Integrate PRs #5, #6, and #7: hardening and pairwise evaluation

.editorconfig

@@ -0,0 +1,21 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{py,swift}]
+indent_style = space
+indent_size = 4
+
+[*.{js,json,ts,yml,yaml}]
+indent_style = space
+indent_size = 2
+
+[Makefile]
+indent_style = tab
+
+[*.md]
+trim_trailing_whitespace = false

.env.example

@@ -43,3 +43,15 @@ CORTEX_EMBEDDING_MODEL=text-embedding-3-small
 CORTEX_EMBEDDING_DIMENSIONS=384
 CORTEX_EMBEDDING_STRICT=0
 OPENAI_API_KEY=
+
+# Pairwise evaluation preflight admission. These are operator-owned ceilings;
+# request callers can tighten them but cannot raise them.
+CORTEX_PAIRWISE_MAX_PROVIDER_CALLS=1000
+CORTEX_PAIRWISE_MAX_TOTAL_TOKENS=10000000
+CORTEX_PAIRWISE_MAX_DURATION_SECONDS=86400
+CORTEX_PAIRWISE_MAX_PARALLEL_GENERATIONS=1
+CORTEX_PAIRWISE_MAX_PARALLEL_JUDGMENTS=1
+# Optional: enables short-lived, user-bound admission receipts. Use a distinct
+# random secret of at least 32 bytes; do not reuse an API or provider key.
+CORTEX_PAIRWISE_ADMISSION_SIGNING_KEY=
+CORTEX_PAIRWISE_ADMISSION_RECEIPT_TTL_SECONDS=900

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,64 @@
+name: Bug report
+description: Report a reproducible problem in Cortex.
+title: "[Bug]: "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve Cortex. Do not include private memory, vaults, exports, credentials, or tokens.
+        Security issues belong in the private process described in SECURITY.md.
+  - type: input
+    id: version
+    attributes:
+      label: Cortex version or commit
+      placeholder: "0.2.0 build 51, or commit SHA"
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: macOS version, architecture, and installation method.
+      placeholder: "macOS 15.5, Apple Silicon, downloaded DMG"
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Reproduction steps
+      description: Use synthetic data and the smallest deterministic reproduction.
+      placeholder: |
+        1. Start Cortex…
+        2. Connect…
+        3. Observe…
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: diagnostics
+    attributes:
+      label: Sanitized diagnostics
+      description: Paste only content-free logs or support-bundle excerpts you reviewed.
+      render: text
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Safety checklist
+      options:
+        - label: I searched existing issues and checked the troubleshooting guide.
+          required: true
+        - label: I removed private memory, credentials, tokens, and personal identifiers.
+          required: true
+        - label: This is not a security vulnerability.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security report
+    url: https://github.com/trace-cortex/cortex-app/security/policy
+    about: Report vulnerabilities privately; do not open a public issue.
+  - name: Support guide
+    url: https://github.com/trace-cortex/cortex-app/blob/main/SUPPORT.md
+    about: Choose the right support path and learn what diagnostics are safe to share.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,38 @@
+name: Feature request
+description: Propose a focused improvement backed by a real use case.
+title: "[Feature]: "
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What job is difficult today, and for whom?
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Describe success without prescribing an implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence or example
+      description: Use synthetic data; never paste private memory or credentials.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: checkboxes
+    id: principles
+    attributes:
+      label: Product principles
+      options:
+        - label: This preserves explicit consent and local-first defaults.
+          required: true
+        - label: This does not require Cortex to produce uncited personal claims.
+          required: true

.github/ISSUE_TEMPLATE/installation_help.yml

@@ -0,0 +1,58 @@
+name: Installation help
+description: Report a reproducible setup, launch, or first-run failure.
+title: "[Install]: "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Start with `make doctor` and the troubleshooting guide. Do not paste tokens, private memory, vault files, or account details.
+  - type: dropdown
+    id: path
+    attributes:
+      label: Installation path
+      options:
+        - Downloaded macOS DMG
+        - make demo / backend development
+        - macOS source build
+        - SDK or plugin
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: OS version, architecture, and relevant Python/Node version.
+      placeholder: "macOS 15.5 arm64; Python 3.12.13"
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command or action that failed
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: output
+    attributes:
+      label: Sanitized output
+      description: Include the exact error and `make doctor` output when applicable.
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: attempted
+    attributes:
+      label: What you already tried
+      description: Link the troubleshooting step if one applied.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Safety and duplicate checks
+      options:
+        - label: I checked docs/TROUBLESHOOTING.md and searched existing issues.
+          required: true
+        - label: I removed tokens, private data, account details, and vault contents.
+          required: true
+        - label: This is not a security vulnerability.
+          required: true

.github/ISSUE_TEMPLATE/showcase.yml

@@ -0,0 +1,43 @@
+name: Integration showcase
+description: Share something you built with Cortex so others can learn from it.
+title: "[Showcase]: "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for building with Cortex. Share the pattern, not private data:
+        use synthetic examples and remove tokens, personal memories, and vault paths.
+  - type: input
+    id: project
+    attributes:
+      label: Project
+      description: What did you build?
+      placeholder: A coding agent that retrieves cited architecture decisions
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: What it unlocks
+      description: Describe the user or developer outcome in a few sentences.
+    validations:
+      required: true
+  - type: textarea
+    id: integration
+    attributes:
+      label: How Cortex is used
+      description: Which API, MCP tool, SDK, connector, or example did you start from?
+    validations:
+      required: true
+  - type: input
+    id: link
+    attributes:
+      label: Public link
+      description: Optional repository, demo, article, or screenshot URL.
+  - type: checkboxes
+    id: privacy
+    attributes:
+      label: Privacy check
+      options:
+        - label: I removed credentials, personal memories, exports, and identifying vault data.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,34 @@
+## What changed
+
+<!-- Explain the user or contributor problem and the smallest solution. -->
+
+## Why
+
+<!-- Link the issue or provide evidence that motivated the change. -->
+
+## Validation
+
+- [ ] Added or updated behavioral tests where appropriate
+- [ ] Ran `make check`
+- [ ] Ran the relevant package/app-specific checks
+- [ ] Updated current-product documentation for public behavior changes
+
+Commands and results:
+
+```text
+paste concise evidence here
+```
+
+## Risk and rollback
+
+<!-- Name storage, security, API, migration, or compatibility risks. Explain rollback. -->
+
+## Privacy and security
+
+- [ ] No real memory, exports, credentials, tokens, or private identifiers are included
+- [ ] Capability and authorization checks remain enforced at execution boundaries
+- [ ] Not applicable
+
+## Screenshots
+
+<!-- Include before/after UI screenshots when the user experience changes. -->

.github/REPOSITORY_METADATA.md

@@ -0,0 +1,42 @@
+# GitHub Repository Metadata
+
+Keep the repository's GitHub settings aligned with the public product contract.
+These fields are not derived from files, so a maintainer must update them in
+**Settings → General** when the positioning changes.
+
+## Description
+
+> Local, cited memory for Claude, Cursor, ChatGPT, and MCP agents—review what it learns and keep a readable vault you own.
+
+## Website
+
+Use the canonical product or documentation URL only when it is maintained and
+matches the current open-source release. Otherwise leave this blank rather than
+linking to an outdated landing page.
+
+## Topics
+
+```text
+ai-memory
+local-first
+mcp
+ai-agents
+rag
+personal-knowledge-management
+sqlite
+swiftui
+python
+privacy
+```
+
+## Social preview
+
+Upload [`assets/social-preview.png`](assets/social-preview.png). The same image
+appears at the top of the README, so link previews and the repository's
+two-minute visitor story stay visually consistent.
+
+## Release copy
+
+Lead with a concrete user outcome, name the supported platform, link the
+changelog, and repeat any material beta limitation. Do not use benchmark
+results as real-world quality claims.