# Contributing

> The ground rules CI enforces, what the project most needs, and how to get a development environment running.

Source: https://getlibero.com/docs/contributing/ · Libero v0.7.0 · pre-1.0

---

The canonical version of this lives in
[CONTRIBUTING.md](https://github.com/getlibero/libero/blob/main/CONTRIBUTING.md) in the
repository. This page is the short form.

## Where to ask

[Discord](https://discord.gg/7JXpyBa6ZJ) is for questions, design discussion, and checking whether
anyone is already on something. [GitHub issues](https://github.com/getlibero/libero/issues) are for
bugs and feature requests, so they stay searchable and can be scheduled into a release. Neither is
for vulnerabilities — use private reporting, described in the
[security model](https://getlibero.com/docs/security.md).

A decision only counts once it is written down in an issue or a pull request. Discord is for
working things out, not for recording them.

## Ground rules CI enforces

- **`packages/agent` may never import `packages/proxy`.** The only path from agent to tools is the
  network call. An ESLint `no-restricted-imports` rule and a grep-level CI job enforce this; pull
  requests that route around either will not merge, regardless of how convenient it is.
- **MIT/Apache-2.0 dependencies only** in the core. The license gate fails the build on copyleft.
  Per [GOVERNANCE.md](https://github.com/getlibero/libero/blob/main/GOVERNANCE.md), AGPL/SSPL and
  commercially-licensed packages are excluded; the latter are allowed only as optional,
  user-installed adapters.
- **`packages/proxy` requires CODEOWNERS review.** The proxy is the security boundary; changes
  there get extra scrutiny by design.
- **Privileged workflows must not check out code.** Any `pull_request_target` workflow containing
  an `actions/checkout` step fails CI.
- TypeScript strict, lint, and tests must pass.

## CLA

A Contributor License Agreement (Apache-style) is required from your first pull request; a bot
will prompt you in CI. The rationale is documented in GOVERNANCE.md — it is short, and it was
written before you asked.

## What the project most needs

The [roadmap](https://getlibero.com/docs/roadmap.md) records the phases, and every phase is shipped: delivery is
milestone-gated per release now, and the open milestone says what lands next. The priority is
still the governed core — vault, team-sheet enforcement, approval broker, budget meter, audit
log, and the e2e security suite that attacks them — and features that outpace it will be
politely parked.

## Following along

Work is planned in [public GitHub issues](https://github.com/getlibero/libero/issues); there is
no separate tracker. One milestone per release carries its definition of done, and the open
milestone is the next release. Each workstream is a `tracking` issue holding PR-sized
sub-issues; ordering is expressed with blocked-by relationships, so filtering out blocked issues
shows what is workable now. Valid work that belongs to a later release is labeled `parked` rather
than closed, and picked up when a milestone schedules it.

New issues arrive labeled `needs-triage`; triage — within a week — either assigns the open
milestone, parks, or closes. An issue is ready to build against when it is in the open milestone
and not blocked; `help wanted` and `good first issue` mark the ones we would most like a hand
with. A pull request for an untriaged or parked issue may wait until a milestone schedules it, so
check before writing code.

The assignee is the in-progress signal — there is no board and no `status:*` label, so an issue
with nobody assigned is free and an assigned one is being worked on. Comment on an issue before
starting it and a maintainer will assign it to you — GitHub only allows assigning users who have
participated in an issue, so the comment is both the claim and what makes the assignment
possible. Open the pull request with `Closes #N` in the body, so merging closes the issue.

## Development

```bash
pnpm install
pnpm -r build
pnpm -r test
```

Node 24+ (the message store's full-text index needs SQLite's FTS5, and the built-in `node:sqlite`
was compiled without it until 22.16), pnpm 9+. The e2e harness — mock Slack plus a mock MCP
server — is in `e2e/`, and `pnpm --filter @getlibero/e2e test` runs the security suite.

The `packageManager` field pins pnpm 9.15.0. On Node 22–24, `corepack enable` reads that field and
provisions it. Corepack was removed from Node in v25, so on newer runtimes install the pinned
version directly:

```bash
npm install -g pnpm@9.15.0
```

## This site

The site lives in `site/` and is deliberately outside the pnpm workspace, so Astro's dependency
tree stays out of the core license gate and the root `pnpm -r` scripts.

```bash
cd site
pnpm install
pnpm dev
```

It reads `design/tokens.css` and `design/libero.css` directly rather than vendoring copies. The
design spec is locked: do not introduce a colour, font, radius, or component shape that is not
already in it.