docs+ci: ROADMAP + GOVERNANCE + coverage reporting (OpenSSF silver readiness)

.github/workflows/coverage.yml

@@ -0,0 +1,47 @@
+name: coverage
+
+# Measure test coverage with cargo-llvm-cov and upload to Codecov (README badge).
+# Informational, not a required status check. Tokenless upload (supported for
+# public repos); fail_ci_if_error is false so a failed/absent upload never blocks
+# a PR. Activate the repo at https://codecov.io to surface the dashboard + badge.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: coverage-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  coverage:
+    name: coverage (cargo-llvm-cov)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable (2026-03-27)
+        with:
+          toolchain: stable
+          components: llvm-tools-preview
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - name: Install cargo-llvm-cov (pinned)
+        run: cargo install cargo-llvm-cov --version 0.8.7 --locked
+      - name: Generate coverage (lcov)
+        run: cargo llvm-cov --all-features --lcov --output-path lcov.info
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        with:
+          files: lcov.info
+          fail_ci_if_error: false
+          token: ${{ secrets.CODECOV_TOKEN }}

.gitignore

@@ -18,3 +18,24 @@
 # in CONTRIBUTING.md.
 /CLAUDE.md
 /.claude/
+
+# Coverage output (cargo-llvm-cov / Codecov).
+lcov.info
+*.profraw
+*.profdata
+
+# Browser-automation session artifacts (Playwright MCP).
+/.playwright-mcp/
+
+# Python build/test artifacts (ordvec-python).
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.venv/
+venv/
+*.egg-info/
+
+# Editor / OS cruft.
+.DS_Store
+.idea/
+.vscode/

GOVERNANCE.md

@@ -0,0 +1,42 @@
+# Governance
+
+ordvec is a small, actively maintained open-source project. This document
+describes how it is run.
+
+## Roles
+
+- **Maintainer.** ordvec is currently maintained by Nelson Spence
+  ([@Fieldnote-Echo](https://github.com/Fieldnote-Echo)), the project lead and
+  final decision-maker on technical direction, releases, and scope.
+- **Code owners.** Listed in [`.github/CODEOWNERS`](.github/CODEOWNERS); they
+  review and approve changes.
+
+## Decision-making
+
+- All changes land via **pull request** — direct pushes to `main` are blocked by
+  branch protection.
+- Every PR requires **passing CI** and at least **one approving review from a
+  code owner other than the author**, with review conversations resolved before
+  merge.
+- Routine changes are decided by maintainer / code-owner review. Larger,
+  direction-setting changes (scope, public API, dependencies) are discussed in
+  an issue or pull request first; the maintainer makes the final call,
+  consistent with the [roadmap](ROADMAP.md).
+- Decisions favour the project's stated scope — ordvec is a retrieval
+  _primitive_ for edge / local AI retrieval, **not** a standalone vector
+  database (see [ROADMAP.md](ROADMAP.md)).
+
+## Becoming a code owner
+
+There is no formal membership process yet. Contributors who provide sustained,
+high-quality contributions and reviews may be invited to become code owners.
+The project is being opened specifically to grow this group — including
+collaborators on the accompanying OrdVec / RankQuant paper.
+
+## Contributing, conduct, and security
+
+- **Contributing:** see [CONTRIBUTING.md](CONTRIBUTING.md). Contributions are
+  dual-licensed **MIT OR Apache-2.0**, matching the project license.
+- **Code of conduct:** see [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
+  (Contributor Covenant).
+- **Security:** report vulnerabilities privately per [SECURITY.md](SECURITY.md).

README.md

@@ -5,6 +5,7 @@
 [![MSRV](https://img.shields.io/badge/MSRV-1.89-blue.svg)](#minimum-supported-rust-version)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Fieldnote-Echo/ordvec/badge)](https://scorecard.dev/viewer/?uri=github.com/Fieldnote-Echo/ordvec)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/12977/badge)](https://www.bestpractices.dev/projects/12977)
+[![codecov](https://codecov.io/gh/Fieldnote-Echo/ordvec/graph/badge.svg)](https://codecov.io/gh/Fieldnote-Echo/ordvec)
 
 <!-- Add at the first crates.io release:
 [![Crates.io](https://img.shields.io/crates/v/ordvec.svg)](https://crates.io/crates/ordvec)

ROADMAP.md

@@ -0,0 +1,61 @@
+# Roadmap
+
+> A living document. ordvec is a small, paper-driven project; this captures
+> **direction and scope**, not committed dates.
+
+## Vision
+
+**ordvec is a retrieval _primitive_, not a database.** The goal is to be a
+universally embeddable building block for **edge-deployed RAG and on-device /
+local AI retrieval** — settings where compute, memory, and storage are tight and
+the hardware is heterogeneous (servers, ARM edge devices, browsers / WASM, and
+eventually mobile and embedded targets).
+
+Everything distinctive about ordvec serves that end:
+
+- **Training-free encoding** — no codebook, no learned rotation, no fit step,
+  and nothing to refit when the corpus drifts.
+- **Zero system dependencies** — pure Rust, no BLAS / LAPACK / `ndarray` /
+  `faer`; no native library to install; links and cross-compiles cleanly.
+- **Predictable footprint** — exactly `dim × bits / 8` bytes per document, known
+  before you see any data.
+- **Runtime-dispatched SIMD with a scalar fallback** — the same retrieval core
+  runs anywhere it compiles (AVX-512 / AVX2, NEON, WASM `simd128`, scalar).
+
+## Non-goals
+
+ordvec will **not** grow into a standalone vector database. It deliberately does
+not pursue billion-scale navigable-graph ANN, distributed serving / sharding, a
+query language, or persistence and transaction machinery beyond its simple file
+formats. That is the territory of pgvector, Qdrant, Milvus, LanceDB, and full
+Graph-RAG stacks. ordvec stays the **substrate** those systems — and bespoke
+edge pipelines — compose, not a competitor to them.
+
+## Direction
+
+The throughline is **"be a good neighbour"**: ordvec should embed _natively_
+into more hosts rather than forcing callers to adapt to it.
+
+- **Publish.** A coordinated first release to crates.io (`ordvec`) and PyPI
+  (`ordvec`), carrying SLSA build provenance and SBOMs (the release machinery is
+  already in place). Unblocks `docs.rs` and the registry badges.
+- **Cross-stack embedding via a C ABI.** A `cdylib` plus a generated C header so
+  non-Rust / non-Python edge runtimes can link ordvec directly — the single
+  largest reach multiplier beyond Rust and Python.
+- **Adapters.** Thin integration layers for host retrieval / RAG systems. ordvec
+  factored out of [turbovec](https://github.com/RyanCodrai/turbovec); natural
+  next targets are mainstream RAG frameworks (via the Python binding) and
+  Rust-native edge Graph-RAG stacks such as
+  [EdgeQuake](https://github.com/raphaelmansuy/edgequake), where ordvec could
+  back the vector-search layer in a Postgres-less / edge deployment —
+  complementing, not replacing, the graph layer.
+- **Broader platform reach.** musllinux wheels (Alpine / minimal containers);
+  continued aarch64 and WASM coverage.
+- **Toward 1.0.** An API-stability pass and a documented compatibility policy.
+- **Supply-chain posture.** OpenSSF Best Practices _passing_ is earned;
+  _silver_ is the next target (governance, this roadmap, coverage reporting).
+
+## Out of scope here
+
+Benchmarks and the intellectual framing live in the OrdVec / RankQuant paper;
+this roadmap concerns the crate as an embeddable building block.