The most useful contribution right now is disagreement. The code is a skeleton; the design is what will be hard to change later. If you think a rule in docs/EVIDENCE-STATES.md is wrong, saying so is worth more than a pull request.
These are not backlog items, unfunded ideas, or things awaiting a maintainer with time. They will not be built, and a pull request adding one will be closed regardless of how it is implemented or what it is for.
No integration with PimEyes, FaceCheck.ID, FaceSift, Clearview, or any comparable service. No building one. No "just for verifying a source's identity", no "only for public figures", no optional flag, no self-hosted variant.
A tool that identifies strangers from photographs is a stalking instrument. What it is used for on a given day does not change what it is, and the population harmed by it is not the population it is built for.
Reverse image search deep links are provided and are a different thing: they find where a picture appeared, they upload nothing until you click, and they run on the provider's site under the provider's terms. Where a provider's results may include face matches, we say so before the click.
Using stylometry to attribute anonymous or pseudonymous text to a known person, or to link two texts to one author. This is the same instrument aimed at writers, and it endangers exactly the people — sources, whistleblowers, dissidents, pseudonymous critics — that the audience for this tool depends on.
The Framing panel measures properties of text. It will not gain a comparison mode, an author fingerprint, a corpus of known authors, or an API that would make one easy.
Not a percentage, not a confidence, not a badge, not a "likely" label. See the README for why the evidence says this cannot be built responsibly. The stylometric module describes measurable properties and makes no authorship claim in any string it produces; a patch that adds one will not be merged.
No truth score, credibility score, trust rating, or single number summarising a page. The three panels are never combined, averaged, or reduced to a badge or a colour. This is enforced structurally — no code path reads two panels — and a patch that introduces one is a P0 bug, not a feature.
No analytics, no error reporting to a server, no anonymous usage statistics, no "help us improve" prompt. Absent, not opt-out.
Nothing is placed on a left–right spectrum and no ideology is attributed to an author or an outlet. Rhetorical technique is described with the triggering spans shown; the reader draws the conclusions.
No archive-mirror substitution to read past a paywall, no bypass headers, no cookie tricks, no ignoring robots.txt or rate limits. Paywalled sources are disclosed and linked.
pnpm install # Node 22+, pnpm 11+
pnpm dev # then load apps/extension/dist as an unpacked extension
pnpm verify # everything CI runs: codegen drift, lint, format, types, tests, build, budgetsFor the optional proxy: cd apps/api && uv sync --all-groups && uv run pytest.
packages/shared/schema/analysis.schema.json defines every result. Zod types and Pydantic models are generated from it, and both are committed so a reader sees the types the code actually uses. Change the schema, run pnpm codegen, commit the result — CI fails if they drift.
Do not hand-edit anything under src/generated/.
- No placeholder code. No
TODO: implement, no function whose body is a comment, no stub returning fake data outside a module named for being a fixture. - Tests alongside, not after. Every pure function in
packages/corehas unit tests. Don't mock the code under test. - Don't abstract before the second use. No plugin systems, registries, or config-driven frameworks with one implementation.
- Run it before saying it works. Paste the output.
- Conventional commits, one logical change each. The history should read as an explanation of the system.
- Record decisions as you go. A choice with a real argument against it belongs in
DECISIONS.mdwith that argument written down. A departure from the specification belongs inDEVIATIONS.mdwith the reason.
- A confidence number rendered in the interface without a reliability diagram and a calibration figure behind it.
- A citation, quote, or source that was not fetched during that request.
- A language model assigning a stance, a claim state, or a fact. Its job is extraction, decontextualisation, question generation, query generation, and neutral summary of passages it was handed — nothing else.
- Absence of a signal rendered in a warning colour. Missing metadata means nothing, and the interface must not suggest otherwise.
- A new lexicon without a
PROVENANCE.mdstating source, licence, derivation, and date. CI enforces this. MPQA is GPL, NRC EmoLex and VAD are non-commercial, LIWC is proprietary — none may be bundled. - Page-derived text that can trigger a tool call, a fetch to a page-supplied URL, or a configuration change.
Detectors are English-only and the panel refuses non-English text rather than approximating. The detector registry is structured so a language pack is a contribution rather than a rewrite — that contribution is very welcome, and it needs its own reference corpus and its own evaluation subset, not just translated cue lists.
Any change touching a scoring or retrieval path runs the evaluation harness in CI. Results commit to eval/results/ so regressions show up in a diff. Single-run numbers are not results; report variance across seeds.
Release-blocking, and enforced in code rather than in review:
- Quote-verification failure rate must be 0 on a full run. Not low.
- Injection canary pass rate must be 100%.
- Any statistical text signal above 5% false-positive rate on the non-native-English subset does not ship enabled by default.
CODE_OF_CONDUCT.md. Argue with the design as hard as you like; the standard applies to how you treat people, not to how strongly you disagree.
Contributions are Apache-2.0, matching the project. By opening a pull request you affirm you have the right to contribute the code under that licence.