Contributing

YieldStream is built as paid contributor work through the Drips Wave program. Every unit of remaining work is already written up as an issue with acceptance criteria — the backlog is the roadmap.

Where the work lives

Tiers

• Trivial (100) — label tier-100. A doc fix, one validation check, UI copy, a single test vector.
• Medium (150) — label tier-150. A bounded feature inside one module.
• High (200) — label tier-200. Storage redesign, cross-repo features, new subsystems.

Process

1. Read the issue. Its acceptance criteria are the definition of done.
2. Comment to request assignment before writing code. Two people on one issue wastes a cycle.
3. Branch, build, and open a PR against main. Stage specific files — not git add . — and use conventional commits (feat(scope): description).
4. Cross-repo work: if your app change depends on an SDK function that does not exist yet, say so on the issue first. Shipping a frontend against an unbuilt dependency reads as a regression.

The bar

Required status checks must pass — these are enforced on main:

# contract
cargo fmt --check
cargo clippy --all-targets -- -D warnings
cargo test --workspace

# sdk and app
npm run typecheck
npm test          # sdk
npm run build     # app

Beyond the green checks, a review looks for: the RFC 6962 format preserved byte-for-byte, any storage change justified with a before and after ledger count, and no new claim in the docs that the code cannot back up.

Review time

Triage and first response within 48 hours; review within 5 days of the PR opening. If it stalls past that, ping on the PR — the maintainer commitment is written down precisely so you can hold it to it.

Good first picks

• contract #6 — bound the Merkle proof loop to tree depth. Small, well-specified, and it closes a real cost-amplification path.
• contract #8 — stop sweep from corrupting campaign stats.
• sdk #1 — leaf hashing conformance. Un-skip the pinned suites and make them pass.

Security work

Do not open public issues for vulnerabilities. Use private disclosure. The contract is unaudited; if you are a security reviewer, that is the most valuable contribution of all and it is not on the backlog yet.

Conduct

Every repo in the org is covered by the same code of conduct: reasons over verdicts, critique the code and not the person, and report concerns privately so you never have to confront anyone to resolve them.