Add open source maintenance governance

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @relaxfinger

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: swift
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes are documented here. This project follows [Semantic Versioni
 
 ## [Unreleased]
 
+## [2.4.5] - 2026-07-18
+
+### Added
+
+- Added support, maintenance, and architecture-decision policies; CODEOWNERS; and weekly Dependabot updates for GitHub Actions and Swift dependencies.
+
 ## [2.4.4] - 2026-07-18
 
 ### Added

CONTRIBUTING.md

@@ -14,6 +14,10 @@ Run all checks before opening a pull request:
 
 ```bash
 swift test
+swift Scripts/validate_route_contract.swift RouteContracts.json
+swift package diagnose-api-breaking-changes origin/master \
+  --products URLRouter \
+  --products URLRouterPolicyProvider
 swift build --package-path Features/NavigationFeature
 swift build --package-path Features/ContentFeature
 xcodebuild build \
@@ -37,6 +41,8 @@ xcodebuild build \
 - Keep each pull request focused on one concern.
 - Add or update tests for observable behavior changes.
 - Update both README languages when a public API or integration workflow changes.
+- Read [MAINTENANCE.md](MAINTENANCE.md) before proposing a compatibility-sensitive change.
+- Add an ADR under `docs/adr/` for a material public-boundary, route-compatibility, security, or long-term maintenance decision.
 - Use concise, imperative commit messages, for example: `Add route registry collision test`.
 - Wait for the required CI checks and maintainer approval before merging.
 - Maintainers use squash merge so each pull request becomes one focused commit on `master`.

MAINTENANCE.md

@@ -0,0 +1,29 @@
+# Maintenance policy
+
+## Supported releases
+
+The latest tagged release on `master` is supported. Security fixes and
+compatibility fixes are normally made there first. Older releases receive fixes
+only when a maintainer explicitly commits to a backport.
+
+## Versioning and compatibility
+
+- **PATCH** releases fix behavior, tests, documentation, or tooling without a public API or route-contract break.
+- **MINOR** releases add backwards-compatible APIs or route contracts.
+- **MAJOR** releases may remove or change a public Swift API or public route contract and must include migration guidance.
+
+PR CI compares public Swift APIs and route contracts with the PR base commit.
+Do not bypass these gates for a patch or minor release.
+
+## Maintainer workflow
+
+1. Triage issues into bug, enhancement, question, or security report.
+2. Require a focused PR, tests for behavior changes, and both README languages when public integration changes.
+3. Require all CI checks, then squash merge to `master`.
+4. Publish a semantic-version tag and GitHub release from the merged commit.
+
+## Architecture records
+
+Material cross-cutting decisions are recorded under `docs/adr/`. A new ADR is
+expected when a change affects public-package boundaries, route compatibility,
+security posture, or long-term maintenance costs.

README.md

@@ -407,3 +407,9 @@ swift Scripts/validate_route_contract.swift RouteContracts.json
 ## License
 
 URLRouter is released under the [MIT License](LICENSE).
+
+## Community and maintenance
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for pull requests, [SUPPORT.md](SUPPORT.md)
+for support channels, [SECURITY.md](SECURITY.md) for responsible disclosure, and
+[MAINTENANCE.md](MAINTENANCE.md) for supported-release and compatibility policy.

README.zh-CN.md

@@ -398,3 +398,9 @@ swift Scripts/validate_route_contract.swift RouteContracts.json
 ## 许可证
 
 URLRouter 使用 [MIT License](LICENSE) 发布。
+
+## 社区与维护
+
+提交 PR 请阅读 [CONTRIBUTING.md](CONTRIBUTING.md)，支持渠道见
+[SUPPORT.md](SUPPORT.md)，安全漏洞请遵循 [SECURITY.md](SECURITY.md)，支持版本与
+兼容性策略见 [MAINTENANCE.md](MAINTENANCE.md)。

SUPPORT.md

@@ -0,0 +1,26 @@
+# Support
+
+URLRouter is maintained as an open-source Swift Package. Use the right channel
+so security reports and actionable bugs receive the appropriate attention.
+
+## Where to ask
+
+| Need | Use |
+| --- | --- |
+| Reproducible defect in a released version | [Bug report](.github/ISSUE_TEMPLATE/bug_report.yml) |
+| Backward-compatible improvement | [Feature request](.github/ISSUE_TEMPLATE/feature_request.yml) |
+| Integration or usage question | GitHub Discussions, if enabled; otherwise open a focused issue with a minimal sample |
+| Security vulnerability | Follow [SECURITY.md](SECURITY.md); do not open a public issue |
+
+## What to include
+
+Include the URLRouter version, Apple platform and OS version, Xcode/Swift
+version, a minimal URL or route-contract example with sensitive values removed,
+and the expected versus actual result. For policy-provider questions, also
+state whether the source is cached, stale, or freshly fetched.
+
+## Support expectations
+
+Maintainers triage new actionable reports on a best-effort basis. A response or
+label is not a commitment to implement a change. Pull requests with tests,
+documentation updates, and a focused scope are the fastest path to a fix.

docs/adr/0001-public-compatibility-gates.md

@@ -0,0 +1,25 @@
+# ADR 0001: Protect public Swift APIs and route contracts in pull requests
+
+**Status:** Accepted
+
+## Context
+
+URLRouter exposes two public library products and a public URL contract catalog.
+Both are consumed outside the repository. Compilation and unit tests alone do
+not reveal that a public type, method, or existing URL route was removed.
+
+## Decision
+
+Every pull request compares public Swift APIs with its exact base commit using
+SwiftPM's `diagnose-api-breaking-changes` command. It also compares
+`RouteContracts.json` with that base commit and rejects removed routes, changed
+paths, removed presentation styles, required parameters, or supported versions.
+
+Breaking changes require a major release and migration guidance. The gates are
+not bypassed for patch or minor releases.
+
+## Consequences
+
+Contributors get an early, reproducible compatibility signal. The repository
+accepts a modest CI cost and full Git history checkout in exchange for avoiding
+silent downstream breakage.