Harden audit methodology and OSS maintenance

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+[*.py]
+indent_size = 4
+
+[*.sql]
+indent_size = 4

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @MPIsaac-Per

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,43 @@
+name: Reproduction discrepancy
+description: Report a schema, query, ingest, or classifier result that does not reproduce.
+title: "bug: "
+labels: [bug, triage]
+body:
+  - type: markdown
+    attributes:
+      value: Do not include raw transcripts, credentials, customer data, private paths, or identifiable prompt text.
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Ingest
+        - Schema or views
+        - Analysis query
+        - Classifier
+        - Documentation
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Sanitized reproduction
+      description: Provide synthetic input, commands, expected output, and actual output.
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Versions
+      placeholder: DuckDB 1.5.4, Python 3.13, Claude Code 2.x
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-submission checks
+      options:
+        - label: I used synthetic or fully sanitized data.
+          required: true
+        - label: I searched existing issues for this discrepancy.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/MPIsaac-Per/claude-code-ops-audit/security/advisories/new
+    about: Report vulnerabilities privately. Do not open a public issue.
+  - name: Usage questions
+    url: https://github.com/MPIsaac-Per/claude-code-ops-audit/discussions
+    about: Ask questions that do not contain private corpus data.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,26 @@
+name: Method or adapter proposal
+description: Propose an analysis, schema extension, or adapter for another agent log format.
+title: "proposal: "
+labels: [enhancement, triage]
+body:
+  - type: textarea
+    id: question
+    attributes:
+      label: Research or operational question
+      description: State the question the change should answer.
+    validations:
+      required: true
+  - type: textarea
+    id: method
+    attributes:
+      label: Proposed method
+      description: Describe inputs, transformations, validation, and expected limitations.
+    validations:
+      required: true
+  - type: textarea
+    id: privacy
+    attributes:
+      label: Privacy boundary
+      description: Explain how the implementation avoids publishing private corpus data.
+    validations:
+      required: true

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ["*"]
+    labels: [dependencies]
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      development-dependencies:
+        dependency-type: development
+    labels: [dependencies, python]
+    open-pull-requests-limit: 5

.github/pull_request_template.md

@@ -0,0 +1,15 @@
+## Change
+
+Describe the methodology, schema, analysis, or classifier behavior changed.
+
+## Verification
+
+- [ ] `uv run ruff check .`
+- [ ] `uv run ruff format --check .`
+- [ ] `uv run pytest --cov=audit --cov-report=term-missing`
+- [ ] No private corpus data, raw logs, paths, credentials, or labeled samples are included
+- [ ] Documentation and query assumptions match the implemented behavior
+
+## Research impact
+
+State whether the change affects previously reported metrics or conclusions. Write `None` when it does not.

.github/workflows/ci.yml

@@ -0,0 +1,77 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    name: Quality
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          enable-cache: true
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.14"
+      - name: Install locked dependencies
+        run: uv sync --locked --all-extras --dev
+      - name: Lint
+        run: uv run ruff check .
+      - name: Check formatting
+        run: uv run ruff format --check .
+      - name: Type-check classifier
+        run: uv run mypy audit/classify.py
+      - name: Audit Python dependencies
+        run: uv run pip-audit
+
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.14"]
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          enable-cache: true
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install locked dependencies
+        run: uv sync --locked --all-extras --dev
+      - name: Test Python and DuckDB ingestion
+        run: uv run pytest --cov=audit --cov-report=term-missing --cov-report=xml
+      - name: Upload coverage report
+        if: matrix.python-version == '3.14'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: coverage-report
+          path: coverage.xml
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/codeql.yml

@@ -0,0 +1,38 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write # Upload CodeQL findings to code scanning.
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          languages: python
+          queries: security-extended
+      - name: Analyze
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0

.github/workflows/dependency-review.yml

@@ -0,0 +1,25 @@
+name: Dependency review
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-review-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    name: Review dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/scorecard.yml

@@ -0,0 +1,48 @@
+name: OpenSSF Scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "31 6 * * 2"
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: scorecard-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analysis:
+    name: Analyze supply-chain posture
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write # Publish signed Scorecard results to the OpenSSF API.
+      security-events: write # Upload Scorecard findings to code scanning.
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Run Scorecard
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - name: Upload Scorecard artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: scorecard-results
+          path: results.sarif
+          if-no-files-found: error
+          retention-days: 5
+      - name: Upload Scorecard results to code scanning
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          sarif_file: results.sarif

.gitignore

@@ -2,6 +2,8 @@
 *.duckdb
 *.duckdb.wal
 *.jsonl
+# Synthetic regression fixtures contain no user session data.
+!tests/fixtures/*.jsonl
 chunks/
 audit_sample*.csv
 audit_*_labeled.csv
@@ -19,6 +21,9 @@ __pycache__/
 .venv/
 venv/
 .python-version
+.coverage
+coverage.xml
+htmlcov/
 
 # Editor
 .DS_Store

CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+This project follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and intends to use [Semantic Versioning](https://semver.org/spec/v2.0.0.html) for releases.
+
+## [Unreleased]
+
+### Added
+
+- Synthetic DuckDB ingestion fixture and classifier test suite.
+- Automated lint, type-check, test, dependency audit, CodeQL, dependency review, and OpenSSF Scorecard workflows.
+- Standard contribution, support, security, conduct, citation, and release documentation.
+
+### Fixed
+
+- Human-message metrics exclude user-role rows that contain only tool results.
+- Assistant text uses the content block's `text` field.
+- Tool results retain their `tool_use_id` so they join to the originating call.
+- Content-block row indexes derive from one corpus scan and remain stable when timestamps collide.
+- Classifier output is schema-validated and written atomically.

CITATION.cff

@@ -0,0 +1,11 @@
+cff-version: 1.2.0
+message: If you use this methodology in published work, cite this repository.
+title: Claude Code Ops Audit
+type: software
+authors:
+  - family-names: Isaac
+    given-names: Michael
+repository-code: https://github.com/MPIsaac-Per/claude-code-ops-audit
+url: https://mpiv.ai/#code
+license: MIT
+version: 0.1.0