Source-backed rules for preparing direct content-only pull requests with one raw MDX file, reachable provenance URLs, issue closure, duplicate history, validation evidence, and no generated artifact churn.
These rules do not run content or automate submissions; they are a review gate for keeping direct content PRs focused and verifiable., Do not run generators, package builds, download packaging, README refreshes, or maintainer automation while preparing a content-only PR unless the issue explicitly requires it., If the submitted entry describes hooks, MCP servers, shell commands, installers, credentialed tools, external writes, or destructive actions, require specific safety notes for that entry before opening the PR.
Privacy notes
PR bodies, source URLs, issue links, duplicate-search notes, screenshots, and validation logs are public review artifacts., Do not use private repositories, customer names, internal docs, local paths, account identifiers, tokens, screenshots with secrets, or unpublished data as public source evidence., When validation output or duplicate evidence contains private details, summarize the verification class publicly and keep sensitive evidence in the approved private channel.
Author
MkDev11
Submitted by
MkDev11
Claim status
unclaimed
Last verified
2026-06-04
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
78
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Complete
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
Registry metadata indicates a reviewed listing.
Done
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Current risk score 16/100. Use staged verification before broader rollout.
Risk 16
Pre-adoption checks
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Done
Confirm metadata review state
Listing has review metadata.
Done
Verify install payload
Install/config payload exists and can be inspected.
Done
Security checks
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Done
Review privacy notesRequired
Privacy notes are present.
Done
Verify package integrity metadata
No package verification/checksum metadata.
Pending
Rollout
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Pending
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Pending
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Pending
Evidence readiness
Evidence readiness matrix · balanced
Required evidence gates are covered (5/6 signals complete).
Risk 15
Source provenance
Present
Source repository/provenance is listed.
Required in this preset
Metadata review
Present
Review metadata is present.
Required in this preset
Safety notes
Present
Safety notes are present.
Required in this preset
Privacy notes
Present
Privacy notes are present.
Optional in this preset
Package integrity
Missing
Package integrity metadata is missing.
Optional in this preset
Install payload
Present
Install payload is available.
Required in this preset
Required evidence gates are covered for this preset.
Decision timeline
Decision timeline · balanced
5/6 steps complete with no blocking gaps for this preset.
Risk 14
triage
Confirm source provenanceRequired
Source/provenance metadata is available.
Done
triage
Check metadata review statusRequired
Review metadata is available.
Done
verify
Review safety notesRequired
Safety notes are available.
Done
verify
Review privacy notes
Privacy notes are available.
Done
verify
Validate package integrity metadata
Package integrity metadata is missing.
Pending
rollout
Verify install payload and commandsRequired
Install payload is available.
Done
No required blockers for this timeline preset.
Prerequisite readiness
Prerequisite readiness
4 prerequisites to line up before setup.
0/4 ready
Network & hosting1General310 minutes
Safety & privacy surface
Safety & privacy surface
3 safety and 3 privacy notes across 5 risk areas. Review closely: credentials & tokens, network access.
5 areas
SafetyExecution & processesThese rules do not run content or automate submissions; they are a review gate for keeping direct content PRs focused and verifiable.
SafetyNetwork accessDo not run generators, package builds, download packaging, README refreshes, or maintainer automation while preparing a content-only PR unless the issue explicitly requires it.
SafetyCredentials & tokensIf the submitted entry describes hooks, MCP servers, shell commands, installers, credentialed tools, external writes, or destructive actions, require specific safety notes for that entry before opening the PR.
PrivacyData retentionPR bodies, source URLs, issue links, duplicate-search notes, screenshots, and validation logs are public review artifacts.
PrivacyCredentials & tokensDo not use private repositories, customer names, internal docs, local paths, account identifiers, tokens, screenshots with secrets, or unpublished data as public source evidence.
PrivacyGeneralWhen validation output or duplicate evidence contains private details, summarize the verification class publicly and keep sensitive evidence in the approved private channel.
Safety notes
These rules do not run content or automate submissions; they are a review gate for keeping direct content PRs focused and verifiable.
Do not run generators, package builds, download packaging, README refreshes, or maintainer automation while preparing a content-only PR unless the issue explicitly requires it.
If the submitted entry describes hooks, MCP servers, shell commands, installers, credentialed tools, external writes, or destructive actions, require specific safety notes for that entry before opening the PR.
Privacy notes
PR bodies, source URLs, issue links, duplicate-search notes, screenshots, and validation logs are public review artifacts.
Do not use private repositories, customer names, internal docs, local paths, account identifiers, tokens, screenshots with secrets, or unpublished data as public source evidence.
When validation output or duplicate evidence contains private details, summarize the verification class publicly and keep sensitive evidence in the approved private channel.
Prerequisites
A selected content slot issue, target category, proposed title, and proposed slug before creating the branch.
Public source URLs that load successfully and directly support the entry's claims.
A duplicate-search pass across existing content, live PRs, closed PRs, source domains, docs URLs, package URLs, provider names, and aliases.
A local checkout where category validation, content policy validation, and whitespace checks can run before the branch is pushed.
Schema details
Install type
copy
Reading time
6 min
Difficulty score
35
Troubleshooting
Yes
Breaking changes
No
Collection metadata
Estimated setup
10 minutes
Difficulty
beginner
Full copyable content
You are preparing a direct content-only pull request.
Rules:
1. Change exactly one raw content file under content/<category>/<slug>.mdx.
2. Keep README output, generated registry files, downloads, workflows,
package files, scripts, and unrelated content out of the PR.
3. Verify every source URL as publicly reachable and directly relevant before
putting it in frontmatter or the PR body.
4. Link the exact child issue with a supported closing keyword.
5. Document duplicate checks across titles, slugs, source URLs, docs URLs,
providers, aliases, existing content, open PRs, and closed PRs.
6. Run focused validation before pushing and report the exact commands.
7. Stop before opening the PR when source proof, duplicate history, safety
notes, privacy notes, or one-file scope is incomplete.
About this resource
Purpose
Use these rules before opening a direct content-only pull request. The goal is
to make the branch easy for maintainers and automation to classify: one raw
source file, reachable source evidence, documented duplicate history, focused
validation, and no generated output.
This is not a general contributor tutorial. It is a gate an AI coding assistant
or contributor can apply at the moment when a content branch is almost ready to
push.
Gate Inputs
Collect these inputs before creating the content file.
Slot and category. Name the child issue, requested category, target
directory, title, and slug.
Source evidence. List official docs, repository files, package pages,
standards, or primary project pages that prove the claims in the entry.
Nearby content. Search existing rules, guides, hooks, skills,
collections, commands, agents, open PRs, and closed PRs for the same
workflow or source URL.
Risk class. Decide whether the submitted entry describes executable
code, install commands, credentialed tools, local file reads, external
writes, network calls, telemetry, logs, or generated artifacts.
Validation path. Know the category validator and content policy command
before opening the PR.
Do not open the PR while any gate input is still unknown.
Scope Rules
Add or modify exactly one raw MDX source file under the requested
content/<category>/ directory.
Do not edit README output, generated registry data, route files, feeds,
downloads, ZIP or MCPB artifacts, package metadata, workflows, scripts, or
unrelated content.
Do not reformat neighboring files, rename existing entries, reorder content
directories, or update shared metadata as a side task.
Keep the branch based on current upstream main so the PR does not open behind
the base branch.
If a rejected one-shot submission is being repaired, create a fresh branch
and PR with the actual blocker fixed rather than force-pushing the closed PR.
Source Rules
Put only reachable public URLs in documentationUrl, repoUrl, and
sourceUrls.
Prefer primary sources: repository files, official docs, standards,
package pages, release notes, or the target repository's validation files.
Verify source URLs with a real HTTP request or browser load before opening
the PR.
Cite the final URL without trailing punctuation, markdown backticks, tracking
parameters, local paths, or private redirects.
Use sources that support the operational claims in the entry, not just the
title.
Replace any source that returns a hard 404, requires private auth, or points
to a file that does not exist on the target repository's default branch.
same-category entries and adjacent-category entries that solve the same
problem;
open PRs, closed PRs, and merged PR history for the child issue;
earlier rejection reasons, especially duplicate, source failure, wrong
category, generated artifacts, or missing safety/privacy evidence.
The PR body should name the closest related content and explain the difference
in one or two concrete sentences.
PR Body Rules
The PR body should include:
the exact closing reference for the child issue, such as Closes #730;
a summary that says the PR changes one content file;
duplicate and closed-PR history;
source URL verification notes;
validation commands;
a statement that generated artifacts, README output, workflows, package
files, and scripts were not changed.
GitHub supports linked pull requests that close issues with keywords, and this
repository's PR template asks direct content submissions to confirm one-file
scope, source/provenance, author attribution, and generated-artifact
boundaries.
The files JSON manifest should contain only the intended MDX source file. If a
validator reports another file, stop and remove the unrelated change before the
PR is opened.
Safety And Privacy Rules
Do not use generic warnings when the submitted content has real runtime risk.
Require specific notes when the entry:
reads files, browsers, repositories, databases, tickets, logs, prompts, or
screenshots;
uses credentials, cookies, OAuth, API keys, database URLs, MCP permissions,
or cloud accounts;
writes to external services, sends messages, opens PRs, edits issues, deploys
code, or publishes artifacts;
stores or transmits user data, telemetry, traces, generated output, or
validation logs.
If none of those behaviors apply, the safety and privacy notes should say that
the rule itself is review-process guidance and explain what public review
artifacts still exist.
any sourceUrls value is private, broken, redirected to an error page, or
decorated with stray markdown characters;
the PR body lacks the child issue closure reference;
the duplicate check ignores an obvious related entry, open PR, or closed PR;
safety or privacy notes are generic for a tool that can execute code, read
local data, use credentials, or write externally;
local validation was skipped without an explicit reason;
the branch is already behind upstream main before the PR is opened.
Review Checklist
{"task": "One file", "description": "The diff contains exactly one raw MDX file under the requested content category"}
{"task": "Sources reachable", "description": "Every documentation, repository, and source URL loads publicly and supports the entry"}
{"task": "Issue closes", "description": "The PR body includes the exact child issue closing reference"}
{"task": "History checked", "description": "Existing content, open PRs, closed PRs, source domains, titles, slugs, and aliases were searched"}
{"task": "Artifacts excluded", "description": "README output, generated files, workflows, packages, scripts, and downloads were not edited"}
{"task": "Validation recorded", "description": "Whitespace, category validation, and content policy validation ran against the reviewed branch"}
Troubleshooting
A source URL returns 404: replace it with the final reachable source, then
rerun source verification before opening a new PR.
The entry overlaps a guide: make the rule enforce a pre-open or
pre-merge decision, and explain how it differs from the contributor guide.
The PR is behind upstream: rebase before opening or immediately after
GitHub reports the stale base.
The closed PR had a private-gate comment: fix the exact blocker in a new
branch and name the prior close reason in the PR body.
The validation command needs a files manifest: write a JSON array with the
single intended file path and pass it to the policy validator.
Duplicate And History Check
Checked existing rules, guides, collections, hooks, skills, commands, open PRs,
closed PRs, repository templates, and validator scripts for content-only PR
hygiene, direct content submissions, source-backed content PRs, generated
artifact churn, one-file PR gates, issue-closing keywords, and source URL
verification.
Adjacent content includes the source-backed content PR guide and generated
artifact churn rules. This entry is distinct because it is an operational gate
for AI coding assistants and contributors immediately before opening a direct
content-only PR: it blocks stale branches, broken source URLs, missing issue
closure, incomplete closed-PR history, and accidental generated-artifact scope.
PR #1135 previously attempted this slot and was closed because source URLs were
reported as hard 404 failures. This resubmission uses verified reachable URLs
and a new slug while keeping the one-file rules scope.
Show that Content-Only Submission PR Gate Rules is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/rules/content-only-submission-pr-gate-rules)
How it compares
Content-Only Submission PR Gate Rules side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
1 trust signal differ across this comparison (Submitter).
Source-backed rules for preparing direct content-only pull requests with one raw MDX file, reachable provenance URLs, issue closure, duplicate history, validation evidence, and no generated artifact churn.
Source-backed rules for requiring coding agents to provide fresh, scoped, and reviewer-visible test evidence before a pull request can be approved or merged.
Source-backed rules for reviewing AI-generated request handlers and forms before merge for cross-site request forgery risk, covering state-changing method discipline, anti-CSRF token correctness, SameSite cookie posture, origin and referer checks, and safe handling of cookie-based sessions.
Source-backed rules for reviewing AI-generated code that makes server-side URL or network requests for server-side request forgery before merge, covering URL allow-lists, block-lists for internal networks, redirect handling, response isolation, and privacy-safe test evidence.
✓These rules do not run content or automate submissions; they are a review gate for keeping direct content PRs focused and verifiable.
Do not run generators, package builds, download packaging, README refreshes, or maintainer automation while preparing a content-only PR unless the issue explicitly requires it.
If the submitted entry describes hooks, MCP servers, shell commands, installers, credentialed tools, external writes, or destructive actions, require specific safety notes for that entry before opening the PR.
✓Tests can mutate databases, send network requests, write files, consume cloud quota, or contact sandboxed services; coding agents must use isolated test environments and documented safe commands.
Passing one focused test does not prove unrelated risky paths are safe; require broader checks for auth, data deletion, payments, migrations, release automation, and generated artifacts.
Treat agent-generated test summaries as untrusted until the reviewer can inspect the exact command, status check, log, or reproducible manual verification evidence.
✓A missing CSRF defense lets a malicious page perform state-changing actions as a logged-in user — transferring funds, changing email or password, or deleting data — using the victim's ambient cookies.
AI assistants often generate handlers that work in tests yet omit token validation or perform state changes on GET, because the happy path succeeds without any forged cross-site request.
Relying on SameSite cookies alone is not sufficient: defaults vary, Lax still allows top-level GET navigations, and some clients or legacy browsers do not enforce it.
✓SSRF lets an attacker use the server as a proxy to reach internal services, cloud metadata endpoints, and other resources that are not internet-exposed, potentially exposing credentials and configuration.
AI assistants frequently write server-side fetch code that accepts a user-supplied URL with no destination check, which looks correct for valid public URLs but becomes a full SSRF on internal targets.
Block-lists are fragile; a new cloud provider, a new internal range, or an IPv6 address can bypass them, so an allow-list of permitted destinations is safer when the feature can work with one.
Privacy notes
✓PR bodies, source URLs, issue links, duplicate-search notes, screenshots, and validation logs are public review artifacts.
Do not use private repositories, customer names, internal docs, local paths, account identifiers, tokens, screenshots with secrets, or unpublished data as public source evidence.
When validation output or duplicate evidence contains private details, summarize the verification class publicly and keep sensitive evidence in the approved private channel.
✓Test logs, snapshots, fixtures, screenshots, coverage reports, and CI artifacts can expose secrets, customer data, internal hostnames, private package names, prompts, or file paths.
Do not paste raw private CI logs, database rows, browser traces, screenshots, or failing payloads into public PR comments without redaction.
When a test needs private credentials or data, record the approved internal verification channel rather than copying sensitive details into the public PR.
✓CSRF tokens are security credentials; do not paste real tokens, session cookies, or production request captures into public PR comments or issues.
Use synthetic accounts and redacted requests when demonstrating a CSRF proof of concept, and avoid attaching real user identifiers.
Be careful that anti-CSRF tokens are not written into URLs, analytics, or logs, where they can leak through referer headers or shared dashboards.
✓SSRF responses can contain cloud metadata credentials, internal service tokens, configuration, and personal data; do not include real infrastructure URLs or actual internal responses in test evidence.
Do not paste raw SSRF probe results, internal IP addresses, or cloud metadata content into public PR comments.
Use a dedicated test server or mock endpoint when demonstrating SSRF prevention so real internal services are never reached during review.
Prerequisites
A selected content slot issue, target category, proposed title, and proposed slug before creating the branch.
Public source URLs that load successfully and directly support the entry's claims.
A duplicate-search pass across existing content, live PRs, closed PRs, source domains, docs URLs, package URLs, provider names, and aliases.
A local checkout where category validation, content policy validation, and whitespace checks can run before the branch is pushed.
A pull request, branch, or patch created or modified by a coding agent.
Access to the repository's documented test commands, CI status checks, and branch-protection rules.
Enough diff context to identify touched behavior, affected packages, generated files, and risky runtime paths.
Permission to request changes or block merge when test evidence is stale, incomplete, unsafe, or unverifiable.
A pull request, diff, or snippet containing an AI-generated or AI-edited request handler, form, or fetch call with enough context to know how the user is authenticated.
Knowledge of how the framework manages sessions and CSRF tokens, since built-in protection, cookie defaults, and token helpers differ between frameworks.
Awareness of which routes change state and which are read-only, so the review can focus on unsafe methods.
Permission to block merge when a cookie-authenticated state change ships without a CSRF defense.
A pull request, diff, or snippet of AI-generated code that makes a server-side request to a URL or hostname influenced by user input.
Knowledge of the HTTP client in use, since redirect behavior, DNS resolution timing, and IP-binding options differ between libraries.
A safe test environment where requests to internal address ranges and metadata endpoints can be attempted without reaching real infrastructure.
Permission to block merge when a user-influenced URL can reach internal services, cloud metadata, or other out-of-scope destinations.