One repository is enough to start.
You do not need to understand all six repositories. Each path below names one repository, one bounded first task, and the form to use. Stars, shares, and follows are never required for anything here.
Shared rules: CONTRIBUTING.md · SECURITY.md · issue forms: defect, contract observation, evidence, proof recipe.
Report a confusing label
One repository: none required; the site is enough.
First safe task: run the proof, then find one word, stamp, or sentence on this site whose meaning was not clear to you, and say where you read it and what you expected instead. That is a real contribution: the labels exist to be understood by people who did not write them.
Use: the evidence form. No account beyond GitHub, no install, no game files.
Add a fence-case fixture
Starter issue: #1 — add a fence-case fixture to the gateway-lease-fence recipe (label first-task; scoped to the site repository; the product crate is a pinned dependency).
One repository: sts2-gateway (read only crates/gateway/tests/control_plane.rs and the recipe under recipes/gateway-lease-fence).
First safe task: run the recipe and confirm the hash. Then pick one fence variant the fixture does not yet show — WrongCaller, WrongSession, WrongLease, Missing, or Expired — and write it as a fixture step: input, expected result, boundary, decision, and the source test it mirrors. Bounded: one variant, one step, no changes to product crates.
Use: the proof-recipe form for the fixture, or the contract-observation form if the gateway does something its README does not say.
Sketch an adapter example against the tool schema
Starter issue: #2 — second recipe replaying the MCP seam (label first-task; scoped to the site repository).
One repository: sts2-mcp-server (read crates/mcp-server/tests/seam.rs; the single tool is sts2_get_state).
First safe task: write a JSON-RPC tools/call example for sts2_get_state that an adapter would send, and the one gateway request it should map to (GET /v1/instances/{id}/state with x-mcp-request-id and x-mcp-session-id). Then write one malformed variant and the error code you expect (-32700, -32602, or -32601). Bounded: no transport, no credentials, no model call.
Use: the proof-recipe form for an adapter example, or the contract-observation form for a schema observation. Read architecture first if you want the surrounding tiers.
Check one claim-to-test mapping
One repository: sts2-gateway at e7bce21.
First safe task: take one row of the claim ledger — for example row 4, fail-closed on readiness and crash — open the named test at the pinned commit, and confirm or refute that the test establishes the sentence as written. Report the result either way. Bounded: one row, one test.
Use: the evidence form for a mapping result or a failure-handling observation. For anything that could be a vulnerability, do not open a public issue: follow SECURITY.md and report privately. There is no listener or process supervisor yet, so there is no exposed surface to probe.
Ground rules
- Stars, shares, follows, and referrals are never required, asked for, or counted as contribution.
- No game files, assets, or marks may be submitted. No credentials in any issue.
- Product trees are Rust only; a policy tool enforces it.
- Every claim you add needs a label and a file, test, or command behind it.
- Defects in the site or the recipe go to the defect form.