chore(governance): sync governance files with uteke standard

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,75 @@
+name: Bug report
+description: Something is broken or behaving unexpectedly
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug. Please fill in the fields below — it makes triage much faster.
+
+        For **security issues**, do NOT open an issue. See [SECURITY.md](https://github.com/codecoradev/skill-suites/blob/develop/SECURITY.md).
+
+  - type: input
+    id: version
+    attributes:
+      label: Affected suite / commit
+      description: Which skill suite (e.g. uteke, cora-code, titen) and the commit or release you're on.
+      placeholder: "cora-code @ v0.13.0"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - macOS (Apple Silicon)
+        - macOS (Intel)
+        - Windows
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear and concise description of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Numbered list of exact steps. Include the exact command or skill invocation.
+      placeholder: |
+        1. Load the `cora-code` skill suite
+        2. Run `cora review --base origin/develop`
+        3. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / output
+      description: Paste relevant terminal or agent output.
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched existing issues and didn't find a duplicate
+          required: true
+        - label: I am running the latest version
+          required: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,53 @@
+name: Feature request
+description: Suggest a new feature or improvement
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the idea! A short conversation here saves everyone time before any code is written.
+
+        skill-suites is intentionally focused — not every idea will make it in. A "no" is not a judgment of the idea.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: |
+        The **why**, not the **what**. What were you trying to do when you wished this existed?
+      placeholder: "When I'm storing memories across different agents, I want namespaces so memories don't collide."
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: How would you imagine using this? CLI flag, API endpoint, config option — anything that helps picture it.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What workarounds have you tried? What other tools handle this well?
+
+  - type: dropdown
+    id: contribution
+    attributes:
+      label: Are you willing to contribute the implementation?
+      options:
+        - "Yes, with guidance"
+        - "Yes, I can do it"
+        - "No, just suggesting"
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before submitting
+      options:
+        - label: I searched existing issues and didn't find a duplicate
+          required: true

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/pull_request_template.md

@@ -1,30 +1,32 @@
-## Description
+<!--
+PR title must follow Conventional Commits — it becomes the merge commit message.
+Format: type(scope): short description
+Examples: feat(skills): add covecto suite / docs(readme): update product versions
+-->
 
-<!-- What does this PR change? One or two sentences. -->
+## What
+<!-- One or two sentences describing the change. -->
 
-## Type
+## Why
+<!-- The problem you're solving. Link to the issue if there is one (e.g. "Closes #42"). -->
 
-- [ ] `feat:` new skill or feature
-- [ ] `fix:` bug fix or validation fix
-- [ ] `docs:` documentation changes
-- [ ] `refactor:` restructure without behavior change
-- [ ] `chore:` meta, config, or cleanup
-
-## Changes
-
-<!-- List the key changes. -->
-
--
+## How
+<!-- Brief notes on the approach, only if non-obvious. -->
 
 ## Validation
 
-- [ ] Structure: SKILL.md, VERSION, README.md present
-- [ ] Frontmatter: name matches dir, version + description + tags set
-- [ ] Links: all relative links resolve
-- [ ] Token size: reference files under 3k tokens
-- [ ] Sanitization: no internal paths, credentials, or private domains
-- [ ] Syntax: Python compiles, YAML parses
+- [ ] Skill files parse (valid YAML frontmatter + markdown)
+- [ ] Tested the changed skill locally in a Hermes/agent session
+- [ ] Docs updated if the skill surface changed (README, examples)
+
+## Related Issues
+<!-- Link to related issues, e.g. Closes #123 -->
 
-## Notes
+## Checklist
 
-<!-- Anything reviewers should know. Breaking changes, migration steps, etc. -->
+- [ ] Branch name follows convention (`fix/`, `feat/`, `docs/`, `chore/`, `refactor/`, `test/`)
+- [ ] Branch is from `develop`
+- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
+- [ ] No secrets or credentials committed
+- [ ] One logical change per PR (no mixed concerns)
+- [ ] [CLA](https://github.com/codecoradev/.github/blob/main/.cla/signatures.json) signed (or will sign when the bot asks)

CODE_OF_CONDUCT.md

@@ -0,0 +1,18 @@
+# Code of Conduct
+
+skill-suites is a small open-source project and we want it to stay a place people enjoy contributing to.
+
+## The rules, briefly
+
+- **Be respectful.** Disagreement is fine; rudeness, condescension, and personal attacks are not.
+- **Stay on topic.** Keep discussions focused on the project and the contribution at hand.
+- **No harassment.** Harassment of any kind will not be tolerated.
+- **Assume good faith.** Most people are trying to help.
+
+## Enforcement
+
+Report issues to the maintainers via [GitHub Private Vulnerability Reporting](https://github.com/codecoradev/skill-suites/security/advisories/new) or by opening a private security advisory. Maintainers may remove comments, close issues/PRs, or ban repeat offenders.
+
+## Attribution
+
+Adapted from the [Uteke Code of Conduct](https://github.com/codecoradev/uteke/blob/develop/CODE_OF_CONDUCT.md).

SECURITY.md

@@ -0,0 +1,35 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| Latest release | ✅ |
+| Older versions | ❌ |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in skill-suites, please report it responsibly.
+
+**Do NOT** open a public issue for security vulnerabilities.
+
+### How to Report
+
+Use [GitHub Private Vulnerability Reporting](https://github.com/codecoradev/skill-suites/security/advisories/new) — this ensures the report is confidential and only visible to maintainers.
+
+Include as much detail as possible:
+
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+### What to Expect
+
+- **Acknowledgment** within 48 hours
+- **Initial assessment** within 5 business days
+- **Fix timeline** depends on severity:
+  - Critical: 7 days
+  - High: 14 days
+  - Medium: 30 days
+  - Low: next minor release