Add project governance and policy docs

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,29 @@
+## Summary
+
+<!-- What does this change? -->
+
+## Why
+
+<!-- Why is the change needed? -->
+
+## Behavior
+
+<!-- Describe observable behavior, compatibility, and migration impact. -->
+
+## Validation
+
+<!-- List commands and relevant manual checks. -->
+
+- [ ] `cargo fmt --check`
+- [ ] `cargo test --locked`
+- [ ] `cargo clippy --locked --all-targets -- -D warnings`
+- [ ] `cargo build --locked`
+
+## Checklist
+
+- [ ] The change is focused and targets `wavefnd/Vex:master`.
+- [ ] User-facing behavior and recovery instructions are documented.
+- [ ] Dependency changes preserve lockfile reproducibility.
+- [ ] `--locked` and `--offline` behavior remains correct.
+- [ ] No raw `wavec` flags were added to the Vex CLI.
+- [ ] New commits include a DCO `Signed-off-by:` line.

.gitignore

@@ -44,6 +44,7 @@ desktop.ini
 *.old
 *.orig
 *.rej
+/.tmp/
 /tmp/
 /temp/
 

.mailmap

@@ -0,0 +1,2 @@
+LunaStev <luna@lunastev.org> <youngjae681@gmail.com>
+LunaStev <luna@lunastev.org> <96914208+LunaStev@users.noreply.github.com>

CODE_OF_CONDUCT.md

@@ -0,0 +1,84 @@
+# Contributor Covenant Code of Conduct
+
+## Our pledge
+
+We as members, contributors, and leaders pledge to make participation in the
+Vex community harassment-free for everyone, regardless of age, body size,
+visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic
+status, nationality, personal appearance, race, caste, color, religion, or
+sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our standards
+
+Positive behavior includes:
+
+- demonstrating empathy and kindness
+- respecting different opinions, viewpoints, and experiences
+- giving and accepting constructive feedback
+- accepting responsibility, apologizing, and learning from mistakes
+- focusing on what is best for the community as a whole
+
+Unacceptable behavior includes:
+
+- sexualized language or imagery and sexual attention or advances
+- trolling, insulting or derogatory comments, and personal or political attacks
+- public or private harassment
+- publishing another person's private information without explicit permission
+- other behavior reasonably considered inappropriate in a professional setting
+
+## Enforcement responsibilities
+
+Community leaders are responsible for clarifying and enforcing these standards.
+They will take appropriate and fair corrective action in response to behavior
+they consider inappropriate, threatening, offensive, or harmful.
+
+Community leaders may remove, edit, or reject comments, commits, code, issues,
+and other contributions that do not align with this Code of Conduct. When
+appropriate, they will communicate the reason for moderation decisions.
+
+## Scope
+
+This Code of Conduct applies in all Vex community spaces and when an individual
+officially represents the project in public, including through official email,
+social accounts, or online and offline events.
+
+## Reporting and enforcement
+
+Report abusive, harassing, or otherwise unacceptable behavior privately to
+`luna@lunastev.org` with the subject `[Vex Conduct]`. Reports will be reviewed
+promptly and fairly. Community leaders must protect the privacy and security of
+reporters.
+
+Community leaders will use the following impact guidelines:
+
+### 1. Correction
+
+For isolated inappropriate or unprofessional behavior, a private written
+warning may explain the impact and request a correction or apology.
+
+### 2. Warning
+
+For a violation through a single incident or series of actions, a warning may
+set consequences and a period during which interaction with affected people or
+enforcers is prohibited.
+
+### 3. Temporary ban
+
+For a serious or sustained violation, participation and public or private
+interaction in project spaces may be prohibited for a defined period.
+
+### 4. Permanent ban
+
+For a pattern of violations, harassment, aggression, or disparagement of groups,
+an individual may be permanently removed from project spaces.
+
+## Attribution
+
+This Code of Conduct is adapted from the
+[Contributor Covenant, version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+Its Community Impact Guidelines were inspired by Mozilla's code of conduct
+enforcement ladder.

CONTRIBUTING.md

@@ -0,0 +1,133 @@
+# Contributing to Vex
+
+Thank you for helping improve Vex, the package manager and build tool for the
+Wave programming language. Vex accepts focused contributions through GitHub
+pull requests and email patches.
+
+## Project direction
+
+Vex is not a raw command-line wrapper around `wavec`. It owns the Wave project
+manifest, dependency resolution, the lockfile, and compiler orchestration.
+Changes should preserve these rules:
+
+- `vex.ws` is the supported project manifest.
+- `wavec` is an internal compiler dependency, not a source of Vex CLI flags.
+- Git and path dependencies are the current package sources; a central registry
+  and publishing are outside the current scope.
+- The same manifest and lockfile must produce the same dependency graph.
+- `--locked` must prevent lockfile changes.
+- `--offline` must prevent Git network access.
+- Errors and progress should explain what Vex is doing and how users can recover.
+
+Please open an issue before beginning a large change that alters these product
+boundaries or a persistent file format.
+
+## Development setup
+
+You need:
+
+- a stable Rust toolchain with `rustfmt` and `clippy`
+- Git for dependency integration tests
+- a compatible `wavec` in `PATH` for end-to-end build and run tests
+
+Set `VEX_WAVEC=/path/to/wavec` when testing a specific compiler binary.
+
+Clone your fork and run the baseline checks:
+
+```sh
+cargo fmt --check
+cargo test --locked
+cargo clippy --locked --all-targets -- -D warnings
+cargo build --locked
+```
+
+## Making a change
+
+Create a branch from the current `wavefnd/Vex:master`. Use `feat/<topic>` for
+features and `patch/<topic>` for fixes. Keep each branch focused on one logical
+change.
+
+```sh
+git switch -c feat/example
+```
+
+Do not overwrite unrelated working-tree changes. Do not commit build output,
+managed dependencies under `.vex/`, local release notes under `.tmp/`, secrets,
+or editor state.
+
+## Tests
+
+Add tests at the same level as the behavior being changed:
+
+- parser and policy details belong in unit tests
+- dependency graph and Git behavior belong in integration tests
+- compiler invocation changes require dry-run schema and end-to-end smoke tests
+
+Git integration tests must use local fixture repositories and must not require
+external network access. Dependency changes should cover direct and transitive
+graphs, exact locked commits, cycles, source/version/name conflicts, and relevant
+`--locked` and `--offline` behavior.
+
+When changing selective update behavior, prove that unrelated locked commits and
+remote-tracking refs remain unchanged.
+
+## Pull requests
+
+Push your branch to a fork and open a pull request against
+`wavefnd/Vex:master`. A pull request should contain:
+
+- a concise Summary
+- Why the change is needed
+- observable Behavior and compatibility impact
+- Validation commands and results
+- documentation updates for user-facing behavior
+
+Draft pull requests are welcome for early review. Keep commits understandable
+and avoid mixing cleanup with functional changes.
+
+## Email patches
+
+Email patches are accepted when GitHub is not suitable. Send them to
+`luna@lunastev.org` with a subject beginning `[Vex PATCH]`.
+
+```sh
+git commit -s
+git format-patch --cover-letter -1
+git send-email --to luna@lunastev.org *.patch
+```
+
+Use `[Vex PATCH 0/N]` for a multi-patch series. Each patch should build on the
+previous one, explain its purpose in the commit message, and address one logical
+change. Do not send security vulnerabilities through a public mailing list or
+public issue; follow [SECURITY.md](SECURITY.md).
+
+## Developer Certificate of Origin
+
+New contributions must include a `Signed-off-by:` line certifying the
+[Developer Certificate of Origin 1.1](https://developercertificate.org/).
+Create it with:
+
+```sh
+git commit -s
+```
+
+By signing off, you certify that you have the right to submit the contribution
+under the project's license.
+
+## Documentation and compatibility
+
+Public command syntax, lockfile behavior, environment variables, supported
+platforms, and recovery instructions must be documented. A lockfile format
+change needs an explicit compatibility and migration plan; silently reinterpreting
+an existing lockfile is not acceptable.
+
+Use clear English for code, public identifiers, commit messages, and canonical
+project documentation. Translations may be added alongside the canonical text.
+
+## Conduct and licensing
+
+Participation is governed by the [Code of Conduct](CODE_OF_CONDUCT.md).
+Security reports follow [SECURITY.md](SECURITY.md).
+
+Unless a file says otherwise, contributions are licensed under the
+[Mozilla Public License 2.0](LICENSE).

COPYRIGHT

@@ -0,0 +1,13 @@
+Vex Package Manager - Copyright Information
+===========================================
+
+Copyright (c) 2025-2026 Wave Foundation
+Copyright (c) 2025-2026 LunaStev and contributors
+
+Vex was initially authored by LunaStev and is maintained as part of the Wave
+language project. The Git history and repository contributor list provide the
+authoritative record of individual contributions.
+
+Copyright ownership of an individual contribution remains with its copyright
+holder unless separately assigned. Unless a file states otherwise, Vex source
+code and documentation are distributed under the Mozilla Public License 2.0.

LICENSE

@@ -1,6 +1,5 @@
 Mozilla Public License Version 2.0
 ==================================
-LunaStev. Wave Project
 
 1. Definitions
 --------------

MAINTAINERS

@@ -0,0 +1,39 @@
+[CLI and Commands]
+M: LunaStev <luna@lunastev.org>
+F: src/main.rs
+F: src/commands/
+F: src/ui.rs
+
+[Manifest and Lockfile]
+M: LunaStev <luna@lunastev.org>
+F: src/manifest.rs
+F: src/lockfile.rs
+
+[Dependency Resolution and Git]
+M: LunaStev <luna@lunastev.org>
+F: src/resolver.rs
+F: tests/git_*.rs
+
+[wavec Integration]
+M: LunaStev <luna@lunastev.org>
+F: src/wavec.rs
+F: src/validate.rs
+F: src/commands/build.rs
+F: src/commands/check.rs
+F: src/commands/run.rs
+
+[Release and CI]
+M: LunaStev <luna@lunastev.org>
+F: .github/
+F: Cargo.toml
+F: Cargo.lock
+F: Makefile
+F: x.py
+
+[Documentation and Community]
+M: LunaStev <luna@lunastev.org>
+F: *.md
+F: MAINTAINERS
+F: COPYRIGHT
+F: NOTICE
+F: ai.txt

NOTICE

@@ -0,0 +1,19 @@
+Vex Package Manager
+===================
+
+Vex is the package manager and build tool for the Wave programming language.
+
+Copyright (c) 2025-2026 Wave Foundation
+Copyright (c) 2025-2026 LunaStev and contributors
+
+Unless a file states otherwise, Vex is licensed under the Mozilla Public
+License 2.0. See LICENSE for the complete license text and COPYRIGHT for project
+copyright information.
+
+Vex invokes the separately distributed `wavec` compiler. The Vex source and
+release archives do not grant additional rights to `wavec`, Wave packages, or
+third-party dependencies; those works remain subject to their respective
+licenses.
+
+Source code for this release is available from:
+https://github.com/wavefnd/Vex

README.md

@@ -134,3 +134,13 @@ VEX_WAVEC=/opt/wave/bin/wavec vex build --dry-run
 ## License
 
 [MPL 2.0 LICENSE](LICENSE)
+
+## Community and Project Policies
+
+- [Contributing](CONTRIBUTING.md)
+- [Code of Conduct](CODE_OF_CONDUCT.md)
+- [Maintainers](MAINTAINERS)
+- [Security Policy](SECURITY.md)
+- [Copyright](COPYRIGHT)
+- [Notice](NOTICE)
+- [AI Usage Policy](ai.txt)