# Contributing

This is an independent mobile repository, not the upstream Yuvomi project.
Discuss substantial changes with the community maintainer before submitting a PR.
Do not open upstream issues or submit upstream patches on somebody else's behalf.

Use `feat/`, `fix/`, or `docs/` branches and Conventional Commits. Keep commits
reviewable and scoped. Preserve existing work. Run the relevant tests, lint,
`python3 scripts/check-repository.py`, and `git diff --check` before committing.
Add regression tests with security fixes, and demonstrate that the test fails
without the fix. Do not commit build outputs, credentials, private signing keys,
local servers, generated fixture certificates, or production household data.

Keep platform integrations native and dependencies minimal. The server owns
business logic, authentication, CSRF, and authorization. Never solve compatibility
by disabling TLS, accepting every origin, or copying a browser's session cookies.
Upstream prohibits frontend frameworks, bundlers, and transpilers in its own
codebase; we make no changes to it. Read its CONTRIBUTING, SECURITY, and DESIGN
before proposing an upstream integration.

This code was drafted with OpenAI through OpenCode. Disclose AI assistance in PRs
(one sentence is sufficient), as upstream requests. Generated code and automated
reviews do not replace human review. No merge, release, public issue, or store
publication happens automatically. Security-sensitive code needs human review.

See `docs/build-android.md`, `docs/build-ios.md`, and `docs/validation.md`.
The portable Swift package checks shared production policy, not the iOS app.