- Open or reference an issue.
- Create a focused branch from
main. - Keep changes small and documented.
- Add or update tests.
- Run all local checks.
- Open a pull request using the template.
- Address reviews; squash merge is preferred.
- Never commit secrets or real user data.
- Public API and scoring changes require documentation.
- Security-sensitive changes require threat-focused tests.
- Architecture changes require an ADR.
- New dependencies require justification and lockfile review.
- User-visible scores must remain explainable.
Use clear imperative messages. Conventional Commits are encouraged: feat:, fix:, docs:, test:, chore:.
Code, tests, docs, accessibility, observability, security implications, migration/rollback plan, and CI must be addressed where applicable.