Focused issues and pull requests are welcome.
- Describe the safety property or failure mode before changing behavior.
- Keep agent proposals separate from authorization and execution.
- Add or update a test that fails without the change.
- Use synthetic data only.
- Run
npm run verifybefore opening a pull request.
For changes to policy semantics, include the old and new precedence, the affected event sequence, the fail-closed behavior, and any migration concern for in-flight runs. For storage adapters, document transaction boundaries, concurrency behavior, idempotency durability, and recovery after partial failure.
Security reports belong in GitHub’s private vulnerability-reporting flow rather than a public issue.