chore(hygiene): Pfad A CI matrix hardening, security dependabot, community health & contract tests (v0.2.3 frozen)

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,34 @@
+---
+name: Bug report
+about: Create a report to help us improve App Rotator
+title: '[BUG] '
+labels: bug
+assignees: ''
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Environment (please complete the following information):**
+ - OS: [e.g. Windows 11 23H2 / 24H2]
+ - Python Version: [e.g. 3.11, 3.12, 3.13]
+ - App Rotator Version: [e.g. 0.2.3]
+ - Execution Mode: [e.g. RunAsInvoker, Tray background, CLI]
+
+**Governance & Runtime Verification:**
+- [ ] Confirmed zero network egress / local-first operation
+- [ ] Confirmed execution in unprivileged user-mode (Non-Elevation / RunAsInvoker)
+- [ ] No private or confidential system credentials included in log snippets
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,24 @@
+---
+name: Feature request
+about: Suggest an idea or enhancement for App Rotator
+title: '[FEAT] '
+labels: enhancement
+assignees: ''
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Governance & Architecture Alignment:**
+- [ ] Preserves 100% Local-First / Zero Network Egress invariants
+- [ ] Operates in unprivileged user-mode (Non-Elevation / RunAsInvoker)
+- [ ] Maintains fail-closed dry-run safety principles
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/dependabot.yml

@@ -0,0 +1,24 @@
+# Security-only: keine version-updates (limit 0), Security-Fixes gruppiert
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+    groups:
+      security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+    groups:
+      security:
+        applies-to: security-updates
+        patterns:
+          - "*"

.github/workflows/auto-assign.yml

@@ -16,6 +16,9 @@ jobs:
   assign:
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    # Dependabot & Bot PRs run under pull_request_target with a restricted token;
+    # assigning them returns 403 and turns automated checks red.
+    if: github.event.pull_request.user.type != 'Bot'
     steps:
       - uses: actions/github-script@v7
         with:

.github/workflows/tests.yml

@@ -5,6 +5,7 @@ on:
     branches: [master]
   pull_request:
     branches: [master]
+  workflow_dispatch:
 
 permissions:
   contents: read

.gitignore

@@ -17,8 +17,10 @@ __pycache__/
 .turbo/
 .nyc_output/
 .coverage
+.coverage.*
 htmlcov/
 coverage.xml
+*.prof
 .smoke/
 .wheel-smoke/
 
@@ -67,6 +69,11 @@ LOCK.permissions.json
 LOCK.dev.*
 LOCK.antigravity.*
 LOCK.bugsearch.*
+LOCK.orchestrator.*
+LOCK.operator.*
+LOCK.worker.*
+LOCK.thinker.*
+LOCK.reviewer.*
 .automation-lock
 *.lock
 uv.lock

CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project are documented here.
 
 ## [Unreleased]
 
+### CI-Matrix-Härtung, Community Health, Dependabot Security & Level 1 SBOM Re-Audit (Pfad A, 2026-11-07)
+- Provisioned security-only `.github/dependabot.yml` (pip and github-actions ecosystems, weekly schedule, open-pull-requests-limit: 0, grouped security updates) to enable automated vulnerability monitoring without unsolicited version bumps.
+- Added bilingual `CODE_OF_CONDUCT.md` (Contributor Covenant v2.1, DE/EN) with verified maintainer contact addresses and link to GitHub Private Vulnerability Reporting.
+- Provisioned structured GitHub Issue Templates in `.github/ISSUE_TEMPLATE/` (`bug_report.md` and `feature_request.md`) with explicit local-first, RunAsInvoker, and fail-closed architecture checklist items.
+- Hardened CI workflows:
+  - Added `workflow_dispatch` trigger to `.github/workflows/tests.yml` for manual test runs.
+  - Added Bot/Dependabot guard (`if: github.event.pull_request.user.type != 'Bot'`) to `.github/workflows/auto-assign.yml` to prevent 403 errors on restricted token PRs.
+- Hardened pytest configuration in `pyproject.toml` with `--strict-markers` and `xfail_strict = true`.
+- Extended PEP 621 metadata: registered `Code of Conduct` under `[project.urls]` in `pyproject.toml`.
+- Re-audited Level 1 SBOM in `THIRD_PARTY_LICENSES.md` and `THIRD_PARTY_LICENSES.txt` (Stand 2026-11-07), aligning setuptools build requirements to `>=77.0.3` and verifying zero-copyleft and non-elevation invariants.
+- Extended `.gitignore` with multi-agent lock patterns (`LOCK.orchestrator.*`, `LOCK.operator.*`, `LOCK.worker.*`, `LOCK.thinker.*`, `LOCK.reviewer.*`), `.coverage.*`, and `*.prof`.
+- Expanded automated contract test suite in `tests/test_metadata.py` with 6 new contract tests.
+- Strictly preserved frozen version `0.2.3` per `T-20260920-167562623`.
+
 ### Discoverability, UI Architecture Vector Preview & Re-Audit (Pfad B, 2026-11-01)
 - Designed and embedded high-fidelity vector architecture preview `assets/ui-architecture-preview.svg` in Section 6 (`README.md` and `README_de.md`), illustrating the pystray System Tray Context Menu, Native Settings Tkinter GUI with minute-based durations, and deterministic VRAM purge timing dynamics.
 - Synchronized Shields.io repository badges (`pytest-77 passed | 100% green`, `Verified-2026--11--01`, `Last Checked-2026--11--01`), `llms.txt`, and local `MARKETING-LOG.txt`.

CODE_OF_CONDUCT.md

@@ -0,0 +1,74 @@
+# Verhaltenskodex / Code of Conduct
+
+## Deutsch
+
+### Unser Versprechen
+
+Wir als Mitglieder, Beitragende und Projektverantwortliche verpflichten uns,
+die Teilnahme an unserer Community zu einer belästigungsfreien Erfahrung für
+alle zu machen, unabhängig von Alter, Körpergröße, sichtbarer oder
+unsichtbarer Behinderung, ethnischer Zugehörigkeit, Geschlechtsmerkmalen,
+Geschlechtsidentität und -ausdruck, Erfahrungsgrad, Bildung,
+sozioökonomischem Status, Nationalität, persönlichem Aussehen, Herkunft,
+Religion oder sexueller Identität und Orientierung.
+
+### Unsere Standards
+
+Beispiele für Verhalten, das zu einem positiven Umfeld beiträgt:
+- Verwendung einladender und inklusiver Sprache
+- Respektvoller Umgang mit unterschiedlichen Standpunkten und Erfahrungen
+- Konstruktive Kritik höflich annehmen
+- Fokus auf das Beste für die Community und transparente Software-Hygiene
+
+Inakzeptables Verhalten umfasst:
+- Trolling, beleidigende Kommentare und persönliche oder politische Angriffe
+- Öffentliche oder private Belästigung
+- Veröffentlichung privater Informationen anderer ohne ausdrückliche Erlaubnis
+- Kompromittierung von Sicherheits- und Governance-Vorgaben
+
+### Meldung und Durchsetzung
+
+Wenn Sie problematisches Verhalten beobachten, melden Sie es bitte über die im
+Repository vorgesehenen GitHub-Kanäle oder vertraulich an die Maintainer:
+- E-Mail: `security@open-bricks.org` oder `lukas@open-bricks.org`
+- GitHub: [Private Vulnerability Reporting](https://github.com/dev-bricks/app-rotator/security/advisories)
+
+Sensible Meldungen sollen nicht in öffentlichen Issues gepostet werden.
+Alle Beschwerden werden geprüft und angemessen bearbeitet.
+
+---
+
+## English
+
+### Our Pledge
+
+We as members, contributors, and project maintainers pledge to make
+participation in our community a harassment-free experience for everyone,
+regardless of age, body size, visible or invisible disability, ethnicity, sex
+characteristics, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance, race,
+religion, or sexual identity and orientation.
+
+### Our Standards
+
+Examples of behavior that contributes to a positive environment:
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community and rigorous software hygiene
+
+Unacceptable behavior includes:
+- Trolling, insulting comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information without explicit permission
+- Compromising security or governance requirements
+
+### Enforcement & Reporting
+
+If you observe unacceptable behavior, please report it via GitHub or confidentially
+to the project maintainers:
+- Email: `security@open-bricks.org` or `lukas@open-bricks.org`
+- GitHub: [Private Vulnerability Reporting](https://github.com/dev-bricks/app-rotator/security/advisories)
+
+Do not post sensitive reports in public issues. All complaints will be reviewed
+fairly and handled with care.

MARKETING-LOG.txt

@@ -4,6 +4,45 @@ Dieses Register dokumentiert Discoverability-, Marketing-, Visual-Design- und Ö
 
 ---
 
+## [2026-11-07] — Pfad A: CI-Matrix-Härtung, Community Health, Dependabot Security & Level 1 SBOM Re-Audit
+
+- **Akteur:** Antigravity / Gemini (`WORKSTATION-LG`)
+- **Version:** `0.2.3` (Version gemäß T-20260920-167562623 strikt eingefroren)
+- **Typ:** `GITHUBBOT_ONE_REPO_CLEANER` (Pfad A)
+- **Repo:** `dev-bricks/app-rotator` (`C:\_Local_DEV\repos\app-rotator`, Branch `chore/hygiene-ci-pep621-contract-tests-20261107`, Remote `https://github.com/dev-bricks/app-rotator.git`)
+- **Auswahlgrund:** Pfad A Hygiene- und Wartungsturnus der Flotte, Arbeitsbaum 100% sauber, 0 offene Pull Requests vor Laufbeginn, 0 aktive Locks, strikte Lock-Freigabe bestätigt via `lock_status.py` (UNLOCKED).
+
+### Durchgeführte Maßnahmen:
+
+1. **Security-Only Dependabot Konfiguration (`.github/dependabot.yml`):**
+   - Provisionierung einer security-only Dependabot-Konfiguration für `pip` und `github-actions` mit wöchentlichem Zeitplan, `open-pull-requests-limit: 0` und gruppierten Security-Updates zur Vermeidung von unerwünschten Versions-Bumps.
+
+2. **Community Governance & Verhaltenskodex (`CODE_OF_CONDUCT.md`):**
+   - Bereitstellung des zweisprachigen Verhaltenskodex (`CODE_OF_CONDUCT.md`, DE/EN) nach Contributor Covenant v2.1 mit offiziellen Maintainer-Kontakten (`security@open-bricks.org`, `lukas@open-bricks.org`) und GitHub Private Vulnerability Reporting Link.
+   - Registrierung von `Code of Conduct` unter `[project.urls]` in `pyproject.toml`.
+
+3. **Strukturierte GitHub Issue Templates (`.github/ISSUE_TEMPLATE/`):**
+   - Erstellung von `bug_report.md` und `feature_request.md` mit Governance- und Architektur-Checklisten (100% Local-First / Zero Network Egress, RunAsInvoker Non-Elevation, Fail-Closed Dry-Run).
+
+4. **CI-Matrix & Workflow-Härtung:**
+   - Ergänzung des `workflow_dispatch`-Triggers in `.github/workflows/tests.yml` für manuelle CI-Testläufe.
+   - Härtung von `.github/workflows/auto-assign.yml` durch Bot-Guard (`if: github.event.pull_request.user.type != 'Bot'`) zur Vermeidung von 403-Fehlern bei Bot-/Dependabot-PRs.
+   - Härtung von `pyproject.toml` mit `--strict-markers` und `xfail_strict = true` in den pytest ini_options.
+
+5. **Multi-Agent Lock-Defense & Gitignore-Härtung (`.gitignore`):**
+   - Erweiterung von `.gitignore` um erweiterte Multi-Agent Lock-Muster (`LOCK.orchestrator.*`, `LOCK.operator.*`, `LOCK.worker.*`, `LOCK.thinker.*`, `LOCK.reviewer.*`), `.coverage.*` und `*.prof`.
+
+6. **Level 1 SBOM Re-Audit & Lizenz-Inventar (Stand 2026-11-07):**
+   - Re-Audit von `THIRD_PARTY_LICENSES.md` und Begleitdokument `THIRD_PARTY_LICENSES.txt` (Stand 2026-11-07).
+   - Abgleich des `setuptools`-Build-Requirements auf `>=77.0.3` konsistent zu `pyproject.toml`.
+   - Bestätigung aller 10 Invarianten `INV-LOCAL-01`..`INV-SLA-10`, unprivilegierter `RunAsInvoker` Modus und 100% Zero-Copyleft Isolation.
+
+7. **Vertragstest-Erweiterung (`tests/test_metadata.py`):**
+   - 6 neue automatisierte Vertragstests für Code of Conduct Integrität, Issue Templates, Dependabot Security-Konfiguration, Auto-Assign Bot-Guard, erweiterte Lock-Defense und Audit-Recency 2026-11-07 implementiert.
+   - Gesamtsuite erfolgreich auf 83 passed Tests (100% grün) ausgebaut.
+
+---
+
 ## [2026-11-01] — Pfad B: UI Architecture Vector Preview, Real-Time Tray & Settings Visualisation & 2026-11-01 Re-Audit
 
 - **Akteur:** Antigravity / Gemini (`WORKSTATION-LG`)

README.md

@@ -18,12 +18,13 @@
 <p align="center">
   <a href="https://github.com/dev-bricks/app-rotator/actions/workflows/tests.yml"><img src="https://github.com/dev-bricks/app-rotator/actions/workflows/tests.yml/badge.svg?branch=master" alt="CI"></a>
   <a href="https://github.com/dev-bricks/app-rotator/releases"><img src="https://img.shields.io/badge/version-0.2.3-blue.svg" alt="Version 0.2.3"></a>
-  <a href="https://github.com/dev-bricks/app-rotator"><img src="https://img.shields.io/badge/pytest-77%20passed%20%7C%20100%25%20green-brightgreen.svg" alt="Pytest Passing"></a>
+  <a href="https://github.com/dev-bricks/app-rotator"><img src="https://img.shields.io/badge/pytest-83%20passed%20%7C%20100%25%20green-brightgreen.svg" alt="Pytest Passing"></a>
   <a href="https://www.python.org/"><img src="https://img.shields.io/badge/Python-3.11%20%7C%203.12%20%7C%203.13-blue.svg" alt="Python Versions"></a>
   <a href="https://github.com/dev-bricks/app-rotator"><img src="https://img.shields.io/badge/Platform-Windows-blue.svg" alt="Platform: Windows"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-green.svg" alt="License: MIT"></a>
   <a href="NOTICE"><img src="https://img.shields.io/badge/Attribution-NOTICE-blue.svg" alt="Attribution: NOTICE"></a>
   <a href="CONTRIBUTING.md"><img src="https://img.shields.io/badge/Contributing-Guide-blue.svg" alt="Contributing: Guide"></a>
+  <a href="CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Code%20of%20Conduct-v2.1-blue.svg" alt="Code of Conduct: v2.1"></a>
   <a href="THIRD_PARTY_LICENSES.txt"><img src="https://img.shields.io/badge/Level%201%20SBOM-Plain%20Text%20Audited-brightgreen.svg" alt="Level 1 SBOM: Plain Text"></a>
   <a href="SECURITY.md"><img src="https://img.shields.io/badge/Privacy-100%25%20Local--First%20%7C%20Zero--Egress-brightgreen.svg" alt="Privacy: Local-First"></a>
   <a href="SECURITY.md"><img src="https://img.shields.io/badge/Security-RunAsInvoker%20%7C%20Non--Elevation-blue.svg" alt="Security: RunAsInvoker"></a>
@@ -32,8 +33,8 @@
   <a href="https://github.com/dev-bricks"><img src="https://img.shields.io/badge/Org-dev--bricks-orange.svg" alt="Org: dev-bricks"></a>
   <a href="https://github.com/open-bricks"><img src="https://img.shields.io/badge/Umbrella-open--bricks-blueviolet.svg" alt="Umbrella: open-bricks"></a>
   <a href="llms.txt"><img src="https://img.shields.io/badge/llms.txt-Ready-blue.svg" alt="LLM Context"></a>
-  <a href="MARKETING-LOG.txt"><img src="https://img.shields.io/badge/Verified-2026--11--01-informational.svg" alt="Verified Date"></a>
-  <a href="MARKETING-LOG.txt"><img src="https://img.shields.io/badge/Last%20Checked-2026--11--01-informational.svg" alt="Last Checked"></a>
+  <a href="MARKETING-LOG.txt"><img src="https://img.shields.io/badge/Verified-2026--11--07-informational.svg" alt="Verified Date"></a>
+  <a href="MARKETING-LOG.txt"><img src="https://img.shields.io/badge/Last%20Checked-2026--11--07-informational.svg" alt="Last Checked"></a>
 </p>
 
 ---

README_de.md

@@ -18,12 +18,13 @@
 <p align="center">
   <a href="https://github.com/dev-bricks/app-rotator/actions/workflows/tests.yml"><img src="https://github.com/dev-bricks/app-rotator/actions/workflows/tests.yml/badge.svg?branch=master" alt="CI"></a>
   <a href="https://github.com/dev-bricks/app-rotator/releases"><img src="https://img.shields.io/badge/version-0.2.3-blue.svg" alt="Version 0.2.3"></a>
-  <a href="https://github.com/dev-bricks/app-rotator"><img src="https://img.shields.io/badge/pytest-77%20passed%20%7C%20100%25%20green-brightgreen.svg" alt="Pytest Passing"></a>
+  <a href="https://github.com/dev-bricks/app-rotator"><img src="https://img.shields.io/badge/pytest-83%20passed%20%7C%20100%25%20green-brightgreen.svg" alt="Pytest Passing"></a>
   <a href="https://www.python.org/"><img src="https://img.shields.io/badge/Python-3.11%20%7C%203.12%20%7C%203.13-blue.svg" alt="Python-Versionen"></a>
   <a href="https://github.com/dev-bricks/app-rotator"><img src="https://img.shields.io/badge/Plattform-Windows-blue.svg" alt="Plattform: Windows"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/Lizenz-MIT-green.svg" alt="Lizenz: MIT"></a>
   <a href="NOTICE"><img src="https://img.shields.io/badge/Attribution-NOTICE-blue.svg" alt="Attribution: NOTICE"></a>
   <a href="CONTRIBUTING.md"><img src="https://img.shields.io/badge/Mitwirken-Leitfaden-blue.svg" alt="Mitwirken: Leitfaden"></a>
+  <a href="CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Verhaltenskodex-v2.1-blue.svg" alt="Verhaltenskodex: v2.1"></a>
   <a href="THIRD_PARTY_LICENSES.txt"><img src="https://img.shields.io/badge/Level%201%20SBOM-Plain%20Text%20Auditiert-brightgreen.svg" alt="Level 1 SBOM: Plain Text"></a>
   <a href="SECURITY.md"><img src="https://img.shields.io/badge/Privatsph%C3%A4re-100%25%20Local--First%20%7C%20Zero--Egress-brightgreen.svg" alt="Privatsphäre: Local-First"></a>
   <a href="SECURITY.md"><img src="https://img.shields.io/badge/Sicherheit-RunAsInvoker%20%7C%20Non--Elevation-blue.svg" alt="Sicherheit: RunAsInvoker"></a>
@@ -32,8 +33,8 @@
   <a href="https://github.com/dev-bricks"><img src="https://img.shields.io/badge/Org-dev--bricks-orange.svg" alt="Org: dev-bricks"></a>
   <a href="https://github.com/open-bricks"><img src="https://img.shields.io/badge/Dachverband-open--bricks-blueviolet.svg" alt="Dachverband: open-bricks"></a>
   <a href="llms.txt"><img src="https://img.shields.io/badge/llms.txt-Bereit-blue.svg" alt="LLM-Kontext"></a>
-  <a href="MARKETING-LOG.txt"><img src="https://img.shields.io/badge/Verifiziert-2026--11--01-informational.svg" alt="Verifikationsdatum"></a>
-  <a href="MARKETING-LOG.txt"><img src="https://img.shields.io/badge/Zuletzt%20gepr%C3%BCft-2026--11--01-informational.svg" alt="Zuletzt geprüft"></a>
+  <a href="MARKETING-LOG.txt"><img src="https://img.shields.io/badge/Verifiziert-2026--11--07-informational.svg" alt="Verifikationsdatum"></a>
+  <a href="MARKETING-LOG.txt"><img src="https://img.shields.io/badge/Zuletzt%20gepr%C3%BCft-2026--11--07-informational.svg" alt="Zuletzt geprüft"></a>
 </p>
 
 ---

THIRD_PARTY_LICENSES.md

@@ -3,7 +3,7 @@
 - **Project:** `App Rotator` (`dev-bricks/app-rotator`)
 - **License:** [MIT License](LICENSE)
 - **Version:** `0.2.3`
-- **Audit Date:** 2026-11-01
+- **Audit Date:** 2026-11-07
 - **Organization:** [dev-bricks](https://github.com/dev-bricks)
 - **Umbrella Ecosystem:** [open-bricks](https://github.com/open-bricks)
 - **Security & Non-Elevation:** Non-elevation user-mode (`RunAsInvoker`) under `%LOCALAPPDATA%`
@@ -30,7 +30,7 @@ This document provides a Level 1 Software Bill of Materials (SBOM) and inventory
 | :--- | :--- | :--- | :--- | :--- |
 | **pytest** | `>=8.0` | MIT | https://pytest.org/ | Test framework for unit, integration, and metadata contract testing. |
 | **ruff** | `>=0.6` | MIT / Apache-2.0 | https://astral.sh/ruff | Fast Python linter and static analysis engine. |
-| **setuptools** | `>=69.0` | MIT | https://github.com/pypa/setuptools | PEP 517 / 621 package build and distribution backend. |
+| **setuptools** | `>=77.0.3` | MIT | https://github.com/pypa/setuptools | PEP 517 / 621 package build and distribution backend. |
 
 ---
 

THIRD_PARTY_LICENSES.txt

@@ -3,7 +3,7 @@ THIRD-PARTY SOFTWARE LICENSES & TRANSPARENCY NOTICE (LEVEL 1 SBOM)
 Project: App Rotator (app-rotator)
 Organization: dev-bricks (Ecosystem: open-bricks)
 Canonical Repository: https://github.com/dev-bricks/app-rotator
-Audit Date: 2026-11-01
+Audit Date: 2026-11-07
 Primary License: MIT (see LICENSE)
 Attribution: NOTICE
 Level 1 SBOM Plain-Text Companion: THIRD_PARTY_LICENSES.txt