# Contributor Flow

Status: VERIFIED BY LOCAL SELF-TEST

## Accepted Work From Unknown Contributors

- Bug reports with reproduction details.
- Documentation corrections in public docs.
- Analyzer rules.
- Editor-only tooling that runs on placeholder data.
- Unit tests against public DTOs and interfaces.
- Performance experiments in isolated samples.
- Small runtime components that do not require production assets.

## Rejected Work From Unknown Contributors

- Changes that require full production scenes.
- Changes that depend on private assets.
- New global runtime surfaces without owner, phase, capacity, and failure mode.
- Third-party packages added directly to the repo.
- Binary blobs without source and purpose.
- PRs that only work by weakening gates.

## Issue Triage

Labels:

- `public-sdk`
- `sandbox`
- `needs-repro`
- `candidate-for-private-port`
- `rejected-production-surface`
- `security-review`

## Patch Intake

1. Public PR must pass public gate.
2. Maintainer reviews for HECTON-8 architecture rules.
3. Maintainer creates a port bundle from the checked-out public PR branch.
4. Useful code is copied or rewritten into a private branch.
5. Private branch runs production gates.
6. Public PR is credited in public changelog when appropriate.

Port bundle command:

```powershell
powershell -ExecutionPolicy Bypass -File .\tools\New-H8PortBundle.ps1 `
  -PublicRepoRoot C:\hades\Hecton8_PublicationWorkspace\Hecton8-PublicSDK `
  -Target public-sdk `
  -BaseRef main `
  -HeadRef HEAD
```

The bundle contains `changes.patch`, copied changed files, and `port-bundle.json`.
It is review input only. It is not applied directly to production.
The bundle output directory must stay outside the public repo being reviewed; an
in-repo bundle would be created after preflight and is rejected.

## No Direct Production Dependency

Public tasks must target public contracts. They must not require access to:

- production scenes;
- production prefabs;
- production save data;
- production baked monoliths;
- vendor assets;
- current private design docs.

If a task cannot be expressed against public contracts, it is not public work.

## Sandbox Export

Default contributor sandbox export is template-only. This prevents accidental
publication of production code while still giving contributors a repo with:

- denylist gate;
- GitHub Actions gate;
- scope file;
- contribution rules;
- placeholder work surface.

Command:

```powershell
powershell -ExecutionPolicy Bypass -File .\tools\New-H8ContributorSandbox.ps1 `
  -DestinationRoot C:\hades\Hecton8_ContribSandbox_Example `
  -Force
```

Production paths move into the sandbox only through
`profiles\contributor-sandbox.allow`, one reviewed path at a time.