Establish AAISA research foundation

CONTRIBUTING.md

@@ -0,0 +1,47 @@
+# Contributing
+
+AAISA welcomes public research contributions through issues and pull requests. Contributions must preserve the project's defensive, local-first, evidence-first boundaries.
+
+## Development setup
+
+```bash
+python3 -m venv .venv
+source .venv/bin/activate
+python -m pip install -e .
+python -m unittest discover -s tests -v
+```
+
+No external dependency is required for the foundation. Discuss new runtime dependencies before adding them.
+
+## Contribution workflow
+
+1. Open or select an issue that describes the research question or defect.
+2. Create a focused branch from `main`.
+3. Add implementation, positive tests, negative tests, and documentation.
+4. Run the full unit-test suite and a scan of `examples/`.
+5. Open a pull request using the repository template.
+6. Address review comments and keep commits focused and attributable.
+
+## Rule proposal requirements
+
+Every new rule must document:
+
+- threat or policy condition;
+- supported artifact classes;
+- deterministic detection logic;
+- evidence and redaction behavior;
+- severity rationale;
+- remediation guidance;
+- known false positives and evasion limits;
+- positive, negative, and ambiguous tests;
+- expected performance on large artifacts.
+
+Rules must not execute scanned content, access the network, modify source files, or place full credential values in reports.
+
+## Commit guidance
+
+Use a concise imperative subject, such as `Add SPDX provenance rule`. Keep unrelated changes separate. Reference the relevant issue in the pull request.
+
+## Review standard
+
+Maintainers evaluate correctness, tests, safety invariants, research reproducibility, report compatibility, performance, and documentation. Security-sensitive changes may require a private review before public discussion.