Dev

.dockerignore

@@ -0,0 +1,4 @@
+.git
+target
+**/target
+**/config.toml

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,42 @@
+---
+name: Bug report
+about: Report a reproducible bug
+title: "bug: "
+labels: bug
+assignees: ""
+---
+
+## Description
+
+<!-- A clear and concise description of what the bug is. -->
+
+## Steps to reproduce
+
+<!-- Minimal command sequence or code snippet that triggers the bug. -->
+
+## Expected behaviour
+
+<!-- What you expected to happen. -->
+
+## Actual behaviour
+
+<!-- What actually happened. Include error output, panic messages, or unexpected responses. -->
+
+## Environment
+
+- **OS**: <!-- e.g. Ubuntu 24.04, macOS 15 -->
+- **Rust version**: <!-- output of `rustc --version` -->
+- **Commit / tag**: <!-- git rev-parse --short HEAD -->
+- **Affected crate(s)**: <!-- core / service / cli -->
+
+## Logs
+
+<!-- Paste relevant logs here. Redact any sensitive data such as private keys. -->
+
+```plaintext
+paste here
+```
+
+## Additional context
+
+<!-- Anything else that might help diagnose the issue. -->

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/BlockstreamResearch/simplicity-unchained/security/advisories/new
+    about: Please report security issues privately via GitHub's security advisory feature rather than opening a public issue.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,27 @@
+---
+name: Feature request
+about: Propose a new feature or improvement
+title: "feat: "
+labels: enhancement
+assignees: ""
+---
+
+## Problem / motivation
+
+<!-- Describe the problem or limitation this feature would address. -->
+
+## Proposed solution
+
+<!-- Describe the change or addition you have in mind. -->
+
+## Affected crate(s)
+
+<!-- Which crate(s) would this touch? core / service / cli -->
+
+## Alternatives considered
+
+<!-- Have you considered any alternative approaches? Why is this one preferred? -->
+
+## Additional context
+
+<!-- Any relevant background, links to specs, related issues, or prior art. -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,37 @@
+# Summary
+
+<!-- Describe what this PR changes and why. -->
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Refactor
+- [ ] Documentation
+- [ ] Dependency update
+- [ ] Other (describe below)
+
+## Affected crates
+
+- [ ] `core`
+- [ ] `service`
+- [ ] `cli`
+- [ ] CI / tooling
+
+## Checklist
+
+- [ ] `cargo fmt --all` passes
+- [ ] `cargo clippy --workspace --all-targets -- -D warnings` passes
+- [ ] `cargo test --workspace --all-targets` passes
+
+## Breaking changes
+
+<!-- List any breaking changes to public APIs or behaviour, or write "None". -->
+
+## Testing
+
+<!-- Describe how this was tested, or why no new tests were needed. -->
+
+## Related issues
+
+<!-- Closes #, Refs # -->

.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  push:
+    branches: [master, development]
+  pull_request:
+    branches: [master, development]
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.92.0
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo build --workspace --all-targets
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.92.0
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo build --workspace --all-targets
+      - run: cargo test --workspace
+
+  clippy:
+    name: Clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.92.0
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --workspace --all-targets -- -D warnings

.github/workflows/release.yml

@@ -0,0 +1,51 @@
+name: Publish release image
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    name: Publish service image to GHCR
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Check out release tag
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: refs/tags/${{ github.event.release.tag_name }}
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
+      - name: Log in to GHCR
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate image tags and labels
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ghcr.io/${{ github.repository }}
+          flavor: latest=false
+          tags: |
+            type=raw,value=${{ github.event.release.tag_name }}
+            type=raw,value=latest,enable=${{ !github.event.release.prerelease }}
+
+      - name: Build and publish image
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.gitignore

@@ -1,3 +1,5 @@
 /target
 /core/target
 *.dev.*
+/config.toml
+/service/config.toml

CONTRIBUTING.md

@@ -0,0 +1,89 @@
+# Contributing to Simplicity Unchained
+
+Contributions of all kinds are welcome — bug reports, documentation improvements, and tests.
+
+## Project Structure
+
+The workspace is organised into focused crates. Keep changes scoped to the appropriate crate and discuss cross-crate changes in an issue first.
+
+- [`policy`](policy/README.md): Portable `bitcoin-policy-v1` registry and verified context.
+- [`core`](core/README.md): Policy execution adapter and shared Bitcoin/Elements primitives.
+- [`service`](service/README.md): Axum HTTP service exposing separate Bitcoin/Liquid policy APIs and the version endpoint.
+- [`cli`](cli/README.md): Primary `policy` workflow and key generation.
+
+## Issues
+
+If this is just a bug report or a feature request, please open an issue first so it can be discussed. PRs for bug fixes are also welcome and can be discussed directly in the PR. However, for larger changes, it is better to open an issue first to discuss the proposed change before implementing it.
+
+### Pull Requests
+
+1. Fork the repository and create a branch from `development`.
+2. Make your changes, including tests where applicable.
+3. Ensure CI checks pass.
+4. Open a PR against `development` describing what was changed and why.
+5. Keep PRs focused, one logical change per PR. Split large changes into sequential PRs if needed.
+
+## Coding Conventions
+
+- Run `cargo fmt` before every commit.
+- The project targets zero `clippy` warnings with `-D warnings`. Fix all warnings introduced by your changes.
+- Use `thiserror` for library errors. Avoid `unwrap()` outside of tests and examples.
+- Keep the public API surface minimal. Only `pub` what downstream crates genuinely need, and add `///` doc comments to all new public items.
+- Adding a new dependency requires justification. Prefer `[workspace.dependencies]` entries and avoid floating version requirements.
+- Add unit tests under a `#[cfg(test)]` module in the same file.
+
+## Running the Service Locally
+
+First follow the service's [key-provisioning instructions](service/README.md#starting-the-service).
+The repository no longer supplies an active configuration or a usable signing key.
+
+```bash
+cd service
+cargo run --quiet -- start
+```
+
+The service reads `config.toml` from the current directory by default. You can point it at a custom file with `--config`:
+
+```bash
+cargo run --quiet -- start --config path/to/your/config.toml
+```
+
+To exercise the policy CLI against a matching Testnet4 service, follow the
+[demo's artifact requirements](cli/README.md#demo):
+
+```bash
+./cli/scripts/demo_btc.sh --help
+# With reviewed policy artifacts configured:
+./cli/scripts/demo_btc.sh review
+```
+
+## Docker
+
+The multi-stage `Dockerfile` builds the `service` binary. To build and run:
+
+```bash
+docker build -t simplicity-unchained-service .
+docker run --rm -p 30431:30431 \
+  --mount type=bind,src=/absolute/path/to/service-config.toml,dst=/app/config.toml,readonly \
+  simplicity-unchained-service
+```
+
+Provision the host configuration outside the Docker build context with a unique
+signing key; see the service [Docker instructions](service/README.md#docker).
+The container runs as a non-root user (`uid=1000`). Ensure the private mounted
+configuration is readable by that user. An unconfigured container exits unsuccessfully.
+
+## Reporting Bugs
+
+Open a GitHub issue including:
+
+1. What happened vs. what you expected.
+2. A minimal command sequence or code snippet to reproduce the issue.
+3. Your OS, Rust version (`rustc --version`), and commit hash.
+4. Relevant error output with sensitive data redacted.
+
+For security-sensitive issues, please follow responsible disclosure and contact the maintainers privately before opening a public issue.
+
+## Licence
+
+By contributing to this project you agree that your contributions are released under the [CC0 1.0 Universal](LICENCE) licence, the same licence that covers the project.