Thank you for improving OpenMozi. Contributions must preserve truthful runtime behavior, user privacy, and parity between the Web/Docker and macOS App surfaces.
- Search existing issues first.
- Use the structured Bug, Feature, or Documentation form.
- Never post credentials, tokens, personal data, private paths, proprietary documents, or unredacted logs.
- Report vulnerabilities through GitHub Private Vulnerability Reporting, not a public issue.
- Fork or branch from the current
main. - Read
AGENTS.mdanddocs/CONSTITUTION.mdbefore changing runtime behavior. - Keep Web and macOS App behavior in shared code unless a platform requirement is documented.
- Add or update regression coverage with the implementation.
- Run the relevant local tests and
pnpm verify:public-export. - Open a focused pull request using the repository template and report only checks that actually ran.
GitHub Actions report deterministic policy, type, unit, integration, and E2E checks. Contributors must still provide focused local verification for the changed behavior; a skipped or missing check is not proof that a change passed.
Before every push, inspect the staged diff and remove secrets and private data. OpenMozi also enables GitHub Secret Scanning and Push Protection, but contributors must not rely on server-side detection as their only control.
Release-related changes must preserve the fail-closed rules in docs/RELEASE.md: unsigned builds are labeled as such, signed builds require verifiable Developer ID and notarization evidence, and GitHub Releases must contain checksummed artifacts rather than an empty release page.