Contribute evidence, not just code.

High-value contributions include reproducible bugs, compatibility evidence, reviewed Effect Profiles, negative/fail-closed tests, documentation and focused implementation fixes.

Before a pull request

npm ci --ignore-scripts
npm test
npm run check:publish

• open an issue before a large protocol/architecture change;
• include positive, negative and fail-closed tests for authority/effect changes;
• do not submit secrets, private evidence or data you cannot publish;
• sign commits using the repository DCO process;
• keep public-package boundaries stable or document the migration;
• report undisclosed vulnerabilities privately.

Effect Profile contributions

Profiles should describe observable postconditions, provenance/identity requirements, bounded resource scope and limitations. A convenient tool name is not sufficient proof of semantics.

Licensing and identity

Current first-party source is Apache-2.0. The RuleOak name and marks are governed separately; forks should not imply official status.