SHA256
Yuvomi Mobile Contributors
2d12491516
Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.
28 lines
1.6 KiB
Markdown
28 lines
1.6 KiB
Markdown
# Contributing
|
|
|
|
This is an independent mobile repository, not the upstream Yuvomi project.
|
|
Discuss substantial changes with the community maintainer before submitting a PR.
|
|
Do not open upstream issues or submit upstream patches on somebody else's behalf.
|
|
|
|
Use `feat/`, `fix/`, or `docs/` branches and Conventional Commits. Keep commits
|
|
reviewable and scoped. Preserve existing work. Run the relevant tests, lint,
|
|
`python3 scripts/check-repository.py`, and `git diff --check` before committing.
|
|
Add regression tests with security fixes, and demonstrate that the test fails
|
|
without the fix. Do not commit build outputs, credentials, private signing keys,
|
|
local servers, generated fixture certificates, or production household data.
|
|
|
|
Keep platform integrations native and dependencies minimal. The server owns
|
|
business logic, authentication, CSRF, and authorization. Never solve compatibility
|
|
by disabling TLS, accepting every origin, or copying a browser's session cookies.
|
|
Upstream prohibits frontend frameworks, bundlers, and transpilers in its own
|
|
codebase; we make no changes to it. Read its CONTRIBUTING, SECURITY, and DESIGN
|
|
before proposing an upstream integration.
|
|
|
|
This code was drafted with OpenAI through OpenCode. Disclose AI assistance in PRs
|
|
(one sentence is sufficient), as upstream requests. Generated code and automated
|
|
reviews do not replace human review. No merge, release, public issue, or store
|
|
publication happens automatically. Security-sensitive code needs human review.
|
|
|
|
See `docs/build-android.md`, `docs/build-ios.md`, and `docs/validation.md`.
|
|
The portable Swift package checks shared production policy, not the iOS app.
|