> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nerdit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Development, contributing, and support

> Work from a source checkout, verify changes safely, and find the public project policies.

## Release and source status

The verified latest public binary release is **v0.5.5**. Current merged source declares **0.6.0**, including database logical dumps and live restore. Public source publication is being prepared; do not assume an available release asset means the matching public source tree has already been published.

Use the [installer](/engine/installation) for a released Engine. The existing `nerdit` package on PyPI is not the current supported installation route. For development, start from an authorized source checkout rather than an invented download command.

## Set up a checkout

Requirements: Python 3.11 or newer, a working Docker environment for runtime work, Git, and Node/npm for the bundled local dashboard. Caddy is required to exercise HTTPS from source.

From the repository root:

```bash theme={null}
python3 -m venv venv
venv/bin/python -m pip install -e '.[dev,mcp]'
(cd src/nerdit/daemon/web && npm ci && npm run build)
venv/bin/nerdit --help
```

The dashboard build is required; otherwise its route reports that the bundle is missing. `nerdit init` is the interactive source-checkout bootstrap, not a repair command for an installed service. Read the checkout's contributor and agent instructions before starting any Engine.

## Verify changes safely

```bash theme={null}
venv/bin/ruff check src/nerdit
venv/bin/ruff format --check src/nerdit
venv/bin/mypy src/nerdit
venv/bin/pytest tests/test_openapi.py tests/test_mcp.py
```

These focused schema/tool checks do not prove a Docker deployment works. Use tests appropriate to the changed feature, then exercise its live path in an isolated environment when runtime behavior changes.

<Warning>
  Some tests start real Engine processes, inspect ports, or interact with Docker. Never run the full suite while a real Engine or demonstration stack is running. A disposable machine is the simplest safe environment for installation, update, uninstall, and recovery tests.
</Warning>

For multiple Engines sharing one Docker host, every scratch Engine must use a **unique `[daemon].instance_id`**, its own configuration/data directory, and separate API/proxy ports. Container cleanup is instance-scoped; using the default identity can affect another instance's managed containers. Preserve Docker CLI/plugin configuration deliberately when isolating user directories.

A useful live validation loop is: dry-run deployment, deploy and wait, request the actual application URL, inspect health/logs, exercise a deliberate failure, and clean up only that test instance. Use throwaway tokens and verify that invalid credentials are actually refused before trusting permission checks.

## Contribute

When public source is available, use the repository's `CONTRIBUTING.md` as the maintained contribution policy. The planned release mirror accepts issues and proposed patches; accepted changes are integrated through the release process. Do not infer that every contribution is merged directly into the public mirror.

Follow the repository's Developer Certificate of Origin requirement:

```bash theme={null}
git commit -s
```

Keep source comments concise and use Google-style Python docstrings. Preserve security, recovery, and caller-visible contracts. MCP descriptions are part of a tool interface: review them with the MCP contract tests rather than treating them as ordinary prose.

Documentation is maintained once in the documentation website's version-controlled source. Public source retains tests and essential root/contributor documents; user-guide sources and MkDocs configuration are not part of the public source export. Report a documentation issue with its page URL and the affected Engine version.

## Licensing

The Engine, CLI, MCP server, and bundled local dashboard are prepared for publication under **Apache-2.0**. Refer to the released source tree's `LICENSE` and `NOTICE` for the actual terms and attribution. Nerdit's name and logo are not licensed as trademarks by the code license. The hosted App is a separate service; an account entitlement is unrelated to the source-code license.

## Support and security reports

Start with [troubleshooting](/engine/troubleshooting). Include your version, platform, installation method, exact command, error code, and redacted diagnostic output when reporting a problem.

The public source repository is planned at [nerdit-ai/nerdit](https://github.com/nerdit-ai/nerdit). Until its issue and security-reporting surfaces are available, contact [support@nerdit.ai](mailto:support@nerdit.ai). Do not publish sensitive reports into an ordinary issue as a workaround.

Once available, use the repository's **Security → Report a vulnerability** flow for Engine vulnerabilities, following `SECURITY.md`. That policy covers the Engine and its bundled interfaces; report third-party dependency issues upstream and hosted App issues through the service's support channel. Security fixes target the latest release line.