@@ -17,22 +17,22 @@ with whole-number floats collapsed to integers.
 
 ## Exact behaviours this port implements
 
-1. **NFC normalization** — every string **value** and every object **key** is
+1. **NFC normalization**: every string **value** and every object **key** is
    `Normalizer.normalize(s, Form.NFC)` before serialization. (`"cafe"+U+0301` →
    `café`.) This is the main divergence from RFC 8785, which does *not* normalize.
-2. **Key sorting** — object keys sorted by Unicode **code point** ascending,
+2. **Key sorting**: object keys sorted by Unicode **code point** ascending,
    recursively. NFC is applied to keys *before* sorting.
-3. **Separators** — `,` between items, `:` between key and value. No whitespace.
-4. **Raw UTF-8, no `\uXXXX`** — non-ASCII characters are emitted as raw UTF-8
+3. **Separators**: `,` between items, `:` between key and value. No whitespace.
+4. **Raw UTF-8, no `\uXXXX`**: non-ASCII characters are emitted as raw UTF-8
    bytes (`ensure_ascii=False`). `é` = `c3 a9`, `☃` = `e2 98 83`, `😀` =
    `f0 9f 98 80`.
-5. **Whole-number floats → integers** — `1.0` → `1`, `2.00` → `2`. A non-whole
+5. **Whole-number floats → integers**: `1.0` → `1`, `2.00` → `2`. A non-whole
    float keeps its value: `1.5` → `1.5`. (Implemented via `BigDecimal`:
    `stripTrailingZeros().scale() <= 0` means whole.)
-6. **Integers stay integers, arbitrary precision** — `9007199254740993` is
+6. **Integers stay integers, arbitrary precision**: `9007199254740993` is
    serialized exactly. This port parses integral JSON numbers into
    `java.math.BigInteger`, so there is no `2^53` precision loss.
-7. **Control-char escaping** — only `"`, `\`, and U+0000–U+001F are escaped,
+7. **Control-char escaping**: only `"`, `\`, and U+0000 to U+001F are escaped,
    using `\b \t \n \f \r` where applicable and `\uXXXX` otherwise. `/` is **not**
    escaped. This matches Python's `json.dumps`.
 
@@ -44,10 +44,10 @@ agree. **Signed payloads should avoid non-trivial floats** (e.g. `0.1 + 0.2`).
 
 ## Signing & encoding
 
-- **VC** — signed payload is the credential minus `proof` and `credentialStatus`,
+- **VC**: signed payload is the credential minus `proof` and `credentialStatus`,
   canonicalized as above, Ed25519-signed; `proof.proofValue` is base64url **with
   padding**.
-- **UCAN** — EdDSA JWTs (compact form). The signed message is
+- **UCAN**: EdDSA JWTs (compact form). The signed message is
   `base64url(header) + "." + base64url(payload)` (base64url **without** padding,
   per the JWT spec). Only `alg=EdDSA` is accepted.
-- **did:key** — `did:key:z` + base58btc(`0xed 0x01` ‖ raw-32-byte key).
+- **did:key**: `did:key:z` + base58btc(`0xed 0x01` ‖ raw-32-byte key).
@@ -0,0 +1,15 @@
+# Code of Conduct
+
+This project adopts the Contributor Covenant, version 2.1, as its code of conduct:
+https://www.contributor-covenant.org/version/2/1/code_of_conduct/
+
+All contributors, maintainers, and participants are expected to follow it. By
+participating, you agree to help keep this a welcoming, respectful community.
+
+## Reporting
+
+To report a concern, contact the maintainers privately at info@vibetensor.com.
+All reports are reviewed and handled confidentially.
+
+Translations of the full text are available at
+https://www.contributor-covenant.org/translations/.
@@ -0,0 +1,38 @@
+# Contributing to the Attestix Java verifier
+
+Thanks for your interest. This is the Java port of the Attestix offline
+verifier, part of the [Attestix](https://github.com/VibeTensor/attestix) project.
+
+## Getting started
+
+1. Fork and clone the repository.
+2. Build and run the tests:
+
+   ```
+   ./gradlew test
+   ```
+
+## Conformance (required)
+
+Every verifier port MUST reproduce the shared cross-language conformance vectors
+from the core repo at
+[`spec/verify/v1`](https://github.com/VibeTensor/attestix/tree/main/spec/verify/v1).
+Run the conformance suite before opening a pull request: a change that diverges
+from the shared `vectors.json` will not be accepted.
+
+## Pull requests
+
+- Branch from `main` and keep each PR focused.
+- Use conventional commit messages (`fix:`, `feat:`, `docs:`, `test:`, `chore:`).
+- Make sure the full test suite passes and add tests for new behaviour.
+- Avoid unrelated formatting churn.
+
+## Reporting issues
+
+Open an issue with a minimal reproduction. For security issues, follow
+[SECURITY.md](SECURITY.md) instead of filing a public issue.
+
+## License
+
+By contributing you agree that your contributions are licensed under the
+Apache License 2.0, the same license as this repository.
@@ -3,8 +3,8 @@
 Offline verifier for **Attestix**-issued credentials, in pure Java. Verify
 Ed25519 [W3C Verifiable Credentials](https://www.w3.org/TR/vc-data-model/) and
 [UCAN](https://github.com/ucan-wg/spec) delegation chains that were issued by the
-[Attestix](https://github.com/VibeTensor/attestix) Python core — **with no Python
-runtime needed**.
+[Attestix](https://github.com/VibeTensor/attestix) Python core (**with no Python
+runtime needed**).
 
 This is a language port of the Attestix verifier. It reproduces the Attestix
 canonical form **byte-for-byte** and is validated against the shared
@@ -31,7 +31,7 @@ Maven (once published to Maven Central):
 
 ```xml
 <dependency>
-  <groupId>io.vibetensor</groupId>
+  <groupId>com.vibetensor</groupId>
   <artifactId>attestix</artifactId>
   <version>0.4.0</version>
 </dependency>
@@ -40,7 +40,7 @@ Maven (once published to Maven Central):
 Gradle (Kotlin DSL):
 
 ```kotlin
-implementation("io.vibetensor:attestix:0.4.0")
+implementation("com.vibetensor:attestix:0.4.0")
 ```
 
 Requires Java 11+ at runtime. (CI builds and tests on Temurin 17.)
@@ -129,15 +129,21 @@ Every vector in `testdata/vectors.json` is asserted by
 ## Releasing to Maven Central
 
 This build is **publish-ready** (POM metadata, sources + javadoc jars, GPG
-signing wired) but is **not** auto-published. To cut a release:
-
-1. Configure Sonatype OSSRH / Central Portal credentials
-   (`OSSRH_USERNAME`, `OSSRH_PASSWORD`) and a GPG key (`SIGNING_KEY`,
-   `SIGNING_PASSWORD`) as environment variables or Gradle properties.
-2. `./gradlew publish` to stage to OSSRH.
-3. Close & release the staging repository (or use the Central Portal UI).
-
-No tokens are committed; publishing is a manual, credentialed step.
+signing wired) via the Sonatype **Central Portal** (`central.sonatype.com`). To
+cut a release:
+
+1. Configure Central Portal token credentials
+   (`mavenCentralUsername`, `mavenCentralPassword`) and an in-memory GPG key
+   (`signingInMemoryKey`, `signingInMemoryKeyPassword`) as `ORG_GRADLE_PROJECT_*`
+   environment variables or Gradle properties.
+2. Bump `version` in `build.gradle.kts`, commit, then push a matching `vX.Y.Z`
+   tag. The `publish` GitHub Actions workflow runs the conformance vectors and
+   then `./gradlew publishToMavenCentral`.
+3. With `automaticRelease = true`, Central validates and releases the artifact
+   automatically (no manual staging step). Flip that flag to stage first.
+
+No tokens are committed; release runs only on a version tag with the credentials
+supplied as encrypted GitHub Actions secrets.
 
 ## License
 
 
@@ -0,0 +1,26 @@
+# Security Policy
+
+## Supported versions
+
+This is a verifier for [Attestix](https://github.com/VibeTensor/attestix) and
+tracks the Attestix core 0.4.x release line. Security fixes land on the latest
+released version.
+
+| Version | Supported |
+|---|---|
+| 0.4.x   | yes       |
+| < 0.4   | no        |
+
+## Reporting a vulnerability
+
+Please do NOT open a public issue for security vulnerabilities.
+
+Report privately by either:
+
+- opening a GitHub Security Advisory on this repository
+  (https://github.com/VibeTensor/attestix-java/security/advisories/new), or
+- emailing info@vibetensor.com.
+
+Include a description, affected versions, and a reproduction if possible. We
+follow coordinated disclosure: we acknowledge the report, work on a fix, and
+credit you (unless you prefer otherwise) when the fix ships.