This directory is the canonical home for contributor, self-hosting, security, testing, and release-readiness docs.
If you start from root docs (README.md, CONTRIBUTING.md, SECURITY.md),
this is the next stop.
- Contributor:
./testing-and-verification.mdand../../CONTRIBUTING.md - Self-hoster / operator:
./setup-self-host-and-deploy.mdand./security-and-operations.md - SDK integrator:
../widget-sdk.mdand../mobile-sdks.md - Maintainer / release owner:
./source-of-truth.mdand./security-and-operations.md
| Domain | Canonical document |
|---|---|
| Architecture and repository layout | ./architecture-and-repo-map.md |
| Setup, self-hosting, deployment paths | ./setup-self-host-and-deploy.md |
| Testing and verification flows | ./testing-and-verification.md |
| Security controls and operational readiness | ./security-and-operations.md |
| Documentation ownership / source-of-truth model | ./source-of-truth.md |
| Domain | Canonical document |
|---|---|
| System architecture and data flows | ../architecture.md |
| Database schema (50+ tables) | ../data-model.md |
| Backend API reference (Convex functions) | ../api-reference.md |
| Widget SDK reference (client-side JS API) | ../widget-sdk.md |
| Mobile SDK reference (RN, iOS, Android) | ../mobile-sdks.md |
| Security deep dive (RBAC, HMAC, auth model) | ../security.md |
| Testing guide (unit, integration, E2E, CI) | ../testing.md |
| Scripts reference (build, deploy, security) | ../scripts-reference.md |
| Feature audit and inventory | ../feature-audit.md |
| Survey delivery contract | ../survey-delivery-contract.md |
- Runtime behavior and command contracts: code and scripts (
apps/**,packages/**,scripts/**, root/packagepackage.json) - Curated guidance: this hub and root docs
If docs conflict with runtime code/scripts, update docs immediately and treat code/scripts as authoritative.
Update this hub and linked root docs when any of the following changes:
- command names or script behavior
- environment variable usage or required/optional semantics
- auth/security boundaries, webhook behavior, CORS behavior, or release operations policy
After documentation updates:
- Validate command references against root and package
package.jsonscripts. - Validate environment variables against source usage and
.envexamples. - Ensure root docs link to this hub and avoid conflicting duplicate guidance.
For a detailed ownership matrix and repeatable checklist, use
./source-of-truth.md.