zaptrace-eda 0.3.3__tar.gz

zaptrace_eda-0.3.3/.bestpractices.json

@@ -0,0 +1,100 @@
+{
+  "schema": "https://www.bestpractices.dev/projects/13403",
+  "project": "zaptrace",
+  "repository": "https://github.com/oaslananka/zaptrace",
+  "license": "MIT",
+  "target_maturity": "Professional OSS / Mature OSS",
+  "openssf_best_practices_target": "Passing, then Silver",
+  "gold_claim": "Not claimed; requires independent contributors, bus factor >= 2, and regular non-author human review.",
+  "baseline_series_target": "Level 2",
+  "evidence": [
+    "docs/openssf-evidence.md",
+    "docs/openssf-gap-analysis.md",
+    "docs/repo-maturity-report.md"
+  ],
+  "last_audited": "2026-08-02",
+  "vulnerability_report_private_status": "Met",
+  "vulnerability_report_private_justification": "GitHub Private Vulnerability Reporting is enabled and SECURITY.md directs reporters to the private advisory form: https://github.com/oaslananka/zaptrace/blob/main/SECURITY.md",
+  "vulnerability_report_response_status": "N/A",
+  "vulnerability_report_response_justification": "No vulnerability report or GitHub security advisory has been received or published in the last six months. The documented target is acknowledgement within 48 hours: https://github.com/oaslananka/zaptrace/blob/main/docs/security/vulnerability-response.md",
+  "build_status": "Met",
+  "build_justification": "The Python/Rust package and container are rebuilt from source with uv, maturin, Cargo, and Docker in required CI: https://github.com/oaslananka/zaptrace/blob/main/docs/development/validation-environment.md",
+  "build_common_tools_status": "Met",
+  "build_common_tools_justification": "The build uses common ecosystem tools: uv/pip-compatible metadata, maturin, Cargo, Docker, and GitHub Actions: https://github.com/oaslananka/zaptrace/blob/main/pyproject.toml",
+  "build_floss_tools_status": "Met",
+  "build_floss_tools_justification": "The documented build toolchain uses FLOSS tools (Python, uv, maturin, Rust/Cargo, Docker-compatible tooling): https://github.com/oaslananka/zaptrace/blob/main/docs/development/validation-environment.md",
+  "test_status": "Met",
+  "test_justification": "The public FLOSS test suites and exact commands are documented and run in CI: https://github.com/oaslananka/zaptrace/blob/main/docs/development/testing-policy.md",
+  "test_invocation_status": "Met",
+  "test_invocation_justification": "Tests use standard ecosystem commands including uv run pytest and cargo test: https://github.com/oaslananka/zaptrace/blob/main/docs/quality/testing-policy.md",
+  "test_most_status": "Met",
+  "test_most_justification": "The suite enforces a 75% Python coverage floor and includes unit, integration, native, hardware, external-tool, benchmark, fuzz, and compatibility lanes: https://github.com/oaslananka/zaptrace/blob/main/docs/development/testing-policy.md",
+  "test_continuous_integration_status": "Met",
+  "test_continuous_integration_justification": "Required GitHub Actions run tests on every pull request and protected main update: https://github.com/oaslananka/zaptrace/blob/main/.github/workflows/quality.yml",
+  "test_policy_status": "Met",
+  "test_policy_justification": "CONTRIBUTING.md requires tests for new features and security-sensitive changes: https://github.com/oaslananka/zaptrace/blob/main/CONTRIBUTING.md",
+  "tests_are_added_status": "Met",
+  "tests_are_added_justification": "Recent feature, refactor, workflow, and security pull requests add or update regression tests, enforced by required CI: https://github.com/oaslananka/zaptrace/pulls?q=is%3Apr+is%3Amerged",
+  "tests_documented_added_status": "Met",
+  "tests_documented_added_justification": "The contribution and testing policies explicitly require tests for new features and public/security-sensitive behavior: https://github.com/oaslananka/zaptrace/blob/main/CONTRIBUTING.md",
+  "warnings_status": "Met",
+  "warnings_justification": "Ruff, Pyright, cargo clippy with -D warnings, actionlint, and workflow/security linters run in required CI: https://github.com/oaslananka/zaptrace/blob/main/docs/development/testing-policy.md",
+  "warnings_fixed_status": "Met",
+  "warnings_fixed_justification": "Required lint/type/Rust warning gates must pass before merge; accepted findings require explicit scoped handling: https://github.com/oaslananka/zaptrace/blob/main/.github/workflows/quality.yml",
+  "warnings_strict_status": "Met",
+  "warnings_strict_justification": "Rust Clippy runs with -D warnings and Python/workflow linters run in strict required gates: https://github.com/oaslananka/zaptrace/blob/main/docs/development/coding-standards.md",
+  "know_secure_design_status": "Met",
+  "know_secure_design_justification": "The maintainer applies least privilege, fail-safe defaults, complete mediation, bounded inputs, and explicit trust boundaries documented in the threat model and input-validation policy: https://github.com/oaslananka/zaptrace/blob/main/docs/security/threat-model.md",
+  "know_common_errors_status": "Met",
+  "know_common_errors_justification": "The security policy and threat model identify injection, path traversal, authorization, dependency, secret, plugin, native-boundary, and resource-exhaustion risks with mitigations: https://github.com/oaslananka/zaptrace/blob/main/SECURITY.md",
+  "crypto_published_status": "Met",
+  "crypto_published_justification": "Project integrity/auth comparisons use published standard primitives such as SHA-256 and Python hmac.compare_digest; transport security is delegated to standard TLS platforms.",
+  "crypto_call_status": "Met",
+  "crypto_call_justification": "ZapTrace does not implement custom cryptographic algorithms; it calls Python standard-library hashing/HMAC primitives and platform TLS.",
+  "crypto_floss_status": "Met",
+  "crypto_floss_justification": "Cryptographic functionality used by project code is provided by FLOSS Python/runtime and platform tooling.",
+  "crypto_keylength_status": "N/A",
+  "crypto_keylength_justification": "ZapTrace does not generate or manage encryption/signing keys or configurable cryptographic key lengths.",
+  "crypto_working_status": "Met",
+  "crypto_working_justification": "Project code uses SHA-256 and constant-time comparison and does not depend on MD4, MD5, DES, RC4, or other broken default cryptographic algorithms.",
+  "crypto_weaknesses_status": "Met",
+  "crypto_weaknesses_justification": "No default security mechanism in project code depends on SHA-1, insecure cipher modes, or another known-seriously-weakened algorithm.",
+  "crypto_pfs_status": "N/A",
+  "crypto_pfs_justification": "ZapTrace does not implement a key-agreement protocol; HTTPS/TLS termination is provided by the deployment platform.",
+  "crypto_password_storage_status": "N/A",
+  "crypto_password_storage_justification": "ZapTrace does not store passwords for authentication of external users; deployments use externally supplied bearer tokens/platform controls.",
+  "crypto_random_status": "N/A",
+  "crypto_random_justification": "ZapTrace does not generate cryptographic keys or nonces as part of its security mechanisms.",
+  "delivery_unsigned_status": "Met",
+  "delivery_unsigned_justification": "Project/release URLs use HTTPS; release artifacts have SHA-256 manifests and GitHub build-provenance attestations with documented verification: https://github.com/oaslananka/zaptrace/blob/main/docs/security/release-verification.md",
+  "vulnerabilities_fixed_60_days_status": "Met",
+  "vulnerabilities_fixed_60_days_justification": "No public or draft ZapTrace security advisory or known unpatched medium-or-higher project vulnerability exists; dependency/security scans run continuously: https://github.com/oaslananka/zaptrace/security",
+  "vulnerabilities_critical_fixed_status": "Met",
+  "vulnerabilities_critical_fixed_justification": "No known unresolved critical ZapTrace vulnerability exists; the documented response process prioritizes critical reports and coordinated fixes: https://github.com/oaslananka/zaptrace/blob/main/docs/security/vulnerability-response.md",
+  "no_leaked_credentials_status": "Met",
+  "no_leaked_credentials_justification": "GitHub secret scanning and push protection are enabled, and required Gitleaks scans pass on pull requests and main: https://github.com/oaslananka/zaptrace/actions/workflows/gitleaks.yml",
+  "static_analysis_status": "Met",
+  "static_analysis_justification": "CodeQL, Semgrep, SonarCloud, Ruff, Pyright, and Rust Clippy run before merge and on main: https://github.com/oaslananka/zaptrace/blob/main/.github/workflows/security-scan.yml",
+  "static_analysis_common_vulnerabilities_status": "Met",
+  "static_analysis_common_vulnerabilities_justification": "CodeQL and Semgrep security rules inspect common vulnerability classes in required CI: https://github.com/oaslananka/zaptrace/blob/main/.github/workflows/security-scan.yml",
+  "static_analysis_fixed_status": "Met",
+  "static_analysis_fixed_justification": "Confirmed exploitable medium-or-higher findings block security gates or are handled through the private vulnerability process; no such unresolved project finding is known.",
+  "static_analysis_often_status": "Met",
+  "static_analysis_often_justification": "Static analysis runs for every pull request and protected main update: https://github.com/oaslananka/zaptrace/actions/workflows/security-scan.yml",
+  "dynamic_analysis_status": "Met",
+  "dynamic_analysis_justification": "A deterministic untrusted-input fuzz campaign runs on every pull request/main update and weekly in deep mode across 14 parser/API/path/export targets: https://github.com/oaslananka/zaptrace/blob/main/docs/security/fuzzing.md",
+  "dynamic_analysis_unsafe_status": "N/A",
+  "dynamic_analysis_unsafe_justification": "Project-owned runtime code is Python and Rust, not a memory-unsafe language such as C or C++; native Rust boundaries are separately tested fail-closed.",
+  "dynamic_analysis_enable_assertions_status": "Met",
+  "dynamic_analysis_enable_assertions_justification": "Pytest, property/fuzz checks, and Rust tests run with their validation/assertion mechanisms enabled before release.",
+  "dynamic_analysis_fixed_status": "Met",
+  "dynamic_analysis_fixed_justification": "No confirmed unresolved medium-or-higher vulnerability from dynamic analysis is known; fuzz failures are retained as artifacts and fail the campaign gate.",
+  "dco_status": "Met",
+  "dco_justification": "CONTRIBUTING.md documents DCO sign-off, scripts/ci_dco_check.py enforces it, and the main ruleset requires the DCO sign-off status: https://github.com/oaslananka/zaptrace/blob/main/CONTRIBUTING.md",
+  "osps_le_01_01_status": "Met",
+  "osps_le_01_01_justification": "Non-trivial contributions require a Signed-off-by assertion enforced by the required DCO sign-off check: https://github.com/oaslananka/zaptrace/blob/main/.github/workflows/dco.yml",
+  "access_continuity_status": "Unmet",
+  "access_continuity_justification": "The project remains solo-maintainer. A real backup maintainer or emergency steward must be added before this criterion is claimed: https://github.com/oaslananka/zaptrace/blob/main/docs/governance/access-continuity.md",
+  "bus_factor_status": "Unmet",
+  "bus_factor_justification": "The current bus factor is one; ZapTrace will not claim this criterion until a second trusted active maintainer or independent contributor is demonstrated: https://github.com/oaslananka/zaptrace/blob/main/MAINTAINERS.md"
+}

zaptrace_eda-0.3.3/.claude-plugin/plugin.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
+  "name": "zaptrace",
+  "version": "0.3.3",
+  "description": "Verification-first ZapTrace workflows for local design validation, proof-pack review, and bounded benchmark evaluation.",
+  "skills": [
+    "./skills/zaptrace-design-validation",
+    "./skills/zaptrace-proof-pack-review",
+    "./skills/zaptrace-benchmark-evaluation"
+  ],
+  "author": {
+    "name": "oaslananka",
+    "url": "https://github.com/oaslananka"
+  }
+}

zaptrace_eda-0.3.3/.dockerignore

@@ -0,0 +1,23 @@
+.git
+.github
+.venv
+.tmp
+.tmp/
+.uv-cache
+.uv-cache/
+.docker-config
+.docker-config/
+.docker-buildx
+.docker-buildx/
+.pytest_cache
+.ruff_cache
+dist
+target
+zaptrace_core/target
+__pycache__
+*.pyc
+*.pyd
+*.so
+coverage.xml
+TestDesign_report.md
+TestDesign_schematic.svg

zaptrace_eda-0.3.3/.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false

zaptrace_eda-0.3.3/.env.example

@@ -0,0 +1,28 @@
+# Copy this file to .env. The default Compose path uses independent REST/MCP static-bearer secrets.
+# For oauth-jwt MCP migration, leave the MCP token/subject empty and use the public profile settings below.
+ZAPTRACE_API_TOKEN=
+ZAPTRACE_MCP_HTTP_TOKEN=
+
+# Host ports remain bound to 127.0.0.1 by docker-compose.yml.
+ZAPTRACE_API_PUBLISHED_PORT=8000
+ZAPTRACE_MCP_HTTP_PUBLISHED_PORT=8090
+
+# Optional server-controlled identity and capability policy.
+ZAPTRACE_API_TOKEN_SUBJECT=compose-api
+ZAPTRACE_API_TOKEN_SCOPES=read
+ZAPTRACE_API_TOKEN_SESSIONS=*
+ZAPTRACE_MCP_TOKEN_SUBJECT=compose-mcp
+
+# Optional versioned MCP HTTP profile selection.
+# Keep these unset to preserve the 0.3.x legacy inference behavior above.
+# ZAPTRACE_MCP_AUTH_CONFIG_VERSION=1
+# ZAPTRACE_MCP_AUTH_PROFILE=static-bearer
+# ZAPTRACE_MCP_AUTH_PROFILE=oauth-jwt
+
+# The oauth-jwt URLs below are public configuration placeholders, not secrets.
+# When selecting oauth-jwt, leave ZAPTRACE_MCP_HTTP_TOKEN and ZAPTRACE_MCP_TOKEN_SUBJECT empty.
+# Access tokens, authorization-server credentials, and signing material stay outside this file/repository.
+# ZAPTRACE_MCP_PUBLIC_BASE_URL=https://mcp.example.com
+# ZAPTRACE_MCP_AUTH_RESOURCE_URI=https://mcp.example.com/mcp
+# ZAPTRACE_MCP_AUTHORIZATION_SERVER=https://auth.example.com/
+# ZAPTRACE_MCP_AUTH_JWKS_URI=https://auth.example.com/.well-known/jwks.json

zaptrace_eda-0.3.3/.github/CODEOWNERS

@@ -0,0 +1,12 @@
+# Repository ownership for review routing.
+# This file does not by itself enforce human review. Enable CODEOWNERS-required
+# review in branch protection when there is at least one independent reviewer.
+
+* @oaslananka
+
+/.github/ @oaslananka
+/docs/ @oaslananka
+/zaptrace/ @oaslananka
+/zaptrace_core/ @oaslananka
+/scripts/ @oaslananka
+/tests/ @oaslananka

zaptrace_eda-0.3.3/.github/FUNDING.yml

@@ -0,0 +1,2 @@
+github: [oaslananka]
+buy_me_a_coffee: oaslananka

zaptrace_eda-0.3.3/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,138 @@
+name: Bug Report
+description: Report an implementation, documentation, or verification defect
+title: "[Bug] "
+labels: ["type/hardening", "status/needs-design"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For security vulnerabilities, use the private security policy instead of a public issue.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What happened, and why is it incorrect or unsafe?
+    validations:
+      required: true
+
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope
+      description: Which behavior, component, or evidence path needs correction?
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction steps
+      description: Provide the smallest deterministic reproducer.
+      placeholder: |
+        1. Run `...`
+        2. Observe `...`
+    validations:
+      required: true
+
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: List concrete pass/fail conditions for the fix.
+      placeholder: |
+        - [ ] Regression test fails before the fix
+        - [ ] Regression test passes after the fix
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence required
+      description: Logs, fixtures, reports, proof records, or CI links required to verify closure.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Primary area
+      options:
+        - area/agent-runtime
+        - area/benchmark
+        - area/ci
+        - area/component-library
+        - area/datasheet
+        - area/dfm
+        - area/drc
+        - area/erc
+        - area/footprints
+        - area/governance
+        - area/interop
+        - area/kicad
+        - area/layout
+        - area/manufacturing
+        - area/plugin
+        - area/proof-pack
+        - area/requirements
+        - area/review-studio
+        - area/router
+        - area/security
+        - area/simulation
+        - area/supply-chain
+    validations:
+      required: true
+
+  - type: dropdown
+    id: priority
+    attributes:
+      label: Suggested priority
+      options:
+        - priority/P0 - release or safety blocker
+        - priority/P1 - next milestone
+        - priority/P2 - important but not blocking
+    validations:
+      required: true
+
+  - type: textarea
+    id: dependencies
+    attributes:
+      label: Dependencies or blockers
+      description: Link required issues, external tools, or state that blocks the fix. Write “None” when independent.
+    validations:
+      required: true
+
+  - type: textarea
+    id: non-goals
+    attributes:
+      label: Non-goals
+      description: State what this fix must not claim or broaden.
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: ZapTrace version
+      placeholder: "0.3.0"
+    validations:
+      required: true
+
+  - type: input
+    id: environment
+    attributes:
+      label: Python and operating system
+      placeholder: "Python 3.13 / Ubuntu 24.04"
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Safety check
+      options:
+        - label: This is not a privately reportable security vulnerability.
+          required: true
+        - label: This report does not claim fabrication approval or no-review correctness.
+          required: true

zaptrace_eda-0.3.3/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/oaslananka/zaptrace/security/policy
+    about: Please report security vulnerabilities privately.
+  - name: Documentation site
+    url: https://oaslananka.github.io/zaptrace
+    about: Read the published documentation before opening support-style issues.

zaptrace_eda-0.3.3/.github/ISSUE_TEMPLATE/epic.yml

@@ -0,0 +1,54 @@
+name: Epic
+description: Define a milestone-level work package
+title: "[Epic] "
+labels: ["type/epic", "status/needs-design"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Goal and problem
+      description: What outcome should this epic achieve, and what current gap does it close?
+    validations:
+      required: true
+
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope and required issues
+      placeholder: |
+        - [ ] #...
+        - [ ] #...
+    validations:
+      required: true
+
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Exit criteria
+      description: Define the milestone-level pass/fail conditions.
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Release gate and evidence
+      description: Which commands, reports, reviews, and artifacts prove completion?
+    validations:
+      required: true
+
+  - type: textarea
+    id: dependencies
+    attributes:
+      label: Dependencies or blockers
+      description: Link predecessor epics, external decisions, or required environments.
+    validations:
+      required: true
+
+  - type: textarea
+    id: non-goals
+    attributes:
+      label: Non-goals
+      description: Which claims and behaviors are explicitly outside the epic?
+    validations:
+      required: true

zaptrace_eda-0.3.3/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,110 @@
+name: Feature Request
+description: Propose a bounded engineering capability or workflow improvement
+title: "[Feature] "
+labels: ["type/feature", "status/needs-design"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Which user, agent, verification, or manufacturing problem should be solved?
+    validations:
+      required: true
+
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope
+      description: Define the bounded capability and public behavior.
+    validations:
+      required: true
+
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      placeholder: |
+        - [ ] Deterministic behavior is tested
+        - [ ] Machine-readable evidence is produced
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence required
+      description: Identify CI artifacts, fixtures, proof records, or reports needed for closure.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: type
+    attributes:
+      label: Work type
+      options:
+        - type/feature
+        - type/hardening
+        - type/research
+        - type/test
+        - type/refactor
+        - type/docs
+        - type/ci
+    validations:
+      required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Primary area
+      options:
+        - area/agent-runtime
+        - area/benchmark
+        - area/ci
+        - area/component-library
+        - area/datasheet
+        - area/dfm
+        - area/drc
+        - area/erc
+        - area/footprints
+        - area/governance
+        - area/interop
+        - area/kicad
+        - area/layout
+        - area/manufacturing
+        - area/plugin
+        - area/proof-pack
+        - area/requirements
+        - area/review-studio
+        - area/router
+        - area/security
+        - area/simulation
+        - area/supply-chain
+    validations:
+      required: true
+
+  - type: dropdown
+    id: priority
+    attributes:
+      label: Suggested priority
+      options:
+        - priority/P0 - foundational or release blocking
+        - priority/P1 - next milestone
+        - priority/P2 - important but not blocking
+    validations:
+      required: true
+
+  - type: textarea
+    id: dependencies
+    attributes:
+      label: Dependencies or blockers
+      description: Link prerequisite issues and external decisions. Write “None” when independent.
+    validations:
+      required: true
+
+  - type: textarea
+    id: non-goals
+    attributes:
+      label: Non-goals
+      description: State excluded behaviors and claims.
+    validations:
+      required: true

zaptrace_eda-0.3.3/.github/ISSUE_TEMPLATE/release_gate.yml

@@ -0,0 +1,52 @@
+name: Release Gate
+description: Define a release-blocking validation gate
+title: "[Release Gate] "
+labels: ["type/hardening", "area/proof-pack", "status/needs-design", "evidence-required", "release-blocking"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Risk or gap
+      description: Which release claim or failure mode needs a gate?
+    validations:
+      required: true
+
+  - type: textarea
+    id: scope
+    attributes:
+      label: Gate scope
+      description: Define inputs, tools, boundaries, and supported environments.
+    validations:
+      required: true
+
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Pass, fail, and skip criteria
+      description: Define PASS, FAIL, SKIP-APPROVED, and SKIP-UNAPPROVED.
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Required evidence
+      description: List exact commands, reports, proof records, and retained artifacts.
+    validations:
+      required: true
+
+  - type: textarea
+    id: dependencies
+    attributes:
+      label: Dependencies or blockers
+      description: Link prerequisite implementation, environments, or approvals.
+    validations:
+      required: true
+
+  - type: textarea
+    id: non-goals
+    attributes:
+      label: Non-goals
+      description: State claims this gate does not establish.
+    validations:
+      required: true

zaptrace_eda-0.3.3/.github/ISSUE_TEMPLATE/research.yml

@@ -0,0 +1,52 @@
+name: Research Task
+description: Track a bounded research or design investigation
+title: "[Research] "
+labels: ["type/research", "status/needs-design"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Research question
+      description: What concrete decision should this research enable?
+    validations:
+      required: true
+
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope and sources
+      description: Define included standards, repositories, tools, datasets, and exclusions.
+    validations:
+      required: true
+
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: What makes the result complete, reproducible, and actionable?
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence required
+      description: Name the decision record, benchmark, prototype, scorecard, or report to produce.
+    validations:
+      required: true
+
+  - type: textarea
+    id: dependencies
+    attributes:
+      label: Dependencies or blockers
+      description: Link required access, standards, datasets, or issues. Write “None” when independent.
+    validations:
+      required: true
+
+  - type: textarea
+    id: non-goals
+    attributes:
+      label: Non-goals
+      description: Which conclusions or implementation claims are outside this investigation?
+    validations:
+      required: true