Pamiya is currently an architecture-first project. Contributions should make the execution model more explicit, testable, and safe rather than merely adding integrations.
- All contributions are licensed under Apache-2.0.
- Use Developer Certificate of Origin sign-off:
git commit -s. - Do not copy code, prompts, diagrams, schemas, or documentation from a source whose license is unknown or incompatible.
- AI-assisted contributions remain the contributor's responsibility for correctness, provenance, security, and license compliance.
- Never commit credentials, real customer data, model transcripts containing sensitive data, or device identifiers.
Create or update an ADR when a change affects:
- protocol compatibility;
- durable state semantics;
- retry or effect safety;
- tenant isolation;
- trust boundaries;
- dependency or license posture;
- public SDK contracts.
An ADR must state context, decision, alternatives, consequences, migration, and verification.
A pull request adding a dependency must document:
- package, version, source, and SPDX identifier;
- direct or transitive use;
- runtime, build, or development role;
- static, dynamic, process, or external-service boundary;
- distribution and SaaS implications;
- required notices and source offers;
- security maintenance status;
- a no-dependency or more permissive alternative.
See docs/17-technology-and-licenses.md and LICENSES/README.md.
- schemas and protocol contracts are updated;
- state transitions and failure cases are documented;
- unit, model, integration, or conformance tests cover the change;
- logs and events define redaction and data classification;
- migrations are reversible or have an explicit roll-forward plan;
- user-facing behavior is observable and auditable;
- generated artifacts and SBOMs are reproducible.