[kraenhansen]

Now that the repo is public, outside contributors need issue/PR templates, a security policy and docs that match the shipped SDK. Closes #20 and covers the docs/metadata part of #12 (new samples stay in #26, landing media in #19).

Changes

• Add issue forms (bug, feature, contact links), a PR template, CODEOWNERS and SECURITY.md under .github/, plus Support and License sections in the README.
• Rewrite the CHANGELOG 0.1.0 entry to the API that actually shipped, with the Unity 6.3 minimum folded in.
• Update ARCHITECTURE.md, CONTRIBUTING.md (adds "Submitting changes") and COMPATIBILITY.md to the as-built native transport, asmdef layout, test layers and builds, and limit platform claims to what's tested.
• Fix a stale "native impl in v0.2" error message and a broken EndSessionAsync cref.
• Run the Unity CI lanes on fork PRs only after a maintainer approves the fork-ci environment (fork pull_request runs never get the UNITY_* secrets); same-repo PRs and pushes keep running unattended.

Verification

• dotnet csharpier check .
• Bridge~ checks (format:check, lint, typecheck, test, verify:primitives, verify:connection)
• Codegen~ checks (verify:protocol-dtos, round-trip)
• Edit Mode tests (pnpm --dir TestProject run test)
• WebGL builds + browser integration tests (IntegrationTests~)
• Manually tested in a Unity project. Platforms and Unity version:

Checklist

• CHANGELOG.md updated under [Unreleased] for user-facing changes
• Public API changes are called out above

---

Additional context intended for coding agents and bots

Design notes

• SECURITY.md lives in .github/ (GitHub reads it there) so Unity doesn't import it into the package or need a .meta. It points at GitHub private vulnerability reporting (already enabled) and the ElevenLabs VDP from elevenlabs.io/.well-known/security.txt.
• Issue forms are modelled on elevenlabs/elevenlabs-python (the only DX SDK repo with templates), adapted for Unity version, build target and Editor/Player/browser logs. No sibling DX repo has a PR template, CODEOWNERS or a usable security policy to copy.
• CODEOWNERS is * @kraenhansen.
• The CHANGELOG change rewrites the 0.1.0 entry itself rather than adding an [Unreleased] line, since 0.1.0 has never been tagged; that's why the "CHANGELOG updated under [Unreleased]" box is unticked.
• Fork CI: jobs choose their path by event and head repo. Same-repo PRs use pull_request; fork PRs use pull_request_target with environment: fork-ci (required reviewer @kraenhansen, already created), checking out pull_request.head.sha with persist-credentials: false. Runs inside forks are skipped. Fork runs restore but never save caches, since pull_request_target caches land in main's scope. Concurrency groups include event + PR number, because github.ref is main under pull_request_target. pull_request_target uses the workflow from main, so the fork path takes effect after merge.
• Platform claims: only Editor, desktop standalone (HostBuild.BuildStandalone) and WebGL are built or tested, so iOS/Android/XR are listed as untested; native WebRTC is documented as unsupported (NotSupportedException).

Known follow-ups (not in this PR)

• .github/workflows/lint.yml's header comment references a nonexistent Docs~/plans/ci.md and says the Unity lanes are blocked on licensing.
• The repo lacks the DX team's shared triage labels (needs reproduction, has reproduction, needs information, tracking, confirmed, upstream, stale) used by sibling SDK repos.

Test plan and verification

• unity test TestProject --mode EditMode -- -nographics: 460/460 passed.
• dotnet csharpier check Runtime: clean.
• Prettier check on .github/ and README.md (parses the issue-form YAML): clean.
• Every API name in the CHANGELOG matched against public members of Conversation / ConversationOptions; doc claims cross-checked against code by a read-only audit pass.
• Support links (discord.com/invite/elevenlabs, ElevenAgents docs, elevenlabs.io/security/report) return 200.

🤖 Generated with Claude Code