## Contributing

[Open an issue](https://github.com/AlexCiortan/setlist/issues) with what held and what fought you; the form "A refusal I did not expect" is for a refusal. [CONTRIBUTING.md](CONTRIBUTING.md) says how changes land, and [SECURITY.md](SECURITY.md) how to report a security problem. **What the package carries:** at hook time the plugin fetches nothing and runs only the commands your `.claude/sdd.json` declares. The stamped workflow installs `jq` and a pinned Mermaid parser. The forge check reads no credential and makes no network call: the stamped workflow asks the forge through the forge's own action, with the workflow's own token, and hands the check the answers as a file. The tokens and secrets the test suite uses are fixtures, joined from parts when the suite runs: strings the scans must refuse, so the suite can show they do, and no shipped file carries one whole. The recording at the top of this page is a real session captured on screen, kept outside the package; the package's one image is its icon.