refactor: reorganize SDK structure into sdks/ directory (develop)

.editorconfig

@@ -0,0 +1,20 @@
+# EditorConfig - https://editorconfig.org
+
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{py,go}]
+indent_size = 4
+
+[Makefile]
+indent_style = tab

.github/CODEOWNERS

@@ -0,0 +1,18 @@
+# Default owners
+*                           @aral-standard/maintainers
+
+# Specifications
+/SPEC/                      @aral-standard/toc
+/SPEC/ARAL-CORE*            @aral-standard/sig-core
+/SPEC/ARAL-SECURITY*        @aral-standard/sig-security
+/SPEC/ARAL-PROTOCOL*        @aral-standard/sig-protocol
+
+# Governance
+/governance/                @aral-standard/steering-committee
+/CODE_OF_CONDUCT.md         @aral-standard/steering-committee
+
+# Schemas
+/schemas/                   @aral-standard/sig-protocol
+
+# Examples
+/examples/                  @aral-standard/sig-core

.github/FUNDING.yml

@@ -0,0 +1,2 @@
+github: [aral-standard]
+open_collective: aral-standard

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,35 @@
+---
+name: Bug Report
+about: Report a bug in ARAL
+title: '[BUG] '
+labels: bug
+assignees: ''
+---
+
+## Description
+
+A clear description of the bug.
+
+## Steps to Reproduce
+
+1. Step 1
+2. Step 2
+3. Step 3
+
+## Expected Behavior
+
+What you expected to happen.
+
+## Actual Behavior
+
+What actually happened.
+
+## Environment
+
+- ARAL Version:
+- Language/SDK:
+- OS:
+
+## Additional Context
+
+Any additional information.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions
+    url: https://github.com/aral-standard/aral-standard/discussions
+    about: For questions, use GitHub Discussions
+  - name: Security Issues
+    url: https://github.com/aral-standard/aral-standard/security/advisories/new
+    about: For security vulnerabilities, use Security Advisories

.github/ISSUE_TEMPLATE/epic-p0-1-gdpr.md

@@ -0,0 +1,279 @@
+---
+name: "Epic: P0-1 GDPR Compliance Package"
+about: Full GDPR compliance with 16 new requirements
+title: "[EPIC] P0-1: GDPR Compliance Package"
+labels: epic:p0-1-gdpr, priority:p0, area:compliance
+assignees: ""
+---
+
+## 🎯 Epic Overview
+
+**Goal**: Implement complete GDPR compliance for ARAL standard  
+**Duration**: 4 weeks (Jan 15 - Feb 12, 2026)  
+**Effort**: 160 hours  
+**Budget**: €20,000  
+**Risk Level**: High (regulatory blocker for EU adoption)
+
+---
+
+## 📋 Objectives
+
+- [ ] Define 16 new GDPR requirements (ARAL-S-110 to S-125)
+- [ ] Create ARAL-PRIVACY-1.0.md specification (30 pages)
+- [ ] Implement GDPR features in Python SDK
+- [ ] Create DPIA (Data Protection Impact Assessment) template
+- [ ] Write user documentation and migration guide
+- [ ] External legal review
+- [ ] 100% test coverage for GDPR features
+
+---
+
+## 🔧 Implementation Tasks
+
+### Week 1: Specification (Jan 15-21)
+
+- [ ] **#1: Draft ARAL-PRIVACY-1.0.md structure** (8h)
+
+  - Sections: Principles, Data Subject Rights, DPIA, Cross-Border, Breach, Retention
+  - Legal review checklist
+  - Assignee: @legal-tech-lead
+
+- [ ] **#2: Define ARAL-S-110 to S-120** (12h)
+
+  - S-110: Data subject identification
+  - S-111: Right to erasure
+  - S-112: Right to portability
+  - S-113: Cross-border transfers
+  - S-114: Breach notification
+  - S-115: Privacy impact assessment
+  - S-116: Consent management
+  - S-117: Data minimization
+  - S-118: Purpose limitation
+  - S-119: Storage limitation
+  - S-120: DPO requirements
+  - Assignee: @spec-editor
+
+- [ ] **#3: Define ARAL-S-121 to S-125** (8h)
+
+  - S-121: Record of processing activities
+  - S-122: Anonymization
+  - S-123: Children's data
+  - S-124: Automated decision-making
+  - S-125: International transfers register
+  - Assignee: @spec-editor
+
+- [ ] **#4: Create DPIA template** (4h)
+  - Appendix A in ARAL-PRIVACY-1.0.md
+  - Risk assessment matrix
+  - Mitigation strategies
+  - Assignee: @legal-tech-lead
+
+### Week 2: Implementation (Jan 22-28)
+
+- [ ] **#5: Extend Memory schema for PII metadata** (6h)
+
+  - Add `pii_metadata` field
+  - `data_subject_id`, `categories`, `retention_days`, `lawful_basis`
+  - Update `schemas/memory.schema.json`
+  - Assignee: @backend-dev
+
+- [ ] **#6: Implement `delete_subject()` method** (8h)
+
+  - Cascade deletion across namespaces
+  - Audit trail (retain deletion event)
+  - 30-day completion requirement
+  - File: `implementations/python/aral/memory.py`
+  - Assignee: @backend-dev
+
+- [ ] **#7: Implement `export_subject_data()` method** (6h)
+
+  - JSON-LD format
+  - Complete history
+  - Machine-readable schema
+  - File: `implementations/python/aral/runtime.py`
+  - Assignee: @backend-dev
+
+- [ ] **#8: Cross-border transfer validation** (8h)
+
+  - EU adequacy list check
+  - SCC signature verification
+  - Transfer logging
+  - File: `implementations/python/aral/orchestration.py`
+  - Assignee: @backend-dev
+
+- [ ] **#9: Breach detection & notification** (10h)
+  - Detect unauthorized access (4h detection)
+  - 72h notification mechanism
+  - Webhook integration
+  - File: `implementations/python/aral/security.py`
+  - Assignee: @security-dev
+
+### Week 3: Testing & Documentation (Jan 29 - Feb 4)
+
+- [ ] **#10: GDPR test suite** (16h)
+
+  - 10 test files covering S-110 to S-125
+  - `tests/gdpr/test_right_to_erasure.py`
+  - `tests/gdpr/test_cross_border_transfer.py`
+  - `tests/gdpr/test_breach_notification.py`
+  - Target: 100% coverage
+  - Assignee: @qa-engineer
+
+- [ ] **#11: User documentation** (8h)
+
+  - Quick Start guide (5 min setup)
+  - Checklists for compliance
+  - Code examples
+  - File: `docs/gdpr/README.md`
+  - Assignee: @tech-writer
+
+- [ ] **#12: Migration guide** (4h)
+
+  - Upgrade from v1.0 to v1.1
+  - Breaking changes (none expected)
+  - PII tagging recommendations
+  - File: `docs/gdpr/MIGRATION.md`
+  - Assignee: @tech-writer
+
+- [ ] **#13: Configuration guide** (4h)
+  - `aral-config.yml` examples
+  - DPO email setup
+  - Retention policies
+  - Breach webhooks
+  - File: `docs/gdpr/CONFIGURATION.md`
+  - Assignee: @tech-writer
+
+### Week 4: Legal Review & Finalization (Feb 5-12)
+
+- [ ] **#14: External legal review** (16h external)
+
+  - GDPR compliance verification
+  - Multi-jurisdiction check (CCPA, PIPL, LGPD)
+  - Risk assessment
+  - Deliverable: Legal opinion document
+  - Assignee: @external-counsel
+
+- [ ] **#15: Address legal review feedback** (8h)
+
+  - Specification updates
+  - Implementation fixes
+  - Documentation clarifications
+  - Assignee: @legal-tech-lead + @backend-dev
+
+- [ ] **#16: CI/CD integration** (6h)
+
+  - GDPR tests in CI pipeline
+  - Coverage reporting
+  - Automated DPIA checks
+  - File: `.github/workflows/gdpr-compliance.yml`
+  - Assignee: @devops
+
+- [ ] **#17: ARAL-PRIVACY-1.0.md finalization** (4h)
+  - Incorporate all feedback
+  - Cross-references to ARAL-CORE, ARAL-SECURITY
+  - Final proofreading
+  - Assignee: @spec-editor
+
+---
+
+## 📊 Success Criteria
+
+- [ ] 16 requirements (S-110 to S-125) published
+- [ ] ARAL-PRIVACY-1.0.md complete (30 pages)
+- [ ] DPIA template provided
+- [ ] 10 GDPR tests passing (100% coverage)
+- [ ] Migration guide published
+- [ ] Legal review completed with approval
+- [ ] Zero CVEs related to data protection
+
+---
+
+## 🎯 Deliverables
+
+| #   | Deliverable              | Owner             | Due Date | Status  |
+| --- | ------------------------ | ----------------- | -------- | ------- |
+| 1   | ARAL-PRIVACY-1.0.md      | @spec-editor      | Feb 12   | 📋 Todo |
+| 2   | Python SDK GDPR features | @backend-dev      | Feb 4    | 📋 Todo |
+| 3   | DPIA template            | @legal-tech-lead  | Jan 21   | 📋 Todo |
+| 4   | Test suite               | @qa-engineer      | Feb 4    | 📋 Todo |
+| 5   | Documentation            | @tech-writer      | Feb 4    | 📋 Todo |
+| 6   | Legal opinion            | @external-counsel | Feb 12   | 📋 Todo |
+
+---
+
+## 🚨 Risks & Mitigations
+
+| Risk                      | Probability | Impact | Mitigation                             |
+| ------------------------- | ----------- | ------ | -------------------------------------- |
+| Legal review delays       | Medium      | High   | Start early (Week 1), book counsel now |
+| Scope creep (CCPA, PIPL)  | High        | Medium | Focus GDPR only, other regs in v1.2    |
+| Implementation complexity | Medium      | Medium | Pair programming, code reviews         |
+| Breaking changes required | Low         | High   | Design backward-compatible APIs        |
+
+---
+
+## 💰 Budget Breakdown
+
+- Backend development: 48h × €150/h = €7,200
+- Legal counsel: 16h × €300/h = €4,800
+- QA testing: 16h × €100/h = €1,600
+- Technical writing: 16h × €120/h = €1,920
+- DevOps: 6h × €150/h = €900
+- Project management: 10h × €150/h = €1,500
+- **Contingency (20%)**: €3,584
+- **Total**: €21,504 (~€20k budgeted)
+
+---
+
+## 📅 Timeline
+
+```mermaid
+gantt
+    title P0-1 GDPR Compliance
+    dateFormat  YYYY-MM-DD
+    section Specification
+    Draft structure       :s1, 2026-01-15, 1d
+    Define S-110 to S-125 :s2, after s1, 3d
+    DPIA template         :s3, after s1, 1d
+
+    section Implementation
+    Memory PII schema     :i1, 2026-01-22, 1d
+    Delete subject        :i2, after i1, 2d
+    Export data           :i3, after i1, 1d
+    Cross-border          :i4, after i2, 2d
+    Breach detection      :i5, after i2, 2d
+
+    section Testing
+    GDPR test suite       :t1, 2026-01-29, 3d
+
+    section Documentation
+    User docs             :d1, 2026-01-29, 2d
+    Migration guide       :d2, after d1, 1d
+
+    section Legal
+    External review       :l1, 2026-02-05, 5d
+    Finalization          :l2, after l1, 2d
+```
+
+---
+
+## 🔗 Related Issues
+
+- Depends on: None (foundational work)
+- Blocks: #TBD (CCPA compliance in v1.2)
+- Related: #TBD (Consent management UI)
+
+---
+
+## 📞 Stakeholders
+
+- **Epic Owner**: @legal-tech-lead
+- **Tech Lead**: @backend-dev
+- **Legal Counsel**: @external-counsel
+- **Reviewers**: @standard-architect, @security-authority
+
+---
+
+**Created**: 2026-01-14  
+**Target**: 2026-02-12  
+**Status**: 📋 Ready for Sprint 1