chore(context): conform agent context, Dependabot and project card

.github/dependabot.yml

@@ -0,0 +1,61 @@
+# Canonical Dependabot configuration of the Libre AI fleet.
+#
+# Source of truth: libre-ai/project-governance, distribution/templates/dependabot/ —
+# two variants, one per manifest set observed at main. github-actions is
+# always present (every repository carries .github/workflows); cargo is added
+# when Cargo.toml exists: github-actions.yml, cargo.yml. Every non-archived
+# repository of ecosystem/repositories.v1.yaml carries the byte-exact copy of
+# its variant at .github/dependabot.yml; the weekly "Inventory drift" job
+# (ecosystem/check-dependabot-conformance.ts) names each repository that
+# does not. Never edit this copy — change the template in governance and let
+# the next fleet wave carry it.
+#
+# No bun entry, on purpose (owner decision 2026-09-08). The bun variants
+# published on 2026-09-07 failed on their first run (governance run
+# 34139635260, job "bun in /."):
+#   Dependabot::DependencyFileNotSupported —
+#   Unsupported bun.lock 'lockfileVersion' 2 in /bun.lock.
+#   The bun version Dependabot runs supports up to 1.
+# Every fleet lockfile is written by bun 1.4 (lockfileVersion 2), so a bun
+# entry is a permanent job error that opens no pull request — a guard that
+# cannot prove it ran, which the doctrine forbids. Upstream:
+# https://github.com/dependabot/dependabot-core/issues/16026 (open on
+# 2026-09-08, "Bun 1.4 uses lockfile v2 which dependabot currently does not
+# support"). Restore the entry when dependabot-core reads lockfileVersion 2 —
+# an owner decision, proved by a trial pull request on one repository before
+# any fleet wave. Until then bun dependencies are watched by the weekly
+# "Fleet advisories" workflow (`bun audit` on every living lockfile,
+# tools/security/check-fleet-advisories.ts) and bumped by agent waves.
+#
+# Release-age guard, on purpose: bunfig.toml pins minimumReleaseAge to
+# 259200 seconds (3 days). A bump to a version younger than that fails
+# `bun install --frozen-lockfile` in CI, and that red is the guard working —
+# never widen minimumReleaseAgeExcludes to make a Dependabot pull request
+# pass. `cooldown` below restates Dependabot's own 3-day default so both
+# guards read the same number; Dependabot never replaces the CI floor.
+#
+# Labels are left to Dependabot's defaults (`dependencies` plus the ecosystem
+# label, created on demand): a custom label absent from a repository is
+# silently ignored, which across a fleet is a guard that cannot prove it ran.
+#
+# Dependabot commits are forge-authored: the DCO gate accepts them from
+# governance generation 767ee84a (governance #29) onward and rejects them
+# before it — bump the fleet pin before restoring Dependabot on a repository.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Paris
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+    cooldown:
+      default-days: 3
+    groups:
+      github-actions:
+        patterns:
+          - "*"

AGENTS.md

@@ -0,0 +1,27 @@
+# Collaborative Data Sync Agent Rules
+
+## Authority
+
+Collaboration core and relay, couche 4 brick of the Libre AI constellation.
+Doctrine lives upstream:
+https://raw.githubusercontent.com/libre-ai/project-governance/HEAD/AGENTS.md
+
+## Boundaries
+
+- Contract shapes are canonical in `libre-ai/schemas-and-contracts`, never
+  redefined here; a new canonical contract is admitted there first.
+- Synchronization never widens application permissions; access decisions
+  stay with the consuming application.
+- Product code and product specifications live in their own repositories;
+  `packages/core` and `packages/relay` keep their own names and versions.
+
+## Quality gates
+
+Install through the shared local composition (`docs/development.md`), then
+run `bun run check`. Never hide a red test.
+
+## Agents
+
+- Read actual state before editing.
+- Stage files before running tree-walking gates.
+- Security > quality > performance > completeness.

CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

README.md

@@ -16,6 +16,18 @@ Collaborative applications need to exchange document changes while keeping track
 
 ## Availability
 
+<!-- libre-ai:project-status:begin -->
+<!-- Section générée depuis project.v1.yaml — ne pas éditer à la main. -->
+
+- Situation actuelle : Recovered source snapshot a3d90ebd80d721901b2cb0d0bbcd46897a9cd13b is present. Product tests and CI were not rerun for this documentary integration; historical evidence is not qualification of this tree. No product admission or authority transfer is established. Historical responsibilities were held by libre-ai/collab-core, a repository since retired.
+- Maturité : idea
+- Exposition : idea
+- Confiance : medium
+- Preuves vérifiées le : 2026-10-08
+- Avancement : Avancement non calculable — périmètre à clarifier
+
+<!-- libre-ai:project-status:end -->
+
 Source code and tests are available in this repository; no package is published to a registry.
 
 Explore the [Libre AI project catalogue](https://github.com/libre-ai/.github/blob/main/profile/README.md).

project.v1.yaml

@@ -0,0 +1,50 @@
+# Project state card — the state authority since ADR-0020 (design §6.2).
+# The README status section is generated from this card (sentinels).
+schema_version: libre-ai.project.v1
+project: collaborative-data-sync
+repository: libre-ai/collaborative-data-sync
+kind: satellite
+layer: couche-4
+statement:
+  for: "contributors assessing and developing this project's intended uses"
+  who_faces: "recovered sources whose current integrated behavior still requires verification"
+  enables: "inspecting the recovered implementation and running its declared checks before admission"
+  producing:
+    - "reproducible qualification evidence for the intended scope"
+  without_depending_on:
+    - "an implicit transfer of historical authority or an assumed passing CI run"
+summary: "collaborative-data-sync: recovered sources with documentary integration under review."
+current_situation: >-
+  Recovered source snapshot a3d90ebd80d721901b2cb0d0bbcd46897a9cd13b is present.
+  Product tests and CI were not rerun for this documentary integration; historical
+  evidence is not qualification of this tree. No product admission or authority
+  transfer is established. Historical responsibilities were held by
+  libre-ai/collab-core, a repository since retired.
+scope:
+  - "Exchange edits between two clients working on the same shared document."
+  - "Recover missing changes after a disconnection without applying duplicate updates."
+  - "Handle changes in access while keeping documents and organizations separate."
+non_goals:
+  - "Claiming operational readiness merely from the presence of recovered code."
+  - "Transferring historical authority or consumers without separate reviewed admission."
+dependencies:
+  - on: libre-ai/project-governance
+    why: "Current fleet doctrine and reusable verification workflows."
+    pinned: "github:libre-ai/project-governance#2024a4884b314df99be457618be9c3b48a0287f7"
+maturity: idea
+confidence: medium
+exposure: idea
+freshness:
+  last_verified_on: 2026-10-08
+scope_stability: unstable
+phases:
+  - id: admission
+    title: "Bounded capability admission"
+    note: "Recovered code is present. Documentary checks do not accept product qualification criteria."
+    exit_criteria:
+      - id: qualified-scope
+        text: "Qualify an exact protocol and consumer with two real clients, explicit membership and the selected cryptographic implementation. Test reconnection, concurrent edits, duplicates, revoked access and isolation between documents and organizations. Observe what the relay can read and retain before making confidentiality claims. Canonical contracts require admission by Contracts; synchronization must not silently expand application permissions."
+        weight: 1
+        status: pending
+benchmark:
+  none: "No benchmark was executed for this integrated tree."