Specification and schemas
Propose predicate vocabulary, canonicalization vectors, compatibility analysis, or precise corrections to the Living Intent Contract.
Make authority harder to bypass—and easier to verify.
The community scope covers the open specification, schemas, vectors, SDKs, examples, adapters, and reference implementation. Hosted operations remain a separate product responsibility.
Choose one reviewable boundary.
Small, evidence-rich changes are safer to evaluate and faster to merge than broad capability claims.
Security and rejection tests
Demonstrate a bypass privately when needed, then preserve the fix with malformed-input, replay, delegation, isolation, or parameter-binding tests.
SDKs and enforcement adapters
Implement verification at the protected resource. Tool-side execution must reject missing, forged, expired, replayed, or mismatched authority.
Documentation and evidence
Clarify trust boundaries, examples, status evidence, and deployment gaps without converting planned work into shipped claims.
Required evidence
The contribution contract is fail-closed.
A passing suite never excuses weaker authorization. Reviewers evaluate the invariant, rejection evidence, compatibility, and public status together.
- 01Name the invariant or acceptance criterion the change preserves.
- 02Include a useful happy path and at least one rejection path proving the bypass remains closed.
- 03Fail closed for malformed input and unavailable deterministic dependencies.
- 04Update the specification and story evidence when the public contract or implementation status changes.
- 05Never include secrets, real customer data, or unsupported partnership, certification, or availability claims.
Verification gates
Run the same evidence checks maintainers review.
cd verid-platform && dotnet test
cd ../verid-sdk/javascript && node --test
powershell -NoProfile -ExecutionPolicy Bypass -File tests/verify-story-coverage.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File tests/verify-brand-lock.ps1Mobile and web suites must also be run when those surfaces change. Environment-dependent checks stay explicitly visible when they cannot be executed.
Security reports
Open disclosure guidance Never publish a suspected vulnerability as a discussion or pull request.
Use the private disclosure path and include the affected component, reproduction steps, expected impact, and suggested mitigation.