chore: release v1.1.0

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,67 @@
+name: Bug report
+description: Report reproducible incorrect engine, CLI, artifact, or contract behavior.
+title: "fix: "
+labels: ["bug"]
+assignees: []
+body:
+  - type: markdown
+    attributes:
+      value: Thanks for providing a small, sanitized reproduction.
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - Accounting and valuation
+        - Artifacts and publication
+        - CLI and diagnostics
+        - Contracts and schemas
+        - Execution and order management
+        - Reducer and sequencing
+        - Risk and margin
+        - Strategy protocol
+        - CI and development tooling
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Engine revision or version
+      placeholder: v1.1.0 or a full commit SHA
+    validations:
+      required: true
+  - type: input
+    id: contracts
+    attributes:
+      label: Contract versions
+      description: Include scenario, journal, diagnostic, and strategy versions that apply.
+      placeholder: scenario v1, journal v1, strategy v1
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Provide exact commands and the smallest sanitized input or fixture.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: Include stable diagnostic codes and bounded output when available.
+    validations:
+      required: true
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Safe report
+      options:
+        - label: I removed credentials, customer data, proprietary strategies, and licensed data.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security policy and private reporting
+    url: https://github.com/fallblu/trading-engine/blob/develop/.github/SECURITY.md
+    about: Review supported versions and report suspected vulnerabilities privately.
+  - name: Support and usage guidance
+    url: https://github.com/fallblu/trading-engine/blob/develop/.github/SUPPORT.md
+    about: Review supported scope, public boundaries, and safe issue-reporting guidance.

.github/ISSUE_TEMPLATE/contract-change.yml

@@ -0,0 +1,64 @@
+name: Contract change
+description: Propose a versioned scenario, journal, diagnostic, capability, or strategy change.
+title: "feat: evolve contract "
+labels: ["enhancement", "component: contracts"]
+assignees: []
+body:
+  - type: dropdown
+    id: family
+    attributes:
+      label: Contract family
+      options:
+        - Scenario and journal
+        - Scenario stream
+        - Capabilities
+        - Diagnostics
+        - External strategy protocol and transcript
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Affected versions
+      placeholder: current v1 and proposed change
+    validations:
+      required: true
+  - type: dropdown
+    id: compatibility
+    attributes:
+      label: Compatibility class
+      options:
+        - Additive within the current version
+        - New version required
+        - Clarification with no wire-format change
+        - Not yet known
+    validations:
+      required: true
+  - type: textarea
+    id: invariant
+    attributes:
+      label: Semantic invariant
+      description: State the runtime rule and what JSON Schema can and cannot enforce.
+    validations:
+      required: true
+  - type: textarea
+    id: wire-change
+    attributes:
+      label: Wire-format change
+      description: Show the smallest representative before-and-after records.
+    validations:
+      required: true
+  - type: textarea
+    id: migration
+    attributes:
+      label: Compatibility and migration
+      description: Explain frozen artifacts, parser behavior, and producer/consumer updates.
+    validations:
+      required: true
+  - type: textarea
+    id: verification
+    attributes:
+      label: Conformance evidence
+      description: List schemas, canonical fixtures, negative fixtures, and differential tests.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/cross-repository.yml

@@ -0,0 +1,59 @@
+name: Cross-repository compatibility
+description: Report or propose coordinated behavior between Trading Engine and Persistra.
+title: "chore: coordinate compatibility "
+labels: ["enhancement", "dependency: persistra"]
+assignees: []
+body:
+  - type: input
+    id: engine-revision
+    attributes:
+      label: Trading Engine revision
+      placeholder: Full commit SHA
+    validations:
+      required: true
+  - type: input
+    id: persistra-revision
+    attributes:
+      label: Persistra revision
+      placeholder: Full commit SHA
+    validations:
+      required: true
+  - type: input
+    id: contracts
+    attributes:
+      label: Contract versions
+      placeholder: scenario v1, journal v1, strategy v1
+    validations:
+      required: true
+  - type: dropdown
+    id: owner
+    attributes:
+      label: Owning boundary
+      options:
+        - Trading Engine consumer/runtime behavior
+        - Persistra producer/host behavior
+        - Versioned contract shared by both repositories
+        - Not yet known
+    validations:
+      required: true
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Compatibility behavior
+      description: Describe the expected handoff and the observed failure or proposed change.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction and evidence
+      description: Include exact commands, sanitized fixtures, diagnostics, and CI links.
+    validations:
+      required: true
+  - type: textarea
+    id: coordination
+    attributes:
+      label: Coordinated update
+      description: Identify which pin, tests, contracts, and documentation each repository changes.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,60 @@
+name: Feature proposal
+description: Propose one scoped capability without assigning a release commitment.
+title: "feat: "
+labels: ["enhancement"]
+assignees: []
+body:
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - Accounting and valuation
+        - Artifacts and publication
+        - CLI and diagnostics
+        - Contracts and schemas
+        - Execution and order management
+        - Reducer and sequencing
+        - Risk and margin
+        - Strategy protocol
+        - CI and development tooling
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Describe the concrete unsupported workflow or invariant.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+      description: Define scope, boundaries, and observable behavior without a delivery date.
+    validations:
+      required: true
+  - type: dropdown
+    id: contract-impact
+    attributes:
+      label: Contract impact
+      options:
+        - No public contract change
+        - Additive current-contract change
+        - Breaking versioned-contract change
+        - Not yet known
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives and tradeoffs
+    validations:
+      required: true
+  - type: textarea
+    id: verification
+    attributes:
+      label: Verification expectations
+      description: List unit, property, conformance, failure-path, or performance evidence.
+    validations:
+      required: true

.github/SECURITY.md

@@ -0,0 +1,52 @@
+# Security policy
+
+## Supported versions
+
+Trading Engine provides security fixes for the latest patch release in the current release line.
+
+| Release line | Supported |
+| --- | --- |
+| Latest 1.0.x patch | Yes |
+| Earlier releases | No |
+
+The `develop` branch contains unreleased work and is not a supported release. A fix is staged there
+or on a hotfix branch according to the repository's release workflow. This table is updated when a
+new release line becomes supported.
+
+## Report a vulnerability privately
+
+Use [GitHub private vulnerability reporting](https://github.com/fallblu/trading-engine/security/advisories/new)
+to report a suspected vulnerability. Do not open a public issue for an undisclosed vulnerability.
+
+A useful report includes the affected version or commit, security impact, trigger conditions, a
+minimal sanitized reproduction, operating-system and dependency versions, and any disclosure
+constraints. Do not include credentials, customer data, proprietary strategies, account details,
+or licensed market data. Use synthetic inputs or describe the behavior when a safe reproduction
+cannot be shared.
+
+The maintainer aims to acknowledge a report within three business days and provide an initial
+assessment within seven business days. Remediation timing depends on severity, exploitability, and
+release risk. These targets are goals, not guarantees. Keep the report private while it is being
+assessed and fixed. The maintainer and reporter will coordinate public disclosure after a fix or
+mitigation is available. The project does not currently offer a bug bounty.
+
+## Security boundaries
+
+An external strategy is an arbitrary executable, not a sandboxed plugin. The engine starts it
+directly without a shell, but the child inherits the engine process's operating-system identity,
+environment, filesystem access, network access, and standard error. Run only trusted strategies or
+isolate them with an operating-system account, container, or sandbox that supplies the minimum
+environment and permissions. Do not put secrets in strategy arguments, scenarios, or engine logs.
+
+Committed fixtures must contain only synthetic or redistributable data. Never add provider
+credentials, customer account data, proprietary strategies, or licensed market data. Sanitize any
+reproduction before sharing it in an issue, pull request, test, journal, or transcript.
+
+Journals and strategy transcripts can contain market events, orders, positions, diagnostics, and
+a bounded prefix of a rejected strategy response. Store them according to the sensitivity of their
+inputs and review them before sharing. Artifact hashes and release attestations provide integrity
+and provenance; they do not encrypt data, enforce access control, or prove that an artifact is safe
+to execute.
+
+Repository dependency and analysis controls are described in the
+[security maintenance guide](../docs/security-maintenance.md).

.github/SUPPORT.md

@@ -0,0 +1,16 @@
+# Support
+
+Start with the [README](../README.md) for setup, supported scope, and command examples. The
+[architecture](../docs/architecture.md), [scenario contract](../docs/scenario.md), and
+[Persistra integration guide](../docs/persistra.md) describe the public boundaries in detail.
+
+Report a suspected vulnerability through the private channel in the
+[security policy](SECURITY.md), not through a public issue.
+
+Use the structured issue forms for reproducible bugs, feature proposals, versioned contract
+changes, and cross-repository compatibility failures. Search existing issues first. Include the
+engine version, relevant contract versions, exact commands, sanitized inputs, and the smallest
+reproduction that demonstrates the behavior.
+
+Do not post credentials, customer data, proprietary strategies, or licensed market data. This
+repository cannot provide private trading, deployment, or strategy-development support.

.github/branch-protection.json

@@ -0,0 +1,25 @@
+{
+  "branches": {
+    "main": {
+      "required_status_checks": {
+        "strict": true,
+        "contexts": ["check", "persistra-compatibility"]
+      },
+      "enforce_admins": true,
+      "required_pull_request_reviews": {
+        "dismiss_stale_reviews": false,
+        "require_code_owner_reviews": false,
+        "required_approving_review_count": 0,
+        "require_last_push_approval": false
+      },
+      "restrictions": null,
+      "required_conversation_resolution": true,
+      "required_linear_history": true,
+      "allow_force_pushes": false,
+      "allow_deletions": false,
+      "block_creations": false,
+      "lock_branch": false,
+      "allow_fork_syncing": false
+    }
+  }
+}

.github/dependabot.yml

@@ -0,0 +1,35 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "America/New_York"
+    target-branch: "develop"
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "pip"
+    directory: "/requirements"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "10:00"
+      timezone: "America/New_York"
+    target-branch: "develop"
+    open-pull-requests-limit: 5
+    groups:
+      python-tooling:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"