Bootstrap the Chronicle Python client repository

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,37 @@
+---
+name: Bug report
+about: Report incorrect Chronicle.Python behavior
+title: ""
+labels: "kind/bug"
+assignees: ""
+---
+
+## Description
+
+Describe the incorrect behavior.
+
+## Steps to reproduce
+
+1. ...
+2. ...
+3. ...
+
+## Expected behavior
+
+Describe what should happen.
+
+## Actual behavior
+
+Describe what happens instead.
+
+## Environment
+
+- OS:
+- Python version:
+- Chronicle.Python revision or version:
+- Chronicle kernel version:
+- Storage provider and topology, if relevant:
+
+## Additional context
+
+Remove credentials, access tokens, customer data, and private addresses before submitting.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security report
+    url: https://github.com/Cratis/Chronicle.Python/security/advisories/new
+    about: Report suspected vulnerabilities privately

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,31 @@
+---
+name: Feature request
+about: Propose a bounded Python client capability
+title: ""
+labels: "kind/feature"
+assignees: ""
+---
+
+## User need
+
+What Python client job should become possible?
+
+## Desired behavior
+
+Describe the smallest observable behavior, including failure behavior.
+
+## Chronicle contract
+
+Link the relevant public Chronicle contract or documentation when known.
+
+## Non-goals
+
+What should this proposal deliberately not implement?
+
+## Acceptance evidence
+
+How should the behavior be tested against the named Python, Chronicle, provider, and topology profile?
+
+## Additional context
+
+Do not include customer identity, credentials, access tokens, private conversations, or restricted details.

.github/pull_request_template.md

@@ -0,0 +1,40 @@
+# Summary
+
+Optional short context. Remove this section when the bullets are sufficient.
+
+## Added
+
+- User-facing addition
+
+## Changed
+
+- User-facing change
+
+## Fixed
+
+- User-facing fix
+
+## Removed
+
+- User-facing removal
+
+## Security
+
+- Security-relevant change without restricted details
+
+## Deprecated
+
+- User-facing deprecation
+
+## Verification
+
+- [ ] `ruff format --check .`
+- [ ] `ruff check .`
+- [ ] `mypy src`
+- [ ] `pytest`
+- [ ] `python -m build`
+- [ ] `python -m twine check dist/*`
+- [ ] Unsupported behavior and development-only exceptions remain explicit
+
+Remove empty sections before opening the pull request. Do not include prompts, transcripts, credentials, customer
+data, or private context.

.github/workflows/build.yml

@@ -0,0 +1,61 @@
+name: Build
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - "**"
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    name: Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Setup Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install development dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+
+      - name: Check formatting
+        run: ruff format --check .
+
+      - name: Lint
+        run: ruff check .
+
+      - name: Type check
+        run: mypy src
+
+      - name: Test
+        run: pytest
+
+      - name: Build distributions
+        run: python -m build
+
+      - name: Check distributions
+        run: python -m twine check dist/*

.github/workflows/markdown-verification.yml

@@ -0,0 +1,28 @@
+name: Markdown Verification
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - "**"
+    paths:
+      - "**/*.md"
+
+permissions:
+  contents: read
+
+jobs:
+  markdown-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Lint Markdown
+        uses: DavidAnson/markdownlint-cli2-action@v18
+        with:
+          globs: "**/*.md"

.github/workflows/publish.yml

@@ -0,0 +1,54 @@
+name: Publish
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Setup Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.14"
+
+      - name: Build distributions
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build twine
+          python -m build
+          python -m twine check dist/*
+
+      - name: Upload distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+
+      - name: Publish distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/verify-semver-label.yml

@@ -0,0 +1,29 @@
+name: Verify Semver Label
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require exactly one release disposition label
+        env:
+          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+        run: |
+          count=$(printf '%s' "$LABELS" | jq '[.[] | select(. == "major" or . == "minor" or . == "patch" or . == "no-release")] | length')
+          if [ "$count" -eq 1 ]; then
+            exit 0
+          fi
+          echo "::error::Add exactly one of major, minor, patch, or no-release."
+          exit 1

.markdownlint.json

@@ -0,0 +1,3 @@
+{
+  "MD013": false
+}

AGENTS.md

@@ -0,0 +1,36 @@
+# Chronicle.Python repository instructions
+
+This is a Cratis framework repository containing an experimental Python client for Chronicle.
+
+## Boundaries
+
+- The idiomatic Python API lives under `src/cratis_chronicle`.
+- Generated protobuf contracts are owned by the core `Cratis/Chronicle` repository and consumed as a package.
+- Do not copy generated files into this repository or manually mirror protobuf messages.
+- Do not infer feature parity, compatibility, maturity, or support from another Chronicle client.
+- Public API design requires maintainer review before broad implementation.
+
+## Engineering rules
+
+- Use Python 3.10-compatible syntax.
+- Network APIs are async-first.
+- Use American English.
+- Add type annotations and keep `mypy` strict mode passing.
+- Keep `ruff format`, `ruff check`, `pytest`, package build, and `twine check` passing.
+- Add tests for behavior and failure paths; a stub that silently succeeds is a bug.
+- Never commit credentials, tokens, customer data, private conversations, transcripts, or generated local artifacts.
+- Prefer narrow, reviewable changes and explicit unsupported outcomes.
+
+## Before completion
+
+Run:
+
+```shell
+ruff format --check .
+ruff check .
+mypy src
+pytest
+rm -rf dist
+python -m build
+python -m twine check dist/*
+```

CODE_OF_CONDUCT.md

@@ -0,0 +1,15 @@
+# Community conduct
+
+Chronicle.Python welcomes constructive contributions from people with different backgrounds and levels of
+experience.
+
+Participants are expected to:
+
+- communicate respectfully and focus criticism on ideas and code;
+- make space for questions and good-faith mistakes;
+- avoid harassment, discrimination, threats, personal attacks, and unwanted disclosure of private information;
+- keep public collaboration free of credentials, customer data, private conversations, and security details; and
+- follow maintainer direction when a discussion needs to pause, narrow, or move to a safer channel.
+
+Unacceptable behavior may be edited, removed, or result in temporary or permanent loss of participation access.
+Report conduct concerns privately to `post@cratis.io`. Do not use a public issue for sensitive reports.