Minimum T56/T99 managed radio client and release preparation

.editorconfig

@@ -0,0 +1,2 @@
+[*.md]
+max_line_length = 70

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+* @awatchar
+

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,81 @@
+name: Bug report
+description: Report a reproducible problem in the Android app or configuration portal.
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for testing Minimum. Do not include server passwords, access tokens, device bearer tokens, APRS passcodes, certificate fingerprints, exact private coordinates, or unredacted configuration files.
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - Android radio application
+        - Configuration portal
+        - Managed configuration delivery
+        - Provisioning script
+        - APRS tracking
+        - Build or release
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      description: Find the Android version in App info, or provide the tested Git commit.
+      placeholder: e.g. 5a28ff5-debug
+    validations:
+      required: true
+  - type: dropdown
+    id: model
+    attributes:
+      label: Device model
+      options:
+        - T56
+        - T99
+        - Generic Android
+        - Web browser only
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: summary
+    attributes:
+      label: What happened?
+      description: Describe the observed result and what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Reproduction steps
+      placeholder: |
+        1. Start with ...
+        2. Press ...
+        3. Observe ...
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Test conditions
+      description: Include screen state, network type, connected server/channel (sanitized), and whether the app was foreground, background, or starting after boot.
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Sanitized evidence
+      description: Attach screenshots, video, timestamps, or a minimal redacted log. Do not upload secrets or a complete bugreport.
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Safety checks
+      options:
+        - label: I stopped transmitting before collecting or uploading diagnostics.
+          required: true
+        - label: I checked the report and attachments for credentials, tokens, exact private coordinates, and other private device data.
+          required: true
+

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,6 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security report
+    url: https://github.com/awatchar/minimum/security/advisories/new
+    about: Report credentials, authentication bypasses, or other vulnerabilities privately.
+

.github/ISSUE_TEMPLATE/device_acceptance.yml

@@ -0,0 +1,77 @@
+name: Device acceptance result
+description: Record a structured T56, T99, or generic Android field-test result.
+title: "[Device test]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for real-device failures or acceptance evidence. Never publish credentials, bearer tokens, APRS passcodes, certificate fingerprints, exact private coordinates, or unsanitized ADB output. A passing result may have its `bug` label removed during triage.
+  - type: dropdown
+    id: model
+    attributes:
+      label: Model
+      options: [T56, T99, Generic Android]
+    validations:
+      required: true
+  - type: input
+    id: build
+    attributes:
+      label: APK version or commit
+      placeholder: e.g. 5a28ff5-debug
+    validations:
+      required: true
+  - type: dropdown
+    id: scenario
+    attributes:
+      label: Scenario
+      options:
+        - Boot to ready channel
+        - Screen-off PTT
+        - Foreground PTT
+        - Network loss and reconnect
+        - Server or channel switch
+        - Multiple simultaneous speakers
+        - Device ID display
+        - Managed config refresh or rollback
+        - Location or APRS tracking
+        - Provisioning
+        - Other
+    validations:
+      required: true
+  - type: dropdown
+    id: result
+    attributes:
+      label: Result
+      options: [PASS, FAIL, PARTIAL, BLOCKED]
+    validations:
+      required: true
+  - type: textarea
+    id: preconditions
+    attributes:
+      label: Preconditions
+      description: State screen/app/network conditions and any relevant setup without secrets.
+    validations:
+      required: true
+  - type: textarea
+    id: procedure
+    attributes:
+      label: Procedure and observations
+      description: Include exact operator actions, timing, visible status, TX/RX behavior, and recovery.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Sanitized evidence
+      description: Attach timestamps, screenshots, video, or only the smallest redacted log needed to support the result.
+  - type: checkboxes
+    id: safeguards
+    attributes:
+      label: Safeguards
+      options:
+        - label: Transmissions were supervised and stopped before failure recovery or diagnostic collection.
+          required: true
+        - label: Evidence was reviewed and contains no credentials, tokens, exact private coordinates, or other private device data.
+          required: true
+

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,39 @@
+name: Feature request
+description: Propose a focused improvement to Minimum.
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - Android radio application
+        - Configuration portal
+        - Provisioning
+        - APRS tracking
+        - Operations or release
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem to solve
+      description: Describe the operator or administrator problem, not only the proposed UI.
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Explain the observable behavior and how it could be accepted as complete.
+    validations:
+      required: true
+  - type: textarea
+    id: constraints
+    attributes:
+      label: Constraints and safety considerations
+      description: Note affected models, networks, permissions, compatibility, privacy, or TX safety concerns.
+

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,33 @@
+## Outcome
+
+Describe the user-visible behavior and why this change is needed. Link the issue with `Closes #...` when applicable.
+
+## Scope
+
+- Components changed:
+- Explicitly out of scope:
+- Configuration schema or migration impact:
+
+## Verification
+
+- [ ] Relevant automated tests pass.
+- [ ] `:app:testFossDebugUnitTest :app:assembleFossDebug` passes for Android changes.
+- [ ] Web tests, TypeScript and production build pass for portal changes.
+- [ ] Real-device acceptance evidence is linked when hardware behavior changed.
+- [ ] Documentation and hand-off status are updated.
+
+List exact commands and manual scenarios with their results:
+
+## Safety and privacy
+
+- [ ] No server password, access token, bearer token, APRS passcode, signing material, exact private coordinates, or unsanitized device data is committed or attached.
+- [ ] PTT changes preserve release-on-key-up, network loss, disconnect, service destruction and watchdog behavior.
+- [ ] Reconnect/config changes preserve throttling, last-known-good fallback and selected-channel restoration.
+- [ ] Public location behavior and operator consent were reviewed when tracking changed.
+
+## Release impact
+
+- [ ] No release note required.
+- [ ] Release note or known limitation is included below.
+
+Release note / known limitation:

.github/SECURITY.md

@@ -0,0 +1,11 @@
+# Security policy
+
+Report authentication bypasses, credential exposure, unsafe transmit behavior and other security
+issues privately with [GitHub Security Advisories](https://github.com/awatchar/minimum/security/advisories/new).
+Do not open a public Issue containing server passwords, access tokens, device bearer tokens, APRS
+passcodes, signing keys, certificate fingerprints, precise private coordinates or complete device
+logs.
+
+Include the affected commit/version, device model, observed impact and the smallest sanitized
+reproduction details. Do not perform unsupervised radio transmission, destructive provisioning or
+location publication to collect evidence.

.github/workflows/ci.yml

@@ -0,0 +1,81 @@
+name: Continuous integration
+
+on:
+  pull_request:
+  push:
+    branches: [main, agent/minimum-foundation]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  android:
+    name: Android tests, debug APK and release lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout with Humla
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - name: Set up Java 21
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+          cache: gradle
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+      - name: Install pinned NDK
+        run: sdkmanager "platforms;android-36" "build-tools;36.0.0" "ndk;25.1.8937393"
+      - name: Build patched Spongy Castle jars
+        working-directory: libraries/humla/libs/humla-spongycastle
+        run: |
+          chmod +x ../../gradlew
+          ../../gradlew jar --no-daemon
+      - name: Test and assemble FOSS debug and unsigned release
+        run: |
+          chmod +x gradlew
+          ./gradlew :app:testFossDebugUnitTest :app:assembleFossDebug :app:assembleFossRelease --no-daemon --stacktrace
+      - name: Upload debug APK
+        uses: actions/upload-artifact@v4
+        with:
+          name: minimum-foss-debug-${{ github.sha }}
+          path: app/build/outputs/apk/foss/debug/mumla-foss-debug.apk
+          if-no-files-found: error
+          retention-days: 14
+
+  web:
+    name: Portal tests and production build
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.16.0
+          run_install: false
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: pnpm
+          cache-dependency-path: web/pnpm-lock.yaml
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Test
+        run: pnpm test
+      - name: Type-check
+        run: pnpm exec tsc --noEmit
+      - name: Build
+        run: pnpm build

.github/workflows/deploy-pages.yml

@@ -0,0 +1,37 @@
+name: Deploy public recovery configuration
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "backend/**"
+      - ".github/workflows/deploy-pages.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Configure Pages
+        uses: actions/configure-pages@v5
+      - name: Upload public recovery configuration
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: backend
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4