Contributing¶
Mallow now has a runtime-installation/verification preview. The complete runtime lifecycle, multimedia setup, bottle/launch and kernel-sandbox features remain unfinished. See the roadmap, bootstrap addendum and installer design. Osallistumisohje suomeksi.
Start here¶
Read CONTRIBUTING.md, development setup and architecture tour. Testers should use the Mac checklist; documentation contributors should read writing docs.
The ground rules¶
Be kind. Reference substantial work, use the correct licence and sign off your own contributions truthfully. Never copy GPL frontend implementations, proprietary CrossOver files or vendor payloads into the project. Cite new environment/registry/DLL rules. Use harmless synthetic tests, not real malware. Report security vulnerabilities privately.
Every change reviews tests, README, CHANGELOG, ROADMAP and affected docs/ and docs-fi/ pages. Separate implementation, automated evidence, publication and actual Mac tests. Keep dated posts historical. Performance work needs measurement or explicit implementation-level wording; speed never excuses skipped checks or weaker security defaults.
Security/governance review rules remain in CONTRIBUTING.md and GOVERNANCE.md. Owner-directed AI work is not a second independent reviewer, maintainer or DCO certification.
Where help is needed now¶
| Work | Starting point |
|---|---|
| Actual-Mac setup, accessibility and performance | Preview tests, #44 |
| Model/format completeness | WF0 #9, DESIGN.md §3.4/§3.7 |
| Capabilities, media dependencies and lifecycle | Installer boundary, the open roadmap tasks |
| Secure bottle/launch pipeline | Security model and its unverified integration work |
| Finnish/English docs and loader behavior | Both user-site trees and generated-output checks |
| Assumption verification | DESIGN.md §11, with actual hardware/OS/result |
Changing the design¶
Do not silently redefine normative APIs, persisted formats, security defaults or release gates. Document proposals and staged exceptions, preserve completed/unfinished distinctions, and follow the review process. Early setup interfaces do not replace the full target architecture.
Getting help¶
Use Discussions, reproducible issues and the full rules. Sensitive reports belong in the private security channel.