chore: open-source repo setup (#1)

* feat: Add CONTRIBUTING.md and LICENSE files for project guidelines and legal terms

* chore(github): add issue and PR templates

- ISSUE_TEMPLATE/bug_report.md: structured bug report (env, repro, logs;
  reminds reporters not to paste model contents or secrets).
- ISSUE_TEMPLATE/feature_request.md: problem / proposal / scope hint,
  with optional OpenSpec change linkage.
- ISSUE_TEMPLATE/config.yml: disables blank issues; routes questions to
  Discussions and security reports to GitHub Security Advisories.
- PULL_REQUEST_TEMPLATE.md: summary, linked OpenSpec change folder,
  invariant checklist, and quality-gate checklist.

* ci: remove docker image build from CI

The docker job rebuilt placeholder images on every push and PR (~30s
runner time) without catching regressions the backend/ui/contracts jobs
miss. Image build is now exercised locally via docker-compose; see
Makefile for the orchestration surface.

* chore(docker): add compose and Makefile for local dev

docker-compose.yml: one file, backend + ui services on a private bridge
network. UI binds to host ${UI_PORT:-3000}; backend is reachable only
from inside the network via the nginx /api proxy. Artifacts persist in
the named volume cerebro-data. Backend CMD is overridden with sleep
infinity while uvicorn is still placeholder; remove that line once the
FastAPI app ships in docker/backend.Dockerfile.

Makefile: thin wrappers over docker compose (up/down/build/rebuild/
restart/ps/logs/shell-backend/shell-ui/clean) plus the same lint/fmt/
test/contracts checks CI runs. `make help` auto-lists targets by
parsing trailing `## doc` comments.

* chore(github): convert templates to YAML Issue Forms

- Replace bug_report.md / feature_request.md (markdown front-matter)
  with bug-report.yml / feature-request.yml (modern Issue Forms).
  Surfaces, environment fields, install-method, and OS dropdowns are
  enumerated so triage gets structured input instead of free-form prose.
- Add openspec-change.yml: tracking-issue template for an OpenSpec
  change folder. Captures lane (v0.1 / v0.2 / v0.3), planned PRs,
  blast-radius from gitnexus_impact, and the pre-flight checklist
  (proposal / design / tasks / deltas / invariants reviewed).
- Enhance PULL_REQUEST_TEMPLATE.md: classification, affected-surface
  matrix mapped to src/cerebro/ subpackages, test plan, invariant
  checklist, quality-gate checklist, branch + commit-style guards
  (Conventional Commits, no AI trailers, no spec IDs in code).
  markdownlint-disable-file MD041 added at the top because GitHub
  templates conventionally start at h2 (the PR title is the implicit h1).

* docs: add Contributor Covenant 2.1 code of conduct

Reports route to dgtalbug@gmail.com. CONTRIBUTING.md already links to
this file from the root.

* ci(ui): point pnpm/action-setup at ui/package.json

pnpm/action-setup@v4 runs with the runner's CWD (repo root) and ignores
the job-level `defaults.run.working-directory`, so the action looked
for a non-existent root `package.json` and failed with 'No pnpm
version is specified'. The pnpm version is already pinned in
ui/package.json as packageManager=pnpm@11.1.2 — this just tells the
action where to read it from.

Author: dgtalbug

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,130 @@
+name: Bug report
+description: Report a defect in Cerebro.
+title: "[bug]: "
+labels:
+  - type:bug
+  - needs-triage
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Please fill out every required field —
+        incomplete reports take longer to triage.
+
+        For security vulnerabilities, **do not** use this form. Use
+        [GitHub Security Advisories](https://github.com/dgtalbug/cerebro/security/advisories/new)
+        for private disclosure.
+
+        Do not paste model contents, training data, secrets, or PII. Counts
+        and sizes are fine (`num_trees=187`, `num_features=24`).
+
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Affected surface
+      description: Which part of Cerebro is misbehaving?
+      multiple: true
+      options:
+        - Backend API (FastAPI)
+        - CLI (`cerebro …`)
+        - Extraction (LightGBM)
+        - Canonical schema / contracts
+        - Storage (artifact files / SQLite registry)
+        - AI agent
+        - UI (React dashboard)
+        - Docker / compose
+        - Documentation
+        - Build / packaging / CI
+        - Other (describe below)
+    validations:
+      required: true
+
+  - type: input
+    id: cerebro-version
+    attributes:
+      label: Cerebro version
+      description: Tag (`v0.x.y`) or commit SHA. From `git rev-parse --short HEAD` if running from source.
+      placeholder: "git@<sha> or v0.x.y"
+    validations:
+      required: true
+
+  - type: input
+    id: python-version
+    attributes:
+      label: Python version
+      description: Output of `python --version` in the active environment.
+      placeholder: "3.12.x"
+    validations:
+      required: true
+
+  - type: input
+    id: node-version
+    attributes:
+      label: Node version
+      description: Output of `node --version`. Leave blank if the bug is backend-only.
+      placeholder: "22.x.x"
+
+  - type: dropdown
+    id: install-method
+    attributes:
+      label: Install method
+      options:
+        - From source (uv + pnpm)
+        - Docker compose (`make up`)
+        - Other
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - macOS (Apple Silicon)
+        - macOS (Intel)
+        - Linux (x86_64)
+        - Linux (arm64)
+        - Windows / WSL2
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction steps
+      description: Minimal, ordered steps that reproduce the bug. If artifact-related, include framework, objective, and shape (num_trees / num_features) — never the artifact itself.
+      placeholder: |
+        1. Train a LightGBM binary classifier on …
+        2. Run `cerebro extract model.txt`
+        3. Observe …
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: Exact error messages, stack traces, or structured-log lines. Redact PII / secrets before pasting.
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: Structured JSON log lines preferred. Cerebro emits one JSON object per line via structlog.
+      render: json
+
+  - type: textarea
+    id: extra
+    attributes:
+      label: Additional context
+      description: Screenshots (UI bugs), related issues, recent changes, hunches.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions and discussion
+    url: https://github.com/dgtalbug/cerebro/discussions
+    about: Open-ended questions, design ideas, and general discussion belong in Discussions.
+  - name: Security report
+    url: https://github.com/dgtalbug/cerebro/security/advisories/new
+    about: Report a security vulnerability privately via GitHub Security Advisories.

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -0,0 +1,86 @@
+name: Feature request
+description: Propose a new capability or improvement.
+title: "[feat]: "
+labels:
+  - type:feature
+  - needs-triage
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for proposing a feature. Cerebro follows an OpenSpec workflow —
+        accepted feature requests usually become a change folder under
+        `openspec/changes/<name>/` (with `proposal.md`, `design.md`, `tasks.md`,
+        and a delta spec) before implementation starts.
+
+        Discussion-style ideas live better in
+        [Discussions](https://github.com/dgtalbug/cerebro/discussions);
+        use this form when you have a concrete proposal.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What's hard or impossible today? Describe the situation, not the solution.
+      placeholder: |
+        When inspecting a multiclass LightGBM model, the dashboard groups all
+        K class trees under a single tab so per-class importance is hidden.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: How would Cerebro behave if this feature shipped? Focus on user-visible behavior, not implementation.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Primary surface(s)
+      description: Where would this feature appear?
+      multiple: true
+      options:
+        - Extraction (LightGBM / XGBoost / future framework)
+        - Canonical schema (new field, semantics, versioning)
+        - Backend API
+        - CLI
+        - Storage / registry
+        - AI agent
+        - UI (React dashboard)
+        - Diagnostics / recommendations
+        - Docker / compose
+        - Documentation
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Other approaches you've thought about and why they fall short.
+
+  - type: textarea
+    id: success
+    attributes:
+      label: Definition of done
+      description: How would we know the feature is finished? Ideally a user-visible, observable outcome.
+
+  - type: input
+    id: openspec-change
+    attributes:
+      label: OpenSpec change folder (if already drafted)
+      description: Path under `openspec/changes/`. Leave blank if triage will assign one.
+      placeholder: "openspec/changes/<short-name>"
+
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Scope
+      options:
+        - label: I've checked open issues and discussions; this is not a duplicate.
+        - label: I'm willing to draft the OpenSpec change proposal for this.
+        - label: I'm willing to implement this if accepted.

.github/ISSUE_TEMPLATE/openspec-change.yml

@@ -0,0 +1,84 @@
+name: OpenSpec change (tracking issue)
+description: Umbrella tracking issue for an OpenSpec change folder. Internal use by maintainers.
+title: "[openspec]: "
+labels:
+  - type:openspec
+  - needs-triage
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this template to open the visible tracking issue for an
+        OpenSpec change. The actual artifacts (`proposal.md`, `design.md`,
+        `tasks.md`, delta specs) live under `openspec/changes/<name>/`;
+        this issue is the umbrella for the change's PRs, review
+        checkpoints, and cross-references.
+
+  - type: input
+    id: change-folder
+    attributes:
+      label: Change folder
+      description: Path under `openspec/changes/`.
+      placeholder: "openspec/changes/lightgbm-extraction"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: lane
+    attributes:
+      label: Lane
+      description: Which release lane does this change target?
+      options:
+        - v0.1 — LightGBM artifact in / canonical JSON out
+        - v0.2 — diagnostics, recommendations, XGBoost extractor
+        - v0.3 — `cerebro train` (apply + retrain)
+        - hygiene / contributors / docs
+        - other
+    validations:
+      required: true
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: One-paragraph summary
+      description: What does this change ship and why?
+    validations:
+      required: true
+
+  - type: textarea
+    id: dependencies
+    attributes:
+      label: Depends on
+      description: Other changes, decisions, or secrets that must land first.
+      placeholder: |
+        - openspec/changes/canonical-schema-v1 merged
+        - `ANTHROPIC_API_KEY` configured for agent E2E tests
+
+  - type: textarea
+    id: pr-plan
+    attributes:
+      label: Planned PRs
+      description: One bullet per PR, in dependency order. Conventional Commit titles.
+      placeholder: |
+        - feat(extractor): canonical schema for LightGBM regression
+        - feat(extractor): cover the 5 LightGBM variants
+        - test(extractor): golden fixtures for each variant
+
+  - type: textarea
+    id: blast-radius
+    attributes:
+      label: Blast radius
+      description: Symbols / modules affected if this is a refactor. Paste the relevant `gitnexus_impact` output. Leave blank for greenfield changes.
+      render: text
+
+  - type: checkboxes
+    id: pre-flight
+    attributes:
+      label: Pre-flight
+      options:
+        - label: "`proposal.md` written and references the design narrative section it implements"
+        - label: "`design.md` written (if structural)"
+        - label: "`tasks.md` enumerates one Conventional Commit per task"
+        - label: "Delta specs added under `openspec/changes/<name>/specs/`"
+        - label: "Hard invariants from `openspec/project.md` reviewed for this change"
+        - label: "Branch convention: `feat/<scope>-<short>` or matching prefix"