diff --git a/.claude/rules/acceptance-tests.md b/.claude/rules/acceptance-tests.md
new file mode 100644
index 000000000..194e5bede
--- /dev/null
+++ b/.claude/rules/acceptance-tests.md
@@ -0,0 +1,12 @@
+---
+paths:
+  - "acceptance/**"
+---
+
+# Acceptance Test Rules
+
+- Tests use Cucumber/Gherkin via Godog with Testcontainers for infrastructure
+- Run single scenario: `make scenario_<name>` (replace spaces with underscores)
+- Use `-persist` flag to keep test env for debugging, `-restore` to rerun
+- Snapshot testing: update with `UPDATE_SNAPS=true make acceptance`
+- macOS requires Podman machine — see `hack/macos/README.md`
diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 000000000..16d5923c5
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "echo \"$CLAUDE_FILE_PATHS\" | while IFS= read -r f; do case \"$f\" in *.go) gofmt -w \"$f\" 2>/dev/null;; esac; done"
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 000000000..aa53fa6c9
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,8 @@
+#### What:
+<!--- What is this change doing? --->
+
+#### Why:
+<!--- Please include the context and background for your change. --->
+
+#### Tickets:
+<!--- Please link to any related Jira issue here. --->
diff --git a/.gitignore b/.gitignore
index 1e919fc0b..869e3b4b6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -170,6 +170,17 @@ tags
 # Persistent undo
 [._]*.un~
 
+# Go coverage output
+cover.out
+coverage.txt
+
+# Vim swap files (explicit patterns for tooling detection)
+*.swp
+*.swo
+
+# OS files
+.DS_Store
+
 # Last persisted acceptance test run information
 acceptance/.persisted
 
diff --git a/.golangci.yaml b/.golangci.yaml
index 01ac605c0..5ffd00b2a 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -24,10 +24,17 @@ run:
 
 linters:
   enable:
+    - depguard
     - gosec
     - misspell
     - staticcheck
   settings:
+    depguard:
+      rules:
+        main:
+          deny:
+            - pkg: "io/ioutil"
+              desc: "Deprecated: use io and os packages instead"
     gosec:
       excludes:
         - G122
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 32d7752b0..d2de2cb06 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -18,4 +18,4 @@ repos:
   - repo: https://github.com/conforma/hooks
     rev: v0.0.2
     hooks:
-      - id: check-commit-message 
+      - id: check-commit-message
diff --git a/AGENTS.md b/AGENTS.md
index ce2434c3d..ff645be5f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -55,6 +55,13 @@ Acceptance tests require `/etc/hosts` entries:
 127.0.0.1 rekor.localhost
 ```
 
+## Single-File Verification
+
+```bash
+golangci-lint run internal/evaluator/evaluator.go   # Lint a single file (fast)
+gofmt -l internal/evaluator/evaluator.go            # Check formatting on a single file
+```
+
 ## Design Documents
 
 Read these before modifying the corresponding areas:
diff --git a/README.md b/README.md
index 79746c43c..a2ddbeeec 100644
--- a/README.md
+++ b/README.md
@@ -11,6 +11,17 @@ such as:
 Consult the [documentation][docs] for available sub-commands, descriptions and
 examples of use.
 
+## Installation
+
+Install a pre-built binary from the [latest release](https://github.com/conforma/cli/releases),
+or build from source:
+
+```bash
+make build        # builds dist/ec for your platform
+```
+
+See the [documentation][docs] for usage examples.
+
 ## Building
 
 Run `make build` from the root directory and use the `dist/ec` executable, or