Patches we accept. Patches we reject.

The repository labels first-touch issues as good-first-issue. The maintainers triage these to confirm the scope is fair and the steps are clear. If you finish one, leave it labelled — it helps the next person.

For larger work, open a discussion first. We will say yes, no, or not yet, here is why. Saying no is part of respecting your time.

shell# in your local clone
git config user.signingkey YOUR_KEY_FINGERPRINT
git config commit.gpgsign true
git config tag.gpgsign true

We require GPG-signed commits. This is not about gatekeeping — it is about keeping the project supply chain honest. If you do not have a key yet, the repository wiki walks you through generating one.

commit messagefeat(lsia): emit telemetry on safe-mode entry

Adds a single counter when the immune-system engine enters safe mode.
The counter is hashed-pattern only and respects the privacy gate.

Refs: #842
Signed-off-by: A. Researcher <a@example.org>

We follow the Conventional Commits spec for the first line. The body explains why. The footer references issues or related changes.

Pull requests run through three automated gates and a human review:

• The reproducible-build check verifies your patch does not break determinism.
• The privacy gate verifies no raw data path was introduced.
• The unit and integration test suite must pass.
• Two reviewers approve before merge. Security-sensitive areas require a security reviewer.

Every accepted contribution appears in the next release notes — with credit, unless you ask for anonymity. The AUTHORS file is updated automatically the first time you merge a change.

For larger work — a major feature, an audit, a translation — the changelog entry calls you out by name. Anonymous credit is a normal request, not a special one.

We follow the Contributor Covenant 2.1. Personal attacks, threats, doxxing, and harassment are immediate-removal violations, no complaint chain required. The full text is in the repository CODE_OF_CONDUCT.md.