Skip to main content

Contributing

The repository is not yet open to outside contributions

The agreement exists so that it can be, without improvising on the day. Bug reports and design objections are welcome right now.

What needs no formality​

Reporting a bug. Proposing a change. Disputing a design decision. Reading the documentation and saying what is unclear.

On a crisis management tool, a precise report — what you were doing, what you expected, what happened — is often worth more than a patch.

What needs a signature​

Submitting code, documentation, a translation, a verification suite.

  1. Sign the register — one line in accords/registre.md, in your first merge request. That line is the signature.
  2. Sign off your commits — git commit -s, that is the Developer Certificate of Origin 1.1.

The contributor keeps their copyright and grants a broad licence, relicensing included. In return, the agreement binds the project: immediate free publication, no withdrawal of what has been published, core kept under a free licence.

If you contribute as part of your job, the entity agreement applies: under French law, rights in software written by an employee in the course of their duties belong to the employer.

What is expected of a patch​

pnpm typecheck && pnpm verif && pnpm accords

One more guarantee in pnpm verif. A fix with no check that failed before and passes after is not finished.

The rule never to break. Every mutation of a crisis's state goes through enregistrer(). A direct insert into a projection table produces a state that replay will not rebuild — that is, a black box that lies.

Comments that say why. A comment paraphrasing the next line will be removed; a comment saying why that line is not what you would write elsewhere will be kept.

French. Function, table, variable and route names, error messages, comments.

Error messages address someone under pressure. They say what happened and what to do next.

Reporting a security flaw​

Do not open a public issue

Write to contact@kourser.bzh, describing the exploitation path and the effect obtained.

Kastell serves precisely when the information system is compromised. A flaw published before a fix does not inconvenience a vendor: it hits organisations that are already under attack.