enuxia-frappe-aio/CONTRIBUTING.md

Contributing

Development principles

Every change must preserve these rules:

1. The controller remains unprivileged.
2. The controller never accesses Docker directly.
3. The controller never executes arbitrary system commands.
4. Privileged behavior belongs in the local agent.
5. Agent operations are typed and explicitly allow-listed.
6. Requests and responses are bounded and validated.
7. State-changing work is persisted.
8. Backup verification remains read-only.
9. Docker resources are discovered through labels, not physical names.
10. Tests accompany protocol and security-boundary changes.

Local verification

cargo fmt --all -- --check
cargo check --workspace
cargo test --workspace
git diff --check

Commit messages

Use concise Conventional Commit-style messages where practical:

feat: expose bounded service logs through agent
fix: reject unsafe backup identifiers
refactor: remove Docker access from controller
docs: document restore safety model

Protocol changes

Protocol changes require stable JSON-shape tests, serialization round trips, compatibility consideration, and strict validation.

Do not add a generic shell-command request.