# Contributing

MIKA De-ID Local is an open-source medical-privacy project licensed under GNU AGPLv3. Contributions must preserve its local-first, human-review, and synthetic-only development boundaries.

## Never submit patient data

Do not include real medical documents, names, identifiers, screenshots, filenames, logs, OCR output, credentials, tokens, or production configuration in an issue, pull request, test, or commit. Use a synthetic reproducer created specifically for the report.

## Contribution requirements

- State what problem is addressed and which safety property changes.
- Add or update automated tests.
- Add synthetic visual fixtures when PDF or image behaviour changes.
- Run the full test suite and output verification.
- Preserve the `AGPL-3.0-only` SPDX header on source files.
- Confirm that the contribution is your original work or that you have the right to submit it under AGPLv3.
- Do not add a dependency without recording its version, licence, upstream source, security implications, and notice requirements.

NPO NT must approve a formal contributor-signoff or contributor-agreement process before accepting external code into a production release. Until that governance step is complete, external submissions are review proposals rather than automatically mergeable contributions.
