# Contributing to YourHand

Thanks for your interest in improving YourHand. The public community edition uses **AGPL-3.0-only**. The maintainer also plans to incorporate eligible contributions into a separately licensed hosted/commercial edition. Copyright ownership stays with contributors.

**External code merge intake is not yet open.** The maintainer adopted the [individual CLA v1.1](CONTRIBUTOR_LICENSE_AGREEMENT.md) and published its [versioned text](https://gist.github.com/archahmedzaki/e2b383e438726b5b157bd5451c0171ba), but hosted CLA Assistant requested account-wide OAuth privileges and was deliberately not authorized; a GitHub Actions **repository-scoped PR-comment consent checker** is prepared and still awaiting live unsigned/signed PR validation. Contributors must [read the exact consent statement](docs/CLA_SCOPED_SIGNING.md). You may discuss ideas and file privacy-safe issues. Do not submit outside code expecting a merge until the signed/unsigned PR checks are confirmed. A DCO sign-off or PR checkbox is not an individual CLA acceptance, and an individual signature does not license an employer's work. See [signing status](docs/CLA_SIGNING_SETUP.md).

When contributions open, the owner or legally authorized rights holder must approve the CLA before merge. If the contributor's employer owns the code, obtain authorized company approval; an employee's personal signature alone will not suffice. Do not copy other projects' code, examples or assets unless you can identify their owners and compatible licenses.

Contributions may target the Windows Agent, Core, MCP tools, website, documentation and isolated tests. Run `npm ci` and `npm test` in a clean checkout. All proposed changes to `main` must pass the repository's [source/privacy and independent secret-scan GitHub Actions checks](.github/workflows/ci.yml); test success does not replace the separately verified and signed CLA requirement for external code contributions. Never include installed production agents, generated installers, machine-specific configurations, private accounts or customer information, paired-device credentials, databases, private logs, screenshots, signing keys or full private Git history. New device actions must enforce authenticated ownership, explicit authorization and no blind retry of uncertain actions.

For policy details, see [docs/LICENSING_POLICY.md](docs/LICENSING_POLICY.md). The YourHand name and artwork are not granted as an unrestricted trademark license by the AGPL.