# Contributing to mgf-secrets

`mgf-secrets` inherits the Magogi Foundation standards from `mgf-common` /
`mgf-standard`. Run **`mgf-fed agents`** for the canonical agent briefing.

## The gates (run before pushing)

```sh
ruff check src tests
ruff format --check src tests scripts
mypy src
coverage run --source=src/mgf -m mgf.test_supervisor --tier 0-2 && coverage combine && coverage report
mgf-fed app-doctor --standards
```

The `.woodpecker.yml` is a **generated artifact** (WF-13) — never hand-edit it;
change `pyproject.toml` inputs / the template and re-run `mgf-fed scaffold`.

## House rules

- **AG-18 is absolute:** never read or print a secret value. Add a redaction-test
  case for any new output path.
- **No ungoverned growth:** a new `kind`/surface needs a doctor check, a probe
  handler, and a replay fixture (the kind-extension meta-test enforces this).
- Every commit carries **both** `Signed-off-by:` and `Co-Authored-By:` (AG-03).
