task: agent ready prep

.github/AGENTS.md

@@ -0,0 +1,19 @@
+# AGENTS.md — .github/
+
+CI/CD workflows and repo automation.
+
+## Workflows (source of truth)
+- `conda-package.yml` — Intel-channel conda build and test
+- `conda-package-cf.yml` — conda-forge conda build and test
+- `build_pip.yml` — editable pip build, including pre-release NumPy
+- `build-with-clang.yml` — build with `icx`/`icpx` from the oneAPI apt repository
+- `build-with-standard-clang.yml` — build with upstream clang
+- `build-docs.yml` — Sphinx build; publishes to `gh-pages` from `master`
+- `pre-commit.yml` — lint/format checks
+- `coverity.yml` — Coverity static analysis (see `coverity/README.md`)
+- `openssf-scorecard.yml` — OpenSSF Scorecard
+- `zizmor.yml` — GitHub Actions security lint
+
+## Policy
+- Treat workflow YAML as canonical for platform/Python matrices.
+- Avoid doc claims about CI coverage unless present in workflow config.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,66 @@
+name: Bug report
+description: Report incorrect results, a crash, or a build failure
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For security vulnerabilities, do not open an issue — follow
+        [SECURITY.md](https://github.com/IntelPython/mkl_random/blob/master/SECURITY.md).
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What happened, and what did you expect instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproducer
+    attributes:
+      label: Reproducer
+      description: |
+        A minimal, self-contained snippet. Include the seed, the `brng`, the
+        distribution and its arguments, and `size`.
+      render: python
+    validations:
+      required: true
+
+  - type: dropdown
+    id: install-source
+    attributes:
+      label: How was `mkl_random` installed?
+      options:
+        - Intel conda channel (software.repos.intel.com)
+        - conda-forge
+        - pip, Intel index (software.repos.intel.com)
+        - pip / PyPI
+        - Built from source
+    validations:
+      required: true
+
+  - type: textarea
+    id: versions
+    attributes:
+      label: Versions
+      description: |
+        Output of:
+        ```
+        python -c "import mkl_random, numpy; print(mkl_random.__version__); print(numpy.__version__)"
+        ```
+        Add your OS and Python version too.
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: notes
+    attributes:
+      label: Anything else
+      description: |
+        Optional. Whether NumPy patching was active (`mkl_random.is_patched()`),
+        whether you used `mkl_random.interfaces.numpy_random`, or a non-default
+        `MKL_NUM_THREADS`.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html
+    about: Report security vulnerabilities through Intel's process, not a public issue.
+  - name: Question about usage
+    url: https://intelpython.github.io/mkl_random/
+    about: Check the documentation and README first.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,38 @@
+name: Feature request
+description: Propose a new distribution, generator, or capability
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: The use case, not the implementation.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: |
+        What you would like `mkl_random` to do. If it mirrors a legacy
+        `numpy.random` function, name it — its signature is the contract for
+        the NumPy interface.
+    validations:
+      required: true
+
+  - type: input
+    id: upstream
+    attributes:
+      label: Upstream equivalent
+      description: Link to the NumPy or oneMKL docs for the equivalent, if there is one.
+    validations:
+      required: false
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Optional. Workarounds you are using today.
+    validations:
+      required: false

.github/pull_request_template.md

@@ -0,0 +1,27 @@
+# Description
+
+<!-- What changed and why. Link any related issues. -->
+
+## Verification
+
+<!-- The commands you ran, and the platform and versions you ran them on. -->
+
+- Tests: <!-- e.g. `pytest mkl_random/tests`, Python 3.12 / NumPy 2.x, Linux -->
+- Lint: <!-- `pre-commit run --all-files` -->
+
+## Not verified
+
+<!--
+Anything skipped or left to CI, and why. Examples: Windows, the Intel-channel
+conda build, the docs build, the benchmarks. Write "none" if you ran everything
+relevant.
+-->
+
+## Checklist
+
+- [ ] Legacy `numpy.random` API compatibility preserved, or the break is intentional and called out above.
+- [ ] Seeded output is unchanged, or the `CHANGELOG.md` entry says which streams changed.
+- [ ] Behavior changes have tests in `mkl_random/tests/`; bug fixes have a regression test.
+- [ ] `CHANGELOG.md` updated under `[dev]` with a `[gh-NNN]` link, or the change isn't user-visible.
+
+<!-- See CONTRIBUTING.md for the build and test workflow, and AGENTS.md for the module map. -->

.gitignore

@@ -9,5 +9,14 @@ mkl_random/mklrand.cpp
 # Byte-compiled / optimized / DLL files
 __pycache__/
 
+# Virtual environments, test caches, local env files
+.venv/
+venv/
+.pytest_cache/
+.env
+
 # ASV benchmark artifacts
 .asv/
+
+# Developer-local coding agent settings
+.claude/settings.local.json

AGENTS.md

@@ -0,0 +1,60 @@
+# AGENTS.md — mkl_random
+
+Entry point for agent context in this repo.
+
+## What this project is
+`mkl_random` is a NumPy-based interface to Intel® oneMKL random number
+generation. `MKLRandomState` exposes the distributions of legacy
+`numpy.random.RandomState` with a choice of MKL basic generators (`brng`).
+`mkl_random.interfaces.numpy_random` is a drop-in replacement for legacy
+`numpy.random`, and runtime patching can install it in NumPy's place.
+
+## Key components
+- **Package and public API:** `mkl_random/`, `mkl_random/__init__.py`
+- **Cython extension:** `mkl_random/mklrand.pyx`
+- **C++ kernels:** `mkl_random/src/`
+- **NumPy interface:** `mkl_random/interfaces/`
+- **Patching:** `_patch_numpy.py`, plus persistent and one-shot patching in
+  `patch.py`, `with_patch.py`, `_patch_startup.py`, and the `__main__.py` CLI
+- **Tests:** `mkl_random/tests/`
+- **Docs:** `docs/` (Sphinx)
+- **Packaging:** `conda-recipe/`, `conda-recipe-cf/`
+- **Benchmarks:** `benchmarks/`
+
+## Build/runtime basics
+- Build system: `pyproject.toml` + `meson.build`
+- Build deps: `mkl-devel`, `numpy`, `meson-python`, `cmake`, `ninja`, `cython`,
+  and a C++ compiler
+- Runtime deps: `numpy`; the conda recipes add MKL
+- Setup, checks, and style: `CONTRIBUTING.md`
+- Single test: `pytest mkl_random/tests/<file>::<test>`
+- Single-file lint: `pre-commit run --files <path>`
+
+## Development guardrails
+- Keep signatures and accepted arguments compatible with legacy `numpy.random`.
+- Seeded output is part of the contract: a change to what a fixed seed
+  produces needs a CHANGELOG entry naming the affected streams.
+- Edit `mklrand.pyx` and `src/`, not the Cython-generated C++.
+- Keep patching reversible, with `is_patched()` reporting the truth.
+- Keep the extension free-threading compatible.
+- Pair behavior changes with tests and keep diffs minimal.
+- Avoid hardcoding mutable versions/matrices/channels in docs.
+
+## Where truth lives
+- Build/config: `pyproject.toml`, `meson.build`
+- Dependencies: `pyproject.toml`, `conda-recipe*/meta.yaml`
+- CI/workflows: `.github/workflows/*.yml`
+- Public API: `mkl_random/__init__.py`, `mkl_random/interfaces/numpy_random.py`
+- Tests: `mkl_random/tests/`
+
+## Directory map
+Use nearest local `AGENTS.md` when present:
+- `.github/AGENTS.md` — CI workflows and automation policy
+- `mkl_random/AGENTS.md` — package modules, the extension, and generators
+- `mkl_random/src/AGENTS.md` — C++ kernels
+- `mkl_random/interfaces/AGENTS.md` — `numpy.random` drop-in interface
+- `mkl_random/tests/AGENTS.md` — test scope and conventions
+- `docs/AGENTS.md` — Sphinx documentation
+- `conda-recipe/AGENTS.md` — Intel-channel conda packaging
+- `conda-recipe-cf/AGENTS.md` — conda-forge recipe
+- `benchmarks/AGENTS.md` — ASV performance suite

CONTRIBUTING.md

@@ -0,0 +1,46 @@
+# Contributing to `mkl_random`
+
+See [README.md](README.md) for usage, [AGENTS.md](AGENTS.md) for a map of the
+source tree, and [SECURITY.md](SECURITY.md) to report a vulnerability.
+
+## Setup
+
+Building needs a C++ compiler (`g++`, `clang++`, or `icpx`).
+
+```sh
+conda create -n mkl_random-dev -c conda-forge python pip mkl-devel numpy \
+    meson-python ninja cmake "cython>=3.1.0" pytest
+conda activate mkl_random-dev
+pip install -e . --no-build-isolation --no-deps
+```
+
+To build the docs, install `sphinx`, `furo`, `sphinx-design`, and
+`sphinxcontrib-programoutput`, then run
+`sphinx-build -M html docs/source docs/build`.
+
+## Checks
+
+```sh
+pytest mkl_random/tests
+pre-commit run --all-files
+```
+
+The pre-commit hooks enforce formatting; otherwise, match the surrounding code.
+
+## Guidelines
+
+- Keep changes small and focused.
+- Keep signatures compatible with legacy `numpy.random`.
+- If a change alters what a fixed seed produces, say which streams changed in
+  the `CHANGELOG.md` entry.
+- Add tests with behavior changes, and a regression test with bug fixes. Seed
+  every generator a test uses.
+- Edit `mklrand.pyx` and `src/`, not generated C++.
+- Keep patching reversible.
+
+## Pull requests
+
+Work on a branch and fill in the PR template. For user-visible changes, add a
+`CHANGELOG.md` entry under `[dev]` with a `gh-NNN` link.
+
+Contributions are licensed under the terms in [LICENSE.txt](LICENSE.txt).

README.md

@@ -158,3 +158,10 @@ then build against the existing installation with:
 ```sh
 python -m pip install --no-build-isolation --no-deps .
 ```
+
+---
+# Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the development workflow: setting up a
+build environment, running the tests and lint hooks, code style, and what to
+include in a pull request.

SECURITY.md

@@ -0,0 +1,12 @@
+# Security Policy
+
+## Report a Vulnerability
+
+Please report security issues or vulnerabilities to the [Intel® Security Center].
+
+For more information on how Intel® works to resolve security issues, see
+[Vulnerability Handling Guidelines].
+
+[Intel® Security Center]:https://www.intel.com/content/www/us/en/security-center/default.html
+
+[Vulnerability Handling Guidelines]:https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html

benchmarks/AGENTS.md

@@ -0,0 +1,22 @@
+# AGENTS.md — benchmarks/
+
+ASV performance suite for `mkl_random`.
+
+## Scope
+- `asv.conf.json` — ASV configuration, channels, and regression thresholds
+- `benchmarks/` — benchmark modules plus shared helpers in `_utils.py`
+- `README.md` — coverage table, threading default, measurement notes, and run
+  commands
+
+## Guardrails
+- Treat `asv.conf.json` as canonical for ASV settings; treat `README.md` as
+  canonical for what each module covers and how measurements are taken.
+- Comparability across machines depends on the thread default in
+  `benchmarks/__init__.py`, the fixed seeds, and the warmup calls in the timing
+  benchmarks' `setup`. Changing any of them invalidates comparison against
+  existing results — call it out explicitly.
+- Follow the engine and `method=` restrictions in `README.md` when adding
+  benchmarks.
+- Report performance numbers with reproducible context: hardware, thread count,
+  versions, and the command used.
+- Results under `benchmarks/.asv/` are local artifacts.

conda-recipe-cf/AGENTS.md

@@ -0,0 +1,14 @@
+# AGENTS.md — conda-recipe-cf/
+
+conda-forge variant of the conda recipe.
+
+## Differences from `conda-recipe/`
+- Installs with `pip install` directly; no wheel build or retag
+- Pins NumPy with `pin_compatible` at run time and runs `pip check` in the
+  package test
+- Adds macOS compiler entries to `conda_build_config.yaml`
+
+## Guardrails
+- Keep conda-forge recipe semantics separate from the Intel-channel recipe.
+- Keep changes in step with `.github/workflows/conda-package-cf.yml`, which
+  builds and tests this recipe.

conda-recipe/AGENTS.md

@@ -0,0 +1,15 @@
+# AGENTS.md — conda-recipe/
+
+Intel-channel conda packaging.
+
+## Files
+- `meta.yaml` — package metadata, dependencies, and the package test
+  (`pytest --pyargs mkl_random`)
+- `build.sh` / `bld.bat` — build a wheel with `python -m build`, then install
+  it; `build.sh` also retags the wheel's platform
+- `conda_build_config.yaml` — compiler and C library pins
+
+## Guardrails
+- Treat recipe files as canonical for packaging intent and dependency pins.
+- Keep recipe changes in step with `.github/workflows/conda-package.yml`, which
+  builds and tests this recipe.

docs/AGENTS.md

@@ -0,0 +1,17 @@
+# AGENTS.md — docs/
+
+Sphinx sources for the published documentation.
+
+## Scope
+- `source/` — pages; `source/conf.py` — Sphinx configuration
+- `source/reference/` — API reference, with one page per basic generator
+- `source/maintenance/index.rst` — the contributor page; keep its commands in
+  step with `CONTRIBUTING.md`
+
+## Guardrails
+- `release` in `source/conf.py` is set by hand; keep it equal to
+  `mkl_random/_version.py`.
+- Build locally with `sphinx-build -M html docs/source docs/build` before
+  changing `conf.py` or adding extensions.
+- `.github/workflows/build-docs.yml` builds the docs on pull requests (as an
+  artifact) and publishes them to `gh-pages` on pushes to `master`.