Pass hardening 100: CLI, MCP, store, docs, CI

.github/CODEOWNERS

@@ -0,0 +1,14 @@
+# CODEOWNERS
+#
+# TelivityAI maintainers review changes to core packages, MCP surface,
+# adapters, and release docs. Update @TelivityAI to the actual GitHub team
+# or maintainer handles when known.
+
+* @TelivityAI
+
+/packages/core/     @TelivityAI
+/packages/cli/      @TelivityAI
+/packages/mcp/      @TelivityAI
+/adapters/          @TelivityAI
+/docs/              @TelivityAI
+/.github/           @TelivityAI

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Report a problem with Agent Wallclock CLI, store, or MCP server
+title: "[bug] "
+labels: bug
+assignees: ''
+---
+
+## Version
+
+- Agent Wallclock version: (`wallclock --version`)
+- Node version:
+- OS:
+
+## What happened
+
+<!-- Clear description of the bug -->
+
+## Steps to reproduce
+
+1.
+2.
+3.
+
+## Expected behavior
+
+## Actual behavior
+
+## Diagnostics
+
+```text
+# Paste sanitized output — no home paths, no store.json contents unless intentional
+wallclock doctor
+```
+
+## Additional context
+
+<!-- MCP host, writes enabled, etc. -->

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,26 @@
+---
+name: Feature request
+about: Suggest an idea for Agent Wallclock
+title: "[feature] "
+labels: enhancement
+assignees: ''
+---
+
+## Problem
+
+<!-- What problem does this solve? Keep scope local-first. -->
+
+## Proposed solution
+
+## Alternatives considered
+
+## Host impact
+
+- [ ] CLI only
+- [ ] MCP tools
+- [ ] Adapters / MODEL_RULES
+- [ ] Docs
+
+## Additional context
+
+<!-- Optional mockups, briefing examples (sanitized) -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,32 @@
+## Summary
+
+<!-- What changed and why (1–3 sentences). -->
+
+## Type
+
+- [ ] fix/pass batch (`fix/pass-NNN-slug`)
+- [ ] Feature (`feat/…`)
+- [ ] Docs only
+- [ ] Chore / deps
+
+## Test plan
+
+- [ ] `npm run build`
+- [ ] `npm test`
+- [ ] `npm run smoke`
+- [ ] `wallclock doctor` (if CLI/MCP touched)
+- [ ] Adapters updated if `MODEL_RULES` or briefing shape changed
+
+## No-leak
+
+- [ ] No home paths (`/Users/…`) or tokens in diff
+- [ ] MCP paths use placeholders or `mcp-config --print` output redacted
+
+## Screenshots / docs
+
+- [ ] MOCK images still labeled MOCK
+- [ ] No fake product UI presented as real
+
+## Related
+
+<!-- Issues, pass batch name (e.g. fix/pass-hardening-100), prior PRs -->

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      production-dependencies:
+        dependency-type: production
+      development-dependencies:
+        dependency-type: development
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/release.yml

@@ -0,0 +1,24 @@
+changelog:
+  exclude:
+    labels:
+      - dependencies
+      - skip-changelog
+  categories:
+    - title: Added
+      labels:
+        - enhancement
+        - feature
+    - title: Changed
+      labels:
+        - changed
+    - title: Fixed
+      labels:
+        - bug
+        - fix
+    - title: Documentation
+      labels:
+        - documentation
+    - title: Maintenance
+      labels:
+        - chore
+        - internal

.github/workflows/ci.yml

@@ -6,7 +6,7 @@ on:
   pull_request:
 
 jobs:
-  test:
+  lint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -16,5 +16,103 @@ jobs:
           cache: npm
       - run: npm install
       - run: npm run build
+      - run: npm run lint
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [20, 22]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+      - run: npm install
+      - run: npm run build
       - run: npm test
+
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+      - run: npm install
+      - run: npm run test:coverage -w @agent-wallclock/core
+
+  smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+      - run: npm install
       - run: npm run smoke
+
+  smoke-windows:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+      - run: npm install
+      - run: npm run build
+      - run: node scripts/smoke.mjs
+
+  smoke-macos:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+      - run: npm install
+      - run: npm run build
+      - run: node scripts/smoke.mjs
+      - run: node scripts/mcp-smoke.mjs
+
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+      - run: npm install
+      - run: node scripts/leak-grep.mjs
+      - name: no outbound network calls in package sources
+        run: |
+          set -euo pipefail
+          if grep -RInE 'fetch\(|http\.request|https\.request|axios|got\(' packages/*/src; then
+            echo "Found outbound network usage in packages/*/src"
+            exit 1
+          fi
+          echo "no-telemetry OK"
+      - run: npm audit --audit-level=high
+      - name: gitleaks
+        run: |
+          set -euo pipefail
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.24.3/gitleaks_8.24.3_linux_x64.tar.gz | tar -xz gitleaks
+          ./gitleaks detect --source . --verbose --no-banner
+
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: actionlint
+        run: |
+          bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+          ./actionlint -color

.github/workflows/release-tag.yml

@@ -0,0 +1,32 @@
+name: release-tag
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Annotated tag to create (e.g. v0.1.1)"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Validate tag format
+        run: |
+          if ! echo "${{ inputs.version }}" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "Tag must match vMAJOR.MINOR.PATCH (e.g. v0.1.1)"
+            exit 1
+          fi
+      - name: Create annotated tag
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "${{ inputs.version }}" -m "Release ${{ inputs.version }}"
+          git push origin "${{ inputs.version }}"

.gitignore

@@ -10,3 +10,6 @@ coverage/
 *.tgz
 .turbo/
 *.tsbuildinfo
+store.backup.*.json
+*.corrupt.*
+**/store.backup.*.json

CHANGELOG.md

@@ -0,0 +1,36 @@
+# Changelog
+
+All notable changes to Agent Wallclock are documented here.
+
+Format loosely follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versioning starts at **0.1.0** for the first public QA-ready release.
+
+## [0.1.0] — 2026-07-31
+
+First post-QA hardening release batch (`fix/pass-hardening-100`).
+
+### Added
+
+- **CLI:** `wallclock doctor`, `wallclock where`, `wallclock --version`, shell `completion`
+- **CLI:** `wallclock brief --json` and `--compact`
+- **CLI:** `wallclock store backup` / `store restore`
+- **CLI:** `wallclock session status`
+- **CLI:** `wallclock effort rename`, `archive`, `unarchive`, `delete --confirm`
+- **CLI:** `wallclock mcp-config --print vscode` (alongside claude/cursor)
+- **MCP:** `get_session_status`, `get_timeline` read tools
+- **MCP:** `log_session` with `start` / `end` / `manual` actions (writes gated)
+- **Core:** Store v2 migration path, lock handling, `runDoctor` checks
+- **Docs:** Architecture, pass PR naming, no-leak and ship checklists, troubleshooting, contributing, security policy
+- **GitHub:** PR/issue templates, Dependabot, CODEOWNERS, release notes template
+
+### Changed
+
+- Briefing includes explicit **Freshness** block (`Generated at`, `Stale after`)
+- `MODEL_RULES` synced across adapters (freshness TTL language, no invented durations)
+- README honest about paste/MCP trust boundaries and MOCK illustrative screenshots
+- MCP write tools remain opt-in via `AGENT_WALLCLOCK_WRITES=1`
+
+### Fixed
+
+- Hardening pass: exit codes, store repair path, MCP smoke coverage for new tools
+
+[0.1.0]: https://github.com/TelivityAI/agent-wallclock/releases/tag/v0.1.0