Add community health files

Author: anar-bastanov

CODE_OF_CONDUCT.md

@@ -0,0 +1,7 @@
+# Code of Conduct
+
+Participation in Root Delta Codec spaces must be professional, constructive, and safe. Treat people with respect regardless of background, identity, experience, or viewpoint. Technical disagreement is expected; harassment, personal attacks, discriminatory language, threats, doxxing, and sustained disruption are not acceptable.
+
+Maintainers may edit or remove abusive content and may temporarily or permanently restrict participation when necessary. The maintainer will acknowledge a report, avoid unnecessary disclosure, and take proportionate action. A maintainer who is personally involved in a report should seek an impartial third party before deciding the outcome.
+
+This policy applies to repository issues, pull requests, discussions, code review, and project-related public or private communication.

CONTRIBUTING.md

@@ -0,0 +1,27 @@
+# Contributing to Root Delta Codec
+
+Bug reports, research questions, reproducibility reports, documentation fixes, and focused code changes are welcome.
+
+## Get Help or Report a Problem
+
+- Use [GitHub Discussions](https://github.com/anar-bastanov/root-delta-codec/discussions) for usage questions and research-design discussion when Discussions is available.
+- Open a [GitHub issue](https://github.com/anar-bastanov/root-delta-codec/issues) for reproducible defects, documentation problems, or feature proposals.
+- Use the private route described in [SECURITY.md](SECURITY.md) for a suspected vulnerability; do not publish exploit details in an issue.
+
+An effective report includes the RDC commit or release, .NET SDK and operating system versions, input format and dimensions, exact command or API call, expected behavior, actual behavior, and a minimal redistributable sample when possible.
+
+## Propose a Change
+
+1. Open an issue before a format or public-API change. A transform change can alter the bitstream and must be reconciled with the normative specification.
+2. Fork the repository and create a focused branch.
+3. Preserve existing public behavior unless the issue explicitly approves a breaking change.
+4. If compression or quality can change, run the benchmark on a disclosed dataset and include both per-image and aggregate results.
+5. Submit a pull request explaining motivation, design trade-offs, verification, and any compatibility effect.
+
+## Authorship and Acknowledgement
+
+Contributors retain copyright in their work and agree that accepted source-code contributions are distributed under the MIT license and documentation contributions under CC BY 4.0. Substantial scholarly contributions may warrant paper authorship; commits, issues, reviews, and smaller contributions will be acknowledged in release notes or repository history as appropriate. Discuss authorship early rather than after submission.
+
+## AI-Assisted Contributions
+
+Disclose material generative-AI assistance in the pull request, including the tool/model, affected files, and validation performed. Contributors remain responsible for correctness, originality, licensing, and security. AI output is not evidence that a change has been tested.

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+RDC is research software and is not a security boundary. Do not process untrusted images without application-level limits on file size, dimensions, pixel count, inflated data, memory, and execution time.
+
+## Reporting a Vulnerability
+
+Prefer GitHub's private vulnerability-reporting or Security Advisory interface for this repository. If that interface is unavailable, contact the maintainer at `anar.bastanov.out@gmail.com` with the subject `RDC Security Report`.
+
+Include the affected commit or release, platform, reproduction steps, impact, and a minimal test file when it is safe and legal to share. Allow a reasonable embargo for analysis and a coordinated fix. Do not open a public issue that contains an exploit or a malicious sample before the report has been assessed.
+
+Only the latest repository state and most recent tagged release are eligible for security fixes. Older prereleases may be asked to upgrade.