docs: add contribution and security guidance

CODE_OF_CONDUCT.md

@@ -0,0 +1,125 @@
+# Contributor Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our Talus
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Designated project maintainers and a moderation team (collectively "the enforcers") are
+responsible for clarifying and enforcing our standards of acceptable behavior. They will take
+appropriate and fair corrective action in response to any behavior that they deem inappropriate,
+threatening, offensive, or harmful within the community spaces defined in this Code of Conduct.
+
+The enforcers have the right and responsibility to remove, edit, or reject comments, commits,
+code, wiki edits, issues, and other contributions on project-managed platforms that are not
+aligned to this Code of Conduct. They will communicate reasons for moderation decisions when
+appropriate. This Code of Conduct governs behavior within our community spaces; it does not
+extend to governing on-chain interactions which are subject to the rules of the protocol itself.
+
+## Scope
+
+This Code of Conduct applies within all project-managed community spaces, including but not
+limited to our GitHub repositories, official Discord server, community forums, Telegram groups,
+and during project-related events. It also applies when an individual is officially representing
+the community in public spaces. Examples of representing our community include using an official
+project email address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the
+enforcers (as defined in "Enforcement Responsibilities") at [hi]. All complaints will be reviewed
+and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the reporter of any
+incident. We strive to apply this Code of Conduct consistently, but acknowledge that the
+permissionless and pseudonymous nature of some blockchain interactions may present challenges to
+enforcement beyond project-controlled platforms. Our focus is on maintaining a healthy
+environment within the community spaces we manage.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining the consequences
+for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or
+unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing clarity around the
+nature of the violation and an explanation of why the behavior was inappropriate. A public apology
+may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No interaction with the
+people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a
+specified period of time. This includes avoiding interactions in community spaces as well as
+external channels like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community standards, including
+sustained inappropriate behavior, harassment of an individual, or aggression toward or
+disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the community on
+project-managed platforms (e.g., GitHub, Discord). We acknowledge that individuals may attempt to
+evade such bans using new pseudonymous identities in a permissionless ecosystem; however, we will
+enforce these consequences to the best of our ability on the platforms we control.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1,
+available at [https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement
+ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations
+[hi]: hi@talus.network

CONTRIBUTING.md

@@ -1,9 +1,33 @@
-# Contributing
+# Contributing to `move-binding`
 
-This workspace is a set of layered Rust crates for typed Sui Move interactions.
-Changes should preserve the layer boundaries described in `MODEL.md`: low-level Move type
-modeling should not depend on transaction building or runtime behavior, and runtime code should
-not hide the Read -> Tx -> Commit boundary.
+Thank you for considering contributing to this project. These guidelines keep the process clear
+and preserve the structure of the workspace.
+
+This workspace is a set of layered Rust crates for typed Sui Move interactions. Changes should
+preserve the layer boundaries described in `MODEL.md`: low-level Move type modeling should not
+depend on transaction building or runtime behavior, and runtime code should not hide the
+Read -> Tx -> Commit boundary.
+
+## CLA
+
+Contributors are required to sign the [CLA]. This process is handled automatically by the
+[CLA Assistant].
+
+## Code of Conduct
+
+This project adheres to a [Code of Conduct]. By participating, you are expected to uphold this
+code.
+
+## How to Contribute
+
+1. Fork the repository and create your branch from `main`.
+2. Follow the coding style used in the project.
+3. Write clear, concise commit messages.
+4. Add tests for new functionality or behavior changes.
+5. Do not introduce `unsafe` Rust unless the safety invariant is documented and reviewed
+   explicitly.
+6. Update documentation to complement user-facing code changes.
+7. Update `CHANGELOG.md` for externally visible changes.
 
 ## Local Checks
 
@@ -18,13 +42,32 @@ cargo test --doc --all
 
 CI runs formatting and clippy strictly, plus stable Rust checks and tests.
 
-## Pull Requests
+## Reporting Issues
 
+- Use the [Issue Tracker] to report bugs or suggest enhancements.
+- Check if the issue already exists before submitting.
+- Provide steps to reproduce, expected vs. actual behavior, and relevant logs or screenshots.
+
+## Pull Request Process
+
+- Open a pull request with a clear description of what it does and why.
+- Link to the issue it fixes, if applicable.
 - Keep changes scoped to one behavioral concern.
+- Ensure your branch is up to date with `main`.
 - Add or update tests for public API behavior, generated output, transaction construction, and
   runtime cursor/effects handling.
 - Update the relevant crate README when changing user-facing APIs.
-- Update `CHANGELOG.md` for externally visible changes.
+- A maintainer will review and may request changes before merge.
+
+## Writing Commit Messages
+
+- Use the [Conventional Commits] specification for commit messages.
+- Use the present tense, for example `feat: add typed call builder` instead of
+  `feat: added typed call builder`.
+- Use imperative tone, for example `fix: reject duplicate object inputs` instead of
+  `fix: rejects duplicate object inputs`.
+- Reference a ticket if applicable.
+- Add context and an explanation for non-trivial contributions.
 
 ## Dependencies
 
@@ -46,3 +89,15 @@ Publish crates in dependency order:
 Before the first crates.io release, `cargo package --workspace` is expected to fail for crates
 whose normal dependencies are not published yet. Package each crate after its normal dependencies
 are available in the registry.
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the same license as the
+project: [LICENSE].
+
+[Issue Tracker]: https://github.com/Talus-Network/move-binding/issues
+[Code of Conduct]: CODE_OF_CONDUCT.md
+[LICENSE]: LICENSE
+[CLA]: https://gist.github.com/devops-talus/82cafc9752547baf4be140b6db1e8fd6
+[CLA Assistant]: https://cla-assistant.io/Talus-Network/move-binding
+[Conventional Commits]: https://www.conventionalcommits.org/