feat: prepare App X-Ray for service readiness

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,60 @@
+---
+name: Bug report
+about: Report a reproducible App X-Ray problem
+title: "fix: "
+labels: bug
+assignees: ""
+---
+
+## Summary
+
+Describe the problem and the user-visible impact.
+
+## Steps to Reproduce
+
+1.
+2.
+3.
+
+## Expected Behavior
+
+What should have happened?
+
+## Actual Behavior
+
+What happened instead?
+
+## App X-Ray Area
+
+- [ ] Source input/import
+- [ ] AI analysis
+- [ ] Review workbench
+- [ ] App Map / Data Map
+- [ ] Validation
+- [ ] Export
+- [ ] Backup / restore
+- [ ] AI settings / BYOK provider
+- [ ] Documentation
+- [ ] Other
+
+## Environment
+
+- OS:
+- Browser:
+- Node.js version, if running locally:
+- App X-Ray commit or branch:
+
+## Verification
+
+What checks did you run?
+
+```text
+npm run typecheck
+npm test
+npm run build
+npm run test:e2e
+```
+
+## Additional Context
+
+Do not include API keys, private source documents, or sensitive workspace data.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security report
+    url: https://github.com/flowylife/appXray/security/advisories/new
+    about: Please use GitHub private vulnerability reporting when available instead of opening a public issue.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,37 @@
+---
+name: Feature request
+about: Propose a focused App X-Ray improvement
+title: "feat: "
+labels: enhancement
+assignees: ""
+---
+
+## Problem
+
+What user problem should this solve?
+
+## Proposed Behavior
+
+Describe the expected workflow and outcome.
+
+## User Flow
+
+1.
+2.
+3.
+
+## Product Boundary Check
+
+- [ ] Keeps App X-Ray local-first
+- [ ] Does not add hidden backend, login, billing, hosted workspace, or AI token resale
+- [ ] Preserves confirmed user decisions
+- [ ] Keeps API keys out of exports, prompts, backups, logs, and tests
+- [ ] Maintains confirmed-only default export behavior
+
+## Alternatives Considered
+
+What simpler option or workaround exists today?
+
+## Additional Context
+
+Screenshots, examples, or links are useful. Do not include secrets or private workspace data.

.github/pull_request_template.md

@@ -0,0 +1,48 @@
+## Purpose
+
+Explain what user problem this pull request solves.
+
+## Changes
+
+-
+
+## Verification
+
+- [ ] npm run typecheck
+- [ ] npm test
+- [ ] npm run build
+- [ ] npm run test:e2e
+- [ ] Browser/manual check completed
+
+If a command was not available or not run, state that clearly.
+
+## User Flow Checked
+
+Describe the actual user journey that was verified.
+
+For UI changes, mention the page checked, action performed, observed result, and layout or interaction issues found.
+
+For storage, import, export, or AI provider changes, mention the input used, expected result, error case checked, and whether sensitive data could leak.
+
+## Risk Areas
+
+- DB schema changed: No
+- API contract changed: No
+- Auth/permission changed: No
+- UI layout changed: No
+- State management changed: No
+- Data import/export changed: No
+- Build/deployment config changed: No
+- Test coverage changed: No
+
+## Files Changed
+
+Summarize the major files changed and why.
+
+## Follow-up Issues
+
+List related issues discovered but intentionally not fixed in this PR.
+
+## Merge Note
+
+Do not merge this PR automatically. The user will review and decide whether to merge.

.github/workflows/ci.yml

@@ -0,0 +1,46 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - dev
+      - "codex/**"
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Unit and integration tests
+        run: npm test
+
+      - name: Build
+        run: npm run build
+
+      - name: End-to-end tests
+        run: npm run test:e2e

.gitignore

@@ -1,3 +1,5 @@
 node_modules/
 dist/
 app-dist/
+test-results/
+playwright-report/

CONTRIBUTING.md

@@ -0,0 +1,84 @@
+# Contributing to App X-Ray
+
+Thanks for helping improve App X-Ray.
+
+App X-Ray is a local-first tool for turning app ideas, PRDs, and work notes into reviewable app structure before AI coding begins. Contributions should preserve that boundary.
+
+## Product Principles
+
+- Keep App X-Ray local-first.
+- Do not add hidden hosted backends, accounts, billing, cloud workspaces, marketplace payment, or AI token resale.
+- Treat AI output as suggested structure until the user confirms it.
+- Preserve user-confirmed `accepted` and `edited` structure across re-analysis, backup import, and template flows.
+- Keep API keys browser-local and out of exports, prompts, logs, backups, fixtures, and tests.
+- Default exports must include confirmed data only unless the user explicitly chooses an audit trail mode.
+
+## Development Setup
+
+```bash
+npm install
+npm run dev
+```
+
+The Vite dev server binds to `127.0.0.1` by default.
+
+## Quality Checks
+
+Run the relevant checks before opening a pull request:
+
+```bash
+npm run typecheck
+npm test
+npm run build
+npm run test:e2e
+```
+
+If a check is not relevant or cannot be run, say that clearly in the pull request.
+
+## Pull Request Scope
+
+Keep pull requests focused and reviewable.
+
+Good scopes:
+
+- one user workflow
+- one validation rule
+- one export format improvement
+- one storage or backup behavior
+- one UI usability fix
+- one documentation update
+
+Avoid mixing unrelated UI, storage, AI provider, export, and tooling changes in one pull request.
+
+## UI Contributions
+
+For UI changes, include the expected states where applicable:
+
+- loading
+- empty
+- error
+- success
+- invalid input
+- partial failure
+
+Check that the layout remains usable on desktop and narrow mobile viewports.
+
+## AI Provider Contributions
+
+Provider changes must:
+
+- validate returned JSON against the App X-Ray analysis contract
+- sanitize provider errors so API keys are not shown
+- avoid writing keys to workspace backups or exports
+- keep mock mode deterministic for offline testing
+
+## Documentation
+
+Update documentation when behavior, product boundaries, import/export support, or development commands change.
+
+Useful references:
+
+- `README.md`
+- `docs/product/service-readiness.md`
+- `docs/product/local-first-data-contract.md`
+- `app-xray-codex-rules/`

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 App X-Ray contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.