chore: add AGENTS.md, Dependabot, CodeRabbit config and hygiene check

- AGENTS.md records the clean-room rule, the generated files and their
  commands, and the four places the opencode version is pinned.
- Dependabot updates Bun dependencies and GitHub Actions, and leaves
  @opencode/* alone because that pin moves with the workflow pins.
- CodeRabbit skips generated and recorded files.
- Hygiene calls the org workflow that rejects machine-local paths.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.coderabbit.yaml

@@ -0,0 +1,15 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+language: en-US
+reviews:
+  profile: chill
+  poem: false
+  review_status: false
+  # Generated or recorded files: reviewed by the commands that produce them.
+  path_filters:
+    - "!bun.lock"
+    - "!COMPATIBILITY.md"
+    - "!e2e/golden/**"
+    - "!e2e/targets.lock.json"
+  auto_review:
+    enabled: true
+    drafts: false

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: bun
+    directory: /
+    schedule:
+      interval: weekly
+    ignore:
+      # The opencode version is pinned in four places that move together. See AGENTS.md.
+      - dependency-name: "@opencode/*"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/hygiene.yml

@@ -0,0 +1,15 @@
+name: Hygiene
+
+# Keeps machine-local paths out of tracked files. The check itself lives in Heretek-AI/.github.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  hygiene:
+    uses: Heretek-AI/.github/.github/workflows/hygiene.yml@8d22f62f11936b3ae00bcb6a98b0fcb88419bc76 # main

.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: Release
+
+# Publishes to npm via OIDC trusted publishing (no long-lived tokens).
+# First publish is done locally; afterwards, pushing a `v*` tag releases.
+# npmjs.com → package Settings → Trusted Publisher must list:
+#   org/user: Heretek-AI, repo: claude-4-opencode, workflow: release.yml
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions:
+  id-token: write # Required for npm OIDC
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.2
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+        with:
+          node-version: 24
+          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false # never use caching in release builds
+      - run: bun install --frozen-lockfile
+      - run: bun run format:check
+      - run: bun run typecheck
+      - run: bun run test
+      - run: bun run build
+      # Provenance is automatic with trusted publishing; no --provenance flag needed.
+      # No NODE_AUTH_TOKEN: authentication comes from the OIDC id-token.
+      - run: npm publish --access public

AGENTS.md

@@ -0,0 +1,33 @@
+# AGENTS.md
+
+## Evidence
+
+Back every claim about behavior with something executed or read: test output, command output, a file and line. State what was not run.
+
+## Clean room
+
+The implementation is written from Claude Code's public documentation and checked against Claude Code's observable behavior. Take behavior from the docs or from running `claude`, and say which. Code from Claude Code, or from reimplementations of it, stays out of this repository; `review/` holds third-party reference source for reading and is gitignored.
+
+## Canonical surfaces
+
+- Generated files, regenerated and never hand-edited:
+  - `COMPATIBILITY.md`: `bun run e2e`, then `bun run e2e:report`.
+  - `e2e/golden/`: `bun run e2e:oracle`, which needs Claude Code installed.
+  - `e2e/targets.lock.json`: `bun e2e/drift.ts`. The weekly Drift workflow moves these pins and opens the pull request.
+- The opencode version is spelled in four places that move together: `@opencode/plugin` in `package.json`, the matrix in `.github/workflows/e2e.yml`, and two installs in `.github/workflows/nightly.yml`. Dependabot ignores `@opencode/*` for that reason.
+- `docs/research/opencode-v2-findings.md` records how the opencode v2 plugin API behaves where this project depends on it. Read it before changing `src/runtime/`, and update it when an observation changes.
+
+## Commands
+
+- `bun run test`, never a bare `bun test`: the bare form also collects anything under `review/`.
+- `bun run e2e` drives the real `opencode` binary on `PATH` in a throwaway home directory. `OPENCODE_BIN` selects another build.
+- `bun run format` after editing any file, Markdown and YAML included: CI runs `format:check` across the repository.
+- The live tier (`bun test ./e2e/live`) needs `OPENCODE_API_KEY` and spends. Run it only when asked.
+
+## Workflow
+
+- Work on a topic branch and open a pull request. A maintainer merges.
+- A `v*` tag publishes to npm through `.github/workflows/release.yml`. Pushing one is a maintainer's step.
+- Stage explicit paths.
+- After a push, check every workflow run.
+- Write repo-relative paths in tracked files, and `owner/name` for another repository.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Heretek-AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package.json

@@ -1,14 +1,15 @@
 {
-  "name": "claude-4-opencode",
-  "version": "0.0.1",
+  "name": "@heretek-ai/claude-4-opencode",
+  "version": "0.1.1",
   "description": "Run Claude Code plugins and marketplaces on opencode v2",
+  "license": "MIT",
   "type": "module",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Heretek-AI/claude-4-opencode.git"
   },
   "bin": {
-    "c4o": "./dist/cli.js"
+    "c4o": "dist/cli.js"
   },
   "exports": {
     ".": "./dist/server.js",