Rust experiments + professional research repository hardening

.github/CODEOWNERS

@@ -0,0 +1,11 @@
+* @qoosmo
+
+/.github/ @qoosmo
+/LICENSE-MIT @qoosmo
+/LICENSE-APACHE @qoosmo
+/NOTICE @qoosmo
+/CITATION.cff @qoosmo
+/research-note/ @qoosmo
+/docs/PROVENANCE.md @qoosmo
+/docs/original-presentation.pdf @qoosmo
+/legacy/ @qoosmo

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,47 @@
+name: Correctness or implementation bug
+description: Report a reproducible defect in Java, Rust, verification, or experiment tooling
+title: "[bug] "
+labels: []
+body:
+  - type: markdown
+    attributes:
+      value: "Please provide a minimal reproducible case."
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - Java reference
+        - Rust reference
+        - Experiment harness
+        - Historical-math verifier
+        - Paper/research note
+        - CI/reproducibility
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed behavior
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What should have happened, and what evidence supports that expectation?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Minimal reproduction
+      description: Commands, parameters, seed, input, test vector, or mathematical counterexample.
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, Java/JDK, Rust toolchain, commit SHA, and relevant versions.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security policy
+    url: https://github.com/qoosmo/cryptanalytic-time-memory-tradeoffs/security/policy
+    about: Read the responsible-disclosure guidance before reporting sensitive issues.
+  - name: Algorizk Labs
+    url: https://algorizk.xyz
+    about: Research and engineering work by Algorizk Labs.

.github/ISSUE_TEMPLATE/research_claim.yml

@@ -0,0 +1,40 @@
+name: Research claim or experiment proposal
+description: Propose a mathematical claim, falsification, experiment, or reproducibility improvement
+title: "[research] "
+labels: []
+body:
+  - type: dropdown
+    id: kind
+    attributes:
+      label: Type
+      options:
+        - Mathematical claim
+        - Counterexample / falsification
+        - Experiment proposal
+        - Reproducibility improvement
+        - Java/Rust equivalence
+        - Finite-field / AES representation
+        - TMTO / functional-graph analysis
+    validations:
+      required: true
+  - type: textarea
+    id: question
+    attributes:
+      label: Precise research question
+      description: State the claim or question in falsifiable form.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Current evidence
+      description: Paper reference, derivation, committed output, code path, or counterexample.
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criterion
+      description: What result would establish, refute, or materially advance this question?
+    validations:
+      required: true

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "maven"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "cargo"
+    directory: "/rust"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

.github/pull_request_template.md

@@ -0,0 +1,27 @@
+## Summary
+
+Describe the research, implementation, documentation, or infrastructure change.
+
+## Evidence
+
+- [ ] Java verification passes (`mvn -B -ntp verify`) or is not affected.
+- [ ] Rust format/tests/Clippy pass or are not affected.
+- [ ] Historical finite-field verifier passes or is not affected.
+- [ ] `git diff --check` passes.
+- [ ] New numerical claims point to committed output and environment metadata.
+- [ ] New mathematical claims are identified as proved, computationally checked, conjectural, or future work.
+
+## Historical integrity
+
+- [ ] `docs/original-presentation.pdf` is unchanged.
+- [ ] Preserved files under `legacy/` are unchanged unless this PR is explicitly archival.
+
+## Cross-language semantics
+
+- [ ] Shared Java/Rust fixtures were updated if common semantics changed.
+- [ ] No Java-vs-Rust speedup claim is made unless both implementations consume the same experiment plan.
+
+## Licensing / provenance
+
+- [ ] New files are compatible with the licensing boundary in `NOTICE`.
+- [ ] Third-party material and historical authorship are attributed.

.github/workflows/ci.yml

@@ -12,31 +12,46 @@ permissions:
 jobs:
   test:
     runs-on: ubuntu-latest
-    timeout-minutes: 12
+    timeout-minutes: 15
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Java 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
         with:
           distribution: temurin
           java-version: '17'
           cache: maven
 
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Verify historical presentation integrity
+        run: |
+          echo "4003194fdfe82e84bcc32876c8d9ba5042d12dc5f14da726a4bd6e3edc2e6bec  docs/original-presentation.pdf" | sha256sum --check --strict
 
       - name: Verify historical finite-field mathematics
         run: python3 scripts/verify-historical-math.py
 
-      - name: Java tests
-        run: mvn -B -ntp test
+      - name: Java verify
+        run: mvn -B -ntp verify
+
+      - name: Rust format
+        run: cargo fmt --manifest-path rust/Cargo.toml --all -- --check
+
+      - name: Rust Clippy
+        run: cargo clippy --locked --manifest-path rust/Cargo.toml --all-targets -- -D warnings
 
       - name: Rust tests
         run: cargo test --locked --manifest-path rust/Cargo.toml
 
+      - name: Rust release build
+        run: cargo build --release --locked --manifest-path rust/Cargo.toml --bin tmto
+
       - name: Rust smoke test
         run: cargo run --quiet --locked --manifest-path rust/Cargo.toml --bin tmto -- smoke
 

CITATION.cff

@@ -0,0 +1,32 @@
+cff-version: 1.2.0
+message: >-
+  If you use this repository, please cite the software artifact and the exact
+  commit you used. The future ePrint author list will be finalized separately
+  with the original research collaborators.
+title: "Representation and Time-Memory Tradeoffs in Symmetric Cryptography"
+type: software
+authors:
+  - family-names: "Sakho"
+    given-names: "Abdourahmane"
+  - family-names: "Mkhida"
+    given-names: "Ali"
+    orcid: "https://orcid.org/0009-0009-2101-9070"
+  - family-names: "El Yadari"
+    given-names: "Maad"
+repository-code: "https://github.com/qoosmo/cryptanalytic-time-memory-tradeoffs"
+url: "https://algorizk.xyz"
+abstract: >-
+  Research artifact on finite-field representation engineering for AES-like
+  arithmetic and reproducible cryptanalytic time-memory tradeoffs, with Java
+  and Rust reference implementations, exact coverage measurements, historical
+  reconstruction, and an evolving ePrint manuscript.
+keywords:
+  - cryptography
+  - cryptanalysis
+  - time-memory tradeoff
+  - Hellman
+  - distinguished points
+  - finite fields
+  - AES
+  - Rust
+  - Java

CODE_OF_CONDUCT.md

@@ -0,0 +1,31 @@
+# Code of Conduct
+
+## Our standard
+
+This is a research repository. Discussion should be technically rigorous,
+professional, and respectful. Contributors are expected to:
+
+- critique claims, proofs, experiments, and code rather than people;
+- distinguish evidence from speculation;
+- disclose uncertainty, failed experiments, and limitations relevant to a claim;
+- respect authorship, provenance, licensing, and responsible-disclosure boundaries;
+- avoid harassment, discriminatory language, personal attacks, doxxing, or intimidation.
+
+## Research disagreements
+
+Strong disagreement is welcome when it improves the work. When challenging a
+result, provide a reproducible counterexample, mathematical argument, failing
+test, benchmark configuration, or precise source reference whenever possible.
+
+## Historical material
+
+Do not erase, rewrite, or misattribute the preserved historical project. Modern
+corrections should be documented as corrections or new analysis rather than
+silently substituted into the historical record.
+
+## Enforcement
+
+Maintainers may edit, hide, reject, or remove contributions that violate these
+standards and may restrict participation for repeated or severe violations.
+Concerns about repository conduct can be raised privately with the repository
+owner through the GitHub account `@qoosmo`.

CONTRIBUTING.md

@@ -1,36 +1,63 @@
 # Contributing
 
-Contributions are welcome when they preserve the repository's evidence discipline.
+Contributions are welcome when they preserve the repository's evidence discipline, historical provenance, and reproducibility guarantees.
 
-## Before changing an algorithm
+## Workflow
 
-- add or update tests;
-- preserve the explicit reduced-state semantics;
-- do not mix historical results with newly measured results;
-- keep Java/Rust equivalence fixtures synchronized when shared semantics change.
+1. Create a focused branch.
+2. Keep historical artifacts untouched unless the change is explicitly archival.
+3. Add tests/evidence before changing an algorithmic or mathematical claim.
+4. Run the relevant quality gates.
+5. Open a pull request using the repository template.
+6. Do not merge a performance claim until output and environment metadata are committed.
 
-## Before adding a paper claim
+## Full check
 
-Classify it as historical, verified, measured, conjectural, or future work. A numerical result must point to a committed experiment or verification path.
+```bash
+./scripts/check-all.sh
+```
 
 ## Java
 
 ```bash
-mvn test
+mvn -B -ntp verify
 ```
 
+Changes to state encoding, DES parity, reduction, table construction, or lookup require regression tests.
+
 ## Rust
 
 ```bash
-cargo test --manifest-path rust/Cargo.toml
+cargo fmt --manifest-path rust/Cargo.toml --all -- --check
+cargo clippy --locked --manifest-path rust/Cargo.toml --all-targets -- -D warnings
+cargo test --locked --manifest-path rust/Cargo.toml
+cargo build --release --locked --manifest-path rust/Cargo.toml --bin tmto
 ```
 
-## Historical finite-field verification
+If shared Java/Rust semantics change, update `test-vectors/` and require both suites to pass.
 
-```bash
-python3 scripts/verify-historical-math.py
-```
+## Paper claims
+
+Classify every new claim as historical reconstruction, mathematically proved,
+computationally verified, measured, conjectural, or future work.
+
+Numerical claims must point to committed parameters, output, and environment
+metadata. Direct Java/Rust performance comparisons require identical experiment
+inputs.
 
 ## Historical assets
 
-Do not modify `docs/original-presentation.pdf` or the preserved Eclipse prototype as part of modernization work.
+Normal modernization work must not modify:
+
+- `docs/original-presentation.pdf`;
+- `legacy/original-eclipse-prototype/`.
+
+The presentation hash is enforced in CI.
+
+## Licensing
+
+Modern contributions intended for the dual-licensed software portion are
+submitted under **MIT OR Apache-2.0**, subject to the boundary in `NOTICE`.
+
+Do not copy third-party or historical material into the dual-licensed tree
+unless rights and attribution are clear.