feat(governance): adopt devops-excellence standard

.claude/settings.json

@@ -0,0 +1,23 @@
+{
+  "extraKnownMarketplaces": {
+    "compound-engineering-plugin": {
+      "source": {
+        "source": "github",
+        "repo": "EveryInc/compound-engineering-plugin"
+      }
+    },
+    "integral-productivity-internal": {
+      "source": {
+        "source": "github",
+        "repo": "Integral-Productivity/marketplace-internal"
+      }
+    }
+  },
+  "enabledPlugins": {
+    "compound-engineering@compound-engineering-plugin": true,
+    "integral-productivity-engineering@integral-productivity-internal": true,
+    "software-architecture@integral-productivity-internal": true,
+    "product-architecture@integral-productivity-internal": true,
+    "lean-management@integral-productivity-internal": true
+  }
+}

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default code-owner. Tier 3 standard from devops-excellence (ADR-001).
+* @kraigparkinson

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+Closes #
+
+## Summary
+
+-
+-
+
+## Test plan
+
+- [ ]
+- [ ]
+
+<!--
+Conventions (see devops-excellence ADRs):
+- Conventional Commits in commit messages and PR titles
+- Branch naming: claude/<slug> for Claude-authored branches (auto-merges on green CI)
+- Squash merge only. PR title becomes the commit subject.
+- Closing keywords (Closes #, Fixes #) must live here or in commit messages, never in review comments.
+- Do not create draft PRs; auto-merge only fires on ready-for-review PRs.
+-->

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+      timezone: America/Los_Angeles
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - github-actions
+    commit-message:
+      prefix: chore(deps)
+      include: scope

.github/workflows/auto-merge.yml

@@ -0,0 +1,29 @@
+# Auto-merge caller for Tier 3 plugin repos, which call the PUBLIC
+# reusable-workflows host. This is deliberately NOT identical to the Tier 1/2
+# templates: those call the PRIVATE devops-excellence reusable and forward the
+# whole-vault OP_SERVICE_ACCOUNT_TOKEN, whereas the public reusable declares
+# only the SCOPED OP_AUTOMERGE_PUBLIC_TOKEN (read-only on the ip-automation-public
+# vault, per ADR-045 / ip-bots#207). GitHub also blocks a public repo from
+# calling a private reusable workflow, which is why Tier 3 uses the public host.
+# Passing OP_SERVICE_ACCOUNT_TOKEN here is an UNDECLARED secret and fails the run
+# at compile time (startup_failure — "workflow file issue").
+#
+# The tier3-claude-plugin and tier3-omnifocus-plugin copies of this file are
+# byte-identical by design (the fitness spec sources one governance set for both).
+
+name: Auto-Merge
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    name: Auto-Merge
+    uses: Integral-Productivity/reusable-workflows/.github/workflows/reusable-auto-merge.yml@v1
+    secrets:
+      OP_AUTOMERGE_PUBLIC_TOKEN: ${{ secrets.OP_AUTOMERGE_PUBLIC_TOKEN }}

.github/workflows/claude.yml

@@ -0,0 +1,36 @@
+# Standard @claude on-demand bot caller. See tier1/.github/workflows/claude.yml
+# for the rationale on the `if:` gate — it is required, do not remove it.
+
+name: Claude Code
+
+# REQUIRED — mirrors reusable-claude.yml's permissions. A workflow_call reusable
+# can only USE permissions the caller GRANTS; without this block the validator
+# rejects the call at startup (0-second startup_failure on every trigger). See
+# tier1/.github/workflows/claude.yml for the full rationale.
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+  id-token: write
+  actions: read
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    uses: Integral-Productivity/reusable-workflows/.github/workflows/reusable-claude.yml@v1
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}