Contributing

Branch from main, open a PR against main using the PR template, and check the PR checklist before requesting review.

Before every commit

npm run typecheck
npm run lint
npm run lint:warning-budget   # must stay 0/0
npm run test:run              # or the focused file you touched

Code standards

• TypeScript strict, no any — narrow from unknown (Zod preferred).
• No console.log — structured logging via emitEvent() from

@/lib/observability/logger.

• Auth on every API route — getCurrentUser(request.headers), handle the

missing case; role-check admin routes.

• Prisma — select minimal fields; scope by firmId (tenant client).
• UI — shadcn/ui primitives from @/components/ui; Tailwind with OKLCH

tokens, dark theme default.

• AI-generated legal work — preserve citations, approval routing, and

prompt/eval visibility (see ai-system).

• Uploads — pending record → storage PUT → confirmation; clean up failures.
• Realtime — scope socket/SSE events by firm, user, case, or portal session.

Tests required with the change

New/changed protected routes need route tests (401/403/happy/invalid/tenant). Behavioral UI changes need component or Playwright coverage. Record evidence per testing.

Docs required with the change

Update the matching docs/dev/ page when changing: APIs, AI prompts/citations/ evals/approval queues, background jobs, realtime/SSE/sockets, storage/uploads, deployment, release/rollback. Feature readiness labels must match feature-status — never claim production-ready without QA evidence.

Commit messages

Imperative, why-focused: Add idle timeout for session security, Fix closure bugs in 7 API routes. Group docs-only and code changes so releases read cleanly (see changelog).