diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
new file mode 100644
index 0000000..2297280
--- /dev/null
+++ b/.github/workflows/verify.yml
@@ -0,0 +1,22 @@
+name: Verify
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  test:
+    # Fork code may run on GitHub-hosted runners, never the trusted Gitea runner.
+    if: github.server_url == 'https://github.com' || github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.13'
+      - run: python -m unittest discover -s tests -v
+      - run: git diff --check
diff --git a/.gitignore b/.gitignore
index 86e3844..8f26c5b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,5 @@ dist/
 /storage-release.json
 /ops/deploy-storage.py
 /ops/release-storage.py
+.pytest_cache/
+.ruff_cache/
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..6cba4d0
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,9 @@
+# 贡献指南 / Contributing
+
+安装和运行步骤见项目首页；使用 Python 3.13 或 3.14，修改保持小而集中。运行 `python3 -m unittest discover -s tests -v`，Shell 脚本使用 `bash -n`，提交前运行 `git diff --check`。
+
+测试只能使用临时目录、模拟服务和设备桩；不得访问真实设备、执行生产写入或提交密钥、令牌、数据库、照片及部署回执。真实设备验证由维护者另行执行。
+
+请通过仓库 Pull Request 提交，说明问题、行为变化和验证结果。行为修复应覆盖对应回归风险。新增代码按本项目 MIT 许可证提供，保留第三方许可及来源。
+
+See README.md for installation. Keep changes focused, test with mocks, and submit a pull request describing the behavior and checks. Never include credentials or production data. Contributions use the MIT license; preserve third-party notices.
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..ed72403
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PIGWay
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index e7bef35..4c0aafb 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,4 +1,4 @@
-# Raspberry Pi Agent v3.11.3
+# pigway-raspberry-pi-agent v3.11.3
 
 - 监控快照超过三秒停止续期硬件插件租约，状态 API 对超过十秒的状态返回 503，避免采集停滞仍显示为新状态。
 - 配置 API 校验有限数值、范围、阈值关系和服务目标；保留名称及进程表达式中的字面百分号。
@@ -7,3 +7,7 @@
 - 根分区缓存恢复期限与七天采集周期一致。
 
 本地 17 项回归测试通过，覆盖并发配置、旧状态拒绝与恢复、快照停滞、告警和缓存。本记录不作为当前生产状态的证明。
+
+统一开源许可证、贡献和安全反馈入口；完善当前版本的文档导航、源码分发和校验和。插件 ZIP 携带许可证。运行功能边界保持项目首页所述。
+
+本轮 17 项 Python 测试通过。源码语法、文档入口、打包和校验和检查通过；生产运行状态以实际部署验收为准。
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..bb81770
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,7 @@
+# 安全反馈 / Security
+
+仅支持当前发布版本。请勿在公开 Issue 中发布密钥、令牌、个人数据或可直接利用的完整漏洞细节。
+
+请通过仓库维护者 [way](https://tea.pigway.com/way) 的私有联系渠道报告，包含受影响版本、复现条件、影响和最小化示例。若尚未建立私有渠道，先在 Issue 请求私下联系，不附敏感细节。
+
+Only the current release is supported. Contact the maintainer privately before disclosing exploit details; include the version, impact and a minimal reproduction. Do not attach credentials or private data to public issues.
diff --git a/SHA256SUMS b/SHA256SUMS
index 1ca59dc..3691cea 100644
--- a/SHA256SUMS
+++ b/SHA256SUMS
@@ -1,7 +1,11 @@
-516ed5bf52a34f3a842dcc050e015106f33cd856987cff1e8005ddeee73452ea  .gitignore
+1db9d786fdc6c2ae84b7d317e981b23e303a5bc0b72704d43558b29373d97ade  .github/workflows/verify.yml
+4035aba62136040755ffdf2faf1556a49215e829c16ee44263e0ab7530fbf521  .gitignore
+79f34290cfa1a6f0928162909848e6597d46183d0de6b213bf52b12546f5fc33  CONTRIBUTING.md
+6eb7728e6e73f9568ca6fd5ad6383d13ffc638f2870fefa2d86f72f39685c0fc  LICENSE
 9c90aa203d27dea1ff6493ff401ce252daa50b340672aa02b84e6729387ffe78  README.md
 cf797200392a367fbe2f4fc79deabcd430249299947bd2d1d8d8cace49bfb97b  README.zh-CN.md
-dd98abfbdfc25c58783084b286d8324a49e5fb0410935f25be04ae9f75f7a2fc  RELEASE_NOTES.md
+54fa1c8f12d277d3309d02885d83bb317cdb0eda0ead1f9e16ccf2960c01b552  RELEASE_NOTES.md
+6cead6c1378cd840f655adc3d467e2cd6fd3ab368d7200a3afbfe85d9ed159be  SECURITY.md
 c5853f283c0951b43f2bacbc49e66c26d3a605a184d427828e042eb9236d2740  app/network_rates.py
 5f553c03839a2acb86265b24db656b358b4cde6b3c617eef97c9316868578e1b  app/pigway_pi_control.py
 c3278a0c09f7529b50460755eed5470893d6598002ac0e0d47bf6247b100aa77  app/pigway_pi_control_api.py
@@ -11,9 +15,9 @@ c3278a0c09f7529b50460755eed5470893d6598002ac0e0d47bf6247b100aa77  app/pigway_pi_
 e3bf3e7070ea62c0526791bed922688c3fb49fee36ca9c375d080119968feb72  docs/HARDWARE_PLUGIN_API.md
 b54ec1f3e9fb15473910686c54142a85d387e44ea5df427a4cf1b06052e789b3  docs/RASPBERRY_PI_OS_TRIXIE_FRESH_INSTALL.md
 9222a2b6a38f6b6d7d88b30c05413c68c05f69ee499c8479eca05ee7c62e87c3  docs/RASPBERRY_PI_OS_TRIXIE_FRESH_INSTALL.zh-CN.md
-67f56bdb128d64f434ca52e45245fd2f3548da3852b3e06cc8def8c804502bf0  docs/README.md
+3041278ff521c303d95711d38f31f43dfd38c8ed94999a7a86514b1fa3e09f60  docs/README.md
 6552741bb5639520c331a8c38d5d99c90f0ab3d9b1f11e571cb789c386bd0577  docs/STORAGE.md
-0eddd7adb18bfdf801e93fde28aa06ef28db3011b4e5f60015f0c641d62c6de1  install.sh
+a38fae07a9151923706ff708598bf24e89ef4ed7fb9449c3f7b4d013d6e1be93  install.sh
 8a593c290da5bd0d037aee86c35264512afd574a2a0f60f2c29e9db63e0109bd  systemd/pigway-pi-control-api.service
 1cb55de6b104a233066495e9786319305fa4f1b6f25483c108ab4f5ac9aa5700  systemd/pigway-pi-control.service
 a58ff2e2ae49f481618cbb8d83b7cfbaa08ed4361eecbcab54755c886a6163eb  tests/test_audit_regressions.py
@@ -21,4 +25,4 @@ a58ff2e2ae49f481618cbb8d83b7cfbaa08ed4361eecbcab54755c886a6163eb  tests/test_aud
 56a7b171f7b6d93721b4888908929b36095a4cb73700a041e37f9bc796309c5e  tests/test_storage_cache.py
 ab555730f3f3955a1338d5d4282addfb2ea1703f6a50541146dc49adbca5694b  tests/test_storage_config.py
 7ef40a31988bc258eb490d39732a1790e6e533b045c3f3ff277d2e0fd274dfa1  tests/test_storage_inventory.py
-9f59e7313ee58e687ae6dd29d175c67082674254ac5c5f54168b2735b64c20a4  uninstall.sh
+273fa86cdb77a0610ef64a3ad1788fecbe465bfbdf9568fa8928304b6be2cfaa  uninstall.sh
diff --git a/docs/README.md b/docs/README.md
index ac11561..2d1bdce 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -6,3 +6,5 @@
 - [Raspberry Pi OS Lite (Debian 13 Trixie) fresh installation](RASPBERRY_PI_OS_TRIXIE_FRESH_INSTALL.md)
 - [Raspberry Pi OS Lite（Debian 13 Trixie）全新安装](RASPBERRY_PI_OS_TRIXIE_FRESH_INSTALL.zh-CN.md)
 - [磁盘发现、刷新与显示](STORAGE.md)
+
+[贡献指南](../CONTRIBUTING.md) · [安全反馈](../SECURITY.md) · [许可证](../LICENSE)
diff --git a/install.sh b/install.sh
index d3d9235..3c97754 100755
--- a/install.sh
+++ b/install.sh
@@ -69,6 +69,8 @@ sys.path.insert(0,'app')
 import pigway_pi_control_api as api
 api.save_ini_text(api.replace_ini_value('api','enabled',os.environ['API_ENABLED']),'install')
 PYAPI
+install -d -m 0755 /usr/local/share/doc/pigway-raspberry-pi-agent
+install -m 0644 LICENSE /usr/local/share/doc/pigway-raspberry-pi-agent/
 systemctl daemon-reload
 if [ "$NO_START" -eq 0 ]; then
   systemctl enable pigway-pi-control.service >/dev/null
diff --git a/uninstall.sh b/uninstall.sh
index b13fd5c..103fc93 100755
--- a/uninstall.sh
+++ b/uninstall.sh
@@ -7,6 +7,7 @@ rm -f /usr/local/sbin/pigway-pi-control
 rm -f /usr/local/sbin/pigway-pi-control-api
 rm -f /etc/pigway-pi-control-api.token
 rm -rf /usr/local/share/pigway-pi-control
+rm -rf /usr/local/share/doc/pigway-raspberry-pi-agent
 systemctl daemon-reload
 echo "程序已卸载。为防误删自定义内容，配置 /etc/pigway-pi-control.conf 已保留。"
 echo "如确定不要配置，可手工：sudo rm /etc/pigway-pi-control.conf"