Establish a safe foundation before implementing the geology RAG system

The project begins with architecture, data governance, reproducible evaluation, deployment boundaries, and secret-handling contracts so later code has measurable acceptance criteria.

Constraint: Real provider credentials, workspace identities, and restricted geological data must never enter Git

Rejected: Add placeholder runnable services in the design commit | would imply unverified implementation readiness

Confidence: high

Scope-risk: narrow

Reversibility: clean

Directive: Run make verify before every commit and update ADRs when architecture boundaries change

Tested: Secret scan, Markdown links, YAML parse, shell syntax, and staged diff validation

Not-tested: Application runtime is intentionally deferred to the implementation stage

CONTRIBUTING.md

@@ -0,0 +1,20 @@
+# 贡献规范
+
+## 分支与提交
+
+- `main` 始终保持可验证状态。
+- 功能分支使用 `feat/`、`fix/`、`docs/`、`chore/` 前缀。
+- 每个提交只承担一个明确意图，提交前运行 `make verify`。
+- 提交信息说明“为什么”，并在正文中记录必要的 `Constraint:`、`Rejected:`、`Tested:`、`Not-tested:` 等 Lore trailers。
+
+## 目录边界
+
+- Python 服务端代码只放在 `backend/`。
+- React 客户端代码只放在 `frontend/`。
+- 设计、接口、数据规范和决策记录只放在 `docs/`。
+- 可重复执行的工具放在 `scripts/`，不可把一次性命令散落在文档中当作实现。
+- 数据目录只允许提交格式、清单、校验和以及明确允许公开的小样例。
+
+## 完成定义
+
+代码变更至少需要相应的单元或集成测试；接口变更需要更新契约文档；数据处理变更需要记录处理器版本和样例回归结果；RAG 参数变更需要保存可复现实验配置。