Complete GitHub community setup

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @devkyato

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,68 @@
+name: Bug report
+description: Report an incorrect finding, crash, or CLI problem.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve Relay. Remove private credentials and proprietary source before posting.
+        Relay reports are advisory and must not be treated as permission to operate physical machinery.
+  - type: input
+    id: version
+    attributes:
+      label: Relay version
+      description: Run `relay --version`.
+      placeholder: relay 0.1.0
+    validations:
+      required: true
+  - type: dropdown
+    id: language
+    attributes:
+      label: Analysed language
+      options:
+        - Arduino / embedded C++
+        - Python
+        - MicroPython
+        - Mixed project
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Include the smallest safe source sample and exact Relay command.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed behaviour
+      description: Include the rule ID, output, traceback, or exit code.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behaviour
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: Platform and Python version
+      placeholder: Windows 11, Python 3.13
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Safety and search checks
+      options:
+        - label: I removed secrets and sensitive source from this report.
+          required: true
+        - label: I searched existing issues for the same problem.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/devkyato/Relay/security/advisories/new
+    about: Report vulnerabilities privately instead of opening a public issue.
+  - name: Usage and configuration documentation
+    url: https://github.com/devkyato/Relay/tree/main/docs
+    about: Review the local-first usage, configuration, rules, and limitations guides.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,47 @@
+name: Feature request
+description: Suggest a rule, parser improvement, report format, or workflow enhancement.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What control-programming or timing-analysis problem should Relay address?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behaviour
+      description: Describe inputs, expected findings, confidence, and remediation where relevant.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: dropdown
+    id: scope
+    attributes:
+      label: Primary area
+      options:
+        - C/C++ parser
+        - Python parser
+        - Rule engine
+        - Timing model
+        - Reports and integrations
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues for a similar request.
+          required: true
+        - label: I understand Relay cannot guarantee real-time or physical-machine safety.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+## Summary
+
+Describe what changed and why.
+
+## User impact
+
+Explain how this affects findings, compatibility, performance, reports, or documentation.
+
+## Validation
+
+- [ ] `pytest`
+- [ ] `ruff check .`
+- [ ] `ruff format --check .`
+- [ ] `mypy`
+- [ ] Relevant CLI or package smoke test
+
+## Rule and safety review
+
+- [ ] New or changed findings use stable rule IDs and explicit confidence.
+- [ ] Line numbers and deterministic ordering are covered by tests.
+- [ ] Analysed source is never executed, imported, compiled, or uploaded.
+- [ ] Timing claims are labelled as estimates.
+- [ ] Physical-machine safety is not claimed.
+
+## Documentation
+
+List updated documentation, examples, or changelog entries.

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies

CODE_OF_CONDUCT.md

@@ -0,0 +1,27 @@
+# Code of conduct
+
+Relay contributors must help maintain a welcoming, technically rigorous, and safety-conscious
+community.
+
+## Expected behaviour
+
+- Be respectful, patient, and constructive.
+- Critique ideas and code without attacking people.
+- Welcome people of different backgrounds and experience levels.
+- State uncertainty and safety limitations honestly.
+- Remove credentials, personal data, and proprietary source from public reports.
+- Never present Relay output as proof that physical machinery is safe.
+
+Harassment, discrimination, threats, deliberate intimidation, doxxing, sexualized conduct, and
+disruptive bad-faith behaviour are not accepted.
+
+## Enforcement
+
+Report security problems through
+[GitHub private security advisories](https://github.com/devkyato/Relay/security/advisories/new).
+Report other conduct concerns privately to the repository owner through their GitHub profile.
+Maintainers may edit or remove contributions and temporarily or permanently restrict participation
+when needed to protect the community.
+
+Enforcement decisions should be proportionate, documented privately, and focused on community
+safety. This code applies in project spaces and when someone publicly represents the project.

README.md

@@ -114,6 +114,7 @@ time. Its timeline is a conservative scheduling estimate, never a cycle-accurate
 Source files are treated as untrusted data. Relay bounds file count and size, does not follow
 directory symlinks, does not run external commands during analysis, and will not overwrite an
 analysed source or a symlink with a report. See [security](docs/security.md), [limitations](docs/limitations.md),
-[contributing](CONTRIBUTING.md), and [SECURITY.md](SECURITY.md).
+[roadmap](docs/roadmap.md), [support](SUPPORT.md), [contributing](CONTRIBUTING.md), and
+[SECURITY.md](SECURITY.md).
 
 Relay is copyright devkyato and available under the [MIT License](LICENSE).

SUPPORT.md

@@ -0,0 +1,12 @@
+# Support
+
+Relay is an early open-source project maintained on a best-effort basis.
+
+- Read the [README](README.md) and [documentation](docs/) first.
+- Use the bug-report form for reproducible crashes or incorrect findings.
+- Use the feature-request form for rule, parser, timing, or report proposals.
+- Report vulnerabilities through
+  [GitHub private security advisories](https://github.com/devkyato/Relay/security/advisories/new).
+
+Include `relay --version`, Python and operating-system versions, the exact command, and a minimal
+sanitised source sample. Do not post credentials, private firmware, or machinery control secrets.

docs/roadmap.md

@@ -0,0 +1,13 @@
+# Roadmap
+
+Relay 0.1.x establishes the safe, local-first structural analyser and timing-impact model.
+
+Priorities for 0.2.0 are:
+
+- reduce false positives through context-aware network timeout and polling analysis;
+- add source-level suppression directives with auditable reasons;
+- improve C++ macro, template, overload, and cross-file resolution;
+- prototype optional Clang enrichment without making it a core dependency;
+- expand timing contracts and machine-readable schemas without implying cycle accuracy.
+
+Roadmap work is tracked in GitHub issues and may change based on reproducible user feedback.