Documentation / contribution guide

Make security claims testable. Keep evidence real.

ELITZE changes must preserve tenant isolation, source attribution, real integration state, bounded AI reasoning and verified execution. This public page follows the full contribution guide in docs/contributing.md.

Open workspace

Control plane

Built for evidence-first security operations

Unavailable integrations are labeled not configured. Missing evidence is described as not verified or not measurable.

Local setup

Evidence first

Use the supported Node version, install lockfile-pinned dependencies with npm ci, and configure local-only environment variables. Never copy production secrets into development.

Disposable test data

Evidence first

Run auth E2E only against explicit loopback PostgreSQL test databases. Fixtures belong to tests, never production customer records.

Evidence lineage

Evidence first

Preserve connector ID, source event ID, timestamp, source reference and original evidence state. Non-observed events are not detections.

Integration truth

Evidence first

Do not mark an integration CONNECTED until a provider-specific live probe succeeds. Source code and saved credentials are not connectivity proof.

Safe execution

Evidence first

Maintain target allowlists, private-address rejection, exact scope/profile rules, unexpired authorization, signed callbacks and approval gates. Never execute arbitrary model-generated commands.

Release procedure

Evidence first

Run focused self-tests, lint, typecheck, npm audit, sale:readiness, git diff --check and production build. Promote only after mandatory CI and live integration gates are green.

Related capabilities

Full Markdown guideRead or save the repository's complete contribution document.FAQProduct behavior and evidence boundaries.Security disclosureResponsible disclosure and testing boundaries.Integration consoleConfigure tenant model providers and run live probes.

ELITZE does not claim a clean posture when telemetry is absent. Live source records, authorization scope, execution state, and verification evidence remain separately visible.