chore: close the repository-hygiene gaps before the first release

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Every path is owned by the maintainer; GitHub requests review automatically.
+* @Blind-Striker

.github/CONTRIBUTING.md

@@ -94,7 +94,7 @@ sign.
 
 ### Creating a Bug Report
 
-Use the [bug report template](ISSUE_TEMPLATE/bug_report.md), which asks for:
+Use the [bug report form](https://github.com/Blind-Striker/opencode-sdk-dotnet/issues/new/choose), which asks for:
 
 - **Environment details** (SDK version, opencode server version, target framework, OS)
 - **A minimal reproduction** — the smallest snippet that shows the problem

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,132 @@
+name: Bug report
+description: Something in the SDK behaves differently than documented
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing: this is the **.NET SDK**, not the opencode server. If the server itself
+        misbehaves — a wrong response body, a route that 500s under any client — report it at
+        [anomalyco/opencode](https://github.com/anomalyco/opencode/issues) instead.
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened, and what did you expect instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Minimal reproduction
+      description: The smallest snippet that shows it. Redact credentials and project content.
+      render: csharp
+      value: |
+        using OpenCode.Sdk;
+
+        using var client = new OpenCodeClient(new OpenCodeClientOptions
+        {
+            Endpoint = new Uri("http://127.0.0.1:4096"),
+        });
+    validations:
+      required: true
+
+  - type: input
+    id: package-version
+    attributes:
+      label: Package version
+      description: The version of `OpenCodeAI.Sdk` you are running.
+      placeholder: 0.8.0-preview.1
+    validations:
+      required: true
+
+  - type: dropdown
+    id: package-source
+    attributes:
+      label: Where did the package come from?
+      options:
+        - NuGet.org
+        - GitHub Packages nightly
+        - Built from source
+    validations:
+      required: true
+
+  - type: input
+    id: server-version
+    attributes:
+      label: opencode server version
+      description: The `version` field `GetHealthAsync` returns.
+      placeholder: v0.0.0-next-17403
+    validations:
+      required: true
+
+  - type: dropdown
+    id: server-start
+    attributes:
+      label: How was the server started?
+      options:
+        - "`opencode2 serve` that I started myself"
+        - "`OpenCodeServer.StartAsync()`"
+        - A background service that was already running
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: tfm
+    attributes:
+      label: Target framework
+      placeholder: net10.0
+    validations:
+      required: true
+
+  - type: input
+    id: os
+    attributes:
+      label: Operating system
+      placeholder: Windows 11 / Ubuntu 24.04 / macOS 15
+    validations:
+      required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Which part of the SDK?
+      options:
+        - A generated operation
+        - Event streaming (SubscribeAsync / GetLogAsync)
+        - A terminal session (PtySession / PersistentPtySession)
+        - The launcher (OpenCodeServer)
+        - Dependency injection (AddOpenCode)
+        - Serialization — a response that did not deserialize
+        - Something else
+    validations:
+      required: true
+
+  - type: textarea
+    id: errors
+    attributes:
+      label: Error message or stack trace
+      render: text
+
+  - type: textarea
+    id: raw
+    attributes:
+      label: Raw response (optional)
+      description: >
+        If the SDK refused or mistyped a payload, the raw JSON the server returned is the most
+        useful thing you can attach. Redact credentials and project content first.
+      render: json
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before you submit
+      options:
+        - label: I searched existing issues for a duplicate
+          required: true
+        - label: I checked the README's Known Issues section
+          required: true
+        - label: As far as I can tell this is the SDK's behaviour, not the server's
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: The opencode server itself
+    url: https://github.com/anomalyco/opencode/issues
+    about: Wrong server behaviour, a route that fails under any client, a missing API — report it upstream, not here.
+  - name: Report a security vulnerability
+    url: https://github.com/Blind-Striker/opencode-sdk-dotnet/security/advisories/new
+    about: Private advisory. Please do not open a public issue for a vulnerability.
+  - name: How do I use this?
+    url: https://github.com/Blind-Striker/opencode-sdk-dotnet/blob/master/docs/guide/README.md
+    about: The guide covers installing, connecting, streaming, terminals, errors, and pagination.

.github/ISSUE_TEMPLATE/operation_gap.yml

@@ -0,0 +1,62 @@
+name: Missing or wrong generated operation
+description: An operation the server declares is absent, mis-shaped, or mis-typed in the SDK
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        The callable surface is generated from an accepted OpenAPI snapshot, never from a live
+        branch, so an operation can be absent for three different reasons: the pinned snapshot
+        predates it, it is declined by a recorded decision, or generation has a defect. This form
+        asks for the two facts that tell those apart.
+
+        `src/OpenCode.Sdk/.generation-incomplete` lists every operation that is deliberately not
+        generated, with its reason. Worth checking first — it may already name yours.
+
+  - type: input
+    id: operation-id
+    attributes:
+      label: Operation id
+      description: The `operationId` as the OpenAPI document spells it.
+      placeholder: v2.session.message
+    validations:
+      required: true
+
+  - type: dropdown
+    id: kind
+    attributes:
+      label: What is wrong with it?
+      options:
+        - It is missing from the SDK entirely
+        - It exists, but a property has the wrong .NET type
+        - It exists, but a required property is optional (or the reverse)
+        - It exists, but a response arm is missing
+        - Something else
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What the document declares
+      description: >
+        The relevant fragment of the pinned `spec/openapi.json`, or the upstream source that
+        contradicts it. This is what turns a report into a fix.
+    validations:
+      required: true
+
+  - type: input
+    id: package-version
+    attributes:
+      label: Package version
+      placeholder: 0.8.0-preview.1
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before you submit
+      options:
+        - label: I checked `.generation-incomplete` and this operation is not listed there
+          required: true

.github/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-This project is pre-1.0 and has not published a stable release yet. Until `0.1.0` ships, the
+This project is pre-1.0 and has not published a stable release yet. Until the first release ships, the
 supported version is whatever is current on `master` (and the nightly packages built from it).
 Security patches are prioritized by CVSS v3.0 rating:
 
@@ -41,8 +41,8 @@ suspected vulnerability as a public issue.
 
 ## Scope
 
-This policy covers the SDK packages in this repository — `OpenCode.Sdk` and
-`OpenCode.Sdk.Extensions` — and the repository's own tooling and workflows.
+This policy covers the SDK packages in this repository — `OpenCodeAI.Sdk` and
+`OpenCodeAI.Sdk.Extensions` — and the repository's own tooling and workflows.
 
 Two things are explicitly **out of scope**:
 

.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+updates:
+  # Central Package Management holds every version in Directory.Packages.props, so a NuGet update
+  # is a one-file change. Analyzers move together to keep the wall's arbitration reviewable in one
+  # place rather than across five separate pull requests.
+  - package-ecosystem: nuget
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      analyzers:
+        patterns:
+          - "*Analyzer*"
+          - "Roslynator.*"
+          - "SonarAnalyzer.*"
+          - "Meziantou.*"
+
+  # The workflows pin third-party actions by commit SHA; this is what keeps those pins current
+  # instead of frozen.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly

.github/triage-labels.md

@@ -1,15 +1,24 @@
 # Triage Labels
 
-Date: 2026-08-18
+Date: 2026-09-08
 
-The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
+What the labels on this repository's issues mean. Every new issue starts at `needs-triage`; the
+rest describe where it went from there.
 
-| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
-| -------------------------- | -------------------- | ---------------------------------------- |
-| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
-| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
-| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
-| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
-| `wontfix`                  | `wontfix`            | Will not be actioned                     |
+| Label | Meaning |
+|---|---|
+| `needs-triage` | Filed, not yet evaluated. The maintainer decides what it is and where it goes. |
+| `needs-info` | Evaluated, but it cannot move until the reporter answers something. Stale ones are closed. |
+| `ready-for-human` | Specified enough to work on, and it needs a person: a design call, a canon change, or a judgement the issue cannot state for you. |
+| `ready-for-agent` | Specified enough that the work is mechanical — the change, the files, and the passing condition are all named in the issue. |
+| `bug` | Behaviour that contradicts what is documented. |
+| `enhancement` | Something the SDK does not do yet. |
+| `performance` | Speed or allocation work. Claims here are settled by the benchmark suite, never by inspection. |
+| `documentation` | Only prose changes. |
+| `question` | A usage question. Answered, then closed. |
+| `good first issue` | Small, self-contained, and does not require reading the generator to start. |
+| `help wanted` | Would be welcome from anyone; not on the maintainer's own queue. |
+| `duplicate`, `invalid`, `wontfix` | Closed, with the reason in a comment. |
 
-When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.
+`ready-for-human` and `ready-for-agent` split the same state — specified and actionable — by what
+kind of attention the work needs, not by who is allowed to take it. Anyone may pick up either.