# Contributing

Keep changes scoped to this repository. Do not change global Git user identity or global GitHub login. Multiple account sessions must not operate on this same checkout concurrently. Use a separate checkout/worktree for separate work and a `codex/` branch prefix for agent-created branches.

Start with a synthetic failing test, make a complete feature/fix, then run `moon fmt`, `moon check --target wasm-gc --deny-warn`, `moon test --target wasm-gc`, `moon info`. Before a pull request run `python scripts/verify.py`; without a native compiler explicitly use `--skip-native-runtime` and disclose the skip. Do not update recorded evidence to PASS unless the corresponding process succeeded. CI must subsequently prove native runtime behavior.

Coordinates, ambiguity semantics and wire format are public contracts. Changes need examples, boundary/negative tests, generated interface review and a changelog entry. Do not add real enzyme catalogues or external biological data without separately reviewed scope and license. Do not promote generic upstream FASTA/base functions as project-original features.

Never add credentials, application/contact details, compiled outputs or `.mooncakes` sources to Git. Commits should represent complete useful changes, not empty/format-only history padding. Before a remote write use `scripts/identity-preflight.ps1` and independently confirm the explicit owner, push URL and intended operation. The script is read-only and does not change auth/config or perform pushes.

Use official MoonBit installation sources. The CI installer checksum is intentionally pinned: review upstream changes and archives before updating it. CI permissions remain read-only; publishing/releasing is an explicit maintainer action, not part of tests.