feat: bootstrap xobject-template mvp foundation

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

Author: vitormattos

.docker/Dockerfile

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+FROM php:8.2-cli
+
+ARG UID=1000
+ARG GID=1000
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git unzip zip bash curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN pecl install xdebug \
+    && docker-php-ext-enable xdebug
+
+RUN groupadd -g ${GID} app || true \
+    && useradd -m -u ${UID} -g ${GID} -s /bin/bash app || true
+
+COPY --from=composer:2 /usr/bin/composer /usr/local/bin/composer
+
+WORKDIR /var/www/html
+USER app
+
+CMD ["bash"]

.env.example

@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+UID=1000
+GID=1000
+XDEBUG_ENABLED=0
+COMPOSER_CACHE_DIR=${HOME}/.composer

.github/CODEOWNERS

@@ -0,0 +1,9 @@
+* @LibreSign/maintainers
+
+/src/ @LibreSign/maintainers
+/.github/workflows/ @LibreSign/maintainers
+/composer.json @LibreSign/maintainers
+/REUSE.toml @LibreSign/maintainers
+/phpunit.xml.dist @LibreSign/maintainers
+/psalm.xml @LibreSign/maintainers
+/rector.php @LibreSign/maintainers

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: libresign

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,22 @@
+name: Bug report
+description: Report a reproducible defect
+labels: [bug]
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security disclosure
+    url: https://github.com/LibreSign/xobject-template/security
+    about: Please report vulnerabilities privately.

.github/ISSUE_TEMPLATE/discussion.yml

@@ -0,0 +1,16 @@
+name: Discussion
+description: Start a technical/product discussion
+labels: [discussion]
+body:
+  - type: textarea
+    id: topic
+    attributes:
+      label: Topic
+    validations:
+      required: true
+  - type: textarea
+    id: context
+    attributes:
+      label: Context
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,16 @@
+name: Feature request
+description: Propose a feature for roadmap review
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem statement
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+## Scope
+
+- [ ] Change scope and impact are clearly described
+
+## Evidence
+
+- [ ] Tests added/updated
+- [ ] Relevant checks executed
+
+## Performance
+
+- [ ] Performance impact assessed
+- [ ] Benchmark threshold still green
+
+## Compliance
+
+- [ ] DCO sign-off in all commits
+- [ ] REUSE/SPDX metadata preserved
+- [ ] License compatibility reviewed

.github/copilot-instructions.md

@@ -0,0 +1,19 @@
+# Copilot Instructions
+
+## Mandatory quality flow
+
+1. Implement in small increments.
+2. Run focused tests first, then full checks.
+3. Ensure performance-sensitive paths stay within benchmark thresholds.
+
+## Compliance and contribution
+
+- DCO sign-off is mandatory for every commit.
+- Keep REUSE/SPDX headers and AGPL compatibility.
+- Respect allowed dependency licenses.
+
+## Memory-as-Code policy
+
+- Operational details belong to the memory repository, not this package repo.
+- Keep this repository documentation minimal (`README.md` + mandatory governance files).
+- Avoid doc sprawl.