# Community Contribution Pipeline (Phase 6)

## Contribution Model

Genesis development is public-primary: all contributors work on the
public `GENesis-AGI` repo. The contribution pipeline
(`genesis contribute <sha>`) auto-creates a private fork in the user's
namespace on first use, sanitizes the diff, and opens a PR from the
fork against the public repo.

Repo identity is read from `~/.genesis/config/genesis.yaml`
(`github.user` / `github.public_repo`). Fork resolution and
sanitization live in `src/genesis/contribution/pr_opener.py` and
`sanitize.py`. Full user-facing story: `.claude/docs/your-genesis.md`.

## Contribution Offers

When the user commits a bug fix (`fix:` conventional commit), a post-commit
git hook writes a marker file under `~/.genesis/pending-offers/`. On the
next user prompt, the `contribution_offer_hook.py` UserPromptSubmit hook
injects a `[Contribution]` system-reminder so Genesis can proactively
offer: "Want to contribute this fix upstream to the public repo?"

**Your job** when you see a `[Contribution]` reminder:
1. Ask the user conversationally — do not run the pipeline without explicit
   approval
2. If yes, invoke `genesis contribute <sha>` as a `Bash` tool call. The CLI
   handles: divergence check -> version gate -> sanitizer -> adversarial
   review -> consent prompt -> draft PR via `gh`
3. If the user declines or ignores, do nothing — the marker has already been
   unlinked by the hook

**Opt-out:** committing with `fix(local):` scope (e.g. `fix(local): tweak
my voice exemplars`) skips the offer entirely.

## What Ships in Every PR Body

Generated by the pipeline, not you:
- Contributor install version (`<version>@<short-sha>`)
- Version status (matches upstream HEAD, or N commits behind)
- Install ID (first 8 chars of local UUID — pseudonymous by default)
- Sanitizer finding count + scanners run (`detect-secrets`, `portability`)
- Review result (first-success chain: `codex` -> `cc-reviewer` ->
  genesis-native)

**Attribution:** pseudonym by default. Pass `--identify` to use the user's
real git identity.

## Scope & Safety

**MVP scope:** bug fixes only. New features are out of scope for Phase 6.1.
Use `--allow-non-fix` only if explicitly asked.

The contribution pipeline is **fail-closed** — the sanitizer refuses any
diff that contains secrets, personal email addresses, hardcoded IPs,
home directory paths, or files on the `contribution_forbidden` tier of
`config/protected_paths.yaml`. If a sanitizer block looks like a false
positive, the right response is to fix the diff locally, not to pressure
the pipeline.
