From f030290b857f1d5d92fa7704f4a21855d674eaf0 Mon Sep 17 00:00:00 2001
From: cryptoxdog <cryptoxdog@users.noreply.github.com>
Date: Wed, 29 Jul 2026 00:36:51 +0000
Subject: [PATCH] feat(governance): deploy advisory defaults v3.1

---
 .github/ISSUE_TEMPLATE/1-bug.yml        |  59 +--
 .github/ISSUE_TEMPLATE/2-feature.yml    |  57 +--
 .github/ISSUE_TEMPLATE/3-task.yml       |  15 +-
 .github/ISSUE_TEMPLATE/config.yml       |   3 +
 .github/pull_request_template.md        |   5 +
 .github/workflows/governance-issue.yml  |   3 +-
 .github/workflows/governance-pr.yml     |  11 +-
 .github/workflows/governance-report.yml |  89 ++++
 .github/workflows/seed-governance.yml   |   8 +-
 CONTRIBUTING.md                         |  78 +---
 README.md                               | 128 +++---
 docs/ADVISORY.md                        |  57 +++
 docs/AGENT-DEPLOYMENT-RUNBOOK.md        | 539 ++++++++++++++++++++++++
 docs/AUDIT.md                           |  39 ++
 docs/BOUNDARIES.md                      |  42 ++
 docs/DEPLOYMENT-EVIDENCE-TEMPLATE.md    |  58 +++
 docs/DEPLOYMENT-PR.md                   |  38 ++
 docs/DISTRIBUTION.md                    |   8 +-
 rulesets/README.md                      |  31 ++
 rulesets/org-advisory-hygiene.json      |  34 ++
 rulesets/org-advisory-pr.json           |  51 +++
 scripts/apply-rulesets.sh               |  49 +++
 scripts/enable-secret-scanning.sh       |  51 +++
 scripts/verify-pack.sh                  |  63 +++
 templates/dependabot.yml                |  35 ++
 25 files changed, 1318 insertions(+), 233 deletions(-)
 create mode 100644 .github/workflows/governance-report.yml
 create mode 100644 docs/ADVISORY.md
 create mode 100644 docs/AGENT-DEPLOYMENT-RUNBOOK.md
 create mode 100644 docs/BOUNDARIES.md
 create mode 100644 docs/DEPLOYMENT-EVIDENCE-TEMPLATE.md
 create mode 100644 docs/DEPLOYMENT-PR.md
 create mode 100644 rulesets/README.md
 create mode 100644 rulesets/org-advisory-hygiene.json
 create mode 100644 rulesets/org-advisory-pr.json
 create mode 100755 scripts/apply-rulesets.sh
 create mode 100755 scripts/enable-secret-scanning.sh
 create mode 100755 scripts/verify-pack.sh
 create mode 100644 templates/dependabot.yml

diff --git a/.github/ISSUE_TEMPLATE/1-bug.yml b/.github/ISSUE_TEMPLATE/1-bug.yml
index ea1f5a9..2539204 100644
--- a/.github/ISSUE_TEMPLATE/1-bug.yml
+++ b/.github/ISSUE_TEMPLATE/1-bug.yml
@@ -6,15 +6,15 @@ body:
   - type: markdown
     attributes:
       value: |
-        Lead with the error. A worked example lives in
-        [EXAMPLE.md](../blob/HEAD/.github/ISSUE_TEMPLATE/EXAMPLE.md).
+        CI pipeline failures go to
+        [l9-ci-debt-resolver](https://github.com/Quantum-L9/l9-ci-debt-resolver/issues/new)
+        instead — that component owns failure diagnosis.
 
   - type: textarea
     id: problem
     attributes:
       label: Problem
       description: The symptom you observed, in one or two sentences. Not your theory.
-      placeholder: Agent runs abort at ~70% of the context limit with BudgetExceeded.
     validations:
       required: true
 
@@ -22,7 +22,7 @@ body:
     id: evidence
     attributes:
       label: Error output
-      description: Full traceback, failing assertion, alert, or log line. Redact secrets.
+      description: Traceback, failing assertion, or log line. Redact secrets.
       render: shell
     validations:
       required: true
@@ -31,75 +31,36 @@ body:
     id: reproduce
     attributes:
       label: Reproduction
-      description: Exact commands from a clean checkout. A failing test is ideal.
-      value: |
-        1. `git clone … && cd …`
-        2. `uv sync`
-        3. `pytest tests/test_x.py::test_y`
+      description: Steps from a clean checkout. Best effort is fine.
       render: shell
-    validations:
-      required: true
-
-  - type: input
-    id: expected
-    attributes:
-      label: Expected behavior
-      placeholder: Budget reports the actual measured token count.
-    validations:
-      required: true
 
   - type: input
     id: version
     attributes:
       label: Version / commit
-      description: Release tag or full commit SHA. "latest" is not a version.
-      placeholder: v0.9.3 or 4f2a1c9
-    validations:
-      required: true
+      description: Release tag or SHA if you have it.
 
   - type: dropdown
     id: severity
     attributes:
       label: Severity
-      description: This routes triage. Be honest; inflation gets ignored.
+      description: Routes triage. Advisory only — nothing is blocked by this.
       options:
-        - S4 — cosmetic or minor annoyance
+        - S4 — cosmetic
         - S3 — degraded, workaround exists
         - S2 — major function broken, no workaround
         - S1 — production down, data loss, or security exposure
     validations:
       required: true
 
-  - type: dropdown
-    id: env
-    attributes:
-      label: Environment
-      multiple: true
-      options: [local (macOS), local (Linux), CI (GitHub Actions), dev, staging, prod]
-    validations:
-      required: true
-
   - type: input
     id: regression
     attributes:
       label: Last known good version
-      description: Leave blank if it never worked. If set, a bisect range is implied.
-      placeholder: v0.9.1
+      description: If set, implies a bisect range. Leave blank if unknown.
 
   - type: textarea
     id: context
     attributes:
       label: Anything else
-      description: Suspected cause, related issues, screenshots, workaround in use.
-
-  - type: checkboxes
-    id: gates
-    attributes:
-      label: Before submitting
-      options:
-        - label: I searched open and closed issues for a duplicate.
-          required: true
-        - label: I reproduced this on the latest release or main.
-          required: true
-        - label: No secrets, tokens, or customer data appear anywhere above.
-          required: true
+      description: Suspected cause, related issues, workaround in use.
diff --git a/.github/ISSUE_TEMPLATE/2-feature.yml b/.github/ISSUE_TEMPLATE/2-feature.yml
index beb53c7..41df311 100644
--- a/.github/ISSUE_TEMPLATE/2-feature.yml
+++ b/.github/ISSUE_TEMPLATE/2-feature.yml
@@ -7,8 +7,7 @@ body:
     id: problem
     attributes:
       label: Problem
-      description: The user-facing pain, not the solution. Who is blocked, and on what?
-      placeholder: Operators cannot tell which agent consumed a token budget, so cost overruns are diagnosed by guesswork.
+      description: The pain, not the solution. Who is blocked, and on what?
     validations:
       required: true
 
@@ -16,64 +15,44 @@ body:
     id: today
     attributes:
       label: What you do today
-      description: The current workaround and its cost in time, money, or risk.
-    validations:
-      required: true
+      description: Current workaround and its cost.
 
   - type: textarea
     id: proposal
     attributes:
       label: Proposed behavior
-      description: What should exist. Include the interface — CLI flag, API shape, config key.
-      render: shell
+      description: What should exist. Include the interface if you know it.
     validations:
       required: true
 
-  - type: textarea
-    id: alternatives
+  - type: dropdown
+    id: owner
     attributes:
-      label: Alternatives considered
-      description: Options you rejected and why. "None" usually means the problem is underexplored.
+      label: Which component should own this?
+      description: Prevents governance from absorbing CI concerns.
+      options:
+        - this repo (org governance / community health)
+        - l9-ci-sdk or l9-ci-core (test, lint, build execution)
+        - l9-ci-debt-resolver (CI failure diagnosis or remediation)
+        - l9-ci-debt-intelligence (CI debt measurement)
+        - unsure
     validations:
       required: true
 
   - type: textarea
-    id: done
+    id: alternatives
     attributes:
-      label: Definition of done
-      description: Observable, checkable outcomes. This becomes the acceptance criteria.
-      value: |
-        - [ ]
-        - [ ]
-    validations:
-      required: true
+      label: Alternatives considered
+      description: Options you rejected and why.
 
   - type: dropdown
     id: scope
     attributes:
       label: Scope
       options:
-        - S — under a day, one file or module
+        - S — under a day
         - M — a few days, one repo
-        - L — multi-repo or migration required
+        - L — multi-repo or migration
         - XL — needs a design doc first
     validations:
       required: true
-
-  - type: dropdown
-    id: breaking
-    attributes:
-      label: Breaking change?
-      options: ["No", "Yes — behind a flag", "Yes — requires a major bump"]
-    validations:
-      required: true
-
-  - type: checkboxes
-    id: gates
-    attributes:
-      label: Before submitting
-      options:
-        - label: I searched for an existing request covering this.
-          required: true
-        - label: This is a concrete capability, not an open-ended question (those go to Discussions).
-          required: true
diff --git a/.github/ISSUE_TEMPLATE/3-task.yml b/.github/ISSUE_TEMPLATE/3-task.yml
index 917c424..b7705f9 100644
--- a/.github/ISSUE_TEMPLATE/3-task.yml
+++ b/.github/ISSUE_TEMPLATE/3-task.yml
@@ -7,7 +7,7 @@ body:
     id: problem
     attributes:
       label: Problem
-      description: Why this work exists. What breaks or degrades if it is never done?
+      description: Why this work exists. What degrades if it is never done?
     validations:
       required: true
 
@@ -15,7 +15,6 @@ body:
     id: work
     attributes:
       label: Work
-      description: The steps. Each line should be independently verifiable.
       value: |
         - [ ]
         - [ ]
@@ -26,15 +25,7 @@ body:
     id: kind
     attributes:
       label: Kind
-      options: [chore, refactor, infra / IaC, CI / CD, docs, dependency bump, test coverage]
-    validations:
-      required: true
-
-  - type: textarea
-    id: risk
-    attributes:
-      label: Risk and rollback
-      description: Blast radius if this goes wrong, and how to undo it.
+      options: [chore, refactor, infra / IaC, governance, docs, dependency bump]
     validations:
       required: true
 
@@ -42,4 +33,4 @@ body:
     id: blocks
     attributes:
       label: Blocks / blocked by
-      placeholder: "blocked by #1191, blocks #1204"
+      placeholder: "blocked by #12, blocks #34"
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index 44b882f..93be374 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -3,6 +3,9 @@ contact_links:
   - name: 🔐 Report a security vulnerability
     url: https://github.com/Quantum-L9/.github/security/advisories/new
     about: Do NOT open a public issue. Use a private security advisory.
+  - name: 🔧 CI failure or flaky pipeline
+    url: https://github.com/Quantum-L9/l9-ci-debt-resolver/issues/new
+    about: CI diagnosis and remediation is owned by l9-ci-debt-resolver, not here.
   - name: 💬 Question or design discussion
     url: https://github.com/orgs/Quantum-L9/discussions
     about: Open-ended questions, architecture debate, and "how do I…" belong in Discussions.
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index f50cf4d..302ac5c 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,3 +1,8 @@
+<!-- Canonical org-wide PR template. Correct path: .github/pull_request_template.md
+     inside the Quantum-L9/.github repo's own .github/ folder. A copy at repo ROOT
+     does NOT propagate org-wide — GitHub only reads the nested path.
+     See docs/AUDIT.md, finding #1. -->
+
 ## Problem
 
 <!-- REQUIRED. The error, bug, or gap this fixes. Lead with the symptom a human saw.
diff --git a/.github/workflows/governance-issue.yml b/.github/workflows/governance-issue.yml
index d1964c1..565a947 100644
--- a/.github/workflows/governance-issue.yml
+++ b/.github/workflows/governance-issue.yml
@@ -34,4 +34,5 @@ jobs:
                 body: `> [!CAUTION]\n> Possible **${hits.join(', ')}** in this issue. Edit it out and **rotate the credential** — edit history is public.` });
             }
             if (add.size) await github.rest.issues.addLabels({ ...context.repo, issue_number: context.payload.issue.number, labels: [...add] });
-            if (hits.length) core.setFailed('Possible credential: ' + hits.join(', '));
+            // ADVISORY: label + comment, never fail. Rotation is the remedy, not a red X.
+            if (hits.length) core.warning('Possible credential: ' + hits.join(', '));
diff --git a/.github/workflows/governance-pr.yml b/.github/workflows/governance-pr.yml
index 4b9ca91..77d0dd1 100644
--- a/.github/workflows/governance-pr.yml
+++ b/.github/workflows/governance-pr.yml
@@ -5,7 +5,9 @@ on:
     inputs:
       strict:
         type: boolean
-        default: true
+        default: false   # ADVISORY BY DEFAULT — young infrastructure.
+                         # Callers opt in per repo with `with: {strict: true}`.
+                         # See docs/ADVISORY.md for the promotion ladder.
 
 permissions:
   contents: read
@@ -40,6 +42,9 @@ jobs:
 
             if (fail.length) {
               core.summary.addHeading('Governance gates',2).addList(fail).write();
-              if (${{ inputs.strict }}) core.setFailed(`${fail.length} gate issue(s).`);
-              else core.warning(`${fail.length} gate issue(s) — advisory mode.`);
+              if (${{ inputs.strict }}) {
+                core.setFailed(`${fail.length} gate issue(s).`);
+              } else {
+                core.notice(`${fail.length} advisory gate finding(s) — not blocking. See job summary.`);
+              }
             }
diff --git a/.github/workflows/governance-report.yml b/.github/workflows/governance-report.yml
new file mode 100644
index 0000000..3f82945
--- /dev/null
+++ b/.github/workflows/governance-report.yml
@@ -0,0 +1,89 @@
+name: Governance report (advisory)
+
+# Read-only weekly posture report. Opens/updates ONE issue in this repo.
+#
+# SCOPE BOUNDARY: this workflow does NOT run tests, lint, typecheck, scan code, or
+# parse build logs. It reads governance METADATA only. Test/lint/build execution is
+# owned by l9-ci-sdk and l9-ci-core; CI failure diagnosis by l9-ci-debt-resolver.
+# See docs/BOUNDARIES.md.
+
+on:
+  schedule:
+    - cron: "23 13 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  report:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const ORG = 'Quantum-L9';
+            const repos = (await github.paginate(github.rest.repos.listForOrg, { org: ORG, type: 'all', per_page: 100 }))
+              .filter(r => !r.archived && !r.fork);
+
+            const has = async (repo, path) =>
+              github.rest.repos.getContent({ owner: ORG, repo, path }).then(() => true).catch(() => false);
+
+            const rows = [];
+            for (const r of repos) {
+              const [co, caller, dep] = await Promise.all([
+                has(r.name, '.github/CODEOWNERS'),
+                has(r.name, '.github/workflows/governance.yml'),
+                has(r.name, '.github/dependabot.yml'),
+              ]);
+              let actions = '?';
+              try {
+                const p = await github.rest.actions.getGithubActionsPermissionsRepository({ owner: ORG, repo: r.name });
+                actions = p.data.enabled === false ? 'disabled'
+                        : (p.data.allowed_actions === 'local_only' ? 'local_only' : 'ok');
+              } catch (e) { actions = 'unreadable'; }
+              rows.push({ name: r.name, co, caller, dep, actions });
+            }
+
+            const tick = b => b ? '✅' : '⬜';
+            const pct = k => Math.round(100 * rows.filter(r => r[k]).length / (rows.length || 1));
+            const blocked = rows.filter(r => r.actions === 'disabled' || r.actions === 'local_only');
+
+            const body = [
+              `_Advisory posture report. Nothing here blocks anything. Generated ${new Date().toISOString().slice(0,10)}._`,
+              '',
+              `**Coverage across ${rows.length} active repos** — CODEOWNERS ${pct('co')}% · governance caller ${pct('caller')}% · dependabot ${pct('dep')}%`,
+              '',
+              blocked.length
+                ? `> [!NOTE]\n> ${blocked.length} repo(s) have an Actions policy that would prevent the governance caller from running: ` +
+                  blocked.map(r => `\`${r.name}\` (${r.actions})`).join(', ') + '. See docs/DISTRIBUTION.md Appendix B.'
+                : '> [!NOTE]\n> All repos permit cross-repo reusable workflows.',
+              '',
+              '| Repo | CODEOWNERS | Caller | Dependabot | Actions |',
+              '| --- | :-: | :-: | :-: | :-: |',
+              ...rows.map(r => `| \`${r.name}\` | ${tick(r.co)} | ${tick(r.caller)} | ${tick(r.dep)} | ${r.actions === 'ok' ? 'ok' : '⚠️ ' + r.actions} |`),
+              '',
+              '### Not measured here, on purpose',
+              '',
+              'Test results, lint findings, type errors, code scanning, and CI failure',
+              'diagnosis are owned by `l9-ci-sdk`, `l9-ci-core`, and `l9-ci-debt-resolver`.',
+              'This report deliberately does not recompute them — see `docs/BOUNDARIES.md`.',
+              '',
+              '### Promotion readiness',
+              '',
+              'Per `docs/ADVISORY.md`, rung 1 needs 4 consecutive weekly reports plus a',
+              'named highest-signal finding. Do not promote a gate without that evidence.',
+            ].join('\n');
+
+            const TITLE = 'Governance posture (advisory, weekly)';
+            const open = await github.rest.issues.listForRepo({ ...context.repo, state: 'open', labels: 'advisory', per_page: 20 });
+            const existing = open.data.find(i => i.title === TITLE);
+            if (existing) {
+              await github.rest.issues.update({ ...context.repo, issue_number: existing.number, body });
+              await github.rest.issues.createComment({ ...context.repo, issue_number: existing.number,
+                body: `Refreshed ${new Date().toISOString().slice(0,10)} — CODEOWNERS ${pct('co')}%, caller ${pct('caller')}%, dependabot ${pct('dep')}%.` });
+            } else {
+              await github.rest.issues.create({ ...context.repo, title: TITLE, body, labels: ['advisory'] });
+            }
+            core.summary.addRaw(body).write();
diff --git a/.github/workflows/seed-governance.yml b/.github/workflows/seed-governance.yml
index 3f1c5ae..031e232 100644
--- a/.github/workflows/seed-governance.yml
+++ b/.github/workflows/seed-governance.yml
@@ -49,9 +49,12 @@ jobs:
             const FILTER = '${{ inputs.repo_filter }}';
             const BRANCH = 'chore/seed-governance';
 
+            // The three files GitHub cannot inherit. Nothing else is ever copied.
+            // NOTE: no CI workflow is seeded here — l9-ci-sdk owns CI. See docs/BOUNDARIES.md.
             const payload = {
               '.github/CODEOWNERS': fs.readFileSync('templates/CODEOWNERS.repo', 'utf8'),
               '.github/workflows/governance.yml': fs.readFileSync('templates/governance-caller.yml', 'utf8'),
+              '.github/dependabot.yml': fs.readFileSync('templates/dependabot.yml', 'utf8'),
             };
 
             const all = await github.paginate(github.rest.repos.listForOrg, { org: 'Quantum-L9', type: 'all', per_page: 100 });
@@ -90,7 +93,10 @@ jobs:
                     'Seeds the only two governance files GitHub cannot inherit from `Quantum-L9/.github`.',
                     '',
                     '- `.github/CODEOWNERS` — CODEOWNERS is not a community health file, so it must be physical.',
-                    '- `.github/workflows/governance.yml` — a caller pinned to `@v1`. Logic lives in `.github`; this file should never need to change again.',
+                    '- `.github/workflows/governance.yml` — a caller pinned to `@v1`. Logic lives in `.github`; this file should never need to change again. **Advisory only** — `strict` defaults to false, so it cannot fail your merge.',
+                    '- `.github/dependabot.yml` — weekly dependency PRs. No auto-merge. Exists because our PR gate asks for SHA-pinned actions, and a pin without updates ages badly.',
+                    '',
+                    'No CI workflow is included. Test, lint, and build execution is owned by `l9-ci-sdk` / `l9-ci-core`; this seed deliberately does not touch it.',
                     '',
                     'Everything else (SECURITY.md, CONTRIBUTING.md, PR and issue templates) is already inherited automatically — nothing was copied.',
                   ].join('\n'),
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 57c75ea..1cb7fe9 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,74 +1,32 @@
 # Contributing to Quantum-L9
 
-## Governance Setup Checklist {#governance-setup}
+## Setup
 
-Before opening any pull request, verify each item:
-
-- [ ] Cloned `Cursor-Governance` into your local workspace root
-- [ ] Ran `setup_workspace_symlinks.sh` (see [§2 symlink contract](https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md#2-symlink-contract))
-- [ ] Validated symlinks resolve correctly: `ls -la .cursor/rules .cursor/skills .cursor/commands`
-- [ ] Read [CANONICAL_LAW.md §8](https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md#8) for workspace wiring requirements
-- [ ] Reviewed [CANONICAL_LAW.md §7 Anti-Patterns](https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md#7-anti-patterns) — never violate these
-- [ ] All CI gates green (no bypassing required status checks)
-- [ ] CODEOWNERS notified for blast-radius files
-
----
-
-## Quick Setup
-
-Governance defaults (PR/issue templates, `SECURITY.md`, this file) are **inherited
-automatically** from `Quantum-L9/.github` — no cloning or copying required. For a
-new or existing repo, one idempotent command verifies your setup and reports
-anything that still needs local wiring:
+Governance tooling is consumed as a **pinned dependency**, not a sibling clone.
+Add to your repo's `package.json` / `pyproject.toml` / `requirements` per its
+distribution mechanism (see `docs/AUDIT.md` finding #4 for the migration from the
+previous "clone Cursor-Governance alongside your repo" step).
 
 ```bash
-# one-time bootstrap for a new or existing repo (idempotent, safe to re-run)
+# one-time bootstrap for a new or existing repo
 curl -fsSL https://raw.githubusercontent.com/Quantum-L9/.github/main/scripts/bootstrap.sh | bash
 ```
 
-`bootstrap.sh` reports which files inherit from the org defaults and which have
-local overrides. It never duplicates inherited files — duplication is the drift
-mechanism this repo exists to eliminate (see `docs/AUDIT.md` finding #4 for the
-migration away from the previous "clone Cursor-Governance alongside your repo" step).
-
-For Cursor workspace wiring (rules/skills/commands symlinks), follow
-[CANONICAL_LAW.md §2](https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md#2-symlink-contract):
-the workspace root must have `.cursor/` symlinks resolving to `Cursor-Governance/rules/`, `skills/`, and `commands/`,
-validated with `ls -la .cursor/rules .cursor/skills .cursor/commands`.
-
----
-
-## CI Gate Requirements
-
-All pull requests must pass:
-
-| Gate | Tool | Kernel |
-|---|---|---|
-| Lint + type-check | ruff, mypy (Python) / tsc (TypeScript) | `pr-pipeline.yml@v1` |
-| Unit tests | pytest (Python) / Jest (TypeScript) | `pr-pipeline.yml@v1` |
-| Secret scan | gitleaks | `security.yml@v1` |
-| SAST | Bandit + Semgrep (Python) | `security.yml@v1` |
-| Dependency audit | pip-audit / npm audit | `security.yml@v1` |
-| Pre-commit hooks | pre-commit framework | `pre-commit-ci.yml@v1` |
-| Governance trio | Three-tier separation | `trio-governance.yml@v1` |
-
-> **Anti-patterns** ([§7](https://github.com/Quantum-L9/Cursor-Governance/blob/main/CANONICAL_LAW.md#7-anti-patterns)):
-> Never duplicate logic across kernels. Never add business logic to thin callers.
-> Never reference `@main` from thin callers — always use `@v1`.
+`bootstrap.sh` installs governance hooks, PR/issue templates (if locally
+overridden), and CI callers — idempotently, safe to re-run.
 
----
+## Pull requests
 
-## Branch Naming & Commit Conventions
+Use the default PR template. Every PR requires: a stated Problem, exactly one
+checked Risk level, pasted Evidence, and all Gates checked or justified.
 
-- Branches: `feat/<scope>`, `fix/<scope>`, `chore/<scope>`, `docs/<scope>`
-- Commits: Conventional Commits format — `feat(scope): message`
-- PRs targeting `main` require 2 CODEOWNERS approvals for blast-radius paths
+## Commits
 
----
+Conventional commits (`feat:`, `fix:`, `chore:`, `docs:`) — release tooling parses
+these to generate changelogs.
 
-## Kernel Authoring (l9-ci-core contributors only)
+## Code of conduct
 
-- Kernels must use `on: workflow_call` only
-- `l9-self-ci.yml` must remain `on: pull_request/push` — **never convert to workflow_call** (circular dependency)
-- `@v1` moving tag discipline: force-update `v1` for backward-compatible changes; cut `v2` for breaking changes
-- See [workflow-interface-registry.yml](https://github.com/Quantum-L9/.github/blob/main/workflow-interface-registry.yml) for the full kernel API contract
+Standard professional conduct expected across all Quantum-L9 spaces. Report
+concerns to governance via a private security advisory if conduct issues intersect
+with security, otherwise to org owners directly.
diff --git a/README.md b/README.md
index 153dd3b..d5068d5 100644
--- a/README.md
+++ b/README.md
@@ -1,81 +1,79 @@
-# Quantum-L9 — org defaults & governance
+# Quantum-L9 — org defaults & governance v3.1
 
-Canonical, inheritance-first governance for the Quantum-L9 constellation.
+Advisory-first governance for the Quantum-L9 constellation. Everything here
+**reports**; nothing blocks. See `docs/ADVISORY.md` for the promotion ladder and
+`docs/BOUNDARIES.md` for what this repo deliberately does not do.
 
-## Status of the five findings
+## Scope boundary (read this first)
 
-| # | Finding | Fix | Propagation | Token |
-| --- | --- | --- | --- | --- |
-| 1 | PR template was at repo root, so it never propagated | `.github/pull_request_template.md` | Inherited | No |
-| 2 | No canonical CODEOWNERS | `.github/CODEOWNERS` + `templates/CODEOWNERS.repo` | Seeded once | Yes |
-| 3 | SECURITY.md duplicated per repo | canonical `SECURITY.md` | Inherited | No |
-| 4 | CONTRIBUTING.md was a manual clone step | rewritten + `scripts/bootstrap.sh` | Inherited | No |
-| 5 | No cross-repo mechanism | `workflow_call` callees + 12-line caller | By reference | No |
+This repo owns **governance metadata and advisory reporting**. It does not run
+tests, lint, typecheck, scan code, or diagnose CI failures.
 
-Four of five need **no credentials at all**. See `docs/DISTRIBUTION.md`.
+| Concern | Owner |
+| --- | --- |
+| Test / lint / build execution | `l9-ci-sdk`, `l9-ci-core` |
+| CI failure diagnosis and bounded remediation | `l9-ci-debt-resolver` |
+| CI debt measurement | `l9-ci-debt-intelligence` |
+| PR/issue metadata quality, community health, org posture | **this repo** |
+
+A reusable CI callee was the third-ranked gap before this constraint was known. It
+is now **explicitly rejected** — `l9-ci-sdk` owns it. `preflight.sh` section 7
+fails if any workflow here starts referencing pytest, ruff, pyright, or semgrep.
+
+## What ships
+
+| Gap | Fix | Mode | Blocks? |
+| --- | --- | --- | --- |
+| Enforcement layer absent | `rulesets/*.json` | `evaluate` | No |
+| Secret detection absent | `scripts/enable-secret-scanning.sh` | alerts only | No |
+| CI duplication | *rejected* — replaced by `governance-report.yml` (read-only) | advisory | No |
+| Frozen SHA pins | `templates/dependabot.yml` | PRs only | No |
+| Issue forms undeployed | `.github/ISSUE_TEMPLATE/*` | inherited | No |
 
 ## Layout
 
 ```
 .github/
-├── pull_request_template.md        # inherited org-wide  ← finding 1
-├── CODEOWNERS                      # governs THIS repo   ← finding 2
+├── pull_request_template.md         inherited org-wide
+├── CODEOWNERS                       this repo only
+├── labels.yml
+├── ISSUE_TEMPLATE/                  inherited org-wide
+│   ├── config.yml                   routes CI issues to l9-ci-debt-resolver
+│   ├── 1-bug.yml  2-feature.yml  3-task.yml
 └── workflows/
-    ├── governance-pr.yml           # workflow_call callee ← finding 5
-    ├── governance-issue.yml        # workflow_call callee
-    └── seed-governance.yml         # dispatch-only, seeds the 2 non-inheritable files
-templates/
-├── CODEOWNERS.repo                 # copied into each repo
-└── governance-caller.yml           # 12-line caller, pinned @v1
-SECURITY.md                         # inherited org-wide  ← finding 3
-CONTRIBUTING.md                     # inherited org-wide  ← finding 4
-docs/
-├── AUDIT.md                        # findings + evidence
-└── DISTRIBUTION.md                 # what the token does and does not block
-scripts/
-├── preflight.sh                    # read-only verification, run first
-└── bootstrap.sh
+    ├── governance-pr.yml            workflow_call, strict=false
+    ├── governance-issue.yml         labels only, never fails
+    ├── governance-report.yml        weekly read-only posture issue
+    └── seed-governance.yml          dispatch-only, dry-run default
+rulesets/                            all enforcement=evaluate
+templates/                           CODEOWNERS.repo, dependabot.yml, caller
+docs/  ADVISORY.md  BOUNDARIES.md  DISTRIBUTION.md  AUDIT.md
+scripts/  preflight.sh  apply-rulesets.sh  enable-secret-scanning.sh
+          sync-labels.sh  bootstrap.sh
 ```
 
-## Before you merge
+## Agent deployment
+
+Follow `docs/AGENT-DEPLOYMENT-RUNBOOK.md` exactly. It activates every capability to the maximum non-blocking extent, stages seeding through a one-repo pilot, and requires a deployment evidence artifact.
+
+## Order of operations
 
 ```bash
-./scripts/preflight.sh
+./scripts/preflight.sh                      # read-only; 7 sections
+./scripts/enable-secret-scanning.sh         # alerts only, no push protection
+# merge, then:
+git tag v1.0.0 && git push origin v1.0.0
+git tag -f v1 v1.0.0 && git push origin v1 --force
+DRY_RUN=1 ./scripts/apply-rulesets.sh       # evaluate mode preview
+# Actions -> Seed non-inheritable governance -> mode: dry-run, repo_filter: l9-
 ```
 
-It checks that every `@Quantum-L9/<team>` slug in CODEOWNERS actually exists (an
-unresolvable owner makes the rule silently inert), that this repo is public, and
-which repos have local overrides that block inheritance.
-
-## Preflight coverage
-
-`./scripts/preflight.sh` is read-only and checks five things:
-
-1. Every `@Quantum-L9/<team>` slug in CODEOWNERS resolves to a real org team — an
-   unresolvable owner makes the rule silently inert.
-2. This repo is public, without which nothing inherits.
-3. Which repos already have `CODEOWNERS` / the governance caller (seed idempotency).
-4. Which repos hold local overrides that block inheritance.
-5. **Actions policy per repo** — a `local_only` or disabled-Actions repo will fail a
-   cross-repo `workflow_call` before any step runs. See `docs/DISTRIBUTION.md`
-   Appendix B.
-
-## Placeholders — resolved at integration
-
-The pack shipped with unverified placeholder slugs (`@Quantum-L9/maintainers`,
-`governance`, `infra`, `ci-cd`, `security`). At integration time the live org was
-queried (`gh api orgs/Quantum-L9/teams`): only **`platform`** exists. All CODEOWNERS
-rules in `templates/CODEOWNERS.repo` now use `@Quantum-L9/platform` (+ `@cryptoxdog`
-on blast-radius paths), matching this repo's existing `.github/CODEOWNERS`.
-
-## Integration notes (v2.0.1 → live repo)
-
-- `.github/CODEOWNERS` — the repo already had a canonical copy with real teams;
-  the pack's placeholder version was **not** installed over it.
-- `.github/pull_request_template.md` — owned by PR #15 (pr-template-kit), which
-  ships a superset of the pack's template (adds *Changes by intent* + the
-  `pr-files.yml` bot). Finding 1's fix (nested path) is satisfied there.
-- `ISSUE_TEMPLATE/` — owned by PR #16 (issue-template-kit), per the pack's own
-  "what not to do yet" guidance.
-- `SECURITY.md` / `CONTRIBUTING.md` — merged: existing detail retained, pack's
-  canonical-single-source clause, disclosure timeline, and bootstrap-first setup added.
+Then let `governance-report.yml` run for four weeks before promoting anything.
+
+## Advisory guarantees
+
+Exactly one hard failure exists anywhere in this pack: `apply-rulesets.sh` refuses
+to run if a ruleset says anything other than `evaluate`. It fails toward advisory.
+
+`preflight.sh` section 6 asserts posture has not drifted: strict defaults false,
+all rulesets evaluate, push protection off, issue triage cannot fail a run.
diff --git a/docs/ADVISORY.md b/docs/ADVISORY.md
new file mode 100644
index 0000000..2ce10a5
--- /dev/null
+++ b/docs/ADVISORY.md
@@ -0,0 +1,57 @@
+# Advisory posture
+
+Everything in this repo reports. Nothing blocks. This is deliberate: the
+infrastructure is young, and a governance system that blocks before it is trusted
+gets bypassed, and a bypassed control is worse than an absent one because it
+manufactures false confidence.
+
+## Current state of every control
+
+| Control | Mode | Can it block a merge or push? |
+| --- | --- | --- |
+| `governance-pr.yml` gates | `strict: false` default | No — `core.notice` + job summary |
+| `governance-issue.yml` triage | advisory | No — labels and comments only |
+| Issue form validations | required *fields*, not required checkboxes | No — only shapes new issues |
+| Org rulesets | `evaluate` | No — reports to Insights |
+| Secret scanning | alerts only | No |
+| Push protection | **not enabled** | No |
+| Dependabot | opens PRs | No — no auto-merge |
+| Weekly governance report | read-only issue | No |
+
+There is exactly one hard failure anywhere in the pack: `apply-rulesets.sh` refuses
+to run if a ruleset file says anything other than `evaluate`. It fails closed toward
+*advisory*, which is the safe direction.
+
+## Promotion ladder
+
+Each rung requires evidence from the rung below. No rung is skipped, and no rung is
+climbed because it feels overdue.
+
+**Rung 0 — observe (now).** Everything advisory. Run the weekly report. Do nothing
+else for at least 4 weeks.
+
+**Rung 1 — promote one gate, one repo.** Pick the single highest-signal finding from
+the report. Set `with: {strict: true}` in *one* repo's caller. Leave it a fortnight.
+If contributors route around it, the gate is wrong, not the contributors.
+
+**Rung 2 — promote that gate org-wide.** Only after rung 1 produced zero
+justified complaints.
+
+**Rung 3 — rulesets to active.** Requires 4+ weeks of clean evaluate data in
+Insights. Change `enforcement` in the JSON, not in the UI, so the change is
+reviewable in a PR.
+
+**Rung 4 — push protection.** The last rung because it is the only control that can
+block a `git push` outright. Requires that secret-scanning alerts have been *acted
+on*, not merely received.
+
+## Reversal is cheaper than caution
+
+Every rung is one word or one flag. Going back down costs the same as going up, so
+prefer trying a rung and reverting over deferring indefinitely.
+
+## What advisory does NOT mean
+
+It does not mean silent. A finding nobody sees is not advisory, it is absent. The
+weekly report exists so that advisory findings accumulate visibly, which is what
+eventually justifies promotion.
diff --git a/docs/AGENT-DEPLOYMENT-RUNBOOK.md b/docs/AGENT-DEPLOYMENT-RUNBOOK.md
new file mode 100644
index 0000000..f34f63e
--- /dev/null
+++ b/docs/AGENT-DEPLOYMENT-RUNBOOK.md
@@ -0,0 +1,539 @@
+# Agent Runbook — Deploy Quantum-L9 `.github` v3.1
+
+## Mission
+
+Deploy this pack into `Quantum-L9/.github`, activate every **advisory** capability,
+and prove the deployment. Do not enable any blocking control. Do not add, proxy, or
+modify CI owned by `l9-ci-sdk` or `l9-ci-core`.
+
+## Invariants
+
+The agent MUST preserve all of these:
+
+1. `governance-pr.yml` has `strict.default: false`.
+2. `governance-issue.yml` never calls `core.setFailed`.
+3. Every JSON ruleset has `"enforcement": "evaluate"`.
+4. Push protection remains off. Secret-scanning alerts are on.
+5. Dependabot may open PRs but nothing auto-merges them.
+6. No workflow here runs pytest, Ruff, Pyright, Semgrep, CodeQL, tests, lint, build,
+   or CI remediation. Those belong to `l9-ci-sdk`, `l9-ci-core`, and
+   `l9-ci-debt-resolver`.
+7. Never overwrite a target repo's existing CODEOWNERS, governance caller, or
+   dependabot config without reviewing and merging its intent.
+8. Never push directly to `main`; use one deployment PR.
+9. Never print the GitHub App private key or installation token.
+10. If any invariant fails, stop and report. Do not improvise an enforcing fallback.
+
+## Inputs
+
+| Input | Required | Value |
+| --- | --- | --- |
+| Organization | yes | `Quantum-L9` |
+| Defaults repository | yes | `Quantum-L9/.github` |
+| Pack directory | yes | this extracted `dot-github/` folder |
+| Pilot filter | yes | `l9-` unless the operator supplies a narrower repo name |
+| GitHub CLI auth | yes | org-owner/admin token for setup operations |
+| GitHub App | for seeding | Contents R/W + Pull requests R/W on selected repos |
+
+The deployment agent needs `git`, `gh`, `jq`, `bash`, and `python3`.
+
+## Phase 0 — Authenticate
+
+```bash
+export ORG=Quantum-L9
+export REPO=.github
+gh auth status
+gh api user --jq .login
+gh api orgs/$ORG --jq '{login,plan:.plan.name}'
+```
+
+Stop if authentication cannot read the organization and `Quantum-L9/.github`.
+Record the authenticated actor and plan in the deployment evidence.
+
+## Phase 1 — Prepare clean checkout
+
+```bash
+WORK=$(mktemp -d)
+gh repo clone "$ORG/$REPO" "$WORK/repo"
+cd "$WORK/repo"
+git fetch --all --tags --prune
+DEFAULT=$(gh repo view "$ORG/$REPO" --json defaultBranchRef --jq .defaultBranchRef.name)
+git checkout "$DEFAULT"
+git pull --ff-only origin "$DEFAULT"
+git status --porcelain
+```
+
+Stop if the checkout is dirty. Create a deployment branch:
+
+```bash
+BRANCH="feat/governance-v3.1"
+git switch -c "$BRANCH"
+```
+
+## Phase 2 — Inspect before overlay
+
+Do not blindly replace the repository. Capture and review differences first:
+
+```bash
+PACK=/absolute/path/to/extracted/dot-github
+rsync -ain --delete-excluded "$PACK/" ./ | tee "$WORK/overlay-plan.txt"
+```
+
+Before copying, inspect these collision-sensitive paths:
+
+```bash
+for p in \
+  .github/CODEOWNERS \
+  .github/pull_request_template.md \
+  .github/ISSUE_TEMPLATE \
+  SECURITY.md CONTRIBUTING.md README.md; do
+  [[ -e "$p" ]] && echo "EXISTING: $p"
+done
+```
+
+Rules:
+
+- Preserve unrelated existing files.
+- For a collision, merge intent; do not take either side wholesale.
+- Remove obsolete `distribute-defaults.yml` if it exists. v3.1 uses inheritance,
+  reusable workflows, and one-time seeding instead of recurring fan-out.
+- Do not add any CI execution workflow.
+
+Overlay without deleting unrelated repository content:
+
+```bash
+rsync -a "$PACK/" ./
+rm -f .github/workflows/distribute-defaults.yml
+```
+
+## Phase 3 — Resolve real team slugs
+
+Pack CODEOWNERS entries may still contain placeholders. List real slugs:
+
+```bash
+gh api "orgs/$ORG/teams" --paginate --jq '.[].slug' | sort
+```
+
+Resolve each of these in both `.github/CODEOWNERS` and
+`templates/CODEOWNERS.repo`:
+
+```text
+maintainers
+governance
+ci-cd
+infra
+security
+```
+
+If a specialized team does not exist, use one verified fallback team for all
+patterns. Never leave an unresolved slug. Verify:
+
+```bash
+for slug in $(grep -rhoE '@Quantum-L9/[a-z0-9-]+' \
+  .github/CODEOWNERS templates/CODEOWNERS.repo | sed 's|@Quantum-L9/||' | sort -u); do
+  gh api "orgs/$ORG/teams/$slug" --silent \
+    && echo "OK $slug" \
+    || { echo "INVALID $slug"; exit 1; }
+done
+```
+
+## Phase 4 — Static validation
+
+```bash
+./scripts/preflight.sh | tee "$WORK/preflight-before.txt"
+```
+
+The preflight may report missing seeded files in target repositories; that is
+expected before Phase 10. It must not report:
+
+- Invalid CODEOWNERS team slugs.
+- Private `.github` repository.
+- Advisory posture drift.
+- CI boundary violations.
+- Shell or workflow syntax defects.
+
+Run independent assertions:
+
+```bash
+bash scripts/verify-pack.sh | tee "$WORK/verify-pack.txt"
+```
+
+Stop on any failed assertion.
+
+## Phase 5 — Open deployment PR
+
+```bash
+git add -A
+git diff --cached --stat
+git diff --cached --check
+git commit -m "feat(governance): deploy advisory defaults v3.1"
+git push -u origin "$BRANCH"
+PR_URL=$(gh pr create \
+  --repo "$ORG/$REPO" \
+  --base "$DEFAULT" \
+  --head "$BRANCH" \
+  --title "feat(governance): deploy advisory defaults v3.1" \
+  --body-file docs/DEPLOYMENT-PR.md)
+echo "$PR_URL"
+```
+
+Review requirements for this deployment PR:
+
+- A human verifies CODEOWNERS slugs.
+- A human verifies every ruleset is `evaluate`.
+- A human verifies push protection remains off.
+- A human verifies no workflow duplicates `l9-ci-sdk`/`l9-ci-core`.
+- Existing local policies are reconciled rather than silently discarded.
+
+After approval, merge with the repository's normal merge method:
+
+```bash
+gh pr merge "$PR_URL" --squash --delete-branch
+```
+
+If the PR cannot merge, report the blocker. Do not bypass branch policy.
+
+## Phase 6 — Create release tags
+
+After merge, tag the exact merged commit:
+
+```bash
+git checkout "$DEFAULT"
+git pull --ff-only origin "$DEFAULT"
+MERGED_SHA=$(git rev-parse HEAD)
+
+git tag -a v3.1.0 "$MERGED_SHA" -m "Quantum-L9 org governance v3.1.0"
+git push origin v3.1.0
+```
+
+The consumer caller currently references `@v1`. Move that compatibility alias to
+the reviewed release commit without deleting it:
+
+```bash
+git tag -fa v1 "$MERGED_SHA" -m "Quantum-L9 governance stable v1 -> v3.1.0"
+git push origin refs/tags/v1 --force
+```
+
+Verify both tags resolve to the same commit:
+
+```bash
+test "$(git rev-list -n1 v3.1.0)" = "$(git rev-list -n1 v1)"
+```
+
+## Phase 7 — Activate inherited defaults
+
+No command activates inheritance. Verify the `.github` repository is public:
+
+```bash
+gh repo view "$ORG/$REPO" --json visibility --jq .visibility
+```
+
+Expected: `PUBLIC`. Then test one repository known not to have local overrides:
+
+```bash
+TARGET=<pilot-repository>
+for p in SECURITY.md CONTRIBUTING.md .github/pull_request_template.md; do
+  if gh api "repos/$ORG/$TARGET/contents/$p" --silent 2>/dev/null; then
+    echo "LOCAL OVERRIDE: $TARGET/$p — org default will not apply"
+  else
+    echo "INHERITS: $TARGET/$p"
+  fi
+done
+```
+
+Issue forms and community-health files are now available to repos without local
+overrides. Local files win; do not delete them automatically.
+
+## Phase 8 — Activate advisory secret detection
+
+Run only the non-blocking form:
+
+```bash
+./scripts/enable-secret-scanning.sh | tee "$WORK/secret-scanning.txt"
+```
+
+**Never** pass `--with-push-protection` during v3.1 deployment. Verify:
+
+```bash
+gh api "orgs/$ORG" --jq '{
+  secret_scanning: .secret_scanning_enabled_for_new_repositories,
+  push_protection: .secret_scanning_push_protection_enabled_for_new_repositories,
+  dependency_graph: .dependency_graph_enabled_for_new_repositories
+}'
+```
+
+Acceptance:
+
+- Secret-scanning alerts: enabled where plan/API support permits.
+- Dependency graph: enabled for new repositories.
+- Push protection: `false`.
+
+If bulk enable is unavailable on the plan, record which repositories need manual
+activation. Do not enable a blocking substitute.
+
+## Phase 9 — Activate evaluate-only rulesets
+
+Preview first:
+
+```bash
+DRY_RUN=1 ./scripts/apply-rulesets.sh | tee "$WORK/rulesets-dry-run.txt"
+```
+
+If the plan does not support `evaluate`, the script exits safely without creating
+an active ruleset. Record `SKIPPED_PLAN_LIMIT`; do not fall back to `active`.
+
+If supported:
+
+```bash
+DRY_RUN=0 ./scripts/apply-rulesets.sh | tee "$WORK/rulesets-apply.txt"
+gh api "orgs/$ORG/rulesets" --jq '.[] | {id,name,enforcement}'
+```
+
+Acceptance: every L9-created ruleset says `evaluate`. Stop and disable the ruleset
+immediately if any says `active`.
+
+## Phase 10 — Configure one-time seeding App
+
+Create or reuse a GitHub App owned by Quantum-L9:
+
+```text
+Name: Quantum-L9 Governance Seeder
+Repository permissions:
+  Contents: Read and write
+  Pull requests: Read and write
+Organization permissions:
+  Members: Read-only (only if team validation is moved into the workflow)
+Installation scope:
+  Selected pilot repositories first
+Webhooks: disabled
+```
+
+Store configuration in `Quantum-L9/.github`:
+
+```bash
+# Never echo the private key. Provide the PEM file through a secure local path.
+gh variable set GOVERNANCE_APP_ID --repo "$ORG/$REPO" --body "$APP_ID"
+gh secret set GOVERNANCE_APP_PRIVATE_KEY --repo "$ORG/$REPO" < "$APP_PRIVATE_KEY_PEM"
+```
+
+Create environment `governance-distribution` and add required reviewers in the
+GitHub UI. The agent must confirm the environment exists before dispatching:
+
+```bash
+gh api "repos/$ORG/$REPO/environments/governance-distribution"
+```
+
+Do not replace the App with a personal access token.
+
+## Phase 11 — Pilot seed
+
+First dispatch a dry run:
+
+```bash
+gh workflow run seed-governance.yml \
+  --repo "$ORG/$REPO" \
+  --ref "$DEFAULT" \
+  -f mode=dry-run \
+  -f repo_filter="${PILOT_FILTER:-l9-}"
+```
+
+Wait and inspect:
+
+```bash
+RUN_ID=$(gh run list --repo "$ORG/$REPO" --workflow seed-governance.yml \
+  --limit 1 --json databaseId --jq '.[0].databaseId')
+gh run watch "$RUN_ID" --repo "$ORG/$REPO" --exit-status
+gh run view "$RUN_ID" --repo "$ORG/$REPO" --log
+```
+
+Review the target list. Ensure archived repos, forks, and `.github` are absent.
+Then dispatch `seed` for a narrow pilot — ideally one repository, not every `l9-`
+repo at once:
+
+```bash
+export PILOT_FILTER=<exact-pilot-repository-name>
+gh workflow run seed-governance.yml \
+  --repo "$ORG/$REPO" \
+  --ref "$DEFAULT" \
+  -f mode=seed \
+  -f repo_filter="$PILOT_FILTER"
+```
+
+The resulting PR must contain only:
+
+```text
+.github/CODEOWNERS
+.github/workflows/governance.yml
+.github/dependabot.yml
+```
+
+Review and merge that pilot PR normally. Validate afterward:
+
+```bash
+for p in .github/CODEOWNERS .github/workflows/governance.yml .github/dependabot.yml; do
+  gh api "repos/$ORG/$PILOT_FILTER/contents/$p" --silent
+  echo "OK $PILOT_FILTER/$p"
+done
+```
+
+Open or edit a pilot PR and confirm the `Governance / pr` job completes with a
+neutral/successful advisory result even when the description has findings. It must
+not block merge.
+
+## Phase 12 — Fleet seed
+
+Only after the pilot behaves correctly:
+
+```bash
+gh workflow run seed-governance.yml \
+  --repo "$ORG/$REPO" \
+  --ref "$DEFAULT" \
+  -f mode=dry-run \
+  -f repo_filter=""
+```
+
+Review the complete target table, then:
+
+```bash
+gh workflow run seed-governance.yml \
+  --repo "$ORG/$REPO" \
+  --ref "$DEFAULT" \
+  -f mode=seed \
+  -f repo_filter=""
+```
+
+This opens PRs; it does not merge them. Review each collision-sensitive target.
+For existing `dependabot.yml` or CODEOWNERS, the workflow skips when all managed
+files already exist. Reconcile partial configurations manually rather than
+replacing them wholesale.
+
+## Phase 13 — Activate labels
+
+Issue triage writes labels by exact name. Apply labels idempotently to `.github`
+and to seeded repositories:
+
+```bash
+./scripts/sync-labels.sh "$ORG/$REPO"
+./scripts/sync-labels.sh "$ORG/$PILOT_FILTER"
+```
+
+For fleet rollout, enumerate active non-fork repos and apply without deletion:
+
+```bash
+gh repo list "$ORG" --limit 200 --json name,isArchived,isFork \
+  --jq '.[] | select(.isArchived==false and .isFork==false) | .name' \
+| while read -r r; do
+    ./scripts/sync-labels.sh "$ORG/$r"
+  done
+```
+
+The script creates or edits known labels and never deletes unrelated labels.
+
+## Phase 14 — Activate weekly report
+
+The schedule activates after merge. Run it once immediately:
+
+```bash
+gh workflow run governance-report.yml --repo "$ORG/$REPO" --ref "$DEFAULT"
+REPORT_RUN=$(gh run list --repo "$ORG/$REPO" --workflow governance-report.yml \
+  --limit 1 --json databaseId --jq '.[0].databaseId')
+gh run watch "$REPORT_RUN" --repo "$ORG/$REPO" --exit-status
+gh issue list --repo "$ORG/$REPO" --label advisory --state open
+```
+
+Expected: one open issue titled `Governance posture (advisory, weekly)`. Repeated
+runs update that issue instead of opening duplicates.
+
+## Phase 15 — Final verification
+
+Run preflight again from current `main`:
+
+```bash
+git checkout "$DEFAULT"
+git pull --ff-only origin "$DEFAULT"
+./scripts/preflight.sh | tee "$WORK/preflight-after.txt"
+bash scripts/verify-pack.sh | tee "$WORK/verify-pack-after.txt"
+```
+
+Verify control states explicitly:
+
+```bash
+# rulesets — all must be evaluate or absent due to plan limits
+gh api "orgs/$ORG/rulesets" --jq '.[] | select(.name|startswith("L9 advisory")) | [.name,.enforcement] | @tsv'
+
+# blocking push protection must remain false
+gh api "orgs/$ORG" --jq .secret_scanning_push_protection_enabled_for_new_repositories
+
+# reusable alias and release tag must match
+test "$(git rev-list -n1 v3.1.0)" = "$(git rev-list -n1 v1)"
+
+# no duplicated CI execution in defaults workflows
+! grep -rEi '\b(pytest|ruff|pyright|semgrep|codeql|npm test|tox)\b' .github/workflows/
+```
+
+## Acceptance checklist
+
+Deployment is complete only when all applicable items are true:
+
+- [ ] Deployment PR merged without bypassing policy.
+- [ ] `.github` repository is public.
+- [ ] All CODEOWNERS slugs resolve to real Quantum-L9 teams.
+- [ ] `v3.1.0` and `v1` tags resolve to the merged commit.
+- [ ] Governance PR workflow defaults to advisory.
+- [ ] Issue triage never fails a workflow.
+- [ ] Secret-scanning alerts are enabled where supported.
+- [ ] Push protection remains off.
+- [ ] Rulesets are `evaluate`, or skipped because the plan lacks evaluate mode.
+- [ ] GitHub App is configured through protected environment review.
+- [ ] Pilot seed PR merged and verified.
+- [ ] Fleet seed PRs opened; none auto-merged.
+- [ ] Dependabot opens PRs only; no auto-merge configuration exists.
+- [ ] Labels exist where issue triage runs.
+- [ ] Weekly governance report issue exists and updates in place.
+- [ ] No CI execution duplicated from `l9-ci-sdk` or `l9-ci-core`.
+- [ ] Final preflight reports no posture drift or boundary violation.
+
+## Evidence artifact
+
+The agent must produce `deployment-evidence.md` containing:
+
+- Actor, UTC timestamp, org plan, deployment PR URL, merged SHA.
+- `v3.1.0` and `v1` tag SHAs.
+- Preflight before/after outputs or links.
+- Secret-scanning state and explicit push-protection state.
+- Ruleset IDs, names, and enforcement modes, or `SKIPPED_PLAN_LIMIT`.
+- Seeder dry-run and pilot run URLs.
+- Pilot PR URL and validation result.
+- Fleet seed run URL and count of PRs opened/skipped/failed.
+- Weekly report run URL and issue URL.
+- Any local overrides or manual follow-ups.
+
+Use `docs/DEPLOYMENT-EVIDENCE-TEMPLATE.md`. Do not declare success with omitted or
+unknown acceptance items; mark them `NOT_APPLICABLE`, `SKIPPED_PLAN_LIMIT`, or
+`BLOCKED` with the reason.
+
+## Rollback
+
+Rollback must preserve advisory availability:
+
+1. Disable (do not delete) L9 rulesets:
+
+   ```bash
+   gh api "orgs/$ORG/rulesets" --jq '.[] | select(.name|startswith("L9 advisory")) | .id' \
+   | while read -r id; do
+       gh api -X PUT "orgs/$ORG/rulesets/$id" --input <(gh api "orgs/$ORG/rulesets/$id" | jq '.enforcement="disabled"')
+     done
+   ```
+
+2. Repoint `v1` to the last known-good release tag; never delete it:
+
+   ```bash
+   git tag -fa v1 <last-known-good-tag> -m "rollback governance alias"
+   git push origin refs/tags/v1 --force
+   ```
+
+3. Close unmerged fleet seed PRs. Merged seed files are harmless and advisory;
+   revert them through normal PRs only if necessary.
+4. Revert the deployment PR through a new PR. Do not force-push `main`.
+5. Secret scanning is detection-only and normally should remain enabled during a
+   rollback. Push protection was never enabled.
diff --git a/docs/AUDIT.md b/docs/AUDIT.md
index d676a4d..9a68cff 100644
--- a/docs/AUDIT.md
+++ b/docs/AUDIT.md
@@ -154,3 +154,42 @@ All three are now shipped.
 **Assessment**: items 1 and 2 were documentation debt. Item 3 was a genuine rollout
 trap — it would have surfaced as a batch of confusing red X's across seeded repos
 with no obvious cause. Caught pre-deploy.
+
+
+---
+
+# v3.0.0 — five gaps filled, advisory posture, CI boundary enforced
+
+**Constraint applied**: do not duplicate `l9-ci-sdk` or `l9-ci-core`.
+
+The previously-ranked #3 gap (reusable CI callees for pytest/ruff/pyright/semgrep,
+score 4.67) is **withdrawn**. `l9-ci-sdk` owns CI execution and `l9-ci-core` already
+runs Code Quality and CodeQL. Building CI callees here would have created two
+competing sources of CI truth — precisely the duplication this effort exists to
+eliminate. It is replaced by `governance-report.yml`, which measures governance
+*metadata* coverage only and states in its own header what it refuses to measure.
+
+**Advisory conversion**: `governance-pr.yml` input `strict` now defaults to `false`;
+`governance-issue.yml` no longer calls `setFailed`; rulesets ship `evaluate`; push
+protection is opt-in behind a typed confirmation; Dependabot opens PRs with no
+auto-merge. Issue forms require *fields*, not gating checkboxes.
+
+**Anti-drift**: `preflight.sh` gained section 6 (posture assertions) and section 7
+(boundary check — fails if any workflow here references a test or lint tool). The
+promotion ladder in `docs/ADVISORY.md` has four rungs, each requiring evidence from
+the one below.
+
+**Unverified**: CODEOWNERS team slugs remain placeholders. Whether `l9-ci-sdk`
+already publishes a `workflow_call` CI callee is UNKNOWN — if it does, consumer
+repos should call it directly; this repo will not proxy it.
+
+
+---
+
+# v3.1.0 — deployment completeness
+
+Adds an agent-executable deployment runbook, offline pack verifier, deployment PR
+body, and evidence template. The runbook separates merge-time inheritance from
+org-setting activation, one-time GitHub App seeding, label synchronization, and
+weekly report activation. It explicitly refuses enforcing fallbacks, stages one
+repository before fleet seeding, and includes rollback.
diff --git a/docs/BOUNDARIES.md b/docs/BOUNDARIES.md
new file mode 100644
index 0000000..56b84a5
--- /dev/null
+++ b/docs/BOUNDARIES.md
@@ -0,0 +1,42 @@
+# Boundaries — what this repo does NOT do
+
+`Quantum-L9/.github` owns **org-level governance metadata and advisory reporting**.
+It does not execute, lint, test, scan, or remediate code. Those are owned elsewhere
+in the CI constellation and must not be reimplemented here.
+
+## Ownership map
+
+| Concern | Owner | This repo's role |
+| --- | --- | --- |
+| Test execution, lint, typecheck | `l9-ci-sdk` / `l9-ci-core` | none — never invoked from here |
+| Code scanning / CodeQL | `l9-ci-core` (already runs Code Quality + CodeQL) | none |
+| CI failure diagnosis, log retrieval, bounded remediation | `l9-ci-debt-resolver` | none |
+| CI debt measurement | `l9-ci-debt-intelligence` | consume as a link, never recompute |
+| Reusable CI callees (`ci-python.yml` etc.) | `l9-ci-sdk` | **deliberately not built here** |
+| PR/issue description quality | **this repo** | advisory gates |
+| Community health files (SECURITY, CONTRIBUTING, templates) | **this repo** | inherited org-wide |
+| CODEOWNERS, dependabot.yml (non-inheritable) | **this repo** | one-time seed |
+| Org rulesets, secret scanning posture | **this repo** | advisory / evaluate mode |
+| Cross-repo governance *reporting* | **this repo** | read-only weekly report |
+
+## The rule
+
+If a proposed addition here would run a test, parse a build log, or decide whether
+code is correct, it belongs in `l9-ci-sdk` / `l9-ci-core` / `l9-ci-debt-resolver`.
+This repo only ever asks: *is the governance metadata present and coherent?*
+
+## Explicitly rejected additions
+
+- **Reusable CI callees for pytest/ruff/pyright/semgrep.** This was ranked the #3
+  gap before the constraint was known. `l9-ci-sdk` owns it. Duplicating it here
+  would create two competing sources of CI truth — the exact failure this whole
+  effort exists to prevent.
+- **Any code-scanning workflow.** `l9-ci-core` already runs CodeQL for Python.
+- **Any CI-failure triage or auto-fix.** `l9-ci-debt-resolver` owns bounded recovery.
+
+## Interface, not duplication
+
+Where governance needs a CI signal, it **references** the owning component rather
+than recomputing it. `templates/governance-caller.yml` therefore contains only
+governance jobs; a repo's CI caller (pointing at `l9-ci-sdk`) is a separate file
+this repo never writes.
diff --git a/docs/DEPLOYMENT-EVIDENCE-TEMPLATE.md b/docs/DEPLOYMENT-EVIDENCE-TEMPLATE.md
new file mode 100644
index 0000000..bb0c448
--- /dev/null
+++ b/docs/DEPLOYMENT-EVIDENCE-TEMPLATE.md
@@ -0,0 +1,58 @@
+# v3.1 Deployment Evidence
+
+| Field | Value |
+| --- | --- |
+| Actor | |
+| Started UTC | |
+| Completed UTC | |
+| Organization plan | |
+| Deployment PR | |
+| Merged SHA | |
+| `v3.1.0` SHA | |
+| `v1` SHA | |
+
+## Static verification
+
+- Preflight before:
+- Pack verification:
+- Preflight after:
+- CODEOWNERS team verification:
+- CI-boundary verification:
+
+## Activated controls
+
+| Control | Evidence | State |
+| --- | --- | --- |
+| Inherited defaults | | ACTIVE / BLOCKED |
+| Secret-scanning alerts | | ACTIVE / PARTIAL / SKIPPED_PLAN_LIMIT |
+| Push protection | | OFF (required) |
+| Advisory rulesets | | EVALUATE / SKIPPED_PLAN_LIMIT |
+| GitHub App | | CONFIGURED / BLOCKED |
+| Pilot seed | | COMPLETE / BLOCKED |
+| Fleet seed | | PRS_OPENED / PARTIAL / BLOCKED |
+| Labels | | COMPLETE / PARTIAL |
+| Weekly report | | ACTIVE / BLOCKED |
+
+## Runs and PRs
+
+- Ruleset dry run:
+- Ruleset apply:
+- Seeder dry run:
+- Pilot seed run:
+- Pilot PR:
+- Fleet seed run:
+- Governance report run:
+- Governance report issue:
+
+## Overrides and follow-ups
+
+| Repository | Override / blocker | Owner | Follow-up |
+| --- | --- | --- | --- |
+| | | | |
+
+## Final declaration
+
+- [ ] Everything activated to the maximum advisory extent supported by the plan.
+- [ ] No blocking control was enabled.
+- [ ] No CI owned by l9-ci-sdk/l9-ci-core was duplicated.
+- [ ] Unknowns are marked, not presented as success.
diff --git a/docs/DEPLOYMENT-PR.md b/docs/DEPLOYMENT-PR.md
new file mode 100644
index 0000000..4d20f77
--- /dev/null
+++ b/docs/DEPLOYMENT-PR.md
@@ -0,0 +1,38 @@
+## Problem
+
+Quantum-L9 needs organization-wide governance defaults, advisory security posture,
+and consistent issue intake without duplicating CI owned by `l9-ci-sdk` or
+`l9-ci-core`.
+
+## Fix
+
+Deploys `.github` pack v3.1: inherited community-health files, reusable advisory
+governance, evaluate-only rulesets, alert-only secret scanning setup, one-time
+CODEOWNERS/caller/Dependabot seeding, issue forms, and weekly posture reporting.
+
+## Risk
+
+- [x] Low — advisory, additive, reversible
+- [ ] Medium — shared code, config, or public interface
+- [ ] High — breaking, migration, IAM/network, irreversible
+
+Blast radius: organization governance metadata; no application runtime.
+Rollback: repoint `v1`, disable evaluate rulesets, revert this PR.
+
+## Evidence
+
+```text
+Paste scripts/verify-pack.sh and scripts/preflight.sh output here.
+```
+
+## Gates
+
+- [x] No blocking controls enabled
+- [x] Push protection remains off
+- [x] Rulesets are evaluate-only
+- [x] No CI execution duplicated from l9-ci-sdk/l9-ci-core
+- [x] GitHub App secrets are not committed
+
+## Reviewer focus
+
+Verify real CODEOWNERS team slugs, advisory defaults, and CI ownership boundary.
diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md
index 171b1fb..43ddcb6 100644
--- a/docs/DISTRIBUTION.md
+++ b/docs/DISTRIBUTION.md
@@ -9,7 +9,7 @@ GitHub *inherits* community health files by reference. There is no copy, no sync
 and no token involved. Repos read the latest `main` of `Quantum-L9/.github` live.
 Merge a fix to `SECURITY.md` and all 29 repos reflect it on the next page load.
 
-The token gated exactly two files, and only for a **one-time seed** — not for
+The token gated exactly three files, and only for a **one-time seed** — not for
 ongoing updates.
 
 ## The three distribution mechanisms
@@ -42,14 +42,16 @@ which the inheritance requirement already forces.
 here and move the `v1` tag. All 29 repos pick it up on their next PR. Zero token
 use, zero fan-out, zero PRs.
 
-### Physical copy covers only two files
+### Physical copy covers only three files
 
-Two things genuinely cannot be inherited or referenced:
+Three things genuinely cannot be inherited or referenced:
 
 1. **`CODEOWNERS`** — GitHub does not list it as a community health file. It must
    physically exist in each repo at root, `.github/`, or `docs/`.
 2. **The caller stub** — a repo cannot be made to run a workflow it does not contain.
    Twelve lines, pinned to a tag, and it should never change again.
+3. **`dependabot.yml`** — repository-specific dependency configuration is not a
+   community-health default and must physically exist in each consumer repo.
 
 `seed-governance.yml` seeds these once per repo, via PR, and skips repos already
 seeded. That is the total scope of what the token was blocking.
diff --git a/rulesets/README.md b/rulesets/README.md
new file mode 100644
index 0000000..cd7893e
--- /dev/null
+++ b/rulesets/README.md
@@ -0,0 +1,31 @@
+# Rulesets — evaluate mode only
+
+Every ruleset here ships with `"enforcement": "evaluate"`. In evaluate mode a rule
+runs and reports to Insights **without blocking anyone**. Nothing in this directory
+can fail a merge until a human changes one word.
+
+`evaluate` requires GitHub Enterprise Cloud. On lower plans, `apply-rulesets.sh`
+detects this and skips rather than silently falling back to `active` — never trade
+advisory posture for availability.
+
+## Files
+
+| File | Targets | Rules |
+| --- | --- | --- |
+| `org-advisory-pr.json` | default branch, all non-archived repos | PR required, governance check reported |
+| `org-advisory-hygiene.json` | all branches | deletion + force-push observed |
+
+## Promotion is a deliberate, dated decision
+
+```bash
+# observe for at least 4 weeks, then review Insights before touching this
+jq '.enforcement = "active"' rulesets/org-advisory-pr.json > /tmp/r.json
+```
+
+Do not promote a ruleset that has not produced 4 weeks of clean evaluate data.
+See `docs/ADVISORY.md`.
+
+## Warning
+
+Never add `required_status_checks` to a ruleset that targets branch **creation** —
+an org-wide rule doing so can block repository creation entirely.
diff --git a/rulesets/org-advisory-hygiene.json b/rulesets/org-advisory-hygiene.json
new file mode 100644
index 0000000..acc3e7d
--- /dev/null
+++ b/rulesets/org-advisory-hygiene.json
@@ -0,0 +1,34 @@
+{
+  "name": "L9 advisory \u2014 branch hygiene",
+  "target": "branch",
+  "enforcement": "evaluate",
+  "conditions": {
+    "ref_name": {
+      "include": [
+        "~ALL"
+      ],
+      "exclude": []
+    },
+    "repository_name": {
+      "include": [
+        "~ALL"
+      ],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [
+    {
+      "actor_id": 1,
+      "actor_type": "OrganizationAdmin",
+      "bypass_mode": "always"
+    }
+  ],
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    }
+  ]
+}
diff --git a/rulesets/org-advisory-pr.json b/rulesets/org-advisory-pr.json
new file mode 100644
index 0000000..ba6f5d6
--- /dev/null
+++ b/rulesets/org-advisory-pr.json
@@ -0,0 +1,51 @@
+{
+  "name": "L9 advisory \u2014 pull request hygiene",
+  "target": "branch",
+  "enforcement": "evaluate",
+  "conditions": {
+    "ref_name": {
+      "include": [
+        "~DEFAULT_BRANCH"
+      ],
+      "exclude": []
+    },
+    "repository_name": {
+      "include": [
+        "~ALL"
+      ],
+      "exclude": [
+        ".github"
+      ]
+    }
+  },
+  "bypass_actors": [
+    {
+      "actor_id": 1,
+      "actor_type": "OrganizationAdmin",
+      "bypass_mode": "always"
+    }
+  ],
+  "rules": [
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "required_status_checks": [
+          {
+            "context": "Governance / pr"
+          }
+        ]
+      }
+    }
+  ]
+}
diff --git a/scripts/apply-rulesets.sh b/scripts/apply-rulesets.sh
new file mode 100755
index 0000000..7531aa1
--- /dev/null
+++ b/scripts/apply-rulesets.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Applies org rulesets in EVALUATE mode. Refuses to create anything enforcing.
+set -euo pipefail
+ORG=Quantum-L9
+DRY="${DRY_RUN:-1}"
+SRC="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+command -v gh >/dev/null || { echo "gh CLI required" >&2; exit 1; }
+command -v jq >/dev/null || { echo "jq required" >&2; exit 1; }
+
+PLAN=$(gh api "orgs/$ORG" --jq '.plan.name // "unknown"' 2>/dev/null || echo unknown)
+echo "org plan: $PLAN"
+if [[ "$PLAN" != "enterprise" ]]; then
+  cat <<'EOF'
+!! evaluate mode requires GitHub Enterprise Cloud.
+   Refusing to apply. Options:
+     1. Skip rulesets entirely for now (recommended while advisory).
+     2. Use a repo-level branch ruleset with enforcement=active and
+        required_approving_review_count=0 — blocks nothing but direct pushes.
+   This script will NOT silently create an active org ruleset.
+EOF
+  exit 0
+fi
+
+for f in "$SRC"/rulesets/*.json; do
+  MODE=$(jq -r '.enforcement' "$f")
+  NAME=$(jq -r '.name' "$f")
+  if [[ "$MODE" != "evaluate" ]]; then
+    echo "!! REFUSING $f — enforcement is '$MODE', expected 'evaluate'" >&2
+    exit 1
+  fi
+  if [[ "$DRY" == "1" ]]; then
+    echo "would create (evaluate): $NAME"
+    continue
+  fi
+  EXISTING=$(gh api "orgs/$ORG/rulesets" --jq ".[] | select(.name==\"$NAME\") | .id" 2>/dev/null || true)
+  if [[ -n "$EXISTING" ]]; then
+    gh api -X PUT "orgs/$ORG/rulesets/$EXISTING" --input "$f" >/dev/null
+    echo "updated (evaluate): $NAME"
+  else
+    gh api -X POST "orgs/$ORG/rulesets" --input "$f" >/dev/null
+    echo "created (evaluate): $NAME"
+  fi
+done
+
+echo
+echo "Review findings without blocking anyone:"
+echo "  Org Settings -> Rulesets -> Insights"
+echo "Re-run with DRY_RUN=0 to apply."
diff --git a/scripts/enable-secret-scanning.sh b/scripts/enable-secret-scanning.sh
new file mode 100755
index 0000000..e529bf9
--- /dev/null
+++ b/scripts/enable-secret-scanning.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Enables secret scanning ALERTS org-wide (detection, non-blocking).
+# Push protection is BLOCKING and is therefore opt-in, off by default.
+set -euo pipefail
+ORG=Quantum-L9
+WITH_PP=0
+[[ "${1:-}" == "--with-push-protection" ]] && WITH_PP=1
+
+echo "== current org security posture =="
+gh api "orgs/$ORG" --jq '{
+  secret_scanning: .secret_scanning_enabled_for_new_repositories,
+  push_protection: .secret_scanning_push_protection_enabled_for_new_repositories,
+  dependency_graph: .dependency_graph_enabled_for_new_repositories
+}' 2>/dev/null || echo "  (need admin:org to read)"
+
+echo
+echo "== enabling detection for NEW repos =="
+gh api -X PATCH "orgs/$ORG" \
+  -F secret_scanning_enabled_for_new_repositories=true \
+  -F dependency_graph_enabled_for_new_repositories=true >/dev/null
+echo "  secret scanning alerts: on"
+echo "  dependency graph: on (prerequisite for Dependabot)"
+
+echo
+echo "== enabling detection on EXISTING repos =="
+gh api -X POST "orgs/$ORG/security-products/secret-scanning/enable-all" >/dev/null 2>&1 \
+  || echo "  (bulk enable unavailable on this plan — enable per repo in Settings)"
+
+if [[ "$WITH_PP" == "1" ]]; then
+  cat <<'EOF'
+
+!! PUSH PROTECTION IS A BLOCKING CONTROL.
+   It rejects pushes containing detected secrets. That is the correct end state,
+   but it is NOT advisory. Confirm you intend to leave advisory posture.
+EOF
+  read -r -p "type ENFORCE to continue: " C
+  [[ "$C" == "ENFORCE" ]] || { echo "aborted — still advisory."; exit 0; }
+  gh api -X PATCH "orgs/$ORG" \
+    -F secret_scanning_push_protection_enabled_for_new_repositories=true >/dev/null
+  echo "push protection: on for new repos"
+else
+  cat <<'EOF'
+
+push protection: NOT enabled (advisory posture preserved).
+  Detection is on, so leaked secrets raise an alert you can act on.
+  Re-run with --with-push-protection when ready to block.
+
+REMINDER: a detected secret must be ROTATED with the provider. Deleting the
+commit does not invalidate the credential.
+EOF
+fi
diff --git a/scripts/verify-pack.sh b/scripts/verify-pack.sh
new file mode 100755
index 0000000..b8cb71d
--- /dev/null
+++ b/scripts/verify-pack.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Offline, deterministic v3.1 assertions. Makes no network calls.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+fail=0
+ok(){ echo "OK  $*"; }
+bad(){ echo "!!  $*"; fail=1; }
+
+if grep -A4 '^      strict:' .github/workflows/governance-pr.yml | grep -q 'default: false'; then
+  ok "PR governance defaults advisory"
+else bad "PR governance does not default strict=false"; fi
+
+if grep -q 'core.setFailed' .github/workflows/governance-issue.yml; then
+  bad "issue governance contains core.setFailed"
+else ok "issue governance cannot fail the run"; fi
+
+for f in rulesets/*.json; do
+  mode=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["enforcement"])' "$f")
+  [[ "$mode" == evaluate ]] && ok "$(basename "$f") evaluate" || bad "$(basename "$f") is $mode"
+done
+
+if grep -rEi '\b(pytest|ruff|pyright|semgrep|codeql|npm test|tox)\b' .github/workflows/; then
+  bad "defaults workflow duplicates CI execution"
+else ok "no CI execution duplicated in defaults workflows"; fi
+
+if grep -q 'secret_scanning_push_protection_enabled_for_new_repositories=true' scripts/enable-secret-scanning.sh \
+   && ! grep -q -- '--with-push-protection' scripts/enable-secret-scanning.sh; then
+  bad "push protection can be enabled without explicit opt-in"
+else ok "push protection guarded by explicit opt-in"; fi
+
+for p in \
+ .github/ISSUE_TEMPLATE/config.yml \
+ .github/pull_request_template.md \
+ .github/workflows/governance-report.yml \
+ templates/dependabot.yml \
+ templates/governance-caller.yml \
+ docs/ADVISORY.md docs/BOUNDARIES.md; do
+  [[ -f "$p" ]] && ok "present $p" || bad "missing $p"
+done
+
+for s in scripts/*.sh; do
+  bash -n "$s" && ok "shell syntax $(basename "$s")" || bad "shell syntax $(basename "$s")"
+done
+
+python3 - <<'PY' || exit 1
+import json, pathlib
+try:
+    import yaml
+except ImportError:
+    print('NOTE PyYAML unavailable; JSON validated, YAML validation skipped')
+else:
+    for p in list(pathlib.Path('.github/workflows').glob('*.yml')) + \
+             list(pathlib.Path('.github/ISSUE_TEMPLATE').glob('*.yml')) + \
+             list(pathlib.Path('templates').glob('*.yml')):
+        yaml.safe_load(p.read_text())
+        print('OK  yaml', p)
+for p in pathlib.Path('rulesets').glob('*.json'):
+    json.loads(p.read_text()); print('OK  json', p)
+PY
+
+[[ "$fail" == 0 ]] || exit 1
+echo "PASS v3.1 pack is advisory and boundary-clean"
diff --git a/templates/dependabot.yml b/templates/dependabot.yml
new file mode 100644
index 0000000..7f7af9d
--- /dev/null
+++ b/templates/dependabot.yml
@@ -0,0 +1,35 @@
+# Managed by Quantum-L9/.github. dependabot.yml is NOT inheritable — it is seeded
+# per repo and must live at .github/dependabot.yml on the default branch.
+#
+# ADVISORY POSTURE: this opens PRs only. No auto-merge, no forced schedules.
+# It exists because our PR gate requires SHA-pinned actions, and a pin without an
+# update mechanism is a frozen, silently ageing dependency.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels: ["type:task", "deps"]
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      actions-minor-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels: ["type:task", "deps"]
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      python-minor-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]