chore: operational maturity (SECURITY, CHANGELOG, templates, runbooks, matrix baseline)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,98 @@
+name: Bug report
+description: Report a reproducible bug in the CLI, chain binary, sidecar, or repo content.
+labels: [bug, needs-triage]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug report.
+
+        **Security vulnerabilities should NOT be filed here.** Use the private security advisory: <https://github.com/hyperspaceai/agi/security/advisories/new>
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: One or two sentences describing the bug.
+      placeholder: "When I run X, Y happens. I expected Z."
+    validations:
+      required: true
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - CLI (hyperspace binary)
+        - Chain binary (hyperspace-agentic-blockchain)
+        - Sidecar (hyperspace-network)
+        - Pods
+        - Wallet
+        - Models / inference
+        - Repo content (project, doc, schema)
+        - GitHub Actions / CI
+        - Other / unsure
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Reproduction steps
+      description: Numbered steps that reliably trigger the bug.
+      placeholder: |
+        1. Install with `curl -fsSL https://agents.hyper.space/api/install | bash`
+        2. Start with `hyperspace start`
+        3. Wait 30 seconds
+        4. Observe ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behaviour
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behaviour
+      description: Paste full error output, log lines, stack traces if available.
+      render: text
+    validations:
+      required: true
+
+  - type: input
+    id: cli_version
+    attributes:
+      label: CLI version
+      placeholder: v5.39.6
+
+  - type: input
+    id: chain_version
+    attributes:
+      label: Chain binary version (if applicable)
+      placeholder: v1.7.4
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      options:
+        - Linux x86_64
+        - Linux aarch64
+        - macOS x86_64
+        - macOS arm64
+        - Windows
+        - Browser (agents.hyper.space)
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Workarounds tried, related issues, hardware specs.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/hyperspaceai/agi/security/advisories/new
+    about: Do NOT file a public issue. Use the private security advisory.
+  - name: General discussion
+    url: https://github.com/hyperspaceai/agi/discussions
+    about: Questions, ideas, and conversations not covered by an issue type.
+  - name: Run a node
+    url: https://agents.hyper.space
+    about: Browser-based onboarding to join the network as an agent.

.github/ISSUE_TEMPLATE/rfc.yml

@@ -0,0 +1,39 @@
+name: RFC discussion
+description: Propose a structural change (protocol, schema, consensus, economics).
+title: "RFC: <one-line summary>"
+labels: [rfc, discussion]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This template is for structural changes that warrant an RFC. For feature requests on existing components, use the bug report template. For trivial fixes, just open a PR.
+
+        **Read [`docs/rfcs/README.md`](../docs/rfcs/README.md) first.** The RFC process is two stages: this issue (rough feedback), then a PR adding `docs/rfcs/RFC-NNNN-<slug>.md`.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem statement
+      description: What is structurally wrong with the current state? What does the absence of this change cost?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposed
+    attributes:
+      label: Proposed direction (sketch, not full design)
+      description: A high-level direction to anchor discussion. The detailed design lives in the eventual RFC document.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Even one or two sentences sketching alternatives helps reviewers understand the design space.
+
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope and dependencies
+      description: Does this RFC depend on or block other RFCs? Is it backwards-compatible?

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,45 @@
+<!--
+Thanks for the contribution!
+
+Title format: <type>: <short description>
+Types: feat | fix | docs | chore | refactor | perf | rfc | ci
+
+Examples:
+- feat(architect): add baseline config
+- fix(ci): handle missing snapshot timestamp
+- docs: update Pods quickstart
+- rfc: RFC-004 Modular Agents
+-->
+
+## Summary
+
+<!-- One paragraph: what this PR does and why. -->
+
+## Motivation
+
+<!-- Why is this needed? Link to the issue or RFC discussion if applicable.
+     "Closes #N" or "Refs #N" should appear here. -->
+
+## Changes
+
+<!-- Bulleted list of concrete changes. Group by file or component. -->
+
+## Test plan
+
+<!-- How can a reviewer verify this works? -->
+
+- [ ] ...
+- [ ] ...
+
+## Checklist
+
+- [ ] Branch is named `<type>/<slug>` (e.g. `fix/snapshot-timestamp`)
+- [ ] Commits follow Conventional Commits style
+- [ ] `CHANGELOG.md` updated under `[Unreleased]` for user-visible changes
+- [ ] Documentation updated where behaviour changed
+- [ ] If this PR introduces a new project, the project has README, baseline/config.yaml, baseline/results.json, and LEADERBOARD.md
+- [ ] If this PR is an RFC, the document follows `docs/rfcs/0000-template.md`
+
+## Notes for reviewer
+
+<!-- Anything specific you want the reviewer to focus on. Optional. -->

.github/workflows/validate-projects.yml

@@ -0,0 +1,84 @@
+name: Validate Project Structure
+
+# Verifies that every project under projects/ has the required files:
+#   - README.md
+#   - baseline/config.yaml
+#   - baseline/results.json
+#   - LEADERBOARD.md   (auto-populated; can be empty)
+#
+# Prevents PRs that add half-baked projects from landing on main.
+
+on:
+  pull_request:
+    paths:
+      - 'projects/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Check project structure
+        run: |
+          set -euo pipefail
+
+          REQUIRED=(README.md baseline/config.yaml baseline/results.json LEADERBOARD.md)
+          MISSING=0
+
+          for proj_dir in projects/*/; do
+            proj=$(basename "$proj_dir")
+            [ "$proj" = "_template" ] && continue
+
+            for f in "${REQUIRED[@]}"; do
+              if [ ! -f "${proj_dir}${f}" ]; then
+                echo "::error file=${proj_dir}${f}::Project '$proj' is missing required file: $f"
+                MISSING=$((MISSING+1))
+              fi
+            done
+          done
+
+          if [ "$MISSING" -gt 0 ]; then
+            echo ""
+            echo "$MISSING required project files are missing."
+            echo "Every project under projects/ must have:"
+            for f in "${REQUIRED[@]}"; do echo "  - $f"; done
+            exit 1
+          fi
+          echo "All projects have the required structure."
+
+      - name: Validate baseline configs are parseable YAML
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import sys, glob, yaml
+          errors = 0
+          for path in glob.glob('projects/*/baseline/config.yaml'):
+              if '_template' in path:
+                  continue
+              try:
+                  with open(path) as f:
+                      yaml.safe_load(f)
+              except yaml.YAMLError as e:
+                  print(f"::error file={path}::Invalid YAML: {e}")
+                  errors += 1
+          sys.exit(1 if errors else 0)
+          PY
+
+      - name: Validate baseline results are parseable JSON
+        run: |
+          set -euo pipefail
+          for f in projects/*/baseline/results.json; do
+            [[ "$f" == *_template* ]] && continue
+            if ! jq empty "$f" 2>/dev/null; then
+              echo "::error file=$f::Invalid JSON"
+              exit 1
+            fi
+          done
+          echo "All baseline results are valid JSON."

CHANGELOG.md

@@ -0,0 +1,87 @@
+# Changelog
+
+All notable changes to the Hyperspace AGI repository (this archive of
+research, agents, projects, and protocol RFCs) are recorded here.
+
+This is **not** the changelog for the CLI binary or the chain binary —
+those have their own release notes. This file tracks changes to **the
+repository content**: documentation, research projects, schemas, scripts,
+RFCs, and CI infrastructure.
+
+Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+Versions: date-based [CalVer](https://calver.org/) (`YYYY.MM.PATCH`).
+
+---
+
+## [Unreleased]
+
+### Added
+- `SECURITY.md` — threat model, vulnerability reporting policy, scope.
+- `CHANGELOG.md` — this file.
+- `.github/ISSUE_TEMPLATE/` — structured templates for bug reports and RFCs.
+- `.github/PULL_REQUEST_TEMPLATE.md` — PR checklist.
+- `.github/workflows/validate-projects.yml` — CI that verifies every project has the required structure (README, baseline/config.yaml, baseline/results.json, LEADERBOARD.md).
+- `docs/runbooks/` — operator runbooks for the most common incidents:
+  - `chain-fork-recovery.md`
+  - `sidecar-crash-recovery.md`
+  - `full-node-bootstrap.md`
+- `projects/matrix/baseline/` — baseline config and results for the previously incomplete Matrix neural retrieval project.
+
+---
+
+## [2026.05.07] — open contribution batch
+
+Same-day batch of four pull requests (#20, #21, #22, #23). The grouping
+below reflects the PR each change came from; the order within the day
+matches the order PRs are expected to merge.
+
+### Added (PR #20)
+- `CONTRIBUTING.md` — full contributor guide.
+- `projects/architect/baseline/` — baseline for the architect project.
+
+### Added (PR #21)
+- `.github/workflows/network-snapshots.yml` — resumes hourly snapshots stalled since 2026-03-11 (closes #12).
+- `docs/POSTMORTEM_2026-04-09_FOUR_WAY_CHAIN_FORK.md` — incident documentation for #15.
+
+### Added (PR #22)
+- `docs/VISION.md` — Compounding Intelligence Roadmap.
+- `docs/rfcs/RFC-001-verifiable-research.md` — every experiment carries a signed receipt with graduated proof ladder.
+- `docs/rfcs/RFC-002-curriculum-dag.md` — projects form a DAG of prerequisites; weights transfer along edges.
+- `docs/rfcs/RFC-003-pouw-consensus.md` — Proof-of-Useful-Work consensus.
+- `docs/rfcs/0000-template.md` — RFC template.
+- `docs/rfcs/README.md` — RFC process documentation.
+- `schemas/research-receipt-v1.schema.json` — JSON Schema for receipts.
+- `scripts/sign-receipt.js` — Ed25519 signer.
+- `scripts/validate-receipt.js` — reference validator.
+- `scripts/validate-receipt.test.js` — 17 unit tests, all passing.
+
+---
+
+## [2026.03.13] — Pods documentation
+
+### Added
+- `docs/PODS.md` — full Pods command reference and Claude Code MCP integration guide.
+
+### Changed
+- Refocused Pods docs on distributed/sharded inference.
+
+---
+
+## [2026.03.08] — repository created
+
+Initial structure: project README, project template, agents directory, blockchain README, model release for `qwen2.5-0.5b-hyperspace-v1`, and the seven seed research projects.
+
+---
+
+## How to update this changelog
+
+When opening a PR with a meaningful repo change, add an entry to `[Unreleased]`. Categories:
+
+- `Added` — new files, RFCs, projects, schemas
+- `Changed` — modifications to existing content
+- `Deprecated` — items to be removed in a future release
+- `Removed` — items removed
+- `Fixed` — bug fixes
+- `Security` — security-relevant changes
+
+When a release is cut, maintainers move `[Unreleased]` entries under a new dated heading.