docs: add CONTRIBUTING.md covering AI policy and nightlies

[theCodeDrift]

Stack (root → tip):

• ➡️ docs: add CONTRIBUTING.md covering AI policy and nightlies #205 (you are here)
  • chore: remove the dev build target #206

The repository had no contributor guide, and no written statement of what we expect from a contribution written with a coding agent.

Why the file is Vale-exempt, deliberately

docs-npx-cli is an error-level rule with scope: [raw, code, text], so it reaches inside fenced code blocks and rewrites pnpm cli to npx @taskless/cli. Its own config records that there is no escape hatch: under a raw scope Vale evaluates against unparsed markup, so <!-- vale off --> and per-rule directives are both ignored (measured on Vale 3.18.0).

That is the right rule for a README, which is read by people who do not have this repository checked out. It also makes a contributor guide impossible to write, because a contributor guide has to name the local scripts.

Every Vale rule here is scoped by path ([**/README.md], [CLAUDE.md], [.conventions/*.md], [packages/cli/src/agent/*.txt], [packages/cli/src/**/*.ts]) and there is no catch-all, so CONTRIBUTING.md is already outside all of them. The rules stay strict everywhere they apply. The file's header says this, so a later change does not "fix" it by adding a scope.

Verified rather than assumed. With a probe line containing an em dash and the word simply appended to CONTRIBUTING.md, check reported zero findings from it, while the identical word in packages/cli/src/agent/onboard.txt still fired. The pnpm cli already in the document did not trip docs-npx-cli either. Probe removed before commit.

Contents

Using AI to contribute — you own what your agent does; you are expected to be able to explain what it does; we are not running an attestation system today and are open to exploring one. Nothing asks a contributor to disclose agent use: the standard is the same either way.

Local development — the build/typecheck/lint/test loop, pnpm cli, and why a stale dist/ serves stale recipes.

Nightlies — moved from the README, plus a Testing against a nightly section that installs into a scratch project rather than globally, avoiding the binary collision. Two gotchas that previously lived only in workflow comments: a nightly bakes its own invocation into everything it ships, and agents in this repository cannot run one because .claude/settings.json denies Bash(npx:*) and Bash(pnpm dlx @taskless/cli*).

Pull requests and code style — short, pointing at CLAUDE.md and .conventions/ rather than duplicating them.

README

Keeps a pointer: what a nightly is, the install line, the binary-collision warning, then a link here. The edited README still passes Vale despite being in scope.

Notes

• No changeset. Documentation only, no release note. Labelled skip-changeset.
• The guide says a nightly is how to use this CLI from another repository. The stronger claim, that no build target exists for that, belongs to the change that removes the dev target and will land with it.