[chore] public-launch hygiene: community files, llms.txt repo links, package metadata

CODE_OF_CONDUCT.md

@@ -0,0 +1,55 @@
+# Code of Conduct
+
+## Our pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior:
+
+- The use of sexualized language or imagery, and sexual attention or advances
+  of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+This applies everywhere the project lives — the repository, Discussions, chat
+spaces, community events (including the in-app collaborative sessions we host,
+such as build challenges), and anywhere someone represents the project.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the maintainer at **hello@theprototype.app**. All complaints will
+be reviewed and investigated promptly and fairly, and the reporter's privacy
+will be respected. The maintainer will remove, edit, or reject contributions
+and may temporarily or permanently ban any contributor for behaviors deemed
+inappropriate, threatening, offensive, or harmful.
+
+## Attribution
+
+Adapted from the [Contributor Covenant](https://www.contributor-covenant.org),
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html

CONTRIBUTING.md

@@ -0,0 +1,53 @@
+# Contributing to theprototype.app
+
+Thanks for wanting to build on this! The project is unusually friendly to
+AI-assisted contributions — the conventions below exist so that humans AND their
+agents can land changes that hold up.
+
+## Quick start
+
+```bash
+npm i --legacy-peer-deps    # three vs postprocessing peer conflict, known
+npm run dev                 # https dev server on :5173
+```
+
+Open two browser windows, connect them with the peer ID, and you have a
+two-peer session on your desk.
+
+## Before you write code
+
+1. **Read [CLAUDE.md](CLAUDE.md).** It's the architecture map, the replication
+   golden rules, and a long list of hard-won gotchas. If you use Claude Code (or
+   any agent), it will pick it up automatically; `static/llms.txt` carries the
+   same pointers for other tools.
+2. **The one rule that matters**: everything a user does must be visible to
+   connected peers. Every mutation = apply locally + broadcast; receivers apply
+   without re-broadcasting. `.claude/skills/peer-feature/SKILL.md` is the
+   checklist for adding a replicated feature.
+3. **Modules**: if your idea is self-contained play content (a game, a tool, an
+   instrument), build it as a module instead of a core change — see
+   [MODULES.md](MODULES.md). Modules are the easiest first contribution.
+
+## Verifying changes
+
+- `npm run e2e -- <suite name>` — the committed Playwright suite
+  (`tests/e2e/`); every feature ships with one, and UI changes must update the
+  suites they break in the same commit. `.claude/skills/e2e-verify/SKILL.md`
+  documents the recipe (incl. two-peer tests).
+- `npm run build` must pass and `npx svelte-check` must add **no new errors**
+  over the current baseline (CI enforces this).
+- VR changes: verify the math/state headlessly where possible and say clearly
+  in the PR what needs an on-device check.
+
+## PRs
+
+- Branch off `main`; one focused change per PR.
+- Commit style: `[feat]/[fix] lowercase summary` + body bullets.
+- Screenshots/clips for anything visual. Playwright can capture them.
+- Look at issues labeled **good first issue** if you want a scoped entry point.
+
+## Questions
+
+GitHub Discussions for ideas/help, issues for bugs (template asks for repro
+steps — two-browser repros are gold). Please don't report security issues
+publicly — see [SECURITY.md](SECURITY.md).

SECURITY.md

@@ -0,0 +1,27 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please **do not** open a public issue for security problems. Email
+**hello@theprototype.app** (or use GitHub's private vulnerability reporting on
+this repository) with steps to reproduce. You'll get a response within a few
+days; fixes ship as fast as severity demands and reporters get credit in the
+release notes unless they prefer otherwise.
+
+## Scope notes for a P2P app
+
+- Sessions are invite-only: a peer must be approved before it can send anything,
+  and incoming message types are gated. Bypasses of the approval gate, or any
+  way for an unapproved peer to mutate a scene, are in scope and serious.
+- WebRTC exposes peer IP addresses to session members by design (disclosed in
+  the privacy policy). Reports about that design are out of scope; ways to learn
+  peers' addresses **without** being approved into the session are in scope.
+- The app executes replicated script/flow content deterministically on every
+  peer. Escapes from that sandboxed evaluation are in scope and serious.
+- Self-hosted infrastructure (signaling server, TURN) has its own repo; reports
+  welcome at the same address.
+
+## Supported versions
+
+The live app at theprototype.app always runs the latest release; only the
+latest release line receives security fixes.

package.json

@@ -1,6 +1,11 @@
 {
-	"name": "theprototype.io",
+	"name": "theprototype.app",
 	"version": "1.0.0",
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/theprototype-app/core.git"
+	},
 	"type": "module",
 	"scripts": {
 		"dev": "vite dev",

static/llms-full.txt

@@ -32,10 +32,16 @@
 
 - [llms-full.txt](/llms-full.txt): this map plus the entire module SDK guide
   inline (works offline / without repo access).
-
-<!-- At public launch, add repo-backed links here: GitHub wiki, README, and the
-     raw MODULES.md URL. They 404 while the repo is private — the inlined
-     /llms-full.txt above carries the same SDK content regardless. -->
+- [Source repository](https://github.com/theprototype-app/core): MIT-licensed
+  code; CLAUDE.md in the repo root documents the architecture, replication
+  rules and conventions agents should follow when contributing.
+- [README](https://github.com/theprototype-app/core#readme): feature overview,
+  quick start, self-hosting notes.
+- [Module SDK guide, raw](https://raw.githubusercontent.com/theprototype-app/core/main/MODULES.md):
+  the same guide as llms-full.txt, straight from the repo.
+- [Releases](https://github.com/theprototype-app/core/releases): changelog per
+  version.
+- [User docs](https://docs.theprototype.app): guides for people (not agents).
 
 ---
 
@@ -190,6 +196,75 @@ api.registerStateSync({
 });
 ```
 
+### Input (K-C)
+
+```js
+// declare bindings so they LIST in Settings ▸ Shortcuts (display-only —
+// you read the keys yourself via input()/onInput)
+api.registerBindings([{ label: 'Drive forward', keys: 'W' }]);
+
+api.registerFrameTask(() => {
+	const { codes, axes } = api.input();  // codes: Set<'KeyW'...> (event.code),
+	if (codes.has('KeyW')) drive(1);      // axes: {lx,ly,rx,ry} = VR stick axes
+});
+api.onInput((kind, code) => {});        // 'down'/'up' events; returns unsubscribe
+
+// pause the HOST's use of an input scope while your module drives:
+//   'keys'       — WASD camera fly + play-mode movement
+//   'locomotion' — VR left-stick locomotion
+api.claimInput('keys');                 // ALWAYS release when your mode ends
+api.releaseInput('keys');
+```
+
+### Pointer ray (190)
+
+```js
+// where the user is POINTING, as a THREE.Raycaster in WORLD space: the desktop
+// mouse over the viewport, or the VR pointer hand's ray. Fresh instance per
+// call; null before the first pointer event. The drag recipe: click to pick,
+// follow pointerRay() in a frame task, click to drop (works desktop + VR).
+api.registerFrameTask(() => {
+	const ray = api.pointerRay();
+	if (!ray || !carried) return;
+	const hit = ray.ray.intersectPlane(dragPlane, tempVec);
+	if (hit) carried.position.copy(hit);
+});
+```
+
+### Physics (P-A)
+
+All mutations are INITIATOR-ONLY — the peer that started the simulation steps
+the world (golden rule: authoritative, never mixed with deterministic). The
+blessed recipe for driven physics (pong's paddle pattern): every peer forwards
+its INPUT via `api.send({op:'drive', ...})` at ~20Hz, and only the peer where
+`api.physics.isInitiator()` is true applies it.
+
+```js
+api.physics.isInitiator();              // true while THIS peer runs the sim
+api.physics.applyImpulse(uuid, [0, 5, 0]); // push a dynamic body (initiator-only)
+api.physics.applyTorqueImpulse(uuid, [0, 2, 0]); // spin a dynamic body (world axes)
+api.physics.setJointMotor(jointId, vel, maxForce); // drive a revolute joint
+api.physics.joints();                   // Promise<the replicated joint defs>
+```
+
+The **car module** (`src/modules/car/`) is the worked example: replicated
+primitives + motorized revolute joints, click-to-claim (pong's paddle
+pattern), driver forwards `{op:'drive', throttle, steer}` at ~20Hz and only
+the initiator applies wheel motors. Driving + the chase camera engage only
+in Play mode with a running simulation (the module claims `'keys'` and uses
+possess's `startFollowCam` while engaged; the claim itself works anytime).
+
+### Possess (K-D)
+
+```js
+// drive any object with WASD/arrows or the VR left stick (tank controls),
+// chase camera by default; Esc releases. Possessing SELECTS the object
+// (selection = lock), suspends its flow effects, and records ONE undo entry
+// on release. Movement replicates as plain throttled moves.
+api.possess(api.selectedUuid(), { camera: 'chase' }); // 'chase'|'orbit'|'none'
+api.releasePossess();
+```
+
 ### Misc
 
 ```js

static/llms.txt

@@ -32,7 +32,13 @@
 
 - [llms-full.txt](/llms-full.txt): this map plus the entire module SDK guide
   inline (works offline / without repo access).
-
-<!-- At public launch, add repo-backed links here: GitHub wiki, README, and the
-     raw MODULES.md URL. They 404 while the repo is private — the inlined
-     /llms-full.txt above carries the same SDK content regardless. -->
+- [Source repository](https://github.com/theprototype-app/core): MIT-licensed
+  code; CLAUDE.md in the repo root documents the architecture, replication
+  rules and conventions agents should follow when contributing.
+- [README](https://github.com/theprototype-app/core#readme): feature overview,
+  quick start, self-hosting notes.
+- [Module SDK guide, raw](https://raw.githubusercontent.com/theprototype-app/core/main/MODULES.md):
+  the same guide as llms-full.txt, straight from the repo.
+- [Releases](https://github.com/theprototype-app/core/releases): changelog per
+  version.
+- [User docs](https://docs.theprototype.app): guides for people (not agents).