Initial curated itworx-knowledge-hub source from 3b1751d0d9dee551aa6994eee0093704dc334817

CONTRIBUTING.md

@@ -0,0 +1,33 @@
+# Contributing
+
+Thank you for helping improve ItWorx Knowledge Hub.
+
+## Before opening a change
+
+- Keep MCP transport outside this repository.
+- Use synthetic fixtures; never commit real knowledge, credentials, server addresses,
+  database dumps or production evidence.
+- Preserve knowledge provenance, classification, redaction and publication approval.
+- Treat agent settings and memory as internal development policy, never public source.
+- Preserve server-side authorization, ETag concurrency and reversible data flows.
+- Treat LeafWiki sources as immutable and read-only.
+- Add behavior-focused tests and update documentation with the implementation.
+- Do not weaken a gate or delete a failing test to make a change pass.
+
+## Local checks
+
+```bash
+corepack pnpm install --frozen-lockfile
+node scripts/verify.mjs --fast
+```
+
+Run `node scripts/verify.mjs --ci` before requesting review when Docker and
+Testcontainers are available. Changes to migrations, imports, authorization,
+attachments or backup/restore need focused integration tests against real PostgreSQL.
+
+## Pull requests
+
+Explain the user-visible outcome, security and migration impact, verification performed
+and any remaining external validation. Also explain privacy and publication impact when
+relevant. Keep commits reviewable and do not mix private deployment evidence into
+reusable product changes. Report vulnerabilities according to `SECURITY.md`.