Yuvomi Mobile Contributors
2d12491516
Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.
1.6 KiB
Contributing
This is an independent mobile repository, not the upstream Yuvomi project. Discuss substantial changes with the community maintainer before submitting a PR. Do not open upstream issues or submit upstream patches on somebody else's behalf.
Use feat/, fix/, or docs/ branches and Conventional Commits. Keep commits
reviewable and scoped. Preserve existing work. Run the relevant tests, lint,
python3 scripts/check-repository.py, and git diff --check before committing.
Add regression tests with security fixes, and demonstrate that the test fails
without the fix. Do not commit build outputs, credentials, private signing keys,
local servers, generated fixture certificates, or production household data.
Keep platform integrations native and dependencies minimal. The server owns business logic, authentication, CSRF, and authorization. Never solve compatibility by disabling TLS, accepting every origin, or copying a browser's session cookies. Upstream prohibits frontend frameworks, bundlers, and transpilers in its own codebase; we make no changes to it. Read its CONTRIBUTING, SECURITY, and DESIGN before proposing an upstream integration.
This code was drafted with OpenAI through OpenCode. Disclose AI assistance in PRs (one sentence is sufficient), as upstream requests. Generated code and automated reviews do not replace human review. No merge, release, public issue, or store publication happens automatically. Security-sensitive code needs human review.
See docs/build-android.md, docs/build-ios.md, and docs/validation.md.
The portable Swift package checks shared production policy, not the iOS app.