Contributing

Guidelines for contributing to the AIIA codebase.

Development Workflow

1. Create a feature branch from main
2. Make small, PR-sized changes
3. Follow existing patterns — no rewrites
4. Include tests (unit + integration)
5. Update documentation if needed
6. Submit a pull request

Definition of Done

Every change must satisfy:

• RBAC/SoD enforced at API + UI
• AuditLogEvent for every CUD, state change, approval
• Versioning for governed records (workpapers, findings, reports)
• Evidence chain-of-custody maintained
• Tests (unit/integration; E2E for UI)
• SaaS + on-prem compatible
• i18n keys (EN + AR) — no hardcoded strings
• AI outputs = suggestions with human approval
• No hardcoded secrets

Hard Constraints

1. ❌ No secrets in code
2. ❌ No audit log bypass
3. ❌ No AI → official record without human action
4. ❌ No cross-boundary data leaks
5. ❌ No SaaS-only dependencies breaking on-prem
6. ❌ No skipped RBAC checks
7. ❌ No weakened security
8. ❌ No hardcoded language strings

Code Standards

Backend (Python)

• Use type hints
• Async/await for all database operations
• SQLModel for models
• FastAPI dependencies for auth/RBAC
• Follow existing router patterns

Frontend (TypeScript)

• Functional components with hooks
• TypeScript strict mode
• Use existing UI components
• Follow existing page patterns

Testing

Level	Tool	Coverage Target
Unit	pytest	80%+
Integration	pytest + TestClient	Critical paths
E2E	Playwright	Core workflows