docs: complete project contract

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+* @joey-huckabee
+
+/.github/ @joey-huckabee
+/Containerfile @joey-huckabee
+/container/ @joey-huckabee
+/tests/ @joey-huckabee

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,66 @@
+name: Bug report
+description: Report reproducible image, runtime, or documentation behavior
+title: "bug: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Do not disclose vulnerabilities here. Use the private security link
+        shown before opening an issue.
+  - type: input
+    id: image
+    attributes:
+      label: Image tag and digest
+      description: Include both when available; do not report only a mutable tag.
+      placeholder: ghcr.io/datopsis/nginx-ubi9:v...@sha256:...
+    validations:
+      required: true
+  - type: input
+    id: runtime
+    attributes:
+      label: Runtime, host, and versions
+      placeholder: RHEL and Podman, Docker, or OpenShift versions
+    validations:
+      required: true
+  - type: dropdown
+    id: architecture
+    attributes:
+      label: Architecture
+      options:
+        - linux/amd64
+        - linux/arm64
+        - Other or unknown
+    validations:
+      required: true
+  - type: textarea
+    id: configuration
+    attributes:
+      label: Minimal NGINX and deployment configuration
+      description: Remove credentials, keys, internal names, and other secrets.
+      render: text
+    validations:
+      required: true
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Reproduction and observed behavior
+      description: List exact steps, the result, and the expected result.
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: Redact secrets and personal or internal information.
+      render: text
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and tested the current development revision or a supported release.
+          required: true
+        - label: I removed secrets and sensitive data from this report.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a vulnerability privately
+    url: https://github.com/datopsis/nginx-ubi/security/advisories/new
+    about: Never disclose a suspected vulnerability in a public issue.
+  - name: NGINX upstream
+    url: https://nginx.org/en/support.html
+    about: Use upstream channels for behavior that reproduces outside this image.

.github/pull_request_template.md

@@ -0,0 +1,21 @@
+## Summary
+
+Describe the user-facing or operational outcome and why the change is needed.
+
+## Validation
+
+- [ ] I ran the relevant local checks from `docs/CI.md`.
+- [ ] I reviewed logs, warnings, annotations, skipped steps, and retained
+      evidence rather than relying only on green status checks.
+- [ ] I added or updated tests for behavior changes.
+- [ ] I updated user and operator documentation where needed.
+- [ ] I recorded notable completed work in `CHANGELOG.md` and removed it from
+      the forward-looking roadmap where applicable.
+- [ ] I did not weaken a security or release control without documenting the
+      threat, rationale, compensating control, owner, and expiry.
+
+## Security and release impact
+
+State whether this changes image contents, runtime behavior, supported scope,
+or release evidence. If it changes a published artifact, identify the required
+version action under `docs/VERSION.md`. List accepted findings or write `None`.

CHANGELOG.md

@@ -10,6 +10,12 @@ but container releases use the upstream-derived format documented in
 
 ### Added
 
+- Added the Apache License 2.0 for Datopsis-authored work, third-party notices,
+  contribution guidance, and a private vulnerability-reporting policy.
+- Defined support classifications, published the current development support
+  matrix and ownership boundary, and documented repository governance.
+- Added Code Owners, a security-aware pull request template, and structured
+  public bug-report and private security-reporting routes.
 - Established repository guidance for secure, rootless image development and
   review.
 - Defined the forward-looking first-release roadmap and evidence lifecycle.
@@ -28,6 +34,8 @@ but container releases use the upstream-derived format documented in
   hash-locked CI Python environment.
 - Documented local checks, GitHub automation, planned image assurance, and the
   evidence boundary of Podman Desktop or a remote Podman machine.
+- Added a contributor environment record for the exercised Ubuntu WSL2 and
+  rootless Podman development setup.
 - Added an initial package-manager-free UBI 9 Micro development image using an
   exact Red Hat NGINX RPM build.
 - Added rootless NGINX defaults for unprivileged HTTP, read-only-root operation,
@@ -49,8 +57,6 @@ but container releases use the upstream-derived format documented in
 - Expanded the first-release roadmap with deployment qualification, systemd and
   logging tests, OSCAL/control engineering, requirement-source review, FIPS
   boundary analysis, go-live evidence, and an assurance-completeness gate.
-- Made upgrading the existing Ubuntu WSL2 Podman environment and rerunning the
-  complete Shell/Quadlet qualification the next roadmap action.
 - Added GitHub topics for NGINX, containers, Podman, OpenShift, UBI 9, and
   supply-chain security.
 - Extended CI with native AMD64 and ARM64 builds, restricted-runtime tests,
@@ -72,3 +78,25 @@ but container releases use the upstream-derived format documented in
   effective capabilities, `no-new-privileges`, arbitrary-UID operation,
   read-only-root behavior, hardened temporary storage, log routing, graceful
   reload and shutdown, and actionable negative startup cases.
+
+### Changed
+
+- Renamed the source repository from `nginx-ubi9` to `nginx-ubi` so repository
+  identity does not prevent future work on other UBI major versions; existing
+  image, service, and UBI 9 identifiers remain unchanged.
+- Upgraded the reference contributor environment from Ubuntu 22.04.5 and
+  Podman 3.4.4 to Ubuntu 24.04.5 and Podman 5.8.2, verified the restricted
+  runtime and Quadlet lifecycle after a cold WSL restart, and retired the
+  completed upgrade plan from the forward-looking roadmap.
+- Retired the completed project-contract package from the forward-looking
+  roadmap after its repository files and current support boundary were added.
+
+### Security
+
+- Enabled GitHub vulnerability alerts, Dependabot security updates, secret
+  scanning with push protection, and private vulnerability reporting.
+
+### Fixed
+
+- Prevented the Docker smoke suite from failing with SIGPIPE when short-circuit
+  log and response assertions run under `pipefail`.

CONTRIBUTING.md

@@ -0,0 +1,51 @@
+# Contributing
+
+Contributions are welcome through GitHub pull requests. Security reports must
+use the private process in [SECURITY.md](SECURITY.md), not a public issue.
+
+## Before changing the repository
+
+1. Read [the agent and contributor guidance](CLAUDE.md), the
+   [forward-looking roadmap](docs/ROADMAP.md), and the
+   [support definitions](docs/SUPPORT.md).
+2. Keep runtime additions minimal and explain why each package, module, port,
+   writable path, capability, or network permission is required.
+3. Pin base images and external inputs as required by the artifact-acquisition
+   policy. Never commit credentials, private keys, private CAs, or internal
+   repository locations.
+4. Add or update automated tests, operational guidance, security
+   considerations, and support classification together when behavior changes.
+5. Record notable completed work under `Unreleased` in `CHANGELOG.md` and
+   remove completed work from `docs/ROADMAP.md`; the roadmap remains forward
+   looking.
+
+Do not weaken the non-root default, checksum and signature verification,
+vulnerability gates, read-only-root compatibility, dropped-capability and
+no-new-privileges baseline, SCAP evidence boundary, or signed-release process
+merely to make a test pass.
+
+## Validate a change
+
+Install and run the pinned repository checks:
+
+```console
+python -m pip install --require-hashes --only-binary=:all: \
+  --requirement .github/requirements/pre-commit.txt
+pre-commit install --install-hooks
+pre-commit run --all-files --show-diff-on-failure
+```
+
+For image-affecting changes, use the build and smoke commands in `README.md`.
+The exercised local WSL2 configuration and its evidence limitations are in
+`docs/CONTRIBUTOR-ENVIRONMENT.md`. A local success does not replace native
+architecture CI or release-candidate platform qualification.
+
+## Pull requests and commits
+
+Keep changes small and dependency ordered. Complete the pull request template,
+identify image, runtime, security, documentation, and release impact, and
+review logs and retained evidence rather than relying only on green checkmarks.
+
+Use concise Conventional Commit subjects such as `feat:`, `fix:`, `docs:`,
+`test:`, `ci:`, `build:`, `refactor:`, or `chore:`. Do not add AI, assistant,
+tool-attribution, or `Co-Authored-By` trailers to commits.