This document explains how to contribute to the project. We follow a
"Dual-Track" architecture where human-readable documentation lives in
the root and machine-readable policies live in .machine_readable/.
We welcome contributions in many forms:
-
Code: Improving the core verified stack or extensions.
-
Documentation: Enhancing AsciiDoc manuals or AI manifests.
-
Testing: Adding property-based tests or formal proofs.
-
Bug reports: Filing clear, reproducible issues.
-
Read the AI Manifest: Start with
0-AI-MANIFEST.a2ml(if present) to understand the repository structure. -
Environment: Use
guixdevelopordirenvallowto set up your tools. -
Task Runner: Use
justto see available commands (just--list).
docs/short-description # Documentation
test/what-added # Test additions
feat/short-description # New features
fix/issue-number-description # Bug fixes
refactor/what-changed # Code improvements
security/what-fixed # Security fixes
We follow Conventional Commits:
<type>(<scope>): <description>
[optional body]
[optional footer]
Types: feat, fix, docs, test, refactor, ci, chore,
security.
Before reporting:
-
Search existing issues.
-
Check if it is already fixed in
main.
When reporting, include:
-
Clear, descriptive title.
-
Environment details (OS, versions, toolchain).
-
Steps to reproduce.
-
Expected vs actual behaviour.
All contributors are expected to adhere to our ethical standards. See CODE_OF_CONDUCT for details.
By contributing, you agree that your contributions will be licensed under the same license as the project (see LICENSE).
Every commit that reaches the default branch must be signed; a ruleset refuses unsigned pushes. Estate policy: SIGNING-POLICY.
- People and interactive agents sign with an SSH key registered on GitHub
as a signing key (
gpg.format=ssh,user.signingkey=<key>.pub,commit.gpgsign=true). The committer email must be verified on that account. - Apps, bots and workflows never
git pushlocal commits. They write through the API (createCommitOnBranchor the estatesigned-pushaction) so that GitHub signs each commit. - Merge PRs with squash. The ruleset checks every commit on the PR branch,
not just the result, so one unsigned commit blocks the merge. Re-create such a
branch with signed commits (
git cherry-pick -S) and open a new PR. Rebase-merge replays commits unsigned and is disabled.