# Contributing

AAISA welcomes public research contributions through issues and pull requests. Contributions must preserve the project's defensive, local-first, evidence-first boundaries.

## Development setup

```bash
python3 -m venv .venv
source .venv/bin/activate
python -m pip install -e .
python -m unittest discover -s tests -v
```

No external dependency is required for the foundation. Discuss new runtime dependencies before adding them.

## Contribution workflow

1. Open or select an issue that describes the research question or defect.
2. Create a focused branch from `main`.
3. Add implementation, positive tests, negative tests, and documentation.
4. Run the full unit-test suite and a scan of `examples/`.
5. Open a pull request using the repository template.
6. Address review comments and keep commits focused and attributable.

## Rule proposal requirements

Every new rule must document:

- threat or policy condition;
- supported artifact classes;
- deterministic detection logic;
- evidence and redaction behavior;
- severity rationale;
- remediation guidance;
- known false positives and evasion limits;
- positive, negative, and ambiguous tests;
- expected performance on large artifacts.

Rules must not execute scanned content, access the network, modify source files, or place full credential values in reports.

## Commit guidance

Use a concise imperative subject, such as `Add SPDX provenance rule`. Keep unrelated changes separate. Reference the relevant issue in the pull request.

## Review standard

Maintainers evaluate correctness, tests, safety invariants, research reproducibility, report compatibility, performance, and documentation. Security-sensitive changes may require a private review before public discussion.