Contributing

Contributions of Firehall-authored code are MIT licensed. Preserve upstream licenses and brand source checksums. See the root contribution/security policies for review and private reporting guidance.

Use bin/bootstrap and npm run dev, with --preview only when intentionally working on fictional UI data. Run formatting/lint, type checks, unit/component tests, relevant builds, and browser/native checks for affected consumers.

Shared/core and tokens must stay platform-neutral. UI components accept props and emit events, with no application transport/store dependency. Native views are NativeScript, not WebViews. Never commit private department data, service accounts, signing files, credentials, device tokens, or .env.

Test output and scratch work live in .firehall. CI invokes the same bin/ci scripts as local contributors. Plans, progress reports, verification logs and implementation notes also belong in .firehall, not the public docs site. Pull-request jobs have no deployment secrets; manual deployment jobs use protected environments. Changes to shared tooling, tokens, UI, and lockfiles must trigger their consumers, including backend theme and native checks.