diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..5f23a1d
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,64 @@
+name: Bug Report
+description: Report a bug in amesh
+labels: ["bug"]
+body:
+  - type: input
+    id: version
+    attributes:
+      label: amesh version
+      description: "Run `amesh --version` or check your package.json"
+      placeholder: "0.5.0"
+    validations:
+      required: true
+  - type: dropdown
+    id: package
+    attributes:
+      label: Affected package
+      options:
+        - "@authmesh/cli"
+        - "@authmesh/agent"
+        - "@authmesh/sdk"
+        - "@authmesh/core"
+        - "@authmesh/keystore"
+        - "@authmesh/relay"
+        - "Other"
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: OS and architecture
+      placeholder: "macOS 15.4 arm64 / Ubuntu 24.04 x64"
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: "A clear description of the bug"
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Steps to reproduce
+      description: "Minimal steps to reproduce the behavior"
+      value: |
+        1.
+        2.
+        3.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: "What you expected to happen"
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs or error output
+      description: "Paste any error messages or logs (redact sensitive data)"
+      render: shell
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..88a858d
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions & Discussion
+    url: https://github.com/ameshdev/amesh/discussions
+    about: Ask questions and discuss ideas in GitHub Discussions
+  - name: Security Vulnerability
+    url: https://github.com/ameshdev/amesh/security/advisories/new
+    about: Report security vulnerabilities privately (do not open a public issue)
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 0000000..72280d0
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,36 @@
+name: Feature Request
+description: Suggest a new feature or improvement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: "What problem does this solve? What's the use case?"
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: "How do you think this should work?"
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: "What other approaches did you consider?"
+  - type: dropdown
+    id: package
+    attributes:
+      label: Related package
+      options:
+        - "@authmesh/cli"
+        - "@authmesh/agent"
+        - "@authmesh/sdk"
+        - "@authmesh/core"
+        - "@authmesh/keystore"
+        - "@authmesh/relay"
+        - "Documentation"
+        - "Other"
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..24e83fc
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,19 @@
+## What
+
+<!-- Brief description of the change -->
+
+## Why
+
+<!-- What problem does this solve? Link to an issue if applicable -->
+
+## How to test
+
+<!-- Steps to verify this works correctly -->
+
+## Checklist
+
+- [ ] `bun run build` passes
+- [ ] `bun run test` passes
+- [ ] `bun run lint` passes
+- [ ] Documentation updated (if user-facing change)
+- [ ] Crypto changes reference `docs/protocol-spec.md`
diff --git a/.github/social-preview.png b/.github/social-preview.png
new file mode 100644
index 0000000..e3d4458
Binary files /dev/null and b/.github/social-preview.png differ
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..144cf74
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,31 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a friendly, safe, and welcoming experience for everyone.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Being respectful and constructive in discussions
+- Giving and accepting feedback gracefully
+- Focusing on what is best for the community
+- Showing empathy towards others
+
+Examples of unacceptable behavior:
+
+- Trolling, insults, or personal attacks
+- Publishing others' private information without permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement
+
+Instances of unacceptable behavior may be reported via [GitHub Private Vulnerability Reporting](https://github.com/ameshdev/amesh/security/advisories/new) or by opening a [Discussion](https://github.com/ameshdev/amesh/discussions).
+
+All complaints will be reviewed and investigated promptly and fairly. Maintainers are obligated to maintain confidentiality with regard to the reporter.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..f4687ad
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,96 @@
+# Contributing to amesh
+
+Thanks for your interest in contributing to amesh! This guide will help you get started.
+
+## Getting Started
+
+### Prerequisites
+
+- [Bun](https://bun.sh) 1.3+
+- Git
+
+### Setup
+
+```bash
+git clone https://github.com/ameshdev/amesh.git
+cd amesh
+bun install
+bun run build
+bun run test
+```
+
+### Project Structure
+
+```
+packages/
+  core/       — crypto primitives (sign, verify, HMAC, HKDF, ECDH)
+  keystore/   — key storage drivers (Secure Enclave, TPM, encrypted file)
+  cli/        — amesh CLI (oclif)
+  agent/      — amesh-agent daemon + remote shell
+  sdk/        — signing fetch client + verification middleware
+  relay/      — WebSocket relay for device pairing
+```
+
+## Development Workflow
+
+1. **Fork** the repository and create a branch from `main`
+2. **Make your changes** — keep commits focused and atomic
+3. **Run checks** before pushing:
+
+```bash
+bun run build    # TypeScript compilation
+bun run test     # All tests
+bun run lint     # ESLint + Prettier
+```
+
+4. **Open a pull request** against `main`
+
+## Pull Request Guidelines
+
+- Keep PRs focused — one concern per PR
+- Include tests for new functionality
+- Update documentation if you change user-facing behavior
+- All CI checks must pass
+
+## What to Contribute
+
+- **Bug fixes** — always welcome
+- **Tests** — especially adversarial/edge case tests
+- **Documentation** — typo fixes, clarifications, new examples
+- **New keystore drivers** — Windows DPAPI, Android Keystore, etc.
+- **SDK ports** — Python, Go, Rust verification middleware
+
+If you're considering a large change, [open a discussion](https://github.com/ameshdev/amesh/discussions) first so we can align on the approach.
+
+## Code Style
+
+- TypeScript with strict mode
+- ESLint + Prettier (config at repo root)
+- `bun run lint` must pass with no warnings
+- Prefer explicit types at module boundaries, inferred types internally
+
+## Cryptography Changes
+
+Changes to cryptographic code require extra scrutiny:
+
+- Reference the relevant section of `docs/protocol-spec.md`
+- Explain **why** the change is correct in the PR description
+- Pin exact versions for `@noble/*` dependencies — never use `^`
+- Include test vectors where applicable
+
+## Reporting Bugs
+
+Use [GitHub Issues](https://github.com/ameshdev/amesh/issues/new?template=bug_report.yml). Include:
+
+- amesh version (`amesh --version`)
+- OS and architecture
+- Steps to reproduce
+- Expected vs actual behavior
+
+## Security Issues
+
+See [SECURITY.md](SECURITY.md) — do **not** open public issues for vulnerabilities.
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the [MIT License](LICENSE).
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..47ee133
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,54 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 0.5.x   | Yes       |
+| < 0.5   | No        |
+
+## Reporting a Vulnerability
+
+**Please do not open a public GitHub issue for security vulnerabilities.**
+
+Instead, use [GitHub Private Vulnerability Reporting](https://github.com/ameshdev/amesh/security/advisories/new) to submit your report. This ensures the issue stays confidential until a fix is available.
+
+### What to include
+
+- Description of the vulnerability
+- Steps to reproduce
+- Affected package(s) and version(s)
+- Impact assessment (what an attacker could achieve)
+
+### What to expect
+
+- **Acknowledgment** within 48 hours
+- **Status update** within 7 days
+- **Fix timeline** depends on severity — critical issues are patched within 72 hours
+
+### Scope
+
+The following are in scope:
+
+- All `@authmesh/*` npm packages
+- The relay server (`relay.authmesh.dev`)
+- The CLI and agent binaries
+- The protocol specification (`docs/protocol-spec.md`)
+
+### Out of scope
+
+- The documentation website (`authmesh.dev`) — unless it exposes sensitive data
+- Social engineering attacks
+- Denial of service against the public relay
+
+## Security Design
+
+amesh underwent a full security audit in April 2026. The findings and fixes are documented in [`docs/security-audit-2026-04.md`](docs/security-audit-2026-04.md).
+
+Key security properties:
+
+- Private keys never leave the device (hardware keystore or encrypted file)
+- All signatures use P-256 ECDSA with raw r||s encoding
+- Replay protection via nonce + timestamp window
+- HMAC-sealed allow lists with atomic writes
+- Shell sessions use transcript-bound authentication and ChaCha20-Poly1305