diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..ed4d60b
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,4 @@
+# Normalise to LF in the repository and in the working tree on every platform.
+# A Windows clone with core.autocrlf=true otherwise rewrites shebangs to CRLF,
+# and a publish from that clone ships a binary Linux rejects as "bad interpreter".
+* text=auto eol=lf
diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 0000000..c5cfb88
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1 @@
+github: Booyaka101
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..dbdf75d
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,44 @@
+name: Bug report
+description: Something didn't work the way it should
+labels: [bug]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What you ran, and what came back.
+      placeholder: |
+        :checkhealth agentscript
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected instead
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: agentscript-nvim version
+      description: The commit or tag you have checked out.
+    validations:
+      required: true
+
+  - type: input
+    id: runtime
+    attributes:
+      label: Neovim version and OS
+      description: Output of `nvim --version | head -1`, plus your OS.
+      placeholder: NVIM v0.11.2 on Windows 11
+    validations:
+      required: true
+
+  - type: textarea
+    id: minimal
+    attributes:
+      label: Minimal `init.lua` that reproduces it
+      description: Start from `nvim -u NONE` and add only what is needed. Reports with a full config attached take much longer to get through.
+      render: lua
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..70b0a89
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,11 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Agent Script language and spec
+    url: https://github.com/salesforce/agentscript
+    about: Questions about the language itself, or about the LSP server's own behaviour.
+  - name: Neovim LSP documentation
+    url: https://neovim.io/doc/user/lsp.html
+    about: How Neovim wires up language servers, `vim.lsp` settings and `:checkhealth`.
+  - name: Security issue
+    url: https://github.com/Booyaka101/agentscript-nvim/security/advisories/new
+    about: Please report vulnerabilities privately, not as a public issue.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 0000000..f8c8f8b
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,30 @@
+name: Feature request
+description: Suggest something agentscript-nvim should do
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        A Neovim plugin. It reads Agent Script files and talks to the language server; it does not run your agents.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do?
+      description: The situation, not the solution. What got in your way?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What would you like it to do?
+    validations:
+      required: false
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: What are you doing instead today?
+    validations:
+      required: false
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..6875a22
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,20 @@
+## What this changes
+
+<!-- And why. Link an issue if there is one. -->
+
+## How you verified it
+
+<!--
+Be specific, and keep the claims separate — they carry different weight:
+  - the test suite under `tests/` passes
+  - ran it against a real project
+  - added a test case covering this
+-->
+
+## Checklist
+
+- [ ] the test suite under `tests/` passes
+- [ ] Added or updated a test for this change
+- [ ] Updated `README.md` if behaviour changed
+- [ ] Added a `CHANGELOG.md` entry under "Unreleased"
+- [ ] No credentials, tokens or personal data in the diff or in pasted output
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..edd4e7e
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+# One run per branch. A second push supersedes the first instead of queueing
+# behind it.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22 # tests/fake_npm.js and the stub servers run under it
+      - uses: rhysd/action-setup-vim@v1
+        with:
+          neovim: true
+          version: stable
+      # Only test_install runs here. The other three need a developer machine:
+      # test_treesitter and test_lsp build the parser out of scratch/ts/, which
+      # is gitignored, and test_upstream_config needs an agentscript-lsp shim on
+      # PATH. Both fail the same way on a clean checkout, CI or not.
+      - run: nvim -l tests/test_install.lua
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..73c2f38
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,26 @@
+# Security Policy
+
+## Supported versions
+
+`main` is the only supported branch. There are no maintenance branches.
+
+## Reporting a vulnerability
+
+Please **don't** open a public issue for a security problem.
+
+Use GitHub's [private vulnerability reporting](https://github.com/Booyaka101/agentscript-nvim/security/advisories/new) instead. Expect a first response within a week.
+
+Please include what you found, how to reproduce it, and what an attacker gets out of it.
+
+## What this touches
+
+A Neovim plugin. It reads Agent Script files and talks to the language server; it does not run your agents.
+
+- **It runs inside your editor** and starts the Agent Script language server on the files you open. It does not run your agents.
+- **Project-local configuration is honoured.** Opening an untrusted repository is the main risk surface here, as with any LSP setup.
+
+## Scope
+
+In scope: anything that leaks a credential, reads data belonging to someone else, or lets untrusted input reach code execution.
+
+Out of scope: findings that require an attacker to already control the machine it runs on.