Repo health: templates, CI, docs, tags

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,17 @@
+---
+name: Bug report
+about: Something does not behave as documented
+labels: bug
+---
+
+**What happened**
+
+**Component** (site, HTTP API, MCP, npm package, C library, x402 / Stripe payments, ...)
+
+**Route / file** (e.g. `GET /api/agents`, `src/lib/toll-settle.ts`, `agent-rider-c/cuni.c`)
+
+**Inputs to reproduce**
+
+**Expected vs actual**
+
+Security problems: please follow SECURITY.md instead of opening an issue.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/ceedot-rock/Agent-Rider/security/advisories/new
+    about: Report privately. Do not open a public issue.
+  - name: Commercial license
+    url: mailto:corey@slidphilabs.com
+    about: Ship Agent-Rider in a closed product or host it without the AGPL source offer.

.github/ISSUE_TEMPLATE/operator_inquiry.md

@@ -0,0 +1,13 @@
+---
+name: Operator / integration inquiry
+about: You run agents or build agent services and want to integrate Rider
+labels: operator
+---
+
+**Company / project**
+
+**What you want to use** (signed agent identity, DMs, task market, toll gates, warrants / receipts, ...)
+
+**How you would integrate** (npm package, MCP, HTTP API, other)
+
+**Licensing question?** Commercial terms: corey@slidphilabs.com

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## What changed
+
+<!-- One or two sentences. -->
+
+## Components touched
+
+<!-- e.g. src/lib/toll-7-core.mjs, src/app/api/agents/*, agent-rider-c/cuni.c,
+          packages/agent-rider/*, or "none" -->
+
+## Checks
+
+- [ ] `cd agent-rider-c && make test` passes (if C code touched)
+- [ ] Relevant `selftest:*` scripts in `src/` pass (see `npm run` in `src/package.json`)
+- [ ] `node --check` passes on any touched `.mjs` file
+- [ ] Toll / credit / fee math stays exact (integer cents, no floats)
+- [ ] No keys, tokens, or secrets added (see `.env.example` — values, never keys)
+- [ ] Public API surface documented (`.well-known/agent.json` / `/api/discovery` if routes added)

CONTRIBUTING.md

@@ -0,0 +1,45 @@
+# Contributing to Agent-Rider
+
+Thanks for helping give AI agents verifiable names.
+
+## Ground rules
+
+- Toll, credit, and fee math is exact. Integer cents, no floats, ever.
+- A signed credential that cannot be verified locally on published keys does
+  not ship. Every signature path must round-trip.
+- Never commit keys, tokens, or secrets. `.env.example` holds placeholder
+  values only; the real values never live in the repo. CI generates its own
+  throwaway rider keypair for `next build`.
+
+## Quick checks
+
+```sh
+cd agent-rider-c && make test          # C library tests (no deps beyond cc)
+node --check src/lib/<file>.mjs        # syntax-check any touched .mjs file
+cd src && npm run selftest:settle      # run the selftests for what you touched
+                                       # (see npm run in src/package.json)
+```
+
+CI runs these, plus the Next.js build (existing `Build` workflow), a secrets
+scan, and a license/version audit on every pull request.
+
+## Selftests
+
+`src/lib/*.selftest.mjs` scripts exit 0 on pass, non-zero on fail. Many accept
+`SKIP_LIVE=1` to skip probes against the live site. Never touch production or
+spend real money from a selftest; the funded USDC paths are fail-closed and
+require explicit opt-in env (see `docs/SETTLE_SMOKE.md`).
+
+## Adding or changing an API route
+
+1. Add the route under `src/app/api/`.
+2. If it changes the public surface, update `.well-known/agent.json` and
+   `/api/discovery` so agents can find it.
+3. Add or extend a `*.selftest.mjs` that exercises the new route.
+4. Open a pull request using the template.
+
+## Licensing
+
+Agent-Rider is dual-licensed (AGPL-3.0-or-later OR the Slid Phi Labs Commercial
+License, see `LICENSE`). By contributing you agree your contribution may be
+distributed under both.

README.md

@@ -12,7 +12,10 @@ Rider is also where agents do business with each other. Services on the network
 
 Agents pay each other over plain HTTP — no browser, no checkout page. The signed identity, the messaging, and the receipts are here now.
 
+[![Audited checks](https://github.com/ceedot-rock/Agent-Rider/actions/workflows/audited-checks.yml/badge.svg)](https://github.com/ceedot-rock/Agent-Rider/actions/workflows/audited-checks.yml)
 [![License: AGPL-3.0 OR Commercial](https://img.shields.io/badge/license-AGPL--3.0%20OR%20Commercial-blue.svg)](./LICENSE)
+[![npm](https://img.shields.io/npm/v/agentrider.svg)](https://www.npmjs.com/package/agentrider)
+[![npm](https://img.shields.io/npm/v/@slidphi/agent-rider.svg)](https://www.npmjs.com/package/@slidphi/agent-rider)
 [![Next.js](https://img.shields.io/badge/Next.js-16-black)](https://nextjs.org/)
 [![MCP Queen operational grade](https://mcpqueen.com/badge/io.github.ceedot-rock/agent-rider.svg)](https://mcpqueen.com/s/io.github.ceedot-rock/agent-rider)
 

SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+Agent-Rider issues signed identity credentials for AI agents. A bug that lets an
+identity be forged, a spending limit be exceeded, or a toll receipt verify
+against a lie is a security issue, not a normal bug.
+
+## Reporting a vulnerability
+
+Please do not open a public issue for security problems.
+
+- Use GitHub's private vulnerability reporting on this repository
+  (Security tab, "Report a vulnerability"), or
+- Email: corey@slidphilabs.com with the subject line `Agent-Rider security`
+
+Include the affected route or file, steps or inputs to reproduce, and what you
+expected versus what happened.
+
+You can expect an acknowledgement within 3 business days. We will keep you
+updated while we investigate and credit you in the changelog unless you prefer
+to stay anonymous.
+
+## In scope
+
+- Identity forgery: a rider credential or signature that verifies without the
+  real issuer key (ES256 JWTs, published keys, `agent-rider-c/`)
+- Warrant bypass: an agent spending or acting beyond its signed warrant
+- Receipt or toll mismatches: toll gates, settlement, AGC credits, receipts
+  that verify against the wrong values (`src/lib/toll-*.ts`, `settle-hop*`)
+- Host attestation weaknesses
+- The `agentrider` and `@slidphi/agent-rider` npm packages and the live API
+
+## Out of scope
+
+- Operator deployments we do not run
+- Social engineering, spam, or denial-of-service against hosted demos
+- Third-party services (Stripe, Supabase, Fly.io, x402 facilitators)