OMT-Global · hephaestus-omt · Jul 11, 2026 · Jul 11, 2026 · Jul 11, 2026 · Jul 11, 2026
@@ -16,12 +16,5 @@
   "mounts": [
     "source=${localEnv:HOME}/.claude,target=/home/vscode/.claude,type=bind"
   ],
-  "postCreateCommand": "bash scripts/claude/setup-devcontainer.sh",
-  "customizations": {
-    "vscode": {
-      "settings": {
-        "terminal.integrated.defaultProfile.linux": "bash"
-      }
-    }
-  }
+  "postCreateCommand": "bash scripts/claude/setup-devcontainer.sh"
 }
@@ -1,22 +1,30 @@
 ## Summary
 
-- 
+-
 
-## Scope
+## Governing Issue
 
-- R milestone:
-- Linked issue:
+Refs #<issue-number>  <!-- use Closes/Fixes/Resolves only when this PR fully completes the issue; otherwise use Refs/Part of, owner/repo#123, a full GitHub issue URL, or explain why no issue is linked -->
 
-## Test Plan
+## Validation
 
-- [ ] `bash scripts/ci/run-fast-checks.sh`
+- [ ] Relevant local checks passed
+- [ ] Required PR checks are expected to satisfy `CI Gate`
+- [ ] Skipped checks are explained below
 
-## Documentation
+## Bootstrap Governance
 
-- [ ] README/docs updated or not needed
-- [ ] Public scope/stub status still accurate
+- [ ] Changes are scoped to the linked issue
+- [ ] Contributor or PR guidance changes are reflected in `CONTRIBUTING.md`, `.github/PULL_REQUEST_TEMPLATE.md`, and `docs/bootstrap/onboarding.md` when applicable
+- [ ] PR author enabled auto-merge where GitHub allows it, or GitHub plan-limit evidence/unavailable reason is recorded and the fallback merge-readiness policy applies
+- [ ] No real secrets, runtime auth, or machine-local env files are committed
 
-## Fixtures
 
-- [ ] Fixture changes are synthetic metadata only
-- [ ] No raw mail bodies, secrets, runtime auth, generated databases, or caches
+
+## Merge Automation
+
+- [ ] PR author enabled auto-merge with `gh pr merge --auto --squash`, or the reason it is unavailable/unsafe is noted below
+
+## Notes
+
+-
@@ -2,16 +2,24 @@
 
 - Always work on a feature branch. Hooks block commits to `main` and `master`; enable them with `git config core.hooksPath .githooks`.
 - Stack baseline: Generic polyglot.
-- Repo class: library.
 - CI baseline: fast PR checks stay cheap and shell-safe; extended validation runs on `main`, nightly, or manual dispatch.
-- Self-hosted runner policy: shell-safe jobs may use `[self-hosted, synology, shell-only, private]`; anything needing Docker, service containers, browser infra, or `container:` must stay on GitHub-hosted runners.
+- Self-hosted runner policy: shell-safe jobs must use `[self-hosted, linux, shell-only, public]`; native repos must use self-hosted runners for required automation, with Docker, service-container, browser, or `container:` workloads routed to dedicated self-hosted capability pools.
 - Add or update tests for every interactive, branching, or operator-facing behavior change.
+- PRs must use the generated pull request template. The required PR gate validates summary, issue linkage, validation evidence, and risk notes.
 - Never commit real secrets, runtime auth, or machine-local env files. Use templates and GitHub environments instead.
 
+## Kingdom Governance
+
+- Pheidon is the orchestrator and current gate for repo execution work.
+- GitHub issues are the source of record for agent execution work.
+- Worker agents should act from assigned or explicitly enabled issues, not free-roaming backlog grabs.
+- If an agent authors a PR, that same agent may not approve it. This is a hard rule.
+- Healthy PRs should converge toward auto-merge once required checks are green or intentionally skipped, approvals are satisfied, and no blocking review state remains.
+- When GitHub plan limits make auto-merge unavailable for a private repo, use the fallback merge-readiness policy: required checks pass or are intentionally skipped, approvals and conversation resolution are satisfied, no blocking review state remains, and a maintainer performs the merge manually.
+- PRs should link and close their governing issue where possible so issue state remains the durable work contract.
+
 ## Local Conventions
 
 - Keep scope tight and favor predictable templates over clever scaffolding.
 - Treat `project.bootstrap.yaml` as the source of truth for repo governance, environments, CI policy, and home profile sync.
-- If OpenClaw local skills are available, use the `omt-bootstrap` skill for manifest-first bootstrap work instead of rediscovering the workflow.
 - Review `docs/bootstrap/onboarding.md` before first merge to confirm reviewers, runner labels, and environment gates match the project.
-- The R1-R6 GitHub issues with the `release-v0.1` label drive the public v0.1.0 release.
@@ -1,25 +1,13 @@
 # CLAUDE.md
 
-## Project Map
+## Project Context
 
-- `project.bootstrap.yaml`: source of truth for bootstrap policy
-- `.github/workflows/`: generated fast and extended CI lanes
-- `scripts/claude-cloud/setup.sh`: first-party Claude Code on the web setup script
-- `.github/workflows/claude.yml`: opt-in Claude GitHub Action for manual or `@claude` review flows
-- `.devcontainer/devcontainer.json`: interactive Claude Code workspace baseline
-- `.github/workflows/`: repo CI and review workflows
-- `scripts/ci/`: bootstrap CI entrypoints when this repo uses the generated workflow lane
-- `scripts/claude/setup-devcontainer.sh`: installs repo dependencies inside the devcontainer
-- `.githooks/pre-commit`: branch and env-file guardrail when local hooks are bootstrap-managed
-- `docs/bootstrap/onboarding.md`: operator checklist for repo/governance setup
-- `docs/bootstrap/claude-environment.md`: Claude setup guide for hosted, interactive, and GitHub-hosted use
+- Repository: OMT-Global/mailplus-intelligence
+- Default branch: main
+- Required PR checks: CI Gate
 
 ## Guardrails
 
-- Keep `CI Gate` as the single required PR status check.
-- Use one approval plus code owners on `main` unless the manifest explicitly changes it.
-- `stage` and `prod` environments require reviewers and prevent self-review by default.
-- Home-level Codex and Claude profile sync is managed by the bootstrap tool, not by ad-hoc manual edits.
-- Claude Code on the web should use the repo-managed setup script and keep network access limited by default.
-- The generated Claude GitHub Action is a separate review lane. It must not become a required status check.
-- Treat the devcontainer as a trusted-repo workspace. Do not mount extra secrets beyond the persisted `~/.claude` profile unless you explicitly need them.
+- Use AGENTS.md and docs/bootstrap/onboarding.md as the governing repo policy.
+- Keep Claude automation separate from required PR status checks unless the manifest explicitly changes that contract.
+- Do not commit secrets or machine-local environment files.
@@ -1,2 +1 @@
-# OMT-Global code ownership
-* @OMT-Global/omt-codeowners
+* @jmcte
@@ -1,50 +1,30 @@
 # Contributing
 
-Thanks for helping improve MailPlus Intelligence.
+Contributions should start from a GitHub issue that is assigned or explicitly enabled by Pheidon. Keep changes scoped to that issue, work on a feature branch, and link the issue from the pull request.
 
-## Development Setup
+## Local Setup
 
-Use Python 3.12 or newer:
+- Install dependencies for the selected stack before changing code.
+- Enable repo hooks with `git config core.hooksPath .githooks`; they block direct commits to `main` and catch committed runtime env files.
+- Use `project.bootstrap.yaml` as the source of truth for governance, CI, environments, and bootstrap-managed guidance files.
 
-```bash
-python3.12 -m venv .venv
-source .venv/bin/activate
-python -m pip install -e .
-```
+## Change Expectations
 
-Run the fast validation gate before opening a pull request:
+- Keep implementation changes minimal and relevant to the governing issue.
+- Add or update tests for interactive, branching, or operator-facing behavior changes.
+- Keep fast PR checks cheap and shell-safe; move heavyweight validation to `scripts/ci/run-extended-validation.sh`.
+- Do not commit real secrets, runtime auth, generated credentials, caches, or machine-local env files.
 
-```bash
-bash scripts/ci/run-fast-checks.sh
-```
+## Validation
 
-Before staging local MailPlus fixtures, generated metadata, or cache-related
-changes, run the broader local scan so untracked non-ignored files are checked:
-
-```bash
-bash scripts/check-detect-secrets.sh --all-local
-```
+- Run the relevant local checks before opening a PR.
+- For this bootstrap contract, the required PR check surface is `CI Gate`.
+- Document any skipped checks in the PR with a concrete reason.
 
 ## Pull Requests
 
-- Keep changes focused and reviewable.
-- Add or update tests for interactive, branching, or operator-facing behavior.
-- Keep `CI Gate` passing.
-- Do not include generated databases, local caches, runtime auth, mailbox
-  exports, raw message bodies, attachment payloads, or machine-local files.
-
-## Privacy And Fixtures
-
-Fixtures and examples must be synthetic or fully redacted. Use reserved domains
-such as `example.com` or `example.test`, and avoid values that identify real
-people, accounts, hosts, messages, or credentials.
-
-Review `docs/privacy-redaction-boundaries.md` before adding data fixtures,
-semantic outputs, logs, or documentation examples.
-
-## Good First Issues
-
-Good newcomer tasks are tracked with the
-[`good first issue` label](https://github.com/OMT-Global/mailplus-intelligence/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22).
-Prefer fixture-mode changes, docs clarifications, or tests that do not require
-live MailPlus credentials.
+- Use `.github/PULL_REQUEST_TEMPLATE.md`.
+- Link the governing issue with a closing keyword when the PR should close it.
+- PR authors may not approve their own PRs.
+- A healthy PR should converge toward auto-merge after required checks pass or are intentionally skipped, approvals are satisfied, and no blocking review state remains.
+- When GitHub plan limits make auto-merge unavailable for a private repo, use the fallback merge-readiness policy: required checks pass or are intentionally skipped, approvals and conversation resolution are satisfied, no blocking review state remains, and a maintainer performs the merge manually.
@@ -1,28 +1,15 @@
 # Security Policy
 
-## Supported Versions
+## Supported Surface
 
-This project is pre-1.0. Security fixes are applied to the default branch.
+This repository follows the bootstrap-managed security baseline for OMT-Global/mailplus-intelligence.
 
-## Reporting A Vulnerability
+## Reporting
 
-Please do not open public issues for suspected vulnerabilities, exposed secrets,
-or privacy-sensitive data handling problems.
+Open a private security advisory or contact the repository maintainers before disclosing a vulnerability publicly.
 
-Report security concerns through GitHub private vulnerability reporting when
-available for this repository. If private reporting is unavailable, contact the
-repository owner with a minimal description of the issue and the affected
-version or commit.
+## Baseline
 
-Expected response: the maintainer will acknowledge a complete report within
-seven calendar days and will provide a remediation or disclosure plan once the
-impact is understood. Please include enough reproduction detail to verify the
-issue without including live credentials, raw mail, mailbox exports, or other
-private payloads.
-
-## Data Handling Scope
-
-MailPlus Intelligence must not store raw mail bodies, attachment payloads,
-credential material, session state, mailbox exports, or local runtime caches in
-the repository. See `docs/privacy-redaction-boundaries.md` for the project data
-boundary and redaction rules.
+- Dependabot policy: enabled
+- Secret scanning hints: enabled
+- Generated hooks and CI helpers must not require committed secrets or machine-local environment files.
@@ -1,61 +1,18 @@
 # Claude Environment
 
-Claude Code on the web provides a first-party cloud environment comparable to Codex Web. This bootstrap prepares the hosted path first, then adds optional local and GitHub-native alternatives:
-
-- First-party hosted sessions at `claude.ai/code`
-- Interactive containerized work with `.devcontainer/devcontainer.json`
-- GitHub-hosted automation with `.github/workflows/claude.yml`
-
 ## Project
 
 - Product name: `MailPlus Intelligence`
 - Repository: `OMT-Global/mailplus-intelligence`
 - Manifest: `project.bootstrap.yaml`
 
-## Claude Code On The Web
-
-- Hosted entrypoint: `https://claude.ai/code`
-- Repo: `OMT-Global/mailplus-intelligence`
-- Setup script: `bash scripts/claude-cloud/setup.sh`
-- Network access: start with limited access; only expand it when a task truly needs more than registries and GitHub
-- Environment variables: configure them in the Claude environment UI as `.env`-style key-value pairs
-- GitHub integration: connect GitHub, install the Claude GitHub App, then pick this repo as an allowed target
-- Repo guidance: Claude on the web reads `CLAUDE.md` from the repository
-
-## Teleport And Remote Sessions
-
-- Start a hosted task from the terminal with `claude --remote "your task"`
-- Pull a hosted session back into the terminal with `claude --teleport`
-- Hosted tasks clone the default branch unless you specify a branch in the prompt
-- Teleport requires a clean git state and the same repository/account pairing
-
-## Interactive Devcontainer
+## Enabled Surfaces
 
-- Open the repo in a devcontainer-capable editor and reopen in container.
-- The container installs the Claude Code feature plus repo dependencies via `bash scripts/claude/setup-devcontainer.sh`.
-- `~/.claude` is mounted into the container so Claude Code auth persists between sessions.
-- Only use this with trusted repositories. Mounted Claude credentials are available inside the container.
-
-## GitHub Action
-
-- Workflow file: `.github/workflows/claude.yml`
-- Runner: `ubuntu-latest`
-- Triggers:
-  - manual `workflow_dispatch`
-  - PR or issue comments containing `@claude`
-  - review comments or review bodies containing `@claude`
-- Auth:
-  - preferred: run `/install-github-app` in Claude Code as a repo admin
-  - fallback: add a repository secret named `ANTHROPIC_API_KEY`
+- Claude Code on the web with `bash scripts/claude-cloud/setup.sh`
+- Interactive devcontainer through `.devcontainer/devcontainer.json`
+- GitHub-hosted Claude workflow at `.github/workflows/claude.yml`
 
 ## Guardrails
 
-- Keep the Claude workflow out of the required PR check set. The required checks are `CI Gate`.
-- Prefer Claude Code on the web for long-running async review or fix tasks; use the devcontainer when you need a local interactive container.
-- Treat the devcontainer as a trusted-repo workspace because the mounted `~/.claude` profile is available inside the container.
-- Do not relax the action to allow non-write users on public repos unless you intentionally accept the prompt-injection risk.
-- Keep Claude review and automation on GitHub-hosted runners; do not move it onto the self-hosted shell-only fleet.
-
-## Project
-
-- Default branch: `main`
+- Keep Claude automation out of the required PR check set unless the manifest explicitly changes branch protection.
+- Prefer repo-scoped secrets and avoid mounting additional host credentials into the devcontainer.
@@ -1,13 +1,7 @@
 # Next Steps
 
-- Treat the Python 3.12 package, SQLite fixture runtime, and CI scripts as the
-  established baseline; update `project.bootstrap.yaml` before changing their
-  governance contract.
-- Run `bash scripts/ci/run-fast-checks.sh` before each PR. It includes the
-  executable quickstart/runbook smoke contract and requires no live credentials.
-- Periodically verify CODEOWNERS, environment reviewers, runner labels, and the
-  required `CI Gate` check against `docs/bootstrap/onboarding.md`.
-- Re-run `bootstrap plan --manifest ./project.bootstrap.yaml` after major
-  manifest changes to confirm intended drift.
-- Finish the remaining Phase A blockers in issue #98 before claiming a live or
-  production-verified MailPlus capability.
+- Add the primary runtime and package manifest for this project.
+- Tighten `scripts/ci/run-fast-checks.sh` and `scripts/ci/run-extended-validation.sh` once the toolchain is known.
+
+- Review CODEOWNERS, environment reviewers, and required PR checks before the first merge.
+- Re-run `bootstrap plan --manifest ./project.bootstrap.yaml` after major manifest changes to confirm intended drift.