ajbeck · Oct 2, 2026 · Oct 2, 2026
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -0,0 +1,50 @@
+# Contributing
+
+Contributions are licensed under the [Apache License, Version 2.0](LICENSE), as section 5 of the license describes;
+there is no separate contributor agreement.
+Report security issues through the [security policy](SECURITY.md), not a public issue.
+
+## Before you start
+
+Bug fixes, tests and documentation corrections are welcome as pull requests.
+For changes to the exported API, trust boundaries, error policy or compatibility, open an issue first.
+Those decisions are recorded in [docs/decisions](docs/decisions/README.md) and approved before implementation.
+The [support matrix](docs/support.md) separates implemented behavior from deferred scope.
+
+## Development
+
+Use Go 1.27 or later;
+the module keeps its `go 1.27.0` baseline.
+Run these from the repository root before opening a pull request:
+
+```bash
+gofmt -l .
+go vet ./...
+go mod verify
+go test -race ./...
+sh scripts/check-consumer.sh
+GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build ./...
+GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build ./...
+git diff --check
+```
+
+`gofmt -l .` should print nothing.
+Tests use the standard `testing` package, local HTTP test servers and synthetic fixtures.
+Never commit real credentials, and do not call live AWS services from unit tests.
+
+## Style
+
+Follow [Effective Go](https://go.dev/doc/effective_go) and the [Google Go style guide](https://google.github.io/styleguide/go/).
+Do not wrap code or prose at a fixed column.
+In Markdown and comments, put each sentence on its own line, and break after a semicolon between independent clauses.
+
+## Commits and pull requests
+
+Pull requests are squash-merged, so the pull request title becomes the commit message.
+Write it as a [Conventional Commit](https://www.conventionalcommits.org/): `feat:`, `fix:`, `docs:`, `refactor:` and so on.
+Mark a breaking change with `!` in the title, such as `refactor!: rename X`, so Release Please records it.
+Describe the resulting behavior, how you validated it and any limitations.
+
+Release Please owns CHANGELOG.md, versions and tags;
+do not edit them by hand.
+[AGENTS.md](AGENTS.md) records the full working agreement used in this repository.
diff --git a/README.md b/README.md
@@ -71,7 +71,7 @@ do not select again from mutable headers.
 An action header does not authenticate a caller.
 The selector works with both ordinary Go HTTP servers and the Lambda adapter.
 
-See the [runnable middleware example](action_example_test.go) and [accepted header contract](docs/decisions/0011-request-header-processing.md).
+See the [runnable middleware example](actionheader/example_test.go) and [accepted header contract](docs/decisions/0011-request-header-processing.md).
 
 ## Response header budget
 
@@ -129,6 +129,8 @@ post-handoff streaming panics become terminal errors.
 - [Repository working agreement](AGENTS.md)
 - [Release workflow and GitHub App setup](docs/releases.md)
 - [Initial codec benchmarks](docs/benchmarks.md)
+- [Contributing](CONTRIBUTING.md)
+- [Security policy](SECURITY.md)
 
 ## License
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,38 @@
+# Security policy
+
+This module sits on the authentication and authorization path of the applications that use it, so please report suspected vulnerabilities privately.
+
+## Supported versions
+
+Before v1, only the latest minor release receives security fixes.
+Fixes ship as a new release;
+earlier minor versions are not patched.
+
+## Reporting a vulnerability
+
+Use GitHub's [private vulnerability reporting](https://github.com/asteroid-computing/go-lambda-edge/security/advisories/new) (Security tab, then "Report a vulnerability").
+Do not open a public issue, pull request or discussion for a suspected vulnerability.
+
+Include the affected package and version, the impact you expect, and steps to reproduce.
+Use synthetic credentials only.
+Never send real access tokens, private keys, AWS credentials or signed IAM proofs, even in a private report.
+
+## Scope
+
+In scope:
+
+- Authentication or authorization bypass in `authn`, `iamproof` or `authz`.
+- Caller confusion or replacement in `identity` or gateway identity handling.
+- Credentials, claims or request values leaking through errors or diagnostics.
+- Ways around documented resource limits.
+- Action-selection ambiguity in `actionheader` that lets one request act as another.
+
+Out of scope:
+
+- Deployment configuration documented as the consumer's responsibility, such as API Gateway authorizers, CORS or TLS termination.
+- Behavior the [support matrix](docs/support.md) already lists as unverified or deferred.
+- Vulnerabilities in dependencies; report those upstream, and tell us if this module's use makes them exploitable.
+
+## Process
+
+The maintainer coordinates the fix and disclosure through a GitHub security advisory and credits reporters who want credit.
diff --git a/docs/decisions/0024-release-automation.md b/docs/decisions/0024-release-automation.md
@@ -154,3 +154,7 @@ The working branch was pushed and PR #1 opened.
 [All four PR checks at f6a2624 passed](https://github.com/asteroid-computing/go-lambda-edge/actions/runs/35619720590).
 App installation/permissions and the main-branch release path still need execution evidence after merge.
 No release has been published.
+
+Release execution, verified on 2026-10-02: Release Please minted its App token, opened and maintained [the release PR](https://github.com/asteroid-computing/go-lambda-edge/pull/3), and its Go checks passed.
+After the owner merged it, the release run succeeded and published [v0.1.0](https://github.com/asteroid-computing/go-lambda-edge/releases/tag/v0.1.0), tagged at the release commit 9423302 with the manifest at 0.1.0.
+The accepted workflow is now proven end to end.
diff --git a/docs/decisions/0025-main-branch-protection.md b/docs/decisions/0025-main-branch-protection.md
@@ -8,6 +8,10 @@ Owner direction on 2026-09-27: update readiness documentation, then the owner wi
 Branch protection was not approved as part of that instruction;
 this proposal remains unimplemented.
 
+Owner direction on 2026-10-02: the owner will configure branch protection manually in repository settings.
+No agent changes repository policy;
+this record documents the recommended rule set for that configuration.
+
 ## Evidence
 
 PR #1 at f6a2624469d14a150d89e0f5911644db86449e31 is mergeable, with all four [Go checks passing](https://github.com/asteroid-computing/go-lambda-edge/actions/runs/35619720590).

diff --git a/docs/decisions/README.md b/docs/decisions/README.md
@@ -31,6 +31,6 @@ Keep related decisions small enough to review and implement independently.
 | [0021: Authorization rules](0021-authorization-rules.md) | Accepted; rules, examples and local validation implemented | What rule API, IAM/JWT predicates, failure semantics and consumer resolution/dispatch boundaries should authz expose? |
 | [0022: Streaming writer review](0022-streaming-writer-review.md) | Accepted; writer, public entry points and local validation complete; SDK deployment gate retained | Should streaming omit inferred lengths, how should empty Content-Encoding affect sniffing, and what SDK evidence remains missing? |
 | [0023: Consumer readiness](0023-consumer-readiness.md) | R1–R6 accepted (Apache-2.0 license); local implementation complete; AWS deployment qualifications open | What complete consumer example, test support, deferred scope and release preparation should follow the implemented packages? |
-| [0024: Release automation](0024-release-automation.md) | Accepted; PR-only validation and organization credentials; App installation verified, release execution pending | How should release PRs, validation, credentials and initial versioning work? |
-| [0025: Main-branch protection](0025-main-branch-protection.md) | Proposed; awaiting owner review | Should the existing four CI checks and PR workflow be enforced before merging to main? |
+| [0024: Release automation](0024-release-automation.md) | Accepted; PR-only validation and organization credentials; v0.1.0 released on 2026-10-02 | How should release PRs, validation, credentials and initial versioning work? |
+| [0025: Main-branch protection](0025-main-branch-protection.md) | Proposed; owner configuring manually | Should the existing four CI checks and PR workflow be enforced before merging to main? |
 | [0026: Exported API review](0026-exported-api-review.md) | E1–E6 accepted and implemented in stacked PRs; E7 rejected | Which exported API changes does Google's Go style guidance support before the first release? |
diff --git a/docs/plan.md b/docs/plan.md
@@ -335,7 +335,8 @@ The owner resolved R6 on 2026-10-02: Apache-2.0, with Andrew Beck as copyright h
 - [x] Obtain actual GitHub CI evidence for the foundation PR;
   all four jobs passed at f6a2624.
   Later commits require their own passing checks.
-- [ ] Verify the main release workflow and resolve publication prerequisites before a release.
+- [x] Verify the main release workflow and resolve publication prerequisites before a release.
+  v0.1.0 was released on 2026-10-02.
   Streaming deployment and live identity interoperability remain separate qualifications.
 
 The [complete dispatcher](../examples/dispatcher/README.md), [testing guide](consumer-testing.md), [support matrix](support.md) and [release checklist](release-readiness.md) are implemented.

diff --git a/docs/release-readiness.md b/docs/release-readiness.md
@@ -29,7 +29,8 @@ Secret metadata and repository access were verified on 2026-09-27;
 the obsolete repository variable and private-key secret were removed.
 The new key and Client ID were verified against the astrocompute-release-please App and its repository installation using read-only API calls without printing credentials.
 Its installation grants all three required write permissions.
-No branch protection was configured.
+No branch protection was configured;
+the owner will configure it manually ([decision 0025](decisions/0025-main-branch-protection.md)).
 
 ## Outstanding evidence and owner choices
 
@@ -39,7 +40,10 @@ Release Please has since executed successfully: the App opened [the v0.1.0 relea
 
 The owner chose the Apache License, Version 2.0 on 2026-10-02, with Andrew Beck as copyright holder ([decision 0023 R6](decisions/0023-consumer-readiness.md#r6-obtain-the-owners-distributionlicense-choice-before-publication)).
 LICENSE is the unmodified canonical text.
-No repository visibility change, release tag or release publication has been performed.
+
+The owner merged the release PR on 2026-10-02, and the release run published [v0.1.0](https://github.com/asteroid-computing/go-lambda-edge/releases/tag/v0.1.0) at commit 9423302.
+Repository visibility is unchanged;
+make the repository public, enable private vulnerability reporting for the [security policy](../SECURITY.md), and then request the version from the Go module proxy so pkg.go.dev indexes it.
 
 REST streaming's SDK deployment qualification remains open: local probes cannot establish AWS acceptance of the observed mode-header/connection behavior.
 Authoritative clarification or a separately approved live test is still needed.