feat(community): establish contributor foundation

.github/workflows/ci.yml

@@ -0,0 +1,41 @@
+# ci.yml - fast contributor validation for Codegeist source changes.
+#
+# Pull requests and pushes to source `main` run the same deterministic
+# `task cli:check` contract documented in CONTRIBUTING.md. This workflow uses no
+# secrets, Docker, provider calls, native-image, QEMU, or release publication.
+name: Codegeist CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: JVM check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v7
+
+      - name: Set up Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: "25"
+          cache: maven
+          cache-dependency-path: app/codegeist/cli/pom.xml
+
+      - name: Install Task
+        uses: go-task/setup-task@v2
+        with:
+          version: 3.x
+
+      - name: Run contributor check
+        env:
+          DOCKER_HOST: tcp://127.0.0.1:1
+        run: task cli:check

.github/workflows/release.yml

@@ -142,6 +142,8 @@ jobs:
           set -euo pipefail
 
           mkdir -p target/dist
+          jar --list --file target/codegeist.jar | grep --fixed-strings --line-regexp 'META-INF/LICENSE'
+          unzip -p target/codegeist.jar META-INF/LICENSE | cmp - ../../../LICENSE
           cp -p target/codegeist.jar target/dist/codegeist-jvm.jar
 
       - name: Upload JVM jar artifact
@@ -263,14 +265,14 @@ jobs:
           if-no-files-found: error
           path: app/codegeist/cli/target/dist/codegeist-${{ matrix.platform }}.${{ matrix.extension }}
 
-  stage-install-scripts:
-    name: Stage install scripts
+  stage-release-support:
+    name: Stage release support assets
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
         uses: actions/checkout@v7
 
-      - name: Stage install script assets
+      - name: Stage release support assets
         shell: bash
         run: |
           set -euo pipefail
@@ -295,13 +297,16 @@ jobs:
             fi
             cp -p "$source" "dist/$script"
           done
+          cp -p LICENSE dist/LICENSE
 
-      - name: Upload install script artifact
+      - name: Upload release support artifact
         uses: actions/upload-artifact@v7
         with:
-          name: codegeist-install-scripts
+          name: codegeist-release-support
           if-no-files-found: error
-          path: dist/codegeist-install-*
+          path: |
+            dist/codegeist-install-*
+            dist/LICENSE
 
   checksums:
     name: Generate and verify checksums
@@ -310,7 +315,7 @@ jobs:
       - metadata
       - build-jvm
       - build-native
-      - stage-install-scripts
+      - stage-release-support
     steps:
       - name: Download release artifacts
         uses: actions/download-artifact@v8
@@ -324,6 +329,7 @@ jobs:
 
           mkdir -p dist
           expected_assets=(
+            LICENSE
             codegeist-jvm.jar
             codegeist-linux-x64.tar.gz
             codegeist-windows-x64.zip
@@ -388,6 +394,7 @@ jobs:
 
           mkdir -p release-assets
           expected_assets=(
+            LICENSE
             codegeist-jvm.jar
             codegeist-linux-x64.tar.gz
             codegeist-windows-x64.zip
@@ -415,10 +422,10 @@ jobs:
           Validation completed in this workflow run before upload:
 
           - Maven test suite passed before packaging.
-          - JVM jar was packaged as a release asset without artifact smoke.
-          - Linux x64, Windows x64, and macOS x64 native archives were built, unpacked, and smoke-tested with --version, --show-config, and ask-driven file-edit plus shell-tool side effects.
+          - JVM jar was packaged with the canonical license at META-INF/LICENSE and staged as a release asset without runtime artifact smoke.
+          - Linux x64, Windows x64, and macOS x64 native archives were built, unpacked, and smoke-tested with the canonical LICENSE, --version, --show-config, and ask-driven file-edit plus shell-tool side effects.
           - Linux, macOS, and Windows install scripts were run against local release-shaped assets on their matching release runners, then staged as release assets for curl-based downloads.
-          - The SHA-256 checksum file was generated and verified before upload.
+          - The standalone LICENSE release asset and all executable assets are covered by the SHA-256 checksum file, which was generated and verified before upload.
 
           Install scripts are bootstrap helpers for the native archives. This release intentionally excludes package-manager publishing, signing, notarization, SBOM, and SLSA provenance.
           EOF

.oc_local/commands/codegeist-release.md

@@ -244,6 +244,7 @@ codegeist-macos-x64.tar.gz
 codegeist-install-linux.sh
 codegeist-install-macos.sh
 codegeist-install-windows.ps1
+LICENSE
 SHA256SUMS.txt
 ```
 
@@ -299,6 +300,7 @@ latest_assets=(
   "$tmp_dir/codegeist-install-linux.sh"
   "$tmp_dir/codegeist-install-macos.sh"
   "$tmp_dir/codegeist-install-windows.ps1"
+  "$tmp_dir/LICENSE"
   "$tmp_dir/SHA256SUMS.txt"
 )
 

.oc_local/rules/codegeist-release.md

@@ -132,14 +132,15 @@ codegeist-macos-x64.tar.gz
 codegeist-install-linux.sh
 codegeist-install-macos.sh
 codegeist-install-windows.ps1
+LICENSE
 SHA256SUMS.txt
 ```
 
 Release asset filenames intentionally omit the version because the GitHub Release
 URL and immutable `v*` tag carry the version. Keep `codegeist-jvm.jar` instead of
 `codegeist-jvm-any.jar`; the `jvm` suffix already distinguishes the portable JVM
 artifact from platform-native archives.
-The install scripts are release assets for curl-based bootstrap installs and must
+The install scripts and standalone canonical `LICENSE` are release assets and must
 stay covered by `SHA256SUMS.txt` together with the jar and native archives.
 The release workflow must also run each install script against local release-shaped
 assets on its matching native runner before upload; the macOS installer must be

.oc_local/rules/codegeist-task-specification.md

@@ -1,14 +1,14 @@
 # Codegeist Task Workflow Overlay
 
-Use the shared task phase commands from `.opencode` for task workflow phases:
+Use the shared `/task` workflow from `.opencode`:
 
-- `/specify-task <task-ref> [context/instructions]`
-- `/plan-task <task-ref> [context/instructions]`
-- `/solve-task <task-ref> [context/instructions]`
-- `/work-task <task-ref> [context/instructions]`
+- `/task spec "<title/context>"`
+- `/task impl <task-ref> [instructions]`
+- `/task cancel <task-ref>`
+- `/task backlog <title>`
 
-This overlay adds only Codegeist-specific guidance. Keep generic phase behavior in
-`.opencode/rules/task-phases.md` and `.opencode/rules/task-workflow.md`.
+This overlay adds only Codegeist-specific guidance. Keep generic task behavior in
+`.opencode/rules/task-workflow.md`.
 
 ## Codegeist Guidance
 
@@ -136,14 +136,14 @@ This overlay adds only Codegeist-specific guidance. Keep generic phase behavior
   `.codegeist/Dockerfile` instead. Keep Ollama models under
   `${OLLAMA_MODELS_DIR:-$HOME/.ollama/models}` and use `OLLAMA_ENTER=false task
   ollama-start` for non-interactive automation.
-- For Codegeist implementation verification, prefer the Taskfile entrypoint from
-  `app/codegeist/cli`: run `task test`, and use `task test TEST=<test-selector>`
-  for focused test selectors. Do not document direct `mvn test` commands for new
-  implementation tasks. `task test` starts the shared host Ollama container with
-  `OLLAMA_ENTER=false` and ensures the selected model exists before Maven. For local
-  Ollama provider verification, run one command such as
-  `CODEGEIST_TEST_PROVIDER_CATEGORY=local task test TEST=<selector>` to enable the
-  local provider-call methods.
+- For normal Codegeist implementation verification, use
+  `task cli:test-jvm TEST=<test-selector>` for focused tests and `task cli:check`
+  for the final contributor gate. Both force provider category `none` and avoid
+  Ollama and Docker. Do not document direct `mvn test` commands for new
+  implementation tasks. For intentional local Ollama verification, use the
+  separate provider-capable path, for example
+  `CODEGEIST_TEST_PROVIDER_CATEGORY=local task cli:test TEST=<selector>`; that task
+  starts Ollama and ensures the selected model exists before Maven.
 - For Codegeist test or smoke-script work, read `docs/tests/README.md` first.
   Smoke scripts must keep scan-friendly status lines and emit stable
   `Duration: <label>: <seconds>s` lines for meaningful Maven, package,
@@ -339,7 +339,8 @@ This overlay adds only Codegeist-specific guidance. Keep generic phase behavior
   guard each non-config feature method with an explicit category: `local`,
   `remote_free`, or `remote_paid`. Do not let API-key presence or Maven's default
   test lifecycle trigger remote provider calls.
-- Run provider feature tests through `task test`; `CODEGEIST_TEST_PROVIDER_CATEGORY`
-  is the only provider category gate and defaults to `none`. Config-only checks stay
+- Run config-only provider tests through `task cli:test-jvm` and intentional live
+  provider tests through `task cli:test`; `CODEGEIST_TEST_PROVIDER_CATEGORY` is the
+  only provider category gate and defaults to `none`. Config-only checks stay
   unannotated; use `local` for local provider calls, and treat `remote_paid` as the
   explicit cost and rate-limit opt-in.

CONTRIBUTING.md

@@ -0,0 +1,114 @@
+# Contributing To Codegeist
+
+This guide provides the Java/core ownership, setup, and verification details for
+`codegeist-ai/codegeist`. Account-wide contribution policy is maintained in the
+[Codegeist community repository](https://github.com/codegeist-ai/.github/blob/main/CONTRIBUTING.md);
+the coordinating T010 rollout remains open until those shared defaults and public
+GitHub settings are published across every Codegeist repository.
+
+## Repository Ownership
+
+This repository owns the Java 25 Codegeist core runtime, CLI/TUI application,
+provider and MCP integration, local tools, packaging, installers, and user-facing
+releases. Core implementation belongs under `app/codegeist/cli` and starts from
+this repository's source `main` branch.
+
+Use the other source repositories for shared workspace infrastructure:
+
+- [`codegeist-agent-kit`](https://github.com/codegeist-ai/codegeist-agent-kit)
+  owns shared OpenCode rules, commands, skills, plugins, and generated agent-kit
+  `release` content.
+- [`codegeist-devcontainer-kit`](https://github.com/codegeist-ai/codegeist-devcontainer-kit)
+  owns the shared development image, initialization, Compose runtime, and
+  generated devcontainer `release` content.
+
+Do not implement shared-kit changes inside this repository's `.opencode` or
+`.devcontainer` submodule checkouts. Make the source change and pull request in
+the owning kit first; a later Codegeist change can update the pinned gitlink.
+
+## Contributor Setup
+
+Host prerequisites are Git, Docker, and either VS Code with Dev Containers or
+the Dev Containers CLI. The normal clone initializes only the two shared
+workspace submodules; the large `docs/third-party/*/source` research references
+are not needed for ordinary development.
+
+```bash
+git clone https://github.com/codegeist-ai/codegeist.git
+cd codegeist
+git submodule update --init .devcontainer .opencode
+devcontainer up --workspace-folder .
+devcontainer exec --workspace-folder . task cli:check
+devcontainer exec --workspace-folder . task cli:run -- --version
+```
+
+VS Code users can choose `Reopen in Container` and run `task cli:check` plus
+`task cli:run -- --version` from the container terminal instead.
+
+The devcontainer initialization creates ignored local/generated files such as
+`.codegeist/.local.env`, `.devcontainer/.env`,
+`.devcontainer/Dockerfile.merged.gen`, and generated Compose bridges. Put
+machine-local values in `.codegeist/.local.env`; do not edit generated files.
+Create `.codegeist/compose.local.yml` or `.codegeist/Dockerfile` only when an
+intentional repository-specific override is needed.
+
+## Checks
+
+The canonical contributor and pull-request check is:
+
+```bash
+task cli:check
+```
+
+It runs the JVM tests with provider category `none`, packages
+`app/codegeist/cli/target/codegeist.jar`, and runs that artifact's real
+`--version` command with a non-empty-output assertion. The jar includes the root
+license at `META-INF/LICENSE`. It ignores ambient `TEST` and provider-category
+values, is deterministic and noninteractive, and requires no Docker daemon,
+Ollama service, model download, credentials, or provider call.
+
+Use stronger checks only when the change needs them:
+
+- `task cli:test-jvm TEST=<selector>` runs a focused deterministic JVM test.
+- `CODEGEIST_TEST_PROVIDER_CATEGORY=local task cli:test TEST=<selector>` opts
+  into local-provider tests and the Taskfile-managed Ollama setup.
+- `task cli:mcp-remote-smoke` opts into the Docker/Ollama MCP smoke.
+- `task cli:native-smoke` builds and smokes the GraalVM native artifact.
+- `task cli:final-smoke-suite` runs the environment-heavy Linux and Windows/QEMU
+  suite.
+
+Hosted provider, paid-capable provider, release, and publication checks require
+their explicit documented opt-ins. Credentials alone never authorize a provider
+call. Report every command run, relevant skips, and concrete blockers in the
+pull request.
+
+## Issues, Tasks, And Pull Requests
+
+Use [GitHub Issues](https://github.com/codegeist-ai/codegeist/issues) for public
+discovery, discussion, priority, assignment, and status. The
+[Codegeist Roadmap](https://github.com/users/codegeist-ai/projects/1) provides the
+account-wide view. Once work is accepted and sufficiently scoped, its matching
+file under `docs/tasks/` is the primary implementation specification for goal,
+acceptance criteria, file targets, non-goals, and verification.
+
+Ready issues link their canonical task file, and publicly tracked task files link
+back to the full issue URL. Pull requests should link both, use a closing keyword
+for the owning issue when appropriate, describe the implementation, and report
+verification. See [`docs/tasks/README.md`](docs/tasks/README.md) before selecting
+work; historical task records and an `open` task status do not by themselves mean
+the work is ready for an external contributor.
+
+## Contribution Terms
+
+Codegeist-owned source and documentation are licensed under
+[0BSD](LICENSE). By submitting a contribution, you agree that your contribution
+is provided under the same `0BSD` terms. This project does not require a CLA or
+DCO sign-off. Preserve third-party licenses, notices, vendored material, and
+submodule ownership.
+
+The T010 rollout targets the shared
+[Code of Conduct](https://github.com/codegeist-ai/.github/blob/main/CODE_OF_CONDUCT.md),
+[Security Policy](https://github.com/codegeist-ai/.github/blob/main/SECURITY.md),
+and [Support Guide](https://github.com/codegeist-ai/.github/blob/main/SUPPORT.md).
+These links become the effective account policies when published. Do not report
+vulnerabilities or credentials in public issues while that rollout is pending.

LICENSE

@@ -0,0 +1,7 @@
+BSD Zero Clause License
+
+Copyright (C) 2026 Codegeist contributors
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.