From c3b709a80748ef3594dfb4f98bdfc51d6e4d727f Mon Sep 17 00:00:00 2001
From: "Evgeny @ SimpleX Chat"
 <259188159+evgeny-simplex@users.noreply.github.com>
Date: Mon, 26 Oct 2026 10:34:31 +0000
Subject: [PATCH] docs: CLAUDE.md importing the contributing and CI guides
 (#7871)

---
 CLAUDE.md                    |  4 ++++
 apps/ios/CLAUDE.md           |  1 +
 apps/multiplatform/CLAUDE.md |  1 +
 docs/CONTRIBUTING.md         | 20 ++++++++++----------
 docs/contributing/CODE.md    |  6 ++++++
 5 files changed, 22 insertions(+), 10 deletions(-)
 create mode 100644 CLAUDE.md
 create mode 100644 apps/ios/CLAUDE.md
 create mode 100644 apps/multiplatform/CLAUDE.md

diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000000..2c3cceced7
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,4 @@
+@docs/CONTRIBUTING.md
+@docs/contributing/PROJECT.md
+@docs/contributing/CODE.md
+@scripts/ci/README.md
diff --git a/apps/ios/CLAUDE.md b/apps/ios/CLAUDE.md
new file mode 100644
index 0000000000..99ee350f47
--- /dev/null
+++ b/apps/ios/CLAUDE.md
@@ -0,0 +1 @@
+@README.md
diff --git a/apps/multiplatform/CLAUDE.md b/apps/multiplatform/CLAUDE.md
new file mode 100644
index 0000000000..99ee350f47
--- /dev/null
+++ b/apps/multiplatform/CLAUDE.md
@@ -0,0 +1 @@
+@README.md
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index 7dbf4510e9..9fe9079403 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -21,16 +21,7 @@ Please discuss the problem you want to solve and your detailed implementation pl
 
 ./contributing/CODE.md has details about general requirements common for `simplexmq` and `simplex-chat` repositories.
 
-These files can be used with LLM prompts, e.g. if you use Claude Code you can create CLAUDE.md file in project root importing content from these files:
-
-```markdown
-@README.md
-@docs/CONTRIBUTING.md
-@docs/contributing/PROJECT.md
-@docs/contributing/CODE.md
-```
-
-For Android/Desktop and iOS apps you can additionally import `apps/multiplatform/README.md` and `apps/ios/README.md`.
+CLAUDE.md in the repository root imports these files, this guide and ../scripts/ci/README.md for Claude Code; apps/ios/CLAUDE.md and apps/multiplatform/CLAUDE.md import the README of each app.
 
 ## Compiling with SQLCipher encryption enabled
 
@@ -94,6 +85,15 @@ We squash PRs, do not rewrite branch history after the review.
 
 For some complex features we create feature branches that will be merged once ready - do not make commits directly to them, make PRs to feature branches.
 
+## Pull requests and CI
+
+1. Open a pull request to `master` as a draft. On a draft, CI runs the reduced build: one Linux job that builds and tests the changed scopes, and one macOS job only when iOS code changed (CI guide: scripts/ci/README.md).
+2. Select the core tests in a `ci-tests` block in the description, one hspec match pattern per line. `/` runs all tests; without a block, the reduced build runs no core tests.
+3. Push the changes for review comments to the same branch; each push runs the reduced build.
+4. Reviewers approve the draft. A draft cannot be merged.
+5. After the approval, mark the pull request ready for review. CI then runs the full matrix, and the pull request is merged by squash once it passes.
+6. A change to a scope without CI tests adds its build and tests to CI in the same pull request.
+
 ## Differences between GHC 8.10.7 and GHC 9.6.3
 
 1. The main difference is related to `DuplicateRecordFields` extension.
diff --git a/docs/contributing/CODE.md b/docs/contributing/CODE.md
index 1dcf795c00..fcdbeb4081 100644
--- a/docs/contributing/CODE.md
+++ b/docs/contributing/CODE.md
@@ -4,6 +4,12 @@ This file provides guidance on coding style and approaches and on building the c
 
 ## Code Security
 
+Zero trust: providers and server owners cannot access users' data - design every feature with this constraint. Every code and design decision considers two threat vectors:
+1. users attacking providers;
+2. providers or server owners attacking users.
+
+Default to end-to-end encryption, minimal metadata exposure, and cryptographic verification over trust assumptions. Review the documented threat models and monitor compliance.
+
 When designing code and planning implementations:
 - Apply adversarial thinking, and consider what may happen if one of the communicating parties is malicious.
 - Formulate an explicit threat model for each change - who can do which undesirable things and under which circumstances.