diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..cf93ec6
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,27 @@
+# Dependencies (install with `npm ci`, which reads package-lock.json)
+node_modules/
+
+# Hardhat production build outputs
+cache/
+artifacts/
+
+# Coverage run outputs. Separate from the production build on purpose, so an
+# instrumented build can never be mistaken for, or overwrite, the real one.
+# See hardhat.config.coverage.js.
+cache-coverage/
+artifacts-coverage/
+coverage/
+coverage.json
+*.lcov
+
+# Local environment. NEVER commit a populated .env: this repository is public
+# and holds no keys by design. See REPRODUCE.md, "The secrets boundary".
+.env
+.env.*
+!.env.example
+
+# Editor / OS noise
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/
diff --git a/README.md b/README.md
index c3073ed..e38b2dd 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,30 @@ mainnet. Nothing in this repository can move funds or impersonate the network: t
 private keys, no mnemonics, and no deployment credentials. Every network account is supplied at
 runtime through environment variables (see `hardhat.config.js`).
 
+## Scope, stated up front
+
+Aere Network runs post-quantum signature verification natively on mainnet: Falcon-512 (`0x0AE1`),
+Falcon-1024 (`0x0AE2`), ML-DSA-44 (`0x0AE3`), SLH-DSA-128s (`0x0AE4`) and SHAKE256 (`0x0AE5`)
+have been live as precompiles since block 9,189,161. You can call them yourself against
+`https://rpc.aere.network` without asking us for anything.
+
+**Consensus on chain 2800 is classical secp256k1 ECDSA QBFT.** The post-quantum work lives at the
+signature, precompile, account and transport layers. Nothing in this repository makes the consensus
+post-quantum, and nothing in it should be read as claiming so. Where you see post-quantum consensus
+discussed, it is research about what a future activation could look like, not a description of the
+running chain.
+
+Two further limits worth knowing before you judge anything else here:
+
+- `0x0AE6` (ML-KEM-768) and `0x0AE7` (Falcon HashToPoint) are **testnet only**. They are not
+  active on mainnet.
+- The on-chain zero-knowledge verifiers are classical BN254. They are broken by Shor's algorithm
+  like any other elliptic-curve construction, and we do not describe them as quantum-safe.
+
+The network is operated by seven Foundation-run validators, so its Nakamoto coefficient is
+effectively one today. That is a real limitation, it is on the roadmap, and it is not fixed by any
+code in this repository.
+
 ## Layout
 
 - `contracts/` the Solidity sources, grouped by domain (pqc, pqfinality, settlement, lending,