You can contribute implementation changes and documentation corrections within the current contracts. Phases 0–4 are frozen, and Phase 5 remains active. Read the delivery ledger for unresolved implementation and human gates.
- Read the contributor entry point and the relevant decision records under
specs/. Frozen contracts require change control. - Read
../familiar-contract/rfcs/RFC-0001-familiar-contract.md. RFC-0001 governs familiar identity and Ward requirements and wins on conflicts. - Read
../coven/docs/SAFETY-MODEL.mdfor the daemon trust boundary. - Use a GitHub issue for changes to public contracts or cross-repository behavior. Link the relevant
threads-*bead when Beads is available; a clean-clone contribution must not require a personal Beads database.
Compatibility metadata validation uses Python 3.11+ and its standard-library
tomllib, without additional Python packages. The repository scripts also
require Node.js and the pinned Rust toolchain.
From the repository root:
bash scripts/agent-bootstrap.sh
bash scripts/agent-check.sh fast
bash scripts/agent-check.sh fullFollow AGENTS.md for authority-impact evidence, downstream acceptance, and the applicable contribution workflow.
These commands validate local repository contracts and the portable automation profile; they do not launch a Coven daemon. Required current-checkout compatibility remains work under #31. The separate advisory daemon workflow supports scheduled latest-main and full-SHA manual observations as described in the E2E contract; it is not a required compatibility gate. Use the delivery strategy for sequencing and owner-specific acceptance rather than repeating a completed historical plan.
You can land an approved change without inventing a second reviewer. The maintainer authorized this policy for the solo-maintainer repository on 2026-09-12 (UTC).
Use a pull request, record the human approval and its scope on GitHub, resolve review conversations with their actual disposition, and satisfy the required checks against an up-to-date branch before merging. Agents need explicit human authorization; a passing check, model review, or persona is not approval. Material changes outside the approved scope need renewed authorization.
Ruleset 22910327 requires no approving review and disables latest-push and
extra unattributed-change approvals. It retains pull requests, resolved review
threads, stale-review dismissal, six strict required GitHub Actions checks,
and deletion/non-fast-forward protection, with no bypass actors. GitHub
enforces those controls, but does not enforce the conversational human-approval
process or provide independent review.
The fifth required check, Privacy policy guard, was
separately authorized
on 2026-09-12. It retains the checker-trust limits in the security policy.
The sixth, Pinned daemon compatibility, was
activated after accepted-main evidence and normal #65 landing
on 2026-09-13 under the authorized engineering-closure scope. It runs all four
daemon targets with the actual current Threads dependency. The separate
latest-main canary remains advisory; neither job grants human acceptance.
See the governance ledger for exact checks and rollback. Reassess independent review when another maintainer joins. This repository merge policy does not change protected-write authority or waive the design gates below.
The Phase-0 design freeze is complete. Under the adopted Phase-5 solo-maintainer review policy, Val may author and perform the human coherence review without claiming a separate human reviewer. Phase-5 remediation, Val's coherence acceptance, and a subsequent current-scope freeze/reaffirmation remain outstanding. Agents may prepare evidence; they cannot replace either human decision. Policy adoption under #59 did not waive a technical criterion or accept the implementation.