Merge PR #13: Add repository readiness and contributor governance

Add repository contribution and Codex review guidance

Author: mcvalosborne

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,38 @@
+name: Bug report
+description: Report incorrect behavior or a regression
+title: "Bug: "
+labels: []
+body:
+  - type: textarea
+    id: behavior
+    attributes:
+      label: What happened?
+      description: Describe the observed and expected behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Include controls used, character/location, and repeatable steps.
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Browser and device
+      placeholder: Safari 20 on iPhone, Chrome on macOS, etc.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence
+      description: Add screenshots, recordings, console errors, or other useful detail.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I checked for an existing issue.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security report
+    url: https://github.com/mcvalosborne/littleandroid/security
+    about: Report sensitive vulnerabilities privately rather than opening an issue.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,39 @@
+name: Feature proposal
+description: Propose a focused gameplay, UX, or contributor improvement
+title: "Feature: "
+labels: []
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or opportunity
+      description: Explain the player or contributor need before describing a solution.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed experience
+      description: Describe the smallest useful implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: success
+    attributes:
+      label: Success criteria
+      description: How would we verify that this improves the project?
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Primary area
+      options:
+        - Gameplay
+        - UI and UX
+        - Accessibility
+        - Performance
+        - Community
+        - Tooling
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+## Summary
+
+<!-- What changes for a player, contributor, or maintainer? -->
+
+Closes #
+
+## Verification
+
+- [ ] Relevant automated checks pass.
+- [ ] Movement, scanning, and NPC interaction still work when affected.
+- [ ] Desktop viewport checked for visual changes.
+- [ ] Phone viewport checked for visual changes.
+- [ ] Accessibility impact considered.
+
+Commands and manual checks performed:
+
+```text
+
+```
+
+## Evidence
+
+<!-- Add screenshots, recordings, logs, or a concise explanation when visual evidence is not applicable. -->
+
+## Risks
+
+<!-- Note behavior changes, follow-up work, or known limitations. -->

AGENTS.md

@@ -0,0 +1,34 @@
+# Little Android Repository Guidance
+
+## Product intent
+
+Little Android is a small, handcrafted browser world. Preserve its quiet pixel-art identity, immediate interaction, and static hosting model. Prefer focused improvements over framework or dependency growth.
+
+## Engineering conventions
+
+- Keep runtime code understandable without a large toolchain.
+- Separate world data, state transitions, input, and rendering when adding modules.
+- Keep game-state updates deterministic where practical; inject time and randomness into testable logic.
+- Use elapsed time for behavior and animation durations. Do not assume 60 Hz.
+- Treat touch, keyboard, and pointer input as equal product surfaces.
+- Preserve current behavior unless the linked issue explicitly changes it.
+- Add tests for movement, pathfinding, collisions, persistence, and progression when those areas change.
+- For visual work, verify at desktop and phone viewports and include screenshots or equivalent evidence.
+
+## Verification
+
+Run every command documented in the README and package scripts that applies to the change. A pull request must state what was run and what could not be run.
+
+## Review guidelines
+
+Prioritize correctness, accessibility, regressions, and missing tests. Treat the following as P1 findings:
+
+- Two entities can occupy or reserve the same tile.
+- A change can lose, corrupt, or unintentionally reset player progress.
+- Core movement, scan, or interaction is unavailable to keyboard or touch users.
+- HUD content overlaps or becomes unusable at supported phone sizes.
+- Timed behavior changes with display refresh rate.
+- The game loop continues expensive work while the page is hidden.
+- Untrusted contributed data can inject HTML or JavaScript.
+
+Also verify that new dependencies are justified, static deployment remains functional, and user-facing changes include appropriate feedback rather than silent state changes.

CODE_OF_CONDUCT.md

@@ -0,0 +1,19 @@
+# Code of Conduct
+
+## Our standard
+
+Contributors must make participation respectful and useful. Be specific when discussing code or design, assume good intent, and critique the work rather than the person.
+
+Unacceptable behavior includes harassment, discriminatory language, threats, deliberate disruption, publication of private information, and unwanted sexual attention.
+
+## Scope
+
+This standard applies in repository issues, pull requests, discussions, and other project spaces. It also applies when someone is representing the project publicly.
+
+## Reporting
+
+Report conduct concerns privately to the repository owner through their GitHub profile. Reports will be reviewed promptly and handled with discretion. Maintainers may edit or remove contributions, restrict participation, or permanently ban participants when necessary to protect the project community.
+
+## Attribution
+
+This compact policy is informed by the Contributor Covenant and is intended for the current size of the project. It can be replaced by the full Contributor Covenant as the community grows.

CONTRIBUTING.md

@@ -0,0 +1,37 @@
+# Contributing
+
+## Before starting
+
+1. Check the [roadmap](https://github.com/mcvalosborne/littleandroid/issues/12) and existing issues.
+2. Comment on an issue before taking broad or overlapping work.
+3. Keep one behavioral objective per pull request.
+
+## Local workflow
+
+The current production page has no build step. Serve the repository and open it in a browser:
+
+```sh
+python3 -m http.server 8000
+```
+
+Before submitting, exercise movement, click-to-move, scanning, and at least one NPC interaction. Use the repository's automated checks as they are introduced under issue #4.
+
+## Pull requests
+
+- Link the issue with `Closes #<number>` when the work fully satisfies it.
+- Explain the behavioral change and important implementation decisions.
+- List automated and manual verification.
+- Include desktop and phone evidence for visual changes.
+- Keep unrelated formatting and refactors out of the patch.
+- Resolve or explicitly discuss P0/P1 review findings before merge.
+
+## Design principles
+
+- Preserve the restrained pixel-art palette and compact HUD.
+- Keep controls discoverable without tutorial modals.
+- Do not require audio, fine motor precision, or color perception to progress.
+- Prefer data-driven additions for characters, dialogue, and discoveries.
+
+## Community content
+
+Only submit work you have the right to license under the project's MIT License. Credit collaborators and sources in the pull request. Do not include personal data, tracking identifiers, or unreviewed executable content.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mcvalosborne
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,2 +1,53 @@
-# littleandroid
-littleandroid.com - Interactive pixel art landing page
+# Little Android
+
+An explorable pixel-art micro-world rendered entirely in the browser. Walk through the river factory zone, scan its residents, and discover the small behaviors that make the settlement feel alive.
+
+**[Play Little Android](https://littleandroid.com)**
+
+## Controls
+
+| Action | Input |
+| --- | --- |
+| Move | `W` `A` `S` `D` or click/tap a destination |
+| Scan or interact | `Space` |
+| Interact with an adjacent character | Click/tap the character |
+
+The current mobile experience supports tap-to-move. A dedicated touch action control is tracked in [issue #2](https://github.com/mcvalosborne/littleandroid/issues/2).
+
+## What is here
+
+- A hand-built 24 by 20 tile world with animated water, vegetation, and factory scenery
+- Eight residents with distinct movement and interaction state machines
+- Grid-based movement and click-to-move pathfinding
+- A radial scan that reveals character identities
+- No runtime framework, backend, or asset bundle
+
+## Run locally
+
+The production version is a static page. Open `index.html` directly in a browser, or serve the directory with any static server:
+
+```sh
+python3 -m http.server 8000
+```
+
+Then open `http://localhost:8000`.
+
+## Project direction
+
+The project is moving from an ambient interactive vignette toward a polished five-minute micro-game. The work is organized in the [master roadmap](https://github.com/mcvalosborne/littleandroid/issues/12):
+
+1. Establish contributor tooling, tests, and review gates.
+2. Correct movement and interaction edge cases.
+3. Complete mobile, accessibility, and performance work.
+4. Add a signal-recovery quest, narrative progression, and sensory polish.
+5. Add measured return, sharing, and community contribution loops.
+
+## Contributing
+
+Read [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request. Keep changes focused, preserve static hosting, and include verification evidence for interaction or visual changes.
+
+Codex review follows the repository rules in [AGENTS.md](AGENTS.md).
+
+## License
+
+Source code and original project assets are available under the [MIT License](LICENSE).

SECURITY.md

@@ -0,0 +1,16 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Do not open a public issue for a vulnerability that could put visitors or contributors at risk. Contact the repository owner privately through their GitHub profile with:
+
+- the affected file or behavior;
+- reproduction steps;
+- likely impact;
+- any suggested mitigation.
+
+The maintainer will acknowledge the report, assess severity, and coordinate disclosure. This static project currently has no supported release branches; fixes are applied to `main` and deployed through the configured site hosting.
+
+## Scope
+
+Relevant reports include script injection, unsafe community-content parsing, compromised dependencies, leaked credentials, and privacy-impacting analytics behavior.