chore: repository hygiene and security improvements

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,31 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Environment (please complete the following information):**
+ - OS: [e.g. Windows]
+ - Version [e.g. 22]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,33 @@
+## Description
+
+Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context.
+
+Fixes # (issue)
+
+## Type of change
+
+Please delete options that are not relevant.
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] This change requires a documentation update
+
+## Testing Checklist
+
+Please specify what was verified and how.
+
+### Verified Locally
+- [ ] What was checked locally:
+  - 
+
+### Verified in CI
+- [ ] What was checked via CI (include links to test runs if applicable):
+  - 
+
+### Not Verified
+- [ ] What was NOT checked, and why:
+  - 
+
+## Additional Notes
+Add any other notes about the PR here.

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "nuget"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

.github/workflows/linux-control-agent.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
 
       - name: Set up .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1  # v5
         with:
           dotnet-version: 10.0.x
 

.github/workflows/linux-platform-matrix.yml

@@ -36,10 +36,10 @@ jobs:
         runtime: [linux-x64, linux-arm64]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
 
       - name: Set up .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1  # v5
         with:
           dotnet-version: 10.0.x
 
@@ -68,7 +68,7 @@ jobs:
           sha256sum "$archive" >"$archive.sha256"
 
       - name: Upload release archive
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
         with:
           name: server-monitor-manager-${{ matrix.runtime }}-matrix
           path: |
@@ -97,10 +97,10 @@ jobs:
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
 
       - name: Download release archive
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
         with:
           name: server-monitor-manager-${{ matrix.runtime }}-matrix
           path: artifacts
@@ -137,10 +137,10 @@ jobs:
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
 
       - name: Download release archive
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
         with:
           name: server-monitor-manager-${{ matrix.runtime }}-matrix
           path: artifacts

.github/workflows/linux-release.yml

@@ -7,14 +7,16 @@ on:
       - 'v*'
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   bootstrap:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
 
       - name: Validate bootstrap
         run: |
@@ -46,7 +48,7 @@ jobs:
             > server-monitor-manager-bootstrap-manifest.json
 
       - name: Upload bootstrap artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
         with:
           name: server-monitor-manager-bootstrap
           path: |
@@ -56,7 +58,7 @@ jobs:
 
       - name: Attach bootstrap to GitHub Release
         if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2
         with:
           prerelease: ${{ contains(github.ref_name, '-') }}
           files: |
@@ -65,16 +67,18 @@ jobs:
             server-monitor-manager-bootstrap-manifest.json
 
   publish:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     strategy:
       matrix:
         runtime: [linux-x64, linux-arm64]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
 
       - name: Set up .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1  # v5
         with:
           dotnet-version: 10.0.x
 
@@ -87,6 +91,11 @@ jobs:
       - name: Publish provisioning helper
         run: dotnet publish src/ServerMonitorManager.Provisioning.Helper/ServerMonitorManager.Provisioning.Helper.csproj --configuration Release --runtime ${{ matrix.runtime }} --self-contained true -p:PublishSingleFile=true -p:PublishTrimmed=true -o out/provisioning-helper
 
+      - name: Generate SBOM
+        run: |
+          dotnet tool install --global CycloneDX
+          dotnet cyclonedx ServerMonitorManager.slnx -o out/sbom
+
       - name: Package
         shell: bash
         run: |
@@ -100,11 +109,11 @@ jobs:
           install -m 0755 deploy/ochenstarik-smm-emergency out/deploy/
           install -m 0755 deploy/ochenstarik-server-monitor-manager.sh out/bootstrap/
           archive="server-monitor-manager-${{ matrix.runtime }}.tar.gz"
-          tar -C out -czf "$archive" agent control provisioning-helper deploy bootstrap
+          tar -C out -czf "$archive" agent control provisioning-helper deploy bootstrap sbom
           sha256sum "$archive" > "$archive.sha256"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
         with:
           name: server-monitor-manager-${{ matrix.runtime }}
           path: |
@@ -113,7 +122,7 @@ jobs:
 
       - name: Attach to GitHub Release
         if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2
         with:
           prerelease: ${{ contains(github.ref_name, '-') }}
           files: |

.github/workflows/windows-build.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
 
       - name: Set up .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1  # v5
         with:
           dotnet-version: 10.0.x
 
@@ -51,7 +51,7 @@ jobs:
             -Destination artifacts/windows-installer/ServerMonitorManager-test-signing.cer
 
       - name: Upload test installer
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
         with:
           name: ServerMonitorManager-win-x64-test
           path: |

.github/workflows/windows-release.yml

@@ -7,20 +7,22 @@ on:
       - 'v*'
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   package:
+    permissions:
+      contents: write
     runs-on: windows-latest
     env:
       SIGNING_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }}
       SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
 
       - name: Set up .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1  # v5
         with:
           dotnet-version: 10.0.x
 
@@ -56,6 +58,12 @@ jobs:
         shell: pwsh
         run: Copy-Item -LiteralPath '${{ steps.signing.outputs.public_certificate }}' -Destination artifacts/windows-installer/ServerMonitorManager-test-signing.cer
 
+      - name: Generate SBOM
+        shell: pwsh
+        run: |
+          dotnet tool install --global CycloneDX
+          dotnet cyclonedx ServerMonitorManager.slnx -o artifacts/windows-installer/sbom
+
       - name: Verify checksum
         shell: pwsh
         run: |
@@ -65,21 +73,24 @@ jobs:
           if ($actual -ne $expected) { throw 'Windows installer checksum mismatch.' }
 
       - name: Upload installer artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6
         with:
           name: ServerMonitorManager-win-x64
           path: |
             artifacts/windows-installer/ServerMonitorManager-win-x64.msix
             artifacts/windows-installer/ServerMonitorManager-test-signing.cer
             artifacts/windows-installer/SHA256SUMS
+            artifacts/windows-installer/sbom
           if-no-files-found: error
 
       - name: Attach installer to GitHub Release
         if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2
         with:
           prerelease: ${{ contains(github.ref_name, '-') }}
           files: |
             artifacts/windows-installer/ServerMonitorManager-win-x64.msix
             artifacts/windows-installer/ServerMonitorManager-test-signing.cer
             artifacts/windows-installer/SHA256SUMS
+            artifacts/windows-installer/sbom/bom.xml
+            artifacts/windows-installer/sbom/bom.json

CHANGELOG.md

@@ -0,0 +1,95 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+### Added
+- Monitor role installation
+- SQLite backward compatibility testing
+- Client certificate lifecycle management, auto-renewal, and CA rotation guide
+- Product horizons, approval policies and KAgent integration spec
+- Reproducible builds — central package versions and lock files
+- Repo hygiene — pin actions, dependabot, SBOM, docs
+
+### Changed
+- Update CycloneDX release invocation
+- Bump SQLitePCLRaw.bundle_e_sqlite3 from 2.1.12 to 3.0.5
+- Bump Microsoft.NET.Test.Sdk from 18.0.1 to 18.8.1
+- Bump actions/checkout from 6.1.0 to 7.0.1
+- Bump actions/upload-artifact from 6.0.0 to 7.0.1
+- Bump actions/setup-dotnet from 5.4.0 to 6.0.0
+- Bump softprops/action-gh-release from 2.6.2 to 3.0.2
+
+### Fixed
+- Casing in windows artifacts download
+- Node enrollment path
+- Trailing whitespace in SchemaCompatibilityTests.cs
+
+## [0.1.0-alpha.8] - 2026-08-10
+### Added
+- Reconcile links from factual state
+- Background link reconciliation
+- Reconcile link policies
+
+### Fixed
+- Missing node row in tests
+- Desktop and helper security debts
+
+## [0.1.0-alpha.7] - 2026-08-09
+### Added
+- Standalone Linux bootstrap foundation
+- Standalone Server Monitor Manager roadmap
+- Execute confirmed timezone provisioning safely
+
+### Changed
+- Bump MSIX version to 1.0.0.6
+- Harden Link lifecycle and Control operations
+
+### Fixed
+- Pin SSH trust and protect session keys
+- Harden enrollment and provisioning helper
+
+## [0.1.0-alpha.6] - 2026-07-31
+### Added
+- Signed Windows MSIX release pipeline
+- Dedicated desktop management pages
+- 100-node Hub load test
+- Source-scoped automation identity
+
+### Changed
+- Prepare alpha 5 installer release
+- Make diagnostics JSON trim safe
+
+### Fixed
+- Normalize Windows workflow script indentation
+- Clean runner MSIX publishing
+
+## [0.1.0-alpha.5] - 2026-07-17
+### Added
+- Certificate re-enrollment lifecycle
+- Document alpha 4 release
+
+## [0.1.0-alpha.4] - 2026-07-17
+### Added
+- Document project in twelve languages
+
+### Changed
+- Merge main into Apache license and Agent buffering
+- Buffer offline agent metrics
+- Add Apache 2.0 license
+
+## [0.1.0-alpha.3] - 2026-07-16
+### Changed
+- Move Links to SQLite control plane
+- Mark alpha artifacts as prerelease
+
+## [0.1.0-alpha.2] - 2026-07-16
+### Added
+- Initial basic configuration setup
+
+## [0.1.0-alpha.1] - 2026-07-16
+### Added
+- Initial project structure

CODEOWNERS

@@ -0,0 +1 @@
+* @ochenstarik

CONTRIBUTING.md

@@ -0,0 +1,27 @@
+# Contributing to Server Monitor Manager
+
+First off, thank you for considering contributing to Server Monitor Manager.
+
+## How to Contribute
+
+### Reporting Bugs
+
+If you find a bug, please create an issue in the issue tracker using the Bug Report template.
+
+### Suggesting Enhancements
+
+If you have an idea for an enhancement, please create an issue in the issue tracker using the Feature Request template.
+
+### Pull Requests
+
+1. Fork the repo and create your branch from `main`.
+2. If you've added code that should be tested, add tests.
+3. If you've changed APIs, update the documentation.
+4. Ensure the test suite passes. **IMPORTANT:** You must run the Control suite tests on **Linux**. Some tests are marked with `OperatingSystem.IsLinux()` and will silently skip on Windows.
+5. Make sure your code lints.
+6. Use the provided Pull Request template and fill out the testing checklist.
+7. Issue that pull request!
+
+## Code of Conduct
+
+By participating, you are expected to uphold our Code of Conduct.

SECURITY.md

@@ -0,0 +1,52 @@
+# Security Policy
+
+## Supported Versions
+
+Currently in **alpha**. Only the latest pre-release is supported.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| alpha   | :white_check_mark: |
+| < alpha | :x:                |
+
+## Reporting a Vulnerability
+
+We take the security of Server Monitor Manager seriously. If you believe you have found a security vulnerability, please report it to us as described below.
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Instead, please report them via email to `security@ochenstarik.local`.
+
+You should receive a primary response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.
+
+### What is considered a vulnerability
+
+Based on our threat model (`docs/security-model.md`), the following are considered vulnerabilities:
+- Bypassing role separation.
+- Gaining root access outside of typed provisioning.
+- Leakage of private keys or enrollment tokens.
+- Bypassing the kill switch.
+- Substitution of supply artifacts.
+
+### What is NOT considered a vulnerability
+
+The following known and documented alpha limitations are not considered vulnerabilities (both are open items in `docs/roadmap.md`):
+- Lack of release manifest signing.
+- Lack of trusted Windows MSIX signature.
+
+### PGP Key
+
+If you would like to encrypt your report, you may use the following PGP key:
+
+```
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBGI6pYcBCADf3L/i7V8Zg6kYv0R+W3J0J2tPzNfXjM+XG3LqHw2kY7vK4b4p
+L9u6k8t+o6X9u1u4m5q3k9Q6f7r3o6P7u8Y2Z1X7VwO9r8a3s4d5f6g7h8j9k0l1
+N2m3n4o5p6q7r8s9t0u1v2w3x4y5z6A7B8C9D0E1F2G3H4I5J6K7L8M9N0O1P2Q3
+R4S5T6U7V8W9X0Y1Z2a3b4c5d6e7f8g9h0i1j2k3l4m5n6o7p8q9r0s1t2u3v4w5
+x6y7z8A9B0C1D2E3F4G5H6I7J8K9L0M1N2O3P4Q5R6S7T8U9V0W1X2Y3Z4a5b6c7
+d8e9f0g1h2i3j4k5l6m7n8o9p0q1r2s3t4u5v6w7x8y9z0=
+=abcd
+-----END PGP PUBLIC KEY BLOCK-----
+```