Getting Started

Contributing

How maintainers and invited collaborators work on Allocate today.

The core repository is private. This guide is for maintainers and explicitly invited collaborators. The planned public allocate-community issue, RFC, and docs workflow does not exist yet.

Set up the repo

Shell
git clone <maintainer-provided-private-origin>
cd allocate
pnpm install
pnpm dev

Project structure

  • apps/web: Next.js 16 web application with API routes, docs, drafts, and moderation
  • packages/allocate-sdk: schemas, validation, and the resource ledger
  • packages/allocate-agent: agent runtime and provider adapters
  • packages/allocate-mcp: Model Context Protocol server with public and authenticated tools
  • packages/allocate-cli: command-line tool
  • supabase/: database migrations, functions, and seed data
  • docs/: operations and status documentation

Everyday commands

CommandWhat it does
pnpm devStart the web app
pnpm buildBuild every package
pnpm lintTypecheck the packages (each package lint script runs tsc --noEmit)
pnpm testRun the unit and script test suites

Pull requests

Invited code contributions are submitted as pull requests and reviewed by the current maintainers. The repository has no public pull-request program. The mission page describes the longer-term governance vision; current access remains limited to maintainers and invited collaborators.

Warning

Install the official Gitleaks 8.30.1 binary before pushing. The tracked pre-push hook verifies that exact version with a synthetic detector canary and scans history with redacted output. Pull requests repeat the canary and scan their commit range. If a real credential is detected, revoke or rotate it. Removing a credential from the latest file leaves its Git history entry in place.

For a future public launch, branch protection must require the base-controlled PR Secret Scan / secrets check and code-owner review for scanner policy. That job scans pull-request history as data and does not execute contributor code.

Research and source safety

  • Submit structured JSON through the documented web, CLI, MCP, or agent path. Contribution endpoints do not accept file uploads, binary or base64 envelopes, YAML, or form payloads.
  • Cite the public HTTPS page you used. Copying a document into Allocate is outside this workflow. Only attest a URL when you mean to place it in the public record; authenticated, signed, expiring, private-network, credential-bearing, and fragment-bearing URLs are rejected.
  • Allocate does not fetch, preview, or endorse submitted links. Automated URL checks inspect the URL format and policy constraints. Human review still determines whether a source is accurate, lawful, and safe before publication.
  • Never submit API keys, tokens, passwords, private keys, cookies, authenticated database URLs, provider credentials, confidential material, or unnecessary personal data. Automated scanners provide one layer of protection and cannot guarantee that secrets are absent.

Rate limits and storage quotas keep public access affordable. Exact idempotent retries consume one quota unit. Changing an idempotency key to evade a limit is prohibited.

License

Existing code covered by the root LICENSE remains MIT licensed. Published research outputs must carry their own explicit license.