Contribution and quality

Change workflow

• Keep changes focused and preserve unrelated working-tree modifications.
• Define shared API or IPC contracts before adapting producers and consumers.
• Add or update Prisma migrations for persistence changes.
• Update the affected wiki articles and plans in the same change.
• Record architectural choices in the decision register.

Current baseline

The 2026-08-28 audit found placeholder gates and no tracked test suite.¹ The 2026-08-29 remediation replaces that baseline:

• all five applications/packages typecheck and build;
• ESLint executes real TypeScript targets;
• unit tests cover authorization and outbound retry classification;
• integration tests exercise PostgreSQL, MinIO, tenant isolation, OAuth replay, refresh reuse, timer concurrency, idempotency and durable-job lease recovery;
• Knip checks unused files/dependencies/exports and the duplicate admin source tree has been removed;
• the production dependency audit reports no known advisories at moderate-or-higher policy;
• release and deploy workflows depend on a blocking shared quality job.

The 2026-08-30 expanded run adds Agent CLI, telemetry governance/projector, customer, report worker/bundle/renderer and Admin DOM suites. Ten clean migrations and seed pass; the final integration suite covers 11 files/39 tests and restores the exercised PostgreSQL database into a second empty database with exact representative counts. Every workspace check/build plus dead-code, configuration, OpenTofu and knowledge gates passes. Separate canaries prove representative customer/CTO/compliance/Hubstaff volume, real LibreOffice conversion and ClickHouse load/restore. External canaries and reviews remain separate evidence rather than implicit consequences of a local pass.²³⁴

Executable gates

Run these from the repository root:

Command	Contract
pnpm typecheck	Typecheck every workspace
pnpm lint	Execute ESLint over repository TypeScript/JavaScript
pnpm test:unit	Run deterministic unit tests
pnpm test:integration	Start isolated PostgreSQL/MinIO, apply all migrations and run integration/security cases
pnpm build	Build shared, backend, desktop, admin and website
pnpm audit --prod --audit-level=moderate	Block on production advisories at policy threshold
pnpm deadcode:check	Detect unused files, dependencies and exports
pnpm config:check	Render/validate Compose and Kustomize configuration
pnpm infra:check	Format-check and validate OpenTofu modules
pnpm knowledge:lint	Validate OKF frontmatter, links, index and provenance
pnpm license:check	Require consistent first-party AGPL-3.0-only metadata and desktop license resources
pnpm desktop:supply-chain:test	Verify inventory attribution, license policy and packaged notices

First-party contributions follow the licensing contract. Preserve third-party notices and provenance; the static CI gate runs both license checks above. Public corresponding-source availability remains a release requirement, separate from local tests.⁵

scripts/ci-quality.sh remains the complete local wrapper: it runs the production dependency audit and then scripts/ci-quality-core.sh. Remote Quality makes that same fail-closed audit a required prerequisite before starting the aggregate core, renderer or native matrix, so an advisory-service outage cannot spend the expensive runner budget.⁶ Remote protected-branch results, signed desktop packages and release canaries remain required delivery evidence.

Regression priorities

Keep tenant crossover, ownership, OAuth replay/revocation, concurrent timer starts, retried writes, worker lease expiry and object-storage consistency in the blocking suite whenever their contracts change.

Selective Quality checks — 2026-09-09

Published and fully qualified after the daily-report deployment exposed unnecessary native builds: server/web-only changes skip the desktop renderer and native matrix; shared TypeScript or renderer changes retain desktop JavaScript checks without native compilation. Native, release/version, dependency/build tooling and unknown paths retain full qualification. Push scope includes all changes since the last successful trusted ancestor, so cancelled or failed earlier changes cannot be hidden by a later backend-only push; unavailable history/API falls back to all checks. A final always-running gate validates every selected job and each intentional skip. Deploy uses that exact-commit gate, while desktop release still requires every native lane and renderer check. Native caches now include Core/CLI’s root workspace as well as Tauri. All 72 delivery tests and the actual local web-only static wrapper pass. Remote run 34323687575 passed all ten jobs, including four native lanes and the final gate. The subsequent evidence-only push passed scoped run 34326563951 in 2m 46s, intentionally skipping every desktop job. The actual exact-SHA consumer accepted it for deployment and rejected it for a full desktop release.⁷⁸ Existing CIR residual work is not closed by this change.⁹

Footnotes

1. Full technical audit at v0.2.18. ↩

2. Coordinated plan-foundation quality gates. ↩

3. Active workstream quality, load and recovery evidence. ↩

4. Residual active-plan repository-local closure. ↩

5. AGPL-3.0-only consistency and packaging gates. ↩

6. Fail-fast production dependency audit gate. ↩

7. Successful full qualification of selective Quality. ↩

8. Successful scoped remote Quality and consumer verification. ↩

9. Selective Quality checks and native workspace cache. ↩