diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index bfb6dc02..ea2c3397 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -2,6 +2,8 @@
 
 ExecSurface prioritizes precision, reproducibility, explicit limitations, and evidence-preserving engineering.
 
+**Current supported public release:** `v1.0.0` within the documented Linux x86_64/native-`ptrace` contract. Older Alpha.5 contribution tasks and examples remain useful historical evidence, but they must not be presented as the current stable consumer path without a new exact-v1 run, public artifact verification and fresh CI.
+
 ## New to ExecSurface?
 
 Start with repository Issues labeled `good first issue` and `help wanted`.
@@ -16,7 +18,7 @@ Current newcomer-scoped entry points include:
 
 These tasks are intentionally bounded so contributors can improve usability and integrations without silently changing runtime semantics, evidence authority, support claims or release guarantees.
 
-Independent Alpha.5 evaluation and adversarial findings belong in [Issue #118](https://github.com/AETHERXGLOBAL/execsurface/issues/118). A contribution or self-test is valuable engineering work, but it is not automatically independent external validation.
+Independent Alpha.5 findings remain preserved in [Issue #118](https://github.com/AETHERXGLOBAL/execsurface/issues/118). Current real-workload post-v1 evidence is tracked in [Issue #140](https://github.com/AETHERXGLOBAL/execsurface/issues/140). A contribution or self-test is valuable engineering work, but is not automatically independent external validation or product adoption.
 
 ## Before opening a change
 
diff --git a/SECURITY.md b/SECURITY.md
index 50369a46..72679c16 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -6,9 +6,9 @@ ExecSurface is a security-adjacent developer tool.
 
 ExecSurface is not a sandbox, EDR, antivirus or malware detector.
 
-A future PASS verdict will mean only that under the recorded observer, normalization profile, baseline and policy, no disallowed execution-surface expansion was identified.
+In the current **Stable v1.0.0** Linux x86_64 / native-`ptrace` contract, an ExecSurface `PASS` means only that under the selected observer, normalization profile, baseline and policy, no policy-relevant observed execution-surface drift was identified. It does **not** prove that the wrapped target command exited successfully: target exit status/signal are recorded separately and are not verdict-bearing in v1.0.0.
 
-It will not prove that a program is safe or that unobserved behavior is impossible.
+It does not prove program safety, sandboxing, malware freedom, fair benchmarking, determinism or completeness of all unobserved behavior. Keep the wrapped command's own success/failure gate when its correctness matters.
 
 ## Sensitive data
 
@@ -16,4 +16,4 @@ Evidence and traces can be sensitive. Default product semantics prohibit collect
 
 ## Vulnerability reports
 
-Use GitHub private vulnerability reporting when available. Avoid publishing exploitable details in a public issue before maintainers can assess them.
+Use GitHub private vulnerability reporting when available. Avoid publishing exploitable details in a public issue before maintainers can assess them. For experimental external-trial tooling, the reported CI-output privacy boundary and its reviewed remediation are retained at [Issue #164](https://github.com/AETHERXGLOBAL/execsurface/issues/164); old pinned trial packet revisions do not receive fixes retroactively.