feat: add company self-service public audit pipeline

.github/ISSUE_TEMPLATE/company-public-audit-request.yml

@@ -0,0 +1,106 @@
+name: Company public audit request
+description: Request onboarding to the bounded LiminalQA self-service public quality audit
+title: "[Company audit] "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form only for public HTTPS pages owned by your company or explicitly authorized for review.
+
+        Do not include passwords, tokens, API keys, cookies, private URLs, customer/account data, or security-vulnerability details. The self-service workflow is limited to passive public quality and accessibility evidence.
+
+  - type: input
+    id: company
+    attributes:
+      label: Company or project name
+      placeholder: Example Company
+    validations:
+      required: true
+
+  - type: input
+    id: repository
+    attributes:
+      label: Company GitHub repository
+      description: Repository that will call the reusable workflow or host the audit contract
+      placeholder: https://github.com/example/company-web
+    validations:
+      required: true
+
+  - type: textarea
+    id: origins
+    attributes:
+      label: Authorized public origins
+      description: One exact public HTTPS origin per line. Do not include paths, credentials, tokens, or private hosts.
+      placeholder: |
+        https://www.example.com
+        https://docs.example.com
+    validations:
+      required: true
+
+  - type: textarea
+    id: routes
+    attributes:
+      label: Initial public routes
+      description: List up to eight public routes and their purpose. Query keys must be declared separately and must not contain sensitive values.
+      placeholder: |
+        / — marketing homepage
+        /pricing — pricing information
+        /docs — public documentation
+    validations:
+      required: true
+
+  - type: dropdown
+    id: cadence
+    attributes:
+      label: Intended cadence
+      options:
+        - One-time baseline
+        - Manual on demand
+        - Weekly
+        - Before releases
+        - On pull requests
+    validations:
+      required: true
+
+  - type: dropdown
+    id: gate
+    attributes:
+      label: Initial gate mode
+      description: New integrations should normally begin with evidence-only mode.
+      options:
+        - never — evidence only
+        - high — fail only on HIGH aggregate severity
+        - any-signal — fail on any WARN
+    validations:
+      required: true
+
+  - type: textarea
+    id: goals
+    attributes:
+      label: Audit goals
+      description: Describe the public user journeys, accessibility expectations, and quality risks you want the evidence to cover.
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: authorization
+    attributes:
+      label: Authorization and safety confirmation
+      options:
+        - label: I am authorized to request passive quality testing for the listed public origins.
+          required: true
+        - label: I understand the workflow does not authenticate, submit forms, publish content, call private APIs, perform financial actions, fuzz, exploit, or load test.
+          required: true
+        - label: I will not place credentials, secrets, customer data, or private vulnerability details in the issue or audit contract.
+          required: true
+        - label: I understand automated signals require human review and are not a security or compliance certification.
+          required: true
+
+  - type: input
+    id: contact
+    attributes:
+      label: Public contact or GitHub handle
+      description: Optional public contact for onboarding questions. Do not provide private credentials or account information.
+      placeholder: "@company-engineering"
+    validations:
+      required: false

.github/workflows/company-public-audit-engine-ci.yml

@@ -0,0 +1,103 @@
+name: Company Public Audit Engine CI
+
+on:
+  push:
+    branches:
+      - agent/company-self-service-audit-v0-1
+    paths:
+      - .github/workflows/company-public-audit.yml
+      - .github/workflows/company-public-audit-engine-ci.yml
+      - audits/templates/company-public-audit.example.json
+      - scripts/company_public_audit_engine.py
+      - scripts/company_public_browser_probe.mjs
+      - tests/test_company_public_audit_engine.py
+      - docs/COMPANY_SELF_SERVICE_AUDIT.md
+      - docs/examples/company-audit-caller.yml
+  pull_request:
+    paths:
+      - .github/workflows/company-public-audit.yml
+      - .github/workflows/company-public-audit-engine-ci.yml
+      - audits/templates/company-public-audit.example.json
+      - scripts/company_public_audit_engine.py
+      - scripts/company_public_browser_probe.mjs
+      - tests/test_company_public_audit_engine.py
+      - docs/COMPANY_SELF_SERVICE_AUDIT.md
+      - docs/examples/company-audit-caller.yml
+
+permissions:
+  contents: read
+
+jobs:
+  contract-tests:
+    name: Validate schema, workflow, scripts, and fail-closed tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout exact revision
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Validate GitHub Actions workflows with pinned actionlint
+        id: actionlint
+        shell: bash
+        run: |
+          set -euo pipefail
+          go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.7
+          set +e
+          "$(go env GOPATH)/bin/actionlint" \
+            -ignore 'SC2016|SC2129|SC2155' \
+            .github/workflows/company-public-audit.yml \
+            .github/workflows/company-public-audit-engine-ci.yml \
+            > actionlint.txt 2>&1
+          code=$?
+          set -e
+          cat actionlint.txt
+          {
+            echo "### actionlint"
+            echo '```text'
+            cat actionlint.txt
+            echo '```'
+          } >> "${GITHUB_STEP_SUMMARY}"
+          exit "${code}"
+
+      - name: Upload actionlint diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: company-audit-actionlint-${{ github.run_id }}-${{ github.run_attempt }}
+          path: actionlint.txt
+          if-no-files-found: warn
+          retention-days: 7
+
+      - name: Validate Python, Node, and JSON syntax
+        run: |
+          set -euo pipefail
+          python3 -m py_compile scripts/company_public_audit_engine.py
+          node --check scripts/company_public_browser_probe.mjs
+          python3 -m json.tool audits/templates/company-public-audit.example.json >/dev/null
+
+      - name: Run fail-closed regression suite
+        run: python3 -m unittest -v tests/test_company_public_audit_engine.py
+
+      - name: Validate example contract and matrix
+        run: |
+          set -euo pipefail
+          python3 scripts/company_public_audit_engine.py validate \
+            --config audits/templates/company-public-audit.example.json \
+            --output /tmp/company-audit-config.json
+          matrix="$(python3 scripts/company_public_audit_engine.py matrix \
+            --config /tmp/company-audit-config.json)"
+          test "$(jq -r '.include | length' <<<"${matrix}")" -eq 2
+          test "$(jq -r '.max_parallel' <<<"${matrix}")" -eq 2
+
+  reusable-workflow-smoke:
+    name: Run example.com through reusable pipeline
+    needs: contract-tests
+    uses: ./.github/workflows/company-public-audit.yml
+    with:
+      config_path: audits/templates/company-public-audit.example.json
+      engine_ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      retention_days: 7
+      fail_on: never