34 lines
1.4 KiB
Markdown
34 lines
1.4 KiB
Markdown
# Contributing
|
|
|
|
Thank you for helping improve ItWorx Knowledge Hub.
|
|
|
|
## Before opening a change
|
|
|
|
- Keep MCP transport outside this repository.
|
|
- Use synthetic fixtures; never commit real knowledge, credentials, server addresses,
|
|
database dumps or production evidence.
|
|
- Preserve knowledge provenance, classification, redaction and publication approval.
|
|
- Treat agent settings and memory as internal development policy, never public source.
|
|
- Preserve server-side authorization, ETag concurrency and reversible data flows.
|
|
- Treat LeafWiki sources as immutable and read-only.
|
|
- Add behavior-focused tests and update documentation with the implementation.
|
|
- Do not weaken a gate or delete a failing test to make a change pass.
|
|
|
|
## Local checks
|
|
|
|
```bash
|
|
corepack pnpm install --frozen-lockfile
|
|
node scripts/verify.mjs --fast
|
|
```
|
|
|
|
Run `node scripts/verify.mjs --ci` before requesting review when Docker and
|
|
Testcontainers are available. Changes to migrations, imports, authorization,
|
|
attachments or backup/restore need focused integration tests against real PostgreSQL.
|
|
|
|
## Pull requests
|
|
|
|
Explain the user-visible outcome, security and migration impact, verification performed
|
|
and any remaining external validation. Also explain privacy and publication impact when
|
|
relevant. Keep commits reviewable and do not mix private deployment evidence into
|
|
reusable product changes. Report vulnerabilities according to `SECURITY.md`.
|