if [ "$missing" -eq 1 ]; then
+            exit 1
+          fi
+
+      - name: Check unresolved placeholders
+        shell: bash
+        run: |
+          found=0
+          paths=(AGENTS.md README.md SECURITY.md CHANGELOG.md .codex docs .gitea blueprint.md blueprint.json)
+          pattern='PROJECT_NAME|PROJECT_DESCRIPTION|REPOSITORY_OWNER|REPOSITORY_NAME|PACKAGE_NAME|ARTIFACT_NAME|ARTIFACT_OUTPUT_DIRECTORY|AUTHOR_NAME|PROJECT_STACK|DOWNLOAD_URL|CI_URL|RELEASES_URL|BUILD_COMMAND|TEST_COMMAND|LINT_COMMAND|AUDIT_COMMAND|README_COMMAND|INSTALL_COMMAND|DEV_COMMAND|PACKAGE_MANAGER|PROJECT_VERSION|COMMIT_OR_VERSION'
+
+          for path in "${paths[@]}"; do
+            [ -e "$path" ] || continue
+            if grep -RInE --exclude-dir=.git "$pattern" "$path"; then
+              found=1
+            fi
+          done
+
+          if [ "$found" -eq 1 ]; then
+            echo "Unresolved template placeholders found. Replace real values or mark genuinely unknown values as PENDING."
+            exit 1
+          fi
+
+      - name: Check README divider convention
+        shell: bash
+        run: |
+          if [ -f blueprint.md ] || [ -f blueprint.json ]; then
+            if ! grep -q 'template:section-line' blueprint.md 2>/dev/null; then
+              echo "README blueprint exists but does not use {{ template:section-line }}."
+              exit 1
+            fi
+          fi
+
+      - name: Check workflow baseline
+        shell: bash
+        run: |
+          echo "Detected Gitea workflows:"
+          find .gitea/workflows -maxdepth 1 -type f -name '*.yml' -print 2>/dev/null || true
+
+          if [ ! -f ".gitea/workflows/security-scan.yml" ]; then
+            echo "Recommended workflow missing: .gitea/workflows/security-scan.yml"
+          fi
+
+          if [ ! -f ".gitea/workflows/repo-cleanup.yml" ]; then
+            echo "Recommended workflow missing: .gitea/workflows/repo-cleanup.yml"
+          fi
+
+      - name: Compliance guidance
+        shell: bash
+        run: |
+          cat <<'EOF'
+          Codex template compliance check completed.
+
+          This workflow verifies agent context and template hygiene. It does
+          not change files automatically.
+
+          Recommended manual follow-up:
+          - add missing required Codex context files,
+          - replace unresolved placeholders,
+          - keep README blueprint and README output aligned,
+          - document intentional exceptions in .codex/project.md.
+          EOF