Add the policy engine

.github/workflows/release.yml

@@ -0,0 +1,51 @@
+name: Publish release image
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    name: Publish service image to GHCR
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Check out release tag
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: refs/tags/${{ github.event.release.tag_name }}
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
+      - name: Log in to GHCR
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate image tags and labels
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ghcr.io/${{ github.repository }}
+          flavor: latest=false
+          tags: |
+            type=raw,value=${{ github.event.release.tag_name }}
+            type=raw,value=latest,enable=${{ !github.event.release.prerelease }}
+
+      - name: Build and publish image
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

CONTRIBUTING.md

@@ -6,9 +6,10 @@ Contributions of all kinds are welcome — bug reports, documentation improvemen
 
 The workspace is organised into focused crates. Keep changes scoped to the appropriate crate and discuss cross-crate changes in an issue first.
 
-- [`core`](core/README.md): Simplicity execution engine and Bitcoin/Elements environments.
-- [`service`](service/README.md): Axum HTTP service exposing the sign/PSBT, sign/PSET, and key-tweak endpoints.
-- [`cli`](cli/README.md): `clap`-based CLI for interacting with the service and accessing ecosystem utilities.
+- [`policy`](policy/README.md): Portable `bitcoin-policy-v1` registry and verified context.
+- [`core`](core/README.md): Policy execution adapter and shared Bitcoin/Elements primitives.
+- [`service`](service/README.md): Axum HTTP service exposing separate Bitcoin/Liquid policy APIs and the version endpoint.
+- [`cli`](cli/README.md): Primary `policy` workflow and key generation.
 
 ## Issues
 
@@ -47,14 +48,13 @@ The service reads `config.toml` from the current directory by default. You can p
 cargo run --quiet -- start --config path/to/your/config.toml
 ```
 
-To exercise CLI commands against the running service, use the demo scripts:
+To exercise the policy CLI against a matching Testnet4 service, follow the
+[demo's artifact requirements](cli/README.md#demo):
 
 ```bash
-# Bitcoin regtest demo
-cd cli && ./scripts/demo_btc.sh
-
-# Elements / Liquid testnet demo
-cd cli && ./scripts/demo_elements.sh
+./cli/scripts/demo_btc.sh --help
+# With reviewed policy artifacts configured:
+./cli/scripts/demo_btc.sh review
 ```
 
 ## Docker