Contributing Spec-first: changes that affect behavior must update spec/. Keep SourceOS independent of socios by default. Shell scripts must pass shellcheck.