Read before changing.
Read the contribution guide and the relevant guide or ADR. The API-first boundary matters: update OpenAPI before clients.
Contribution guide ↗Open-source project
Improve the
whole system.
Cix welcomes bug reports, documentation improvements, tests, and code contributions. Start with the public source mirror, read the project rules, and choose a change you can verify.
Contribution path
Make a change that can land.
Cix is maintainer-led. A useful contribution includes the evidence, documentation, and tests needed to understand its effect on the API and the machine. Public questions and non-sensitive bug reports belong in the issue tracker.
Report the real problem.
Use the issue tracker for a focused bug, documentation gap, test improvement, or design question. Include the version, source revision, reproduction, and expected result.
Open issues ↗Keep the contract visible.
Make the smallest coherent change, update tests and documentation with it, and avoid credentials, private keys, generated output, or unlicensed code.
Browse the source ↗Preserve provenance.
Contributors retain copyright. Each commit must carry a DCO sign-off confirming that the contribution can be distributed under Apache-2.0.
Read the licence ↗Project boundary
Open source, maintainer-led.
Cix is led and maintained by Omar Sakka. The maintainer makes final decisions about accepting changes, releases, and the official Cix distribution.
- Keep it reproducibleInclude the commands, source revision, and observed result needed for another contributor to follow the change.
- Keep secrets outNever include credentials, private keys, generated build output, or third-party code without its licence and provenance.
- Report security issues privatelyDo not publish sensitive vulnerability details in a normal issue. Email osakka@gmail.com with the subject “Cix security report”; keep the details private while the report is assessed.
- Keep the public source clearThe public mirror is for browsing and community access; the canonical development repository remains the project’s authoritative source.