Activate governed preproduction workflows (#1)

.github/CODEOWNERS

@@ -0,0 +1,117 @@
+# Code Owners
+
+> **Governance note:** This file uses GitHub's CODEOWNERS syntax for assigning review responsibility.
+> See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+## Default Ownership
+
+All files are owned by the Rig maintainers by default.
+
+* @juliantorr-es
+
+## Domain Layer Ownership
+
+The domain layer contains Rig's core governance logic. Changes here require special attention.
+
+# Domain Layer
+/src/rig/domain/  @juliantorr-es
+/src/rig/domain/*  @juliantorr-es
+
+# Receipt System
+/src/rig/domain/receipt*.py  @juliantorr-es
+/src/rig/domain/*receipt*.py  @juliantorr-es
+
+# Audit System
+/src/rig/domain/*audit*.py  @juliantorr-es
+/src/rig/domain/workspace_audit.py  @juliantorr-es
+
+# Governance Engine
+/src/rig/domain/governance.py  @juliantorr-es
+
+# Replay System
+/src/rig/domain/replay.py  @juliantorr-es
+
+# Projections
+/src/rig/domain/projection*.py  @juliantorr-es
+/src/rig/domain/*projection*.py  @juliantorr-es
+
+# Workspace
+/src/rig/domain/workspace.py  @juliantorr-es
+/src/rig/domain/workspace_*.py  @juliantorr-es
+
+## CLI Layer
+
+# CLI Main
+/src/rig/cli/main.py  @juliantorr-es
+/src/rig/cli/  @juliantorr-es
+
+## UI Layer
+
+# Windowed UI
+/src/rig/ui/  @juliantorr-es
+/src/rig/ui/*  @juliantorr-es
+
+## Infrastructure
+
+# Tests
+/tests/  @juliantorr-es
+/tests/*  @juliantorr-es
+
+# CI/CD
+/.github/workflows/  @juliantorr-es
+/.github/workflows/*  @juliantorr-es
+
+# Documentation
+docs/  @juliantorr-es
+docs/*  @juliantorr-es
+
+# Governance Surfaces
+/.github/pull_request_template_agent.md  @juliantorr-es
+/.github/labels.md  @juliantorr-es
+/.github/workflows/preproduction-validation.yml  @juliantorr-es
+/.github/workflows/replay-integrity.yml  @juliantorr-es
+
+# Configuration
+pyproject.toml  @juliantorr-es
+setup.py  @juliantorr-es
+scripts/  @juliantorr-es
+
+## Notes
+
+### Review Requirements
+
+- **All PRs** require at least one maintainer review
+- **Domain layer changes** require additional scrutiny for:
+  - Receipt schema changes
+  - Governance rule changes
+  - Replay determinism impact
+  - Projection contract changes
+- **No auto-merge** on main branch
+- **All tests must pass** before merging
+
+### Codeowner Responsibilities
+
+Codeowners are expected to:
+1. Review PRs affecting their areas in a timely manner
+2. Ensure changes maintain Rig's governance doctrine
+3. Verify replay determinism is preserved
+4. Confirm projection contracts are maintained
+5. Check for breaking changes to receipt schema
+
+### Escalation
+
+If a codeowner is unresponsive after 7 days, PR authors may:
+1. Ping the codeowner on the PR
+2. Ping @juliantorr-es for escalation
+3. Request review from another maintainer
+
+### Governance Override
+
+All changes, regardless of codeowner approval, must:
+- Pass `bash scripts/check.sh`
+- Maintain replay determinism
+- Preserve projection contracts
+- Follow deny-by-default governance
+- Not introduce new SaaS/cloud dependencies in core governance
+
+**Codeowner approval does NOT override governance requirements.**

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,14 +1,67 @@
 ---
-name: Bug report
+name: Bug Report
 about: Report a reproducible Rig failure
-title: "[bug]"
-labels: bug
+title: "[BUG] "
+labels: bug, needs-triage
+assignees: ''
 ---
 
-## What happened
+> **Before filing:** Please run `bash scripts/check.sh` to ensure this isn't a validation issue.
 
-## Expected
+## Summary
 
-## Reproduction
+<!-- Clear, concise description of the issue -->
+
+## Steps to Reproduce
+
+<!-- Exact commands to reproduce the issue. Be specific. -->
+```bash
+# Example:
+# 1. python -m rig workspace create test
+# 2. python -m rig run --task implement-feature-x --provider custom-command
+# 3. python -m rig workspace apply
+```
+
+## Expected Behavior
+
+<!-- What should happen -->
+
+## Actual Behavior
+
+<!-- What actually happens -->
 
 ## Environment
+
+- **Python version:** `python --version`
+- **Rig version:** `python -m rig --version` or commit hash
+- **OS:** macOS/Linux/Windows, version
+- **Install method:** editable/dev/regular
+- **Dependencies:** `python -m pip freeze` (if relevant)
+
+## Receipts and Audit Trail
+
+<!-- Run these commands and paste the output -->
+```bash
+# Show recent receipts
+python -m rig replay timeline --json
+
+# Show doctor output
+python -m rig doctor all
+
+# Show projections validation
+python -m rig doctor projections
+```
+
+## Additional Context
+
+<!-- Any other relevant information -->
+- Related issues:
+- Screenshots (if UI issue):
+- Log output:
+
+## Validation Checklist
+
+- [ ] I have run `bash scripts/check.sh` and it passes (or fails with this specific issue)
+- [ ] This is a bug in Rig itself, not a usage question
+- [ ] I have checked existing issues for duplicates
+- [ ] The issue is reproducible with the steps above

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,12 +1,123 @@
 ---
-name: Feature request
-about: Propose a Rig improvement
-title: "[feature]"
-labels: enhancement
+name: Feature Request
+about: Propose a Rig improvement or new capability
+title: "[FEAT] "
+labels: enhancement, needs-triage
+assignees: ''
 ---
 
-## Problem
+> **Note:** Rig has strict scope boundaries. Please review [CONTEXT.md](../CONTEXT.md) and [ROADMAP.md](../docs/roadmap/README.md) before submitting.
 
-## Proposal
+## Problem Statement
 
-## Why it matters
+<!-- What problem does this feature solve? -->
+<!-- Why is the current behavior insufficient? -->
+
+## Proposed Solution
+
+<!-- Describe the feature you'd like to see -->
+
+## Why It Matters
+
+<!-- 
+- Why is this important for Rig's mission?
+- How does it improve governance, replay, or projections?
+- Who benefits from this feature?
+-->
+
+## Scope Assessment
+
+**Rig's Core Doctrine:**
+- Models propose; Rig disposes
+- Local-first, offline-capable governance
+- No auto-apply, no auto-accept
+- Replayable from receipts alone
+- Projection-only UI
+
+**Please confirm this proposal aligns with Rig's doctrine:**
+
+- [ ] This feature does NOT add new AI capabilities
+- [ ] This feature does NOT add new governance systems
+- [ ] This feature does NOT add new replay systems
+- [ ] This feature does NOT require hosted/SaaS components
+- [ ] This feature does NOT add OAuth or authentication
+- [ ] This feature does NOT add database dependencies
+- [ ] This feature maintains local-first operation
+- [ ] This feature maintains replay determinism
+- [ ] This feature maintains projection contracts
+
+## Implementation Considerations
+
+### Impact on Receipt Schema
+
+- [ ] No changes to existing receipt types
+- [ ] Adds new receipt type(s): _______
+- [ ] Modifies existing receipt type(s): _______
+
+### Impact on Projection Contracts
+
+- [ ] No changes to existing projections
+- [ ] Adds new projection(s): _______
+- [ ] Modifies existing projection(s): _______
+
+### Impact on Governance Engine
+
+- [ ] No changes to existing gates
+- [ ] Adds new gate(s): _______
+- [ ] Modifies existing gate(s): _______
+
+### Dependencies
+
+- [ ] No new dependencies
+- [ ] New dependency(ies): _______
+- [ ] New optional dependency group: _______
+
+### Breaking Changes
+
+- [ ] No breaking changes
+- [ ] Breaking changes to: _______
+- [ ] Migration path: _______
+
+## Example Usage
+
+<!-- How would users interact with this feature? -->
+```bash
+# CLI examples
+python -m rig ...
+```
+
+## Alternatives Considered
+
+<!-- What other approaches did you consider? Why was this one chosen? -->
+
+## Related Documentation
+
+<!-- Links to relevant docs, ADRs, or issues -->
+- [ ] CONTEXT.md defines terms used
+- [ ] Architecture docs explain relevant components
+- [ ] Related issues: #______
+
+## Validation Plan
+
+<!-- How would this feature be tested? -->
+- [ ] Unit tests for new functionality
+- [ ] Integration tests for new workflows
+- [ ] Replay tests for new receipt types
+- [ ] Projection contract tests for new projections
+- [ ] Manual validation of end-to-end flow
+
+## Acceptance Criteria
+
+<!-- What must be true for this feature to be considered complete? -->
+- [ ] Documentation updated
+- [ ] Tests added and passing
+- [ ] `bash scripts/check.sh` passes
+- [ ] Replay determinism maintained
+- [ ] Projection contracts maintained
+- [ ] Backwards compatibility maintained
+
+## Additional Context
+
+- Blocked by:
+- Blocks:
+- Related proposals: