Professionalize and secure dissertation template

.claude/hooks/protect_raw_data.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 """PreToolUse hook: block file modifications under projects/<study>/data/raw/.
 
-Raw data is immutable (CLAUDE.md > Data Handling). Exit code 2 blocks the tool
+Raw data is immutable (AGENTS.md > Data). Exit code 2 blocks the tool
 call and feeds the stderr message back to the agent. Bash-level writes (shell
 redirects) are not intercepted here — that stays covered by convention and the
 permission deny rules in .claude/settings.json.
@@ -24,7 +24,7 @@ def main() -> int:
     if path and RAW_PATTERN.search(str(path).replace("\\", "/")):
         print(
             f"BLOCKED: '{path}' is inside a data/raw/ directory. Raw data is "
-            "immutable (CLAUDE.md > Data Handling). Write derived outputs to "
+            "immutable (AGENTS.md > Data). Write derived outputs to "
             "data/interim/ or data/processed/ from a script instead.",
             file=sys.stderr,
         )

.claude/scripts/zotero-forward.py

@@ -1,10 +1,11 @@
-"""WSL2 -> Windows Zotero port forwarder.
+"""WSL2 -> Windows Zotero local-API port forwarder.
 
 Forwards localhost:23119 to the Windows host gateway so that
 pyzotero (which hardcodes 127.0.0.1:23119) can reach the Zotero
 desktop app running on the Windows side.
 """
 
+import argparse
 import select
 import socket
 import subprocess
@@ -21,7 +22,11 @@ def get_windows_gateway() -> str:
         check=True,
     )
     # e.g. "default via 172.30.224.1 dev eth0"
-    return result.stdout.split()[2]
+    fields = result.stdout.split()
+    assert len(fields) >= 3 and fields[0] == "default" and fields[1] == "via", (
+        f"Unexpected default route: {result.stdout!r}"
+    )
+    return fields[2]
 
 
 def forward(src: socket.socket, dst: socket.socket) -> None:
@@ -33,8 +38,8 @@ def forward(src: socket.socket, dst: socket.socket) -> None:
                 if not data:
                     break
                 dst.sendall(data)
-    except Exception:
-        pass
+    except (ConnectionError, OSError) as exc:
+        print(f"Zotero forwarding connection closed: {exc}", file=sys.stderr, flush=True)
     finally:
         for s in (src, dst):
             try:
@@ -44,9 +49,18 @@ def forward(src: socket.socket, dst: socket.socket) -> None:
             s.close()
 
 
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--port", type=int, default=23119, help="Zotero API port")
+    parser.add_argument("--gateway", help="Windows host address (auto-detected by default)")
+    return parser.parse_args()
+
+
 def main() -> None:
-    port = 23119
-    gateway = get_windows_gateway()
+    args = parse_args()
+    assert 1 <= args.port <= 65535, f"Invalid port: {args.port}"
+    port = args.port
+    gateway = args.gateway or get_windows_gateway()
 
     server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)

.claude/skills/thesis-check/SKILL.md

@@ -24,7 +24,7 @@ make pdf
 ```
 
 - 失敗したら `draft/main.log` の最初の `!` で始まる行から原因を特定し、平易な言葉で報告して**ここで停止**する(ビルドエラーの修正が先)。
-- よくあるエラーと対処は `.claude/CLAUDE.md` の「Common LaTeX errors」表を参照。
+- よくあるエラーと対処は `draft/README.md` を参照。
 
 ### 2. 整合性チェック
 

.env.example

@@ -9,3 +9,11 @@ JUPYTER_PORT=8889
 # by you. `id -u` / `id -g` print them (defaults cover the common 1000:1000).
 #UID=1000
 #GID=1000
+
+# Optional read-only directory synchronized by Google Drive, Dropbox, OneDrive,
+# Nextcloud, or another file application. Use an absolute host path. Enable it
+# with `make up-files`; never point it at a directory containing credentials.
+#EXTERNAL_FILES_DIR=/absolute/path/to/synced/research-files
+
+# Zotero local API port. Zotero 7 uses 23119 by default.
+ZOTERO_PORT=23119

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+* @humanbeans893
+
+/.github/ @humanbeans893
+/draft/ @humanbeans893
+/tools/ @humanbeans893

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      timezone: Etc/UTC
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      timezone: Etc/UTC
+    open-pull-requests-limit: 3
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      timezone: Etc/UTC
+    open-pull-requests-limit: 3

.github/pull_request_template.md

@@ -0,0 +1,16 @@
+## Summary
+
+-
+
+## Validation
+
+- [ ] `make test`
+- [ ] `make lint`
+- [ ] Manuscript changes: `make pdf && make check`
+- [ ] Public/security changes: `make security`
+
+## Research and data safety
+
+- [ ] No raw data, credentials, personal information, Zotero database, or literature PDF is included.
+- [ ] Generated figures/tables were regenerated from scripts rather than edited by hand.
+- [ ] Methodological decisions are documented when applicable.

.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  python:
+    name: Python
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
+        with:
+          enable-cache: true
+      - name: Sync locked environment
+        run: uv sync --locked --all-groups
+      - name: Test
+        run: uv run pytest
+      - name: Lint
+        run: uv run ruff check .
+      - name: Format check
+        run: uv run ruff format --check .
+      - name: Public repository safety check
+        run: uv run python tools/public_repo_check.py
+
+  thesis:
+    name: Thesis
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Install LuaLaTeX toolchain
+        run: >-
+          sudo apt-get update && sudo apt-get install -y --no-install-recommends
+          latexmk texlive-luatex texlive-lang-japanese texlive-latex-extra
+          texlive-science
+      - name: Build dissertation
+        run: make pdf
+      - name: Check dissertation
+        run: python3 tools/thesis_check.py