[Sara-Khosravi]

What this adds

The shared standard for how AID Edge / Velorona code is tested, released and verified in production, kept in your org repo so it is the instruction for every future session.

Path	Purpose
standards/ENGINEERING-QUALITY-STANDARD.md	Stages A (PR CI) / B (release validation) / C (post-deploy verification); five repository classes; what a real smoke test asserts; failure classification; promotion model for new gates; supply-chain baseline; evidence vocabulary; branch-protection baseline
standards/ENTERPRISE-CHECKLIST.md	The things easy to forget: accounts / single points of failure, repo settings, supply chain, operations, data and claims discipline, compatibility. Each item has a check and a status
standards/RELEASE-AND-ROLLBACK.md	Per-class release and rollback procedures (Cloudflare Pages, QGIS plugin, PyPI)
standards/CLAUDE-AUDIT-RUNBOOK.md	Your audit prompt kept verbatim, plus operating notes learned on the first run
standards/audit/2026-10-13-inventory-and-gap-report.md	Inventory of 13 code repos, evidence-based gaps, commands behind every number, blockers
standards/scripts/audit-github-settings.sh	Read-only script for the settings the audit tools cannot see (branch protection, rulesets, secret scanning, environments, 2FA)
.github/workflows/reusable-*.yml	python-lib-ci (matrix, build, twine --strict, wheel hygiene, clean-venv import, dependency audit), pypi-verify (post-publish check from the real index), workflow-hygiene (actionlint, SHA-pinned actions, top-level permissions)
SECURITY.md, .github/PULL_REQUEST_TEMPLATE.md, .github/dependabot.yml, CLAUDE.md	Org defaults and instructions for sessions working here

Related PRs from the same run

• QGIS plugin: velorona-qgis-plugin#18 (Stage A/B/C) and issue #19
• Velorona Map: velorona-map#29 (pytest on PRs). Merging that one deploys to production.

Evidence

• Validated locally: actionlint 1.7.12 + shellcheck clean on all workflows; bash -n and shellcheck on the audit script. The library-CI build/verify logic run by hand against all five libraries (build, twine check --strict, wheel hygiene, clean-venv import): pass. The PyPI verify logic run against real PyPI: passes for aei-geo-features 0.1.5, fails correctly for a never-published version and for a wrong import name. The pin/permission checks found 52 unpinned refs across the 7 repos with workflows.
• CI-verified: only this repo's ci.yml (calls reusable-workflow-hygiene.yml) runs on this PR. The other two reusable workflows have not run on GitHub; they become callable after merge.
• Not run: audit-github-settings.sh (needs your gh auth login).
• Not verifiable from the audit environment: branch protection, rulesets, secret-scanning state, environment reviewers, org 2FA, anything on map.velorona.ai.

After merge (your decisions, in order)

1. Run standards/scripts/audit-github-settings.sh > standards/audit/settings-2026-10-13.md.
2. Merge the plugin PR; require ci-gate on its main.
3. Decide the Map bot-commit question, merge Map #29, then protect main.
4. Roll the reusable workflows to the five libraries (52 unpinned action refs, no post-publish verification, no tests before publish).

🤖 Generated with Claude Code

https://claude.ai/code/session_01TjQAEEcaafSAcTdkusAkUe

---

Generated by Claude Code