- Create a focused non-default branch.
- Keep module semantics in
module/bin/module-control. - Change core files only when the behavior is useful across multiple modules.
- Update
CORE_VERSIONfor managed-core or API-contract changes. - Keep the browser API typed and allowlisted.
- Add or update unit, WebUI-contract and HTTP-integration tests.
- Run
./scripts/verify.sh. - Run
./scripts/build.sh. - Update architecture, security, migration and provenance documentation.
- Describe rollback and installed-runtime verification in the pull request.
A pull request must not weaken loopback binding, one-time bootstrap, cookie authentication, same-origin mutation checks, output limits, adapter revalidation or WebUI/boot separation.