ORRANGE / Contributing

Contributing

ORRANGE is open source. Help with docs, tests, product, or the AI treasury — but never weaken the boundaries that make it safe.

Set up

  1. Fork and clone: git clone https://github.com/SmratJay/strk20-privacy-wallet.git
  2. Install: npm install
  3. Configure: cp .env.example .env.local and fill what you need (see Environment).
  4. Verify your baseline: npm test, then npm run build and npx tsc --noEmit.

Branch and commit expectations

  • Work on a feature branch; keep it focused.
  • One logical change per commit with a clear message (the project uses conventional-style prefixes, e.g. feat(ai): …, docs: …, fix(treasury): …).
  • All tests green, typecheck clean, build passing before opening a PR.

Where things live

ConcernLocation
AI logic (provider, schema, policy, health)src/ai/
Treasury execution gatesrc/services/treasuryService.ts
STRK20 privacy integrationsrc/privacy/ + src/services/strk20WalletApiService.ts
AI API routesrc/app/api/ai/analyze/route.ts
Docs sitesrc/app/docs/ + src/docs/navigation.ts

Where to add tests

Tests live beside the domain logic under src/__tests__/. Add focused tests where you change behavior:

  • Proposal schema → aiSchema.test.ts
  • Policy / presets → aiPolicy.test.ts, aiPolicyPresets.test.ts
  • Route → aiAnalyzeRoute.test.ts
  • Execution gate → treasuryService.test.ts
  • Simulation → aiSimulate.test.ts; health → aiHealth.test.ts
  • STRK20 identity → aiShadowAccount.test.ts
  • Docs routes → docsNavigation.test.ts

Never break these boundaries

  • The deterministic policy stays the only execution gate. The AI must remain advisory.
  • Destination allowlists and the self-transfer rejection must never be bypassed or removed.
  • Execution must keep re-checking expiry, fresh state, exact bigint amounts, fresh prices, and re-running the policy.
  • The dapp and the AI must never touch viewing keys, notes, or private keys.
  • Don’t fabricate balances, prices, or execution results anywhere in the UI.
A change that “simplifies” one of the security gates is a regression, not an improvement — even if tests pass. If you think a gate is too strict, open an issue and discuss it first.