chore(writ-core): v0.1.0 release prep

Add CONTRIBUTING.md (DCO sign-off requirement, PR flow),
SECURITY.md (private disclosure, 90-day window), and
docs/release-notes-v0.1.0.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: OpsKern

CONTRIBUTING.md

@@ -0,0 +1,32 @@
+# Contributing to writ
+
+## Opening an issue
+
+- Search existing issues before opening a new one.
+- For bugs: include the writ version (`go list -m github.com/opskernel-io/writ`), Go version, OS, and a minimal reproducer.
+- For feature requests: describe the problem you're solving, not just the solution.
+
+## Submitting a pull request
+
+1. Fork the repo and create a branch from `main`.
+2. Make your changes. Run `go test ./...` and `go vet ./...` before pushing.
+3. Open a PR against `main`. Keep the title concise and in the imperative mood ("Add X", "Fix Y").
+4. A maintainer will review within 5 business days. CI must pass before merge.
+
+## DCO sign-off
+
+This project uses the [Developer Certificate of Origin (DCO)](https://developercertificate.org/) in place of a CLA. Add a sign-off line to every commit:
+
+```
+git commit -s -m "your commit message"
+```
+
+This appends `Signed-off-by: Your Name <your@email.com>` to the commit message. By signing off you certify that you wrote the code or have the right to submit it under the Apache 2.0 license.
+
+PRs with unsigned commits will not be merged.
+
+## Code style
+
+- Standard `gofmt` formatting.
+- No new exported symbols without a doc comment.
+- Security-sensitive code (`internal/audit`, `internal/gate`) must pass `gosec ./...` with no new suppressions unless reviewed and justified in the PR description.

SECURITY.md

@@ -0,0 +1,27 @@
+# Security policy
+
+## Supported versions
+
+| Version | Supported |
+|---------|-----------|
+| 0.x     | Yes       |
+
+## Reporting a vulnerability
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Report vulnerabilities by email to **thewismit@gmail.com**. Include:
+
+- A description of the vulnerability and its potential impact
+- Steps to reproduce or a proof-of-concept
+- Affected versions (if known)
+
+You will receive an acknowledgement within 2 business days. We aim to release a fix within 30 days of confirmation; for critical issues, sooner.
+
+**Disclosure window:** We follow a 90-day coordinated disclosure policy. After 90 days from the date of your report (or on the day a fix ships, whichever comes first), you are free to publish your findings. We will credit you in the release notes unless you prefer to remain anonymous.
+
+## Scope
+
+In scope: the `writ` Go module and the `cmd/writ` CLI.
+
+Out of scope: vulnerabilities in third-party dependencies (report those to the respective projects). We will bump affected dependencies promptly when upstream fixes ship.

docs/release-notes-v0.1.0.md

@@ -0,0 +1,16 @@
+## writ v0.1.0
+
+writ is a pre-execution codification gate and Merkle audit chain for Go agents. Every outbound LLM API call is evaluated against an OPA policy before it leaves the process; every gate decision is written to a SHA-256-linked append-only chain that breaks verification if altered.
+
+**EU AI Act Article 12 posture (enforcement begins 2026-08-02):**
+
+- 3 requirements met in full: automatic logging, technical logging, traceability
+- 3 requirements partially met with defined remediation paths: tamper-evident storage, cross-restart chain continuity, full input capture
+- 2 named gaps with a roadmap: RFC 3161 external timestamping, managed 6-month retention
+
+**What's next:**
+
+- Cross-restart hash linking (closes partial requirement 2)
+- `chattr +a` filesystem protection helper (closes partial requirement 1)
+- RFC 3161 timestamp integration via `github.com/digitorus/timestamp`
+- Commercial-tier: hosted eIDAS-compliant timestamping and retention management