Contributing

Open an issue with what held and what fought you; the form "A refusal I did not expect" is for a refusal. CONTRIBUTING.md says how changes land, and SECURITY.md how to report a security problem.

What the package carries: at hook time the plugin fetches nothing and runs only the commands your .claude/sdd.json declares. The stamped workflow installs jq and a pinned Mermaid parser. The forge check reads no credential and makes no network call: the stamped workflow asks the forge through the forge's own action, with the workflow's own token, and hands the check the answers as a file.

The tokens and secrets the test suite uses are fixtures, joined from parts when the suite runs: strings the scans must refuse, so the suite can show they do, and no shipped file carries one whole. The recording at the top of this page is a real session captured on screen, kept outside the package; the package's one image is its icon.