Add PCTR: see what your agents can cause, route them safely, prove what happened

.github/DISCUSSION_TEMPLATE/ideas.yml

@@ -0,0 +1,24 @@
+title: "[Idea] "
+labels: ["type: docs"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Idea / Integration
+        Share an integration surface, use case, or improvement. Not every idea
+        needs an RFC — start the conversation here.
+  - type: textarea
+    id: idea
+    attributes:
+      label: What's the idea?
+    validations:
+      required: true
+  - type: input
+    id: surface
+    attributes:
+      label: Enforcement surface (if applicable)
+      placeholder: "e.g. agent tool call, CI/CD stage, API gateway, service account"
+  - type: textarea
+    id: value
+    attributes:
+      label: Who benefits and why?

.github/DISCUSSION_TEMPLATE/protocol-rfc.yml

@@ -0,0 +1,41 @@
+title: "[RFC] "
+labels: ["type: protocol", "status: needs-rfc"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Protocol RFC Discussion
+        Use this to socialize a protocol change before opening a formal RFC in `rfcs/`.
+        Keep it focused on the **trust-before-execution** boundary.
+  - type: textarea
+    id: motivation
+    attributes:
+      label: Motivation
+      description: What trust, authority, decay, proof, or receipt gap does this address?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: The concrete change to grammar, semantics, schema, or the trust model.
+    validations:
+      required: true
+  - type: dropdown
+    id: layer
+    attributes:
+      label: Protocol layer
+      options:
+        - Language / grammar
+        - Trust scoring & decay
+        - Delegation & isnad chains
+        - Authority grants
+        - Proofs
+        - Execution receipts
+    validations:
+      required: true
+  - type: textarea
+    id: compat
+    attributes:
+      label: Compatibility & security impact
+      description: Backward compatibility, failure modes, and any fail-closed considerations.

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# Trust Transfer Protocol — funding & sponsorship
+# TTP is an open protocol stewarded by BlockSiFr.
+github: [BlockSiFr]
+custom: ["https://blocksifr.com"]

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,47 @@
+<!--
+  Trust Transfer Protocol — Pull Request
+  Keep the protocol precise. Describe impact at each layer it touches.
+-->
+
+## Summary
+
+<!-- What does this change do, and why? One short paragraph. -->
+
+## Protocol Layer Impact
+
+<!-- Does this change the grammar, semantics, schemas, or trust model?
+     If it changes the spec, link the RFC. Write "none" if not applicable. -->
+
+- [ ] Changes protocol grammar / `.ttp` language
+- [ ] Changes a public schema (AuthorityGrant / Attestation / ExecutionReceipt / …)
+- [ ] Changes trust scoring, decay, delegation, or proof semantics
+- [ ] No protocol-surface change
+
+## Runtime Enforcement Impact
+
+<!-- How does this affect the runtime authority gate or decision outcomes
+     (allow / throttle / step-up / escalate / deny)? -->
+
+## Receipt / Evidence Impact
+
+<!-- Does this change what is recorded in an ExecutionReceipt, how it is
+     signed, or how the receipt chain is verified? -->
+
+## Tests
+
+<!-- What did you add or run? Paste the relevant `npm test` output. -->
+
+```text
+```
+
+## Screenshots or Diagrams
+
+<!-- For visual or asset changes, attach a render. -->
+
+## Checklist
+
+- [ ] `npm test` passes
+- [ ] Docs / examples updated (if behavior changed)
+- [ ] An RFC is linked for any protocol-surface change
+- [ ] No `cleartext-dev` assumptions introduced into production paths
+- [ ] Commits are signed off and scoped

.github/labels.yml

@@ -0,0 +1,43 @@
+# Trust Transfer Protocol — canonical label system.
+# Synced to the repo by .github/workflows/labels.yml (EndBug/label-sync).
+# Colors follow the TTP brand token palette.
+
+- name: "type: protocol"
+  color: "00D4FF"
+  description: "Protocol grammar, semantics, or schema"
+- name: "type: runtime"
+  color: "0066CC"
+  description: "Runtime authority gate and enforcement"
+- name: "type: docs"
+  color: "8892A0"
+  description: "Documentation and concepts"
+- name: "type: examples"
+  color: "00B8A9"
+  description: "Example .ttp files and integrations"
+- name: "type: security"
+  color: "FF3D00"
+  description: "Security-relevant change or concern"
+
+- name: "status: good first issue"
+  color: "00E676"
+  description: "Approachable, well-scoped first contribution"
+- name: "status: needs-rfc"
+  color: "FFB300"
+  description: "Requires a protocol RFC before implementation"
+
+- name: "priority: critical"
+  color: "FF3D00"
+  description: "Blocks correctness, security, or release"
+
+- name: "area: trust-decay"
+  color: "00D4FF"
+  description: "Trust scoring and decay model"
+- name: "area: execution-receipts"
+  color: "00B8A9"
+  description: "Execution receipts and evidence chain"
+- name: "area: zkp"
+  color: "0066CC"
+  description: "Zero-knowledge proofs"
+- name: "area: compiler"
+  color: "8892A0"
+  description: ".ttp parser, evaluator, and CLI"

.github/workflows/labels.yml

@@ -0,0 +1,21 @@
+name: Sync labels
+
+# Applies the canonical label system in .github/labels.yml to the repository.
+on:
+  push:
+    branches: [main]
+    paths: [".github/labels.yml"]
+  workflow_dispatch:
+
+permissions:
+  issues: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: EndBug/label-sync@v2
+        with:
+          config-file: .github/labels.yml
+          delete-other-labels: false

.gitignore

@@ -3,5 +3,10 @@ node_modules/
 dist/
 **/dist/
 .runtime-authority-receipts.json
+.cortextrace/
+__pycache__/
+*.pyc
+.venv/
 *.log
 .DS_Store
+.pctr/