docs: add branch protection baseline and sprint-01 backlog

Author: echowang1

.github/CODEOWNERS

@@ -1 +1,7 @@
-* @demshine/admin
+# Replace placeholders with real GitHub usernames or teams.
+* @demshine
+
+# Suggested ownership split:
+# /apps/web/ @demshine/frontend
+# /apps/api/ @demshine/backend
+# /infra/ @demshine/devops

.github/ISSUE_TEMPLATE/task.md

@@ -0,0 +1,18 @@
+---
+name: Task
+about: Engineering or delivery task
+labels: task
+---
+
+## Context
+
+## Scope
+
+## Acceptance Criteria
+1.
+2.
+3.
+
+## Risks
+
+## Dependencies

README.md

@@ -26,3 +26,5 @@ Private monorepo bootstrap for the AI short-drama production platform.
 - `docs/release-playbook.md`
 - `docs/security-baseline.md`
 - `docs/roadmap.md`
+- `docs/branch-protection.md`
+- `docs/sprints/sprint-01-backlog.md`

docs/branch-protection.md

@@ -0,0 +1,34 @@
+# Branch Protection Baseline
+
+## Target Branches
+- `main`
+- `develop`
+
+## `main` Rules
+- Require a pull request before merging.
+- Require approvals: minimum 1.
+- Dismiss stale pull request approvals when new commits are pushed.
+- Require status checks to pass before merging.
+- Require branches to be up to date before merging.
+- Restrict direct pushes and force pushes.
+- Restrict branch deletions.
+
+## `develop` Rules
+- Require a pull request before merging.
+- Require status checks to pass before merging.
+- Require branches to be up to date before merging.
+- Restrict direct pushes and force pushes.
+
+## Required Checks (Initial)
+- `validate`
+
+## Review Policy
+- Every PR must include:
+  - Scope
+  - Risk
+  - Rollback plan
+  - Acceptance evidence
+
+## Admin Guidance
+- Keep admin bypass disabled unless incident response requires emergency hotfix.
+- If bypass is used, record reason in release notes.

docs/sprints/sprint-01-backlog.md

@@ -0,0 +1,90 @@
+# Sprint 01 Backlog (2 Weeks)
+
+## Goal
+Deliver a usable shot-level asset hub with provider-ready orchestration for AI short-drama production.
+
+## Scope
+- Shot state machine and storage.
+- Unified generation task queue baseline.
+- Runway/Kling adapter skeleton.
+- Script Desk + Video Desk first usable UI.
+
+## Work Items
+
+### BE-001 Shot Domain Model
+- Owner: Backend
+- Priority: P0
+- Description: Create shot entity, shot status transitions, and validation rules.
+- Acceptance:
+  - Shot statuses: `draft`, `ready`, `generating`, `generated`, `selected`, `edited`, `published`.
+  - Invalid transitions are rejected with clear errors.
+
+### BE-002 Asset Candidate Model
+- Owner: Backend
+- Priority: P0
+- Description: Support multi-candidate videos per shot and one selected candidate.
+- Acceptance:
+  - A shot can bind multiple candidates from different providers.
+  - Exactly one candidate can be selected.
+
+### BE-003 Task Queue Baseline
+- Owner: Backend
+- Priority: P0
+- Description: Unified task records for generation requests.
+- Acceptance:
+  - Task lifecycle: `queued`, `running`, `succeeded`, `failed`, `cancelled`.
+  - Retry count and error code are persisted.
+
+### BE-004 Provider Adapter Interface
+- Owner: Backend
+- Priority: P0
+- Description: Introduce adapter interface for `runway` and `kling`.
+- Acceptance:
+  - Shared input/output contract implemented.
+  - Provider-specific raw response stored for debug.
+
+### API-001 Core Endpoints
+- Owner: Backend
+- Priority: P0
+- Description: Implement first batch of endpoints.
+- Acceptance:
+  - `POST /projects/:id/shots/import`
+  - `GET /projects/:id/shots`
+  - `POST /shots/:id/generate`
+  - `POST /shots/:id/select`
+
+### FE-001 Script Desk (MVP)
+- Owner: Frontend
+- Priority: P0
+- Description: Build shot list page with filters and batch actions.
+- Acceptance:
+  - Filter by status/provider.
+  - Batch generate and batch retry actions.
+
+### FE-002 Video Desk (MVP)
+- Owner: Frontend
+- Priority: P0
+- Description: Candidate comparison and selection UI.
+- Acceptance:
+  - Preview candidates per shot.
+  - One-click select candidate as primary.
+
+### QA-001 Flow Validation
+- Owner: QA
+- Priority: P0
+- Description: Validate end-to-end shot workflow with mock providers.
+- Acceptance:
+  - 20-shot run without status corruption.
+  - Failed tasks can retry successfully.
+
+### PM-001 Acceptance Checklist
+- Owner: Product
+- Priority: P1
+- Description: Freeze sprint acceptance checklist and demo script.
+- Acceptance:
+  - Checklist approved before sprint review.
+
+## Out of Scope
+- Full CapCut export package generation.
+- Advanced quality scoring model.
+- Multi-tenant RBAC finalization.