how to contribute development workflow

Development workflow

MyPrompt is a standalone SAFRS capsule at the repository root. Every lifecycle command runs from that directory and this capsule's own manifest, lockfile, source, Prisma schema, generated output, scripts, and tests. Nothing may require the surrounding Monorepo.

Lifecycle contract

project.contract.json declares the executable stages. AGENTS.md repeats the same table.

Stage	Program	Arguments
install	pnpm	install --frozen-lockfile
lint	pnpm	run lint
typecheck	pnpm	run typecheck
test	pnpm	run test
build	pnpm	run build
run	pnpm	run start
deployDryRun	pnpm	run deploy:dry-run

Typical loop

1. Edit source.
2. pnpm run lint (eslint).
3. pnpm run typecheck (tsc --noEmit after db:generate).
4. pnpm run test (pretest runs scripts/optimizer-acceptance.ts --dry-run, then vitest run).
5. pnpm run build (desktop:build).
6. pnpm run desktop:smoke for a headless boot check.
7. pnpm run deploy:dry-run to confirm the desktop artifacts exist.

pnpm run verify chains structure, lint, typecheck, test, build, smoke, and deploy dry-run.

Risk classes

Default risk is R2. Read .safrs/policy.json for the repository scale.

• R0 is read-only analysis.
• R1 is reversible local changes.
• R2 is boundary-affecting: desktop IPC, provider keys, dependencies, migrations, shared APIs, architecture boundaries, governance controls.
• R3 is high-impact or irreversible, such as production deployment, production credentials, financial actions, or critical clinical logic.

R2 requires designated review at the work-package or integration boundary. It does not require per-command human approval inside an already authorized package. R3 may be prepared by an agent but needs explicit human authorization before it runs.

Boundaries

• Provider, database, Supabase, Resend, and Xendit values live outside the repository. Never read or commit .env.
• Do not run db:migrate, db:migrate:deploy, db:migrate:apply, db:seed, payment callbacks, or provider requests during migration verification.
• Keep context isolation and IPC validation. Do not widen the preload API during ordinary changes.
• Electron is recorded as R2 in capabilities.json; this capsule-local record mirrors the reviewed manifest.

Standalone proof

The capsule proves independence in two halves:

1. Structural: pnpm run verify:structure runs scripts/verify-structure.mjs, which checks required capsule entries, rejects workspace: or parent file:.. dependencies, and scans desktop/, lib/, prisma/, scripts/, data/, and types/ for D:\DEV\Monorepo or D:\Devops\abyss-monorepo references.
2. Empirical: pnpm run verify:extraction runs scripts/verify-extraction.mjs, which copies the capsule into a fresh temporary directory (excluding node_modules, build output, and VCS) and runs install, structure, lint, typecheck, test, build, smoke, and deploy dry-run there. The extraction result is decisive.

See Testing, Debugging, and Tooling for the supporting detail.