Contributor guide

Extend the list, preserve the boundary.

WTM uses convention over configuration for known locations, versioned data definitions for narrow overrides, and compiled Swift adapters for new capabilities. It never loads third-party code plugins.

Choose the smallest extension type

Settings override

Change a folder, executable path, safe argument token, or enabled state. No code and no new capability.

Data manifest

Share schema-validated labels, paths, typed arguments, aliases, or safe HTTPS templates. Imports remain disabled until reviewed.

Compiled adapter

Add a parser, provider API, deletion semantic, runtime lifecycle, or client handoff. Requires Swift, fixtures, tests, and review.

Adapter types

The current adapter implementations are the source of truth for the adapters shipped by this checkout.

StorageProviderAdapter

Read-only discovery of provider identities, manifests, artifacts, configs, completeness, and evidence. It cannot delete or execute.

ManualFolderAdapter

Conservative format recognition inside a user-enabled folder. It cannot invent provider ownership.

StorageActionAdapter

Provider-aware cleanup planning. A central executor revalidates scope and identity and owns Trash or provider mutation.

RuntimeAdapter

Compatibility, immutable launch plans, loopback health, and minimal inference. A central broker owns processes.

ClientAdapter

Short-lived, explicit handoff to a consumer such as OpenClaw or Unsloth. It cannot silently rewrite client defaults or claim runtime ownership.

From proposal to release

  1. Proposal issueState role, versions, paths or API, capabilities, risks, and test plan.
  2. ImplementationCreate the smallest separate SwiftPM target. Do not add provider branches to core UI.
  3. Fixtures and contract testsUse synthetic or redistributable evidence, malformed-input tests, and path-boundary cases.
  4. ReviewUpdate architecture, threat model, support matrix, and docs. Security-sensitive roles need explicit review.
  5. Signed releaseCompiled adapters ship only inside a normal Developer-ID-signed, notarized WTM release.

Hard boundaries

No dynamic libraries, scripts embedded in manifests, shell strings, hidden network requests, credentials, new deletion behavior, or arbitrary executable capabilities.