# Contributing to Rivox
Thank you for your interest in contributing to Rivox! As a universal polyglot build coordination layer, Rivox relies on a robust, deterministic, and high-performance Rust core.
---
## The Architectural Constitution
Before contributing, please review our **Architectural Constitution**. All Pull Requests MUST strictly adhere to these 10 rules:
1. **Never implement a dependency resolver.** Rivox delegates 100% of dependency resolution to native ecosystem tools (`uv`, `cargo`, `pnpm`).
2. **Native package managers remain the source of truth.**
3. **Native lockfiles (`uv.lock`, `Cargo.lock`, `pnpm-lock.yaml`) remain authoritative.**
4. **Rivox only coordinates build graphs.**
5. **Every operation must be deterministic.** Zero non-deterministic inputs (such as un-seeded timestamps or un-ordered iterations) are permitted in graph or lockfile evaluation.
6. **Every build must be reproducible.**
7. **Every cache must be content-addressed (CAS).**
8. **AI must NEVER participate in build decisions.**
9. **Never replace existing native package ecosystems.**
10. **Everything must be auditable.** Emits standards-compliant SLSA, in-toto, SPDX, and Sigstore provenance.
---
## Development Workflow
### Prerequisites
- Rust 1.75+ (edition 2021)
- `uv` (>=0.4)
- `cargo` (>=1.75)
- `pnpm` (>=9.0)
### Local Setup
```bash
git clone https://github.com/aaryanrwt/rivox.git
cd rivox
cargo check
cargo test
```
### Code Formatting & Linting
All code must pass `cargo fmt` and `cargo clippy` without warnings:
```bash
cargo fmt --check
cargo clippy --all-targets -- -D warnings
```
---
## Submitting Pull Requests
1. Fork the repository and create a feature branch (`git checkout -b feature/my-feature`).
2. Ensure unit tests and integration/conformance tests pass (`cargo test --all-targets`).
3. Include clear commit messages following Conventional Commits format (`feat:`, `fix:`, `docs:`, `perf:`).
4. Submit your PR against the `main` branch.
For security vulnerabilities, please do NOT open a public issue. See [SECURITY.md](SECURITY.md) for confidential reporting instructions.