feat(trace): production hardening — re-baseline to v0.2.0 + OSS hygiene

.editorconfig

@@ -0,0 +1,67 @@
+# EditorConfig — https://editorconfig.org
+# Canonical eco-wide template (.shared-templates/editorconfig.tmpl).
+
+root = true
+
+# Default for everything.
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+# Go uses tabs by convention.
+[*.go]
+indent_style = tab
+indent_size = 4
+
+# Python — PEP 8.
+[*.py]
+indent_size = 4
+
+# TypeScript / JavaScript — 2 spaces, ecosystem default.
+[*.{ts,tsx,js,jsx,mjs,cjs}]
+indent_size = 2
+
+# Web assets.
+[*.{html,css,scss}]
+indent_size = 2
+
+# YAML — 2 spaces (ecosystem standard, GitHub Actions, k8s, etc.).
+[*.{yml,yaml}]
+indent_size = 2
+
+# JSON / JSONC.
+[*.{json,jsonc}]
+indent_size = 2
+
+# TOML.
+[*.toml]
+indent_size = 2
+
+# Markdown — 2 spaces, preserve trailing whitespace (used for line breaks).
+[*.md]
+trim_trailing_whitespace = false
+indent_size = 2
+
+# Shell scripts.
+[*.{sh,bash,zsh,fish}]
+indent_size = 4
+
+# Makefiles must use tabs.
+[{Makefile,*.mk}]
+indent_style = tab
+
+# Dockerfiles.
+[Dockerfile*]
+indent_size = 4
+
+# GitHub Actions workflows — 2 spaces.
+[.github/**/*.{yml,yaml}]
+indent_size = 2
+
+# Config files.
+[*.{cfg,ini,conf}]
+indent_size = 4

.gitattributes

@@ -0,0 +1,86 @@
+# Canonical eco-wide .gitattributes template (.shared-templates/gitattributes.tmpl).
+# Auto-detect text files and normalise line endings to LF.
+
+* text=auto eol=lf
+
+# --- Source code -----------------------------------------------------------
+*.go     text eol=lf diff=golang
+*.py     text eol=lf diff=python
+*.ts     text eol=lf
+*.tsx    text eol=lf
+*.js     text eol=lf
+*.jsx    text eol=lf
+*.mjs    text eol=lf
+*.cjs    text eol=lf
+*.rs     text eol=lf diff=rust
+
+# --- Shell + config --------------------------------------------------------
+*.sh     text eol=lf
+*.bash   text eol=lf
+*.toml   text eol=lf
+*.yaml   text eol=lf
+*.yml    text eol=lf
+*.json   text eol=lf linguist-language=JSON
+*.jsonc  text eol=lf linguist-language=JSON
+*.cff    text eol=lf
+
+# --- Documentation ---------------------------------------------------------
+*.md     text eol=lf diff=markdown
+*.txt    text eol=lf
+
+# --- Build / packaging ----------------------------------------------------
+Makefile        text eol=lf
+*.mk            text eol=lf
+Dockerfile*     text eol=lf
+docker-compose*.yml text eol=lf
+.github/**/*.yml    text eol=lf
+.github/**/*.yaml   text eol=lf
+
+# --- Generated artefacts (mark as such for diffs and language stats) ------
+go.mod          text eol=lf linguist-generated
+go.sum          text eol=lf linguist-generated
+*.pb.go         linguist-generated
+*_generated.go  linguist-generated
+package-lock.json   linguist-generated
+pnpm-lock.yaml      linguist-generated
+yarn.lock           linguist-generated
+
+# --- Vendored / external sources ------------------------------------------
+vendor/**       linguist-vendored
+node_modules/** linguist-vendored
+testdata/**     linguist-vendored
+benchmarks/data/** linguist-vendored
+
+# --- Binary files (do not text-normalise) ---------------------------------
+*.exe    binary
+*.dll    binary
+*.so     binary
+*.dylib  binary
+*.a      binary
+*.o      binary
+*.db     binary
+*.sqlite binary
+*.png    binary
+*.jpg    binary
+*.jpeg   binary
+*.gif    binary
+*.ico    binary
+*.svg    text eol=lf
+*.pdf    binary
+*.zip    binary
+*.tar.gz binary
+*.tgz    binary
+*.whl    binary
+
+# --- Source archive hygiene (excluded from `git archive`) -----------------
+.github         export-ignore
+.shared-templates export-ignore
+.gitattributes  export-ignore
+.gitignore      export-ignore
+.editorconfig   export-ignore
+.golangci.yml   export-ignore
+.goreleaser.yml export-ignore
+.goreleaser.yaml export-ignore
+testdata/       export-ignore
+benchmarks/     export-ignore
+e2e/            export-ignore

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,81 @@
+<!--
+  Thanks for your contribution! Please fill out this template so reviewers can
+  understand the change quickly. Anything that does not apply can be left in
+  place; do not delete unanswered sections — write "n/a".
+-->
+
+## Summary
+
+<!--
+  One paragraph describing what this PR does and why. Link the related
+  issue(s) with `Fixes #N` or `Refs #N` if applicable.
+-->
+
+## Changes
+
+<!--
+  Bullet list of what changed, grouped by area (cmd/trace, perf, redact,
+  e2e, docs, CI). Reviewers should be able to skim this and know what to
+  look at first.
+-->
+
+-
+
+## Privacy & redaction impact
+
+<!--
+  Trace records developer sessions. Any change that touches `redact/`,
+  `cmd/trace/cli/checkpoint/`, or transcript serialization can leak PII,
+  secrets, or proprietary code if regressed.
+
+  - Did you change `redact/redact.go`, `redact/pii.go`, the secret-pattern
+    list, or any code that decides what gets persisted?
+  - If yes: paste before/after `go test -count=1 ./redact/...` results
+    and explicitly call out which redaction patterns were added, removed,
+    or relaxed.
+  - If no: write "n/a".
+-->
+
+## Agent compatibility
+
+<!--
+  trace integrates with Claude Code, Codex, Gemini CLI, OpenCode, Cursor,
+  Factory AI Droid, Copilot CLI, etc. Did you change any agent-specific
+  parsing or transcript shape?
+
+  - Which agents did you test against? (`scripts/test-*-agent-integration.sh`,
+    `e2e/agents/`, or manual.)
+  - Note any agent that you could not test locally and why.
+-->
+
+## Testing
+
+<!--
+  Describe how you tested. Paste output of `mise run test` (or `go test
+  -race -count=1 ./...`) and the lint task. If you added new tests,
+  list them.
+-->
+
+```text
+$ go test -race -count=1 ./...
+...
+$ golangci-lint run ./...
+...
+```
+
+## Checklist
+
+- [ ] Commits follow [Conventional Commits](https://www.conventionalcommits.org/)
+      (`feat:`, `fix:`, `perf:`, `refactor:`, `docs:`, `test:`, etc.)
+- [ ] `go build ./...` passes
+- [ ] `golangci-lint run ./...` passes (no new lint findings, no
+      `nolint:…` without justification)
+- [ ] `go test -race -count=1 ./...` passes locally
+- [ ] e2e impact considered (relevant `e2e/` test added, updated, or
+      verified) — n/a if change is contained to non-runtime code
+- [ ] Public APIs in `cmd/trace/cli/...` have godoc comments
+- [ ] `CHANGELOG.md` updated under `## [Unreleased]` if user-visible
+- [ ] No regression in `redact/` tests
+- [ ] No secrets, tokens, or PII added to the repo (test fixtures use
+      synthetic values only)
+- [ ] No `Co-authored-by:` trailers (this is solo-developer work)