@zackbart/connecta 0.34.1 → 0.36.0

package/documentation/code-mode.md

@@ -33,10 +33,10 @@ new behavior.
 
 ## Deploy-time capability
 
-The `executor` passed to `createConnecta()` is required. `tools/list` is exactly
-six — `execute_code`, `search_tools`, `call_tool`, `call_destructive_tool`,
-`authorize_connector` and `skills`. Construction fails when the
-executor is missing, and the removed `surface` option is rejected rather than
+The `executor` passed to `createConnecta()` is required. The
+[six-tool surface](./meta-tools.md#the-six-tools) is defined in the meta-tool
+reference. Construction fails when the
+executor is missing, and the removed deployment-level `surface` option is rejected rather than
 ignored ([#273](https://github.com/zackbart/connecta/issues/273)), as are the
 pause-only `execute.resumableWrites` and `execute.pausedRunTtlSeconds`
 ([#672](https://github.com/zackbart/connecta/issues/672)).
@@ -70,9 +70,7 @@ through `admission`. Lease release disposes RPC and loader handles independently
 of guest settlement. `bindings`, `modules`, or `globalOutbound` violate `P2`.
 The [Worker example](../examples/worker/README.md#code-mode) has the full setup.
 
-Replace `import { DynamicWorkerExecutor } from "@cloudflare/codemode";` with
-`import { workerExecutor } from "@zackbart/connecta/worker";` and use the wiring above.
-Keep the peer. Unbranded executors throw, including bundled upstream copies.
+Keep the Worker's optional peer. Unbranded executors throw, including bundled upstream copies.
 Shipped executors carry a non-enumerable `Symbol.for("connecta.executor")` version/lifecycle brand.
 Custom sandboxes import `customExecutor` from `@zackbart/connecta`, then configure
 `executor: customExecutor(myExecutor, { lifecycle: "self-managed" })`. They own guest termination
@@ -574,7 +572,7 @@ direct calls; and `input_required_invalid`, `input_required_limit`,
 | `invalid_args`               | arguments or discovery bounds were rejected                                                                                                                                                           | false         |
 | `not_found`                  | the downstream answered and the resource is not there — the one code that says skip this id rather than stop, raised only where the provider tells absence from a permission gap                      | false         |
 | `conflict`                   | the write named a base version someone else already moved past; nothing changed. `details.current` says where things stand (at most 20 whole-number entries) — re-read, reapply, retry with that base | false         |
-| `input_required_unsupported` | a downstream asked for input; use `nextAction` for the equivalent direct call                                                                                                                         | false         |
+| `input_required_unsupported` | a downstream asked for input; a read gets `nextAction` for the equivalent direct call, a write is an unknown outcome (`writeOutcome: "unknown"`) to reconcile before any fresh call                   | false         |
 | `rate_limited`               | the downstream reported a rate limit                                                                                                                                                                  | true          |
 | `unavailable`                | the downstream is down or unreachable; optional sanitized `details.host` and `details.code` describe the transport failure without paths, queries, credentials, or provider prose                     | true          |
 | `timeout`                    | a call or sandbox deadline expired; details name operation, stage, elapsedMs, and deadlineMs                                                                                                          | per operation |
@@ -619,7 +617,7 @@ when empty. An empty string reports `program_error` with
 program-authored throw is `program_error`. `details.name` is a bounded engine
 error name; `details.line` is the source line when the runtime supplies one,
 otherwise null. Fixed hints repair imports/require/filesystem access, shadowed
-`connecta`, and invented globals such as `callTool` and `mixpanel`.
+`connecta`, and invented globals such as `callTool`.
 
 An unchanged uncaught host error retains its classification through Error
 identity. A new error containing its message is a new program error. Copied
@@ -877,7 +875,12 @@ Programs and direct calls use the same invocation deadline and stages. A call's
 and request ceilings still bound the whole run. Timeout details are agent-facing;
 operator records retain only checked classifications and numeric facts.
 A dispatched write timeout becomes `write_outcome_unknown` and retains its
-deadline details even when the program catches the failure. The final program
+deadline details even when the program catches the failure. A completed
+maintained-provider call that reports a timeout keeps `timeout` when its complete
+request ledger records an auxiliary resource read and proves that no call-owned
+request or kit auxiliary falsely declared as a read departed, unless an explicit `writeOutcome: "unknown"` overrides that
+proof. Custom `api()` and `remoteMcp()` connectors, invocation deadlines and
+cancellation without a complete answer retain conservative write outcomes. The final program
 error includes the first timeout in `details`; multiple write timeouts also
 appear in `timeouts`, bounded to ten entries.
 
@@ -908,6 +911,13 @@ because connecta enforces them above the sandbox:
 | Result                                                                                  | 24,000 serialized characters                                                                                 |
 | Logs presented to the model                                                             | 4,000 characters                                                                                             |
 
+For any tool whose output declares `page`, continue while `page.hasMore` is true.
+When approaching the program's host-call limit, return `page.nextCursor` before
+the call that would exceed it and continue in the next program with the same
+arguments and that cursor; don't restart.
+For example, return `{ nextCursor: result.page.nextCursor }` after reducing the
+current page, then pass that cursor to the tool in the next program.
+
 Every `call`, `read`, `search`, `describe`, `result`, and `skill` spends one host
 call on entry, before resolution, validation, or dispatch; automatic transfer
 pages of a paged result do not. Catching a local refusal refunds nothing.
@@ -1023,6 +1033,15 @@ sent and records nothing: it was never an attempt (`W9`).
 
 ## Writes
 
+Kit write tools refuse whole `[redacted]` string values (including decoded
+spellings) and withheld links in argument keys/values with `invalid_args`
+before the program runs. Longer prose may mention the marker: for example,
+`{ body: "the log says [redacted]" }` is accepted. Standard hatches and typed
+kit requests refuse any marker containment in paths and queries, including on
+reads. Obtain the original value/link or omit the field when a whole value is
+withheld. Admission checks agent arguments rather than bodies later composed
+from internal reads. Legacy non-kit and remote MCP tools keep their own rules.
+
 Whether an endpoint writes belongs to deployment code. Every deployment sets
 `readOnly` for `/mcp` explicitly; construction fails without it. Each named pool inherits
 the deployment's `readOnly` unless it sets its own, in either direction. The
@@ -1055,13 +1074,21 @@ all calls this deployment can make through it.
 
 | Precedence | Evidence                                                 | Result                                                                                                                                           |
 | ---------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
-| 1          | Exact deployment `classification[connectorId][toolName]` | `read` or `write`, even over a stale provider review                                                                                             |
+| 1          | Exact deployment `classification[connectorId][toolName]` | `read`, `write`, or `hidden`, even over a stale provider review                                                                                  |
 | 2          | `Connector.classification` provider review               | Reviewed writes remain writes; a stale schema digest makes a read a write; an explicit downstream contradiction also invalidates a reviewed read |
 | 3          | Downstream annotations                                   | Read only when `readOnlyHint === true && destructiveHint !== true`; otherwise write                                                              |
 
 Unknown connector override keys fail construction. Unknown static tool keys
-fail construction; unknown remote tool keys fail publication of the whole
-catalog. Overrides are exact tool names, including names containing dots.
+fail construction. An absent runtime-discovered tool leaves its override
+dormant and emits an operator warning once per catalog change; the override applies if the name returns.
+Hidden tools are absent from search and describe and refuse every call, including
+a guessed name. `"write"` selects the host approval path. MCP recovery sends a
+tool only once when either its effective or source class is write, even when an
+override changes write to read. The source class is the verified provider review
+where present during migration, otherwise the server annotations. It also governs
+authorization recovery, program re-runs and ambiguous failure outcomes: after
+dispatch, an unknown outcome has no retry or wait advice, including on timeout or
+cancellation. Overrides are exact tool names, including names containing dots.
 They are never inferred from descriptions or arguments.
 
 **W9.** Programs on a writable endpoint may write. A dispatched write is awaited even
@@ -1071,8 +1098,11 @@ write makes the run fail `write_outcome_unknown` with
 `writes: { succeeded, failed, unknown }`, regardless of its return value.
 A failed program that already wrote carries those counts on its error. No
 write is automatically retried, including an ambiguous timeout. A downstream
-refusal or a tool's `isError` can establish failure; a timeout or an unanswered
-transport failure leaves the outcome unknown.
+refusal can establish failure only when it covers the whole call: a request
+connecta never sent, or an HTTP 4xx refusal (not 408) of the only request the
+call dispatched. A write's `isError`, a timeout, an unanswered transport
+failure, and a custom connector that composed several calls leave the outcome
+unknown.
 
 **W10.** `execute.maxWrites`, default 10, bounds a program's writes in
 addition to the host-call budget. It is checked after argument validation and
@@ -1096,7 +1126,10 @@ omit write tools from `search_tools`, `connecta.search`, and
 `connecta.describe`, and refuse every write call through `call_tool`,
 `call_destructive_tool`, and programs with `read_only_endpoint` before
 validation or dispatch. Guides and skills are documentation and may still name
-those tools. `tools/list` is the same six tools on both. Approval belongs to the client.
+those tools. Meta endpoints list the same six tools in both modes.
+[Native pools](./meta-tools.md#native-tool-surface) list individual downstream
+tools and omit writes when read-only. They retain `execute_code` by default;
+`executeCode: false` replaces it with `read_result`. Approval belongs to the client.
 `readOnly` grants no tool or connector access and cannot be set by guest code,
 request arguments, or a downstream catalog. `execute.approval`,
 `Connector.approval`, per-tool approval exemptions, and pool `trust` are

package/documentation/deploying.md

@@ -3,7 +3,8 @@
 Use this guide when creating or maintaining a deployment. For changes to the
 Connecta package itself, follow [repository policy](https://github.com/zackbart/connecta/blob/main/AGENTS.md).
 For work through an already connected endpoint, use [Operating an endpoint](./operating.md).
-[All agent routes](./README.md) are in the index.
+[All agent routes](./README.md) are in the index. For a cursor signing-key error,
+follow [cursor-key recovery](#recover-a-cursor-signing-key).
 
 ## Choose a deployment
 
@@ -13,7 +14,8 @@ For work through an already connected endpoint, use [Operating an endpoint](./op
 | Docker             | [Container setup in the same Node template](../templates/node/README.md#run-it-in-docker) | Same source and config, persistent named volume                              |
 | Cloudflare Workers | [Worker example](../examples/worker/README.md#deploy)                                     | Workers Paid plan, Worker Loader binding, one D1 database, Cloudflare Access |
 
-These are the two deployment shapes. Docker packages the Node project.
+These are the two deployment shapes. Docker packages the Node project, and
+Alchemy deploys the Worker.
 Templates and their configuration files own the full runnable steps and
 environment-variable names; follow them rather than rebuilding their setup
 from the contract reference.
@@ -50,24 +52,84 @@ Follow the [template README](../templates/node/README.md) for storage paths,
 backups, Docker provisioning, secrets, and optional modules. Run the deployment's
 `npm run typecheck` after configuration changes.
 
+Retain the Node template's `undici` dependency and serve with `listen` from
+`@zackbart/connecta/node`. `listen()` installs the owned sender for every
+maintained-provider request, reads included, remote MCP writes, and downstream
+OAuth token exchange/refresh, dynamic registration and revocation POSTs.
+Its separate pre-auth request buffer defaults to 4 MiB, matching core's
+authenticated `admission.requests.maxBodyBytes` default. To accept larger MCP
+bodies, configure both core and `listen(..., { maxBodyBytes })`; a smaller
+platform, proxy or adapter cap still wins. See
+[request body limits](./architecture.md#admission-in-two-places).
+A Node host serving `connecta.fetch` without `listen()` has no owned sender:
+every maintained-provider write, every reviewed POST read and every remote MCP
+write is refused before sending. Downstream OAuth credential POSTs also require
+that sender; discovery GETs retain native fetch. Resource writes worked in 0.34.1;
+credential POSTs used native fetch through 0.34.1. For example, an `assistant` using
+`vercel_api_read` to POST `/v1/registrar/domains/availability` needs that
+transport even on a read-only endpoint. A Node deployment using only the root
+entry refuses those requests before sending them. Workers use their native
+fetch transport.
+
+By default, Node's `listen()` handles SIGTERM and SIGINT: it stops accepting
+connections, closes idle connections and accepted sockets without a first HTTP
+request, closes request and code admission, reaps sandbox children, and drains
+active responses and deferred work. A connection serving an active response
+closes as soon as all its admitted responses finish, including SSE, without
+waiting for the normal keepalive timeout or for the client to close. Normal
+keepalive before shutdown is unchanged. Its shutdown deadline defaults to ten seconds
+(`shutdownTimeoutMs`). For example, retain the template's `listen(connecta, port)` when running it under
+Docker Compose so `docker compose stop` uses this cleanup.
+
+The owned Node sender connects directly by default. To send maintained-provider
+requests (including reads), remote MCP writes and OAuth credential POSTs through an HTTP(S) CONNECT
+proxy, set `proxy` explicitly on `listen`:
+
+```ts
+listen(connecta, { port: 3000, proxy: "http://proxy.example.com:8080" });
+```
+
+The URL must have an HTTP or HTTPS scheme and no path, query or fragment.
+Optional URL username/password credentials authenticate CONNECT only; they are
+never forwarded to the destination. Load credential-bearing URLs from the
+host's secret configuration. The sender validates the option before listening,
+uses an owned proxy dispatcher for each send, and closes it when the response
+ends or is canceled. TLS certificates for both proxy and destination use Node's
+normal trust configuration; TLS interception requires operator-configured trust.
+
+The sender ignores `NODE_USE_ENV_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY` and global
+dispatchers. Remote MCP reads retain native fetch and its proxy settings; the
+explicit `proxy` option controls only owned sends. Set the host's native-fetch
+proxy policy too if the remote server requires proxy egress for discovery and
+reads. CONNECT failure before destination dispatch is a known unsent failure;
+a connection failure after a write dispatch is unknown and non-retryable.
+Neither case automatically repeats the write. A credential POST is never
+replayed by the sender, including after HTTP 421, a reset or a 503. An uncertain
+refresh requires authorization again; Connecta blocks the spent refresh
+fingerprint rather than redeeming it twice. Once a refresh claim has been
+submitted, that protection remains conservative even if proxy setup later fails.
+Use a fresh authorization flow to reconcile. OAuth discovery remains on native
+fetch and needs its own host proxy policy. These credential POST requirements
+change the native-fetch behavior of 0.34.1.
+
 ## Start on Workers
 
-Follow the [Worker example](../examples/worker/README.md#deploy) to create D1,
-set secrets, configure `PUBLIC_URL` and `LOADER`, and deploy with Wrangler.
-When copying it into a separate repository, follow
-[the separate-project installation](../examples/worker/README.md#copied-into-its-own-repository)
-and pin Connecta's exact version. The optional `@cloudflare/codemode` peer
-must be installed for the Worker executor.
-
-Attach Cloudflare Access to the Worker destination. Interactive MCP clients
-need Managed OAuth, Dynamic Client Registration, and the documented redirect
-allowlist. Machines are declared agents: they use `/agent/<pool>` with the
-agent's `cta_` bearer as their only credential, once the
-[agent bypass application](#agent-endpoints-behind-cloudflare-access) exists;
-Access service identity alone is refused. Keep
-`enable_request_signal`, construct Connecta once per isolate, and pass `ctx`
-through to `fetch`. The example owns those details and
-[the machine-token procedure](../examples/worker/README.md#machine-tokens).
+Use the [Worker example](../examples/worker/README.md) as the canonical runnable
+setup and upgrade guide. Alchemy deploys that example's stack; it owns the
+Worker, D1 database, Worker Loader, secrets, and Access applications.
+
+| Task                                 | Canonical procedure                                                                                                                                                                                            |
+| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Copy and install a deployment        | [Separate-project installation](../examples/worker/README.md#copied-into-its-own-repository), including exact versions, peers, ignore files, and trusted tooling                                               |
+| Deploy or update the stack           | [Deploy](../examples/worker/README.md#deploy), including account permissions and consistent stage selection                                                                                                    |
+| Protect secrets and retain data      | [Secrets and state](../examples/worker/README.md#secrets-and-state) and [destroying and recovering](../examples/worker/README.md#destroying-and-recovering)                                                    |
+| Configure human and agent access     | [Cloudflare Access](../examples/worker/README.md#cloudflare-access), [agent bypass](../examples/worker/README.md#let-agents-through-access), and [machine tokens](../examples/worker/README.md#machine-tokens) |
+| Move an existing Wrangler deployment | [Take over existing resources](../examples/worker/README.md#moving-a-wrangler-deployed-worker-to-alchemy)                                                                                                      |
+| Run locally and verify a deploy      | [Local development](../examples/worker/README.md#local-development) and [verification](../examples/worker/README.md#verify-after-deploying)                                                                    |
+
+Retain the example's [compatibility flags and entrypoint wiring](../examples/worker/README.md#files).
+The [agent bypass notes](#agent-endpoints-behind-cloudflare-access) below record
+verified ingress behavior and the cases that still require verification.
 
 ## Agent endpoints behind Cloudflare Access
 
@@ -76,7 +138,8 @@ alone and which ignores Access context entirely
 ([agent endpoints](./auth.md#agent-endpoints)). Behind Access, the edge must
 let those requests through without an Access login or service token. The P0
 probe ([observations](./architecture.md#production-access-bypass-for-agent-endpoints))
-verified this shape on 2026-10-15:
+verified this shape on 2026-10-15. The Worker example's `alchemy.run.ts`
+declares both applications:
 
 1. Keep the Worker-level application, whose destination is
    `{ "type": "worker", "worker_id": "<the Worker script tag>" }`, exactly as
@@ -166,6 +229,27 @@ personal connectors in their pools.
 [Auth](./auth.md#principals-visibility-and-operators) owns maintainers and members;
 [Clerk setup](./auth.md#clerk-oauth-tokens-and-operator-sessions) owns resource-bound
 tokens and `aud_claim_enabled`. A person's operator session is not an MCP token.
+Several deployments can share one Clerk instance with one Organization each;
+[Clerk Organizations](./auth.md#one-clerk-instance-one-organization-per-deployment)
+owns that setup and its isolation tradeoff.
+
+Public deployments require ingress rate limiting on all authenticated routes,
+including agent, operator, connection-start, and callback paths. Connecta's
+fixed bound of 16 active inbound authorizations per loaded core/process or
+isolate fast-refuses with retryable 503 `authentication_busy` and `Retry-After: 1`.
+A separate allowance of 16 abandoned operations holds stalled work after its
+hard deadline plus one second of grace. While it is full, new authentication
+receives the same 503, the log records `authentication_abandoned_saturated`,
+and `/health` reports `admission.authentication.abandonedSaturated: true`.
+Stalled work counts until it settles or until the garbage collector frees
+everything that could settle it, as after Cloudflare cancels an invocation.
+That second release is eventual, never timed, and needs `FinalizationRegistry`:
+on Workers, `enable_weak_ref` or a compatibility date of 2025-05-05 or later.
+`/health` reports `admission.authentication.unreachableRelease`.
+These bounds limit outstanding work, not requests per second or a quota shared by several
+isolates or deployments. Budget ingress across the identity-provider account;
+see [authentication capacity](./auth.md#authentication-capacity-and-ingress-limiting)
+for route coverage and the interaction with MCP execution admission.
 
 Every deployment must set `readOnly` in its configuration; startup fails without
 it, and the template and Worker example set `readOnly: false`. Each named pool
@@ -230,14 +314,74 @@ Bump the exact package pin, read the [changelog](../CHANGELOG.md) for every
 intervening release, and apply the relevant migration before startup. `init`
 does not merge changes into an existing deployment.
 
+For an existing Node deployment, add the Node entry's pinned optional peer
+before starting the upgraded package: `npm install --save-exact undici@6.29.1`.
+The current Node template already declares this dependency.
+
+For 0.35.0, serve Node with `listen` from `@zackbart/connecta/node`, as the
+current template does. Without `listen()`, a host serving `connecta.fetch` has
+no owned sender: every maintained-provider write, every reviewed POST read and
+every remote MCP write is refused before sending, although each worked in 0.34.1.
+Downstream OAuth token, registration and revocation POSTs also require that
+sender. With `listen()`, every maintained-provider request, reads included,
+remote MCP writes and those credential POSTs use the owned sender. Configure
+`listen(..., { proxy })` explicitly for HTTP(S) CONNECT proxy egress; ambient
+`NODE_USE_ENV_PROXY`, `HTTP_PROXY`, `HTTPS_PROXY` and host proxy dispatchers do
+not configure it. Remote MCP reads and OAuth discovery GETs retain native fetch
+and need their own host proxy policy. An uncertain refresh requires fresh
+authorization rather than replaying the spent token. See [Start on Node](#start-on-node).
+
+Authenticated MCP bodies now default to 4 MiB through
+`admission.requests.maxBodyBytes`; Node's separate pre-auth buffer also defaults
+to 4 MiB. Configure both core and `listen(..., { maxBodyBytes })` if a deployment
+must accept larger bodies. Smaller platform or proxy limits still apply.
+
+After a dispatched write reports an unknown outcome, read the target before
+making another write. Programs retain that outcome even when guest code catches
+the error; see [Writes](./code-mode.md#writes). Provider
+continuations now bind their connection, credential owner and read arguments;
+connections with caller-dependent downstream identities also bind the admitted
+caller and pool owner. Follow each provider's migration rules for old cursors.
+No database conversion or agent-token rotation is required solely for 0.35.0.
+
+Native pools and code-off result paging are optional; existing pools keep the
+meta-tool surface. See [Native tool surface](./meta-tools.md#native-tool-surface).
+Vercel workload admission and the separate Eve helper are also opt-in; existing
+agent tokens keep working. See [Vercel workload credentials](./auth.md#vercel-workload-credentials)
+and [Eve agents](./meta-tools.md#eve-agents).
+
+- [Provider migration for 0.35](./provider-migration-0.35.md) collects provider upgrade actions for 0.35.0, including removal of Infisical, Notion, and Mixpanel factories.
 - [Migration to 0.34](./migration-0.34.md) covers the Overview landing page, Endpoints at `/endpoints`, default browser titles, and Workspace discovery in owner-less agent pools. No storage migration or token rotation is needed from 0.33.
 - [Migration to 0.33](./migration-0.33.md) maps every removed access option to `maintainers`, pool `members`, and `agents`, moves agents to `/agent/<pool>`, and covers pool owners, token revisions, operator contract v2 with its operator route changes, and the pre-auth listen fix.
 - [Tokens issued before agents](./auth.md#agent-tokens-and-upgrading-from-earlier-tokens) stop admitting until each machine's token is bound once to a declared agent with `npm run adopt-token -- <token-id> <agent>` (Node) or `AccessTokenManager.adopt`, which keeps its secret. Human-bound tokens stay refused; issue those agents new tokens. Pool members name `"agent:<name>"` instead of matching token record ids.
 - [Node storage from 0.28](../templates/node/README.md#storage) uses `connecta migrate-state` to copy the JSON state into SQLite. Activity JSONL is not imported.
 - [Worker storage from 0.28](../examples/worker/README.md#upgrading-from-028) copies KV into D1 with a one-shot migration.
-- [Notion, Vercel, and Cloudflare for 0.29](./provider-migration-0.29.md) change defaults and retained API tool names.
+- [Worker deployments on Wrangler](../examples/worker/README.md#moving-a-wrangler-deployed-worker-to-alchemy) move to Alchemy once, adopting the Worker, D1 database, and Access applications so the script tag and Access AUD stay unchanged.
+- [Notion, Vercel, and Cloudflare for 0.29](./provider-migration-0.29.md) records historical defaults and retained API tool names.
 - [Executor wiring](./code-mode.md#deploy-time-capability) requires branded shipped executors or a self-managed custom executor.
 
+## Recover a cursor signing key
+
+Paged API discovery and bound list continuations use one signing key in the
+deployment store. A load failure returns retryable `unavailable` and names the
+cursor signing key without revealing its value. Restore database connectivity
+first, then retry the call. A valid key already cached by a process keeps working.
+
+If the stored key is corrupt, pause incoming traffic and stop every Node process
+(or prepare a fresh Worker version), then delete only this row from the
+existing SQLite/D1 database:
+
+```sql
+DELETE FROM connecta_kv WHERE key = 'continuation-key:v1:signing';
+```
+
+Restart all Node processes or switch all traffic to the fresh Worker version
+before accepting requests again, so no instance retains an older cached key.
+The next paged call creates one replacement key atomically. Do not print or
+inspect its value. Outstanding cursors signed with the old key fail
+`invalid_args`; start each affected search, details walk or list at its first
+page. Other deployment state and credentials remain in the database.
+
 ## Contributor reference
 
 ### Implementation and evidence