By participating, you agree to follow the Code of Conduct.
- Keep each change focused and add tests for changed behavior.
- Use OpenSpec for scoped product, behavior, API, architecture, database, migration, security, permission, deployment, or data-repair changes. Small documentation corrections and mechanical fixes may proceed directly.
- Update durable documentation with the behavior it describes.
- Run targeted checks while working and
pnpm verifybefore requesting review when feasible. - In the pull request, explain what changed, why, what was verified, and any OpenSpec, migration, deployment, compatibility, or security notes.
If the full gate cannot run, list the commands that did run and the reason for the gap.
- PostgreSQL is the only runtime database. Do not add SQLite or dialect fallback paths.
../nodeclub/andegg-cnode/are reference-only legacy code and are not shipped or modified here.- API contract changes start in route zod-openapi declarations and require
pnpm gen:openapi. - Use obvious placeholders such as
${ENV_VAR},<secret>, orexample.comin examples.
Never commit real dotenv files, credentials, tokens, private keys, database URLs, private hosts, user data, or raw secret-scan output. Run pnpm secrets:scan after touching configuration, deployment, auth, storage, mail, CI, or database files. If a credential is exposed, remove it and rotate it.