# Contributing

Thanks for looking at dsh-suite. PRs welcome.

## Workflow

1. Fork / branch from `main`.
2. Make the change; if it touches the bundle wiring or the skill set, the
   validator pins it (`scripts/validate.mjs`, `node:fs` only — no install).
3. Run the local gate:

   ```bash
   npm test   # structural check: 9 skills present, valid names/frontmatter, bundle wiring intact
   ```

4. Open a PR describing what changed and why.

CI runs the same gate on Node 22; a PR is mergeable when it is green.

## Ground rules

- This is a bundle repo: patch + skills + structural check. No build step, no
  runtime surface, no credentials anywhere.
- A new skill means a new `skills/<name>/` folder with `SKILL.md` (`name:`
  matching the folder, lowercase alphanumerics and hyphens) — plus the folder
  added to the `expected` list in [scripts/validate.mjs](scripts/validate.mjs).
- Skill counts appear in several places (README, `cordis.patch.yml` comment,
  `docs/`). Keep them in sync — the validator's `expected` list is the source
  of truth.
- Update [docs/](docs/index.md) when the bundle wiring or the skill set changes.

## Reporting bugs

Open a GitHub issue with: the dsh-suite version/commit, your DSH version, and
the `npm test` output (or the install command and its error text). Redact
provider keys — config contains provider/model names only, never credentials.

## Security

See [SECURITY.md](SECURITY.md) — please do not open public issues for security reports.