Contributing

The canonical version of this lives in CONTRIBUTING.md in the repository. This page is the short form.

Where to ask

Discord is for questions, design discussion, and checking whether anyone is already on something. GitHub issues are for bugs and feature requests, so they stay searchable and can be scheduled into a release. Neither is for vulnerabilities — use private reporting, described in the security model.

A decision only counts once it is written down in an issue or a pull request. Discord is for working things out, not for recording them.

Ground rules CI enforces

• packages/agent may never import packages/proxy. The only path from agent to tools is the network call. An ESLint no-restricted-imports rule and a grep-level CI job enforce this; pull requests that route around either will not merge, regardless of how convenient it is.
• MIT/Apache-2.0 dependencies only in the core. The license gate fails the build on copyleft. Per GOVERNANCE.md, AGPL/SSPL and commercially-licensed packages are excluded; the latter are allowed only as optional, user-installed adapters.
• packages/proxy requires CODEOWNERS review. The proxy is the security boundary; changes there get extra scrutiny by design.
• Privileged workflows must not check out code. Any pull_request_target workflow containing an actions/checkout step fails CI.
• TypeScript strict, lint, and tests must pass.

CLA

A Contributor License Agreement (Apache-style) is required from your first pull request; a bot will prompt you in CI. The rationale is documented in GOVERNANCE.md — it is short, and it was written before you asked.

What the project most needs

The roadmap records the phases, and every phase is shipped: delivery is milestone-gated per release now, and the open milestone says what lands next. The priority is still the governed core — vault, team-sheet enforcement, approval broker, budget meter, audit log, and the e2e security suite that attacks them — and features that outpace it will be politely parked.

Following along

Work is planned in public GitHub issues; there is no separate tracker. One milestone per release carries its definition of done, and the open milestone is the next release. Each workstream is a tracking issue holding PR-sized sub-issues; ordering is expressed with blocked-by relationships, so filtering out blocked issues shows what is workable now. Valid work that belongs to a later release is labeled parked rather than closed, and picked up when a milestone schedules it.

New issues arrive labeled needs-triage; triage — within a week — either assigns the open milestone, parks, or closes. An issue is ready to build against when it is in the open milestone and not blocked; help wanted and good first issue mark the ones we would most like a hand with. A pull request for an untriaged or parked issue may wait until a milestone schedules it, so check before writing code.

The assignee is the in-progress signal — there is no board and no status:* label, so an issue with nobody assigned is free and an assigned one is being worked on. Comment on an issue before starting it and a maintainer will assign it to you — GitHub only allows assigning users who have participated in an issue, so the comment is both the claim and what makes the assignment possible. Open the pull request with Closes #N in the body, so merging closes the issue.

Development

pnpm install
pnpm -r build
pnpm -r test

Node 24+ (the message store’s full-text index needs SQLite’s FTS5, and the built-in node:sqlite was compiled without it until 22.16), pnpm 9+. The e2e harness — mock Slack plus a mock MCP server — is in e2e/, and pnpm --filter @getlibero/e2e test runs the security suite.

The packageManager field pins pnpm 9.15.0. On Node 22–24, corepack enable reads that field and provisions it. Corepack was removed from Node in v25, so on newer runtimes install the pinned version directly:

npm install -g pnpm@9.15.0

This site

The site lives in site/ and is deliberately outside the pnpm workspace, so Astro’s dependency tree stays out of the core license gate and the root pnpm -r scripts.

cd site
pnpm install
pnpm dev

It reads design/tokens.css and design/libero.css directly rather than vendoring copies. The design spec is locked: do not introduce a colour, font, radius, or component shape that is not already in it.