Contributing to ts-stack

The canonical, repository-wide contribution policy is the root CONTRIBUTING.md. AI agents must also follow the root AGENTS.md.

Those files apply to every package, service, specification, conformance project, documentation surface, and workflow. Package-level AGENTS.md files are generated pointers to the root; packages do not define separate lint, review, dependency, release, documentation, migration, or quality rules.

The canonical policy covers:

• safe workspace setup and the root Node/pnpm toolchain;
• specifications, cross-implementation compatibility, and Tier 0 review;
• strict TypeScript, zero-warning lint, formatting, testing, conformance, package consumers, browser/mobile/WASM, fuzz/property, mutation, security, infrastructure, and documentation validation;
• public-service CORS/CSP compatibility;
• dependency and Dependabot review;
• standardized SemVer, package release notes, changelogs, and migration notes;
• exact-head self-review, Sonar/CodeQL zero-finding requirements, and the rule that work is not handed off or called complete while CI is pending or failing; and
• protected publication, provenance, deployment, and rollback boundaries.

Use the root issue forms and pull request template. Security vulnerabilities must be reported privately under the Security Policy.

Current focused follow-up programs are:

• Deferred final QA: coverage, fuzzing, conformance, and runtime validation;
• Authorized package/image release and external assurance; and
• Sonar administration and CI efficiency review.

The completed modernization history remains in retired tracker #324; it is no longer the source for contribution policy or active work.