# Contributing to TatMapper

TatMapper is proprietary software. This file documents the process for people
who already have written authorization to work on the repository; it is not an
open invitation to contribute and grants no license to the source.

Do not submit code, artwork, documentation, or other material unless the
confirmed rights holder has first agreed to written contribution and ownership
terms. Unsolicited pull requests may be closed without review to avoid
ambiguous intellectual-property ownership.

## Product contract

TatMapper's current public direction is a planar photo-mapping beta. Changes
must not claim curved-surface unwrapping or guaranteed physical accuracy. Keep
all product geometry in normalized source-image pixel coordinates, preserve
stroke boundaries, and make every image-to-screen transform reversible and
tested.

The beta must remain free and local-first. Do not add ads, billing, ATT,
telemetry, or a paywall without a separately reviewed product/privacy decision.

## Development setup

- Flutter 3.44.6 / Dart 3.12.2
- Java 17
- Android SDK 36 for Android release builds
- Xcode 26 for iOS release builds

```bash
cd app
flutter pub get
flutter analyze --fatal-warnings
flutter test
```

Android and iOS are the only supported platforms. Do not generate or commit
Flutter web, Windows, Linux, or macOS runner directories.

## Pull requests

Authorized contributors only:

1. Branch from the appropriate active base.
2. Keep commits small and explain the user-visible behavior.
3. Add deterministic tests for calibration, coordinate transforms,
   persistence, design placement, or physical export math when those areas
   change.
4. Run formatting, analysis, and tests before pushing.
5. Include real emulator/device evidence for UI changes; label generated sample
   imagery clearly.
6. Never commit signing keys, provisioning profiles, credentials, user photos,
   or store secrets.

Use `fix:`, `feat:`, `docs:`, `test:`, or `chore:` prefixes where they make the
history easier to scan.

## Bug reports

Include the commit SHA, device/API or iOS version, exact reproduction steps,
expected and observed result, and sanitized logs. Never attach client photos or
other personal placement media to a public issue.

Security concerns belong in the private process described in
[`SECURITY.md`](SECURITY.md), not a public issue.