Policies

Desktop: Electron API Type Sync

Desktop `window.electronAPI` type contracts must stay synchronized.

Desktop: Preload Least Privilege

Desktop preload bridge must preserve least-privilege exposure.

Desktop: External URL Safety

Desktop external URL opening must enforce protocol safety and validation.

Desktop: BrowserWindow Security Defaults

Desktop BrowserWindow security defaults must be preserved.

Desktop: IPC Contract Sync

Desktop IPC bridge changes must keep contract surfaces in sync.

Frontend + Desktop: High-Risk Flows Require Tests

High-risk frontend and desktop flows require accompanying test coverage updates.

Frontend + Desktop: No Silent Catch

Frontend and desktop runtime code must not silently swallow exceptions.

Mem-Client: OAuth Redirect Resilience

OAuth redirect/callback flows must fail safely and visibly.

Python Service: Bootstrap Completeness

New deployable Python services must include baseline operability scaffolding.

Python Service: Publish/Deploy Gate Dependencies

Publish/deploy jobs must depend on quality and contract gates.

Backend: Django Ninja for New Endpoints

New backend API routes must use Django Ninja, not DRF.

Mem-Client: Exported UPPER_SNAKE Constants In constants.ts

Exported UPPER_SNAKE_CASE constants must be declared in `constants.ts`.

Mem-Client: Exported Literal Collections Use as const

Exported literal collections in constants files must use `as const`.

Python Service: Toolchain Consistency (uv/ruff/ty)

New Python services should use the default repo toolchain unless exception is explicitly documented.

Python Service: Auth Middleware Contract Tests

Auth middleware boundary behavior must have contract tests.

Mem-Client: No Deprecated Design-System Imports

New mem-client code should not introduce deprecated `@/design-system` imports.

Mem-Client: No Arbitrary Playwright Waits

Playwright tests must avoid fixed-time synchronization waits.

Mem-Client: Test Selector Convention

Mem-client component markup must use `data-test-id` selector convention.

Mem-Client: TestWithStore Pattern

Store-dependent component tests should use `TestWithStore`.

Mem-Client: No Console Logging in Runtime

Runtime mem-client code should not introduce new `console.*` logging.

Mem-Client: MDS Components Use export const

MDS component exports should use `export const` component declarations.

Mem-Client: No Emotion Object Style Syntax

MDS style files must use Emotion tagged-template syntax.

Mem-Client: MDS Filenames Must Be kebab-case

New MDS filenames must be lowercase kebab-case.

Mem-Client: MDS File Suffix Convention

MDS support files must use canonical suffixes.

Mem-Client: New MDS Folder Requires index + stories

New MDS component folders must include index and stories files.

Mem-Client: as const Arrays Need Companion Union Type

Exported `as const` arrays require companion union type exports.

Mem-Client: New MDS Folder Requires style + types

New MDS component folders must include style and types scaffolding.

Backend: External V2 Request Tracking

External V2 handlers must preserve request-manager tracking contract.

Backend: List/Search Bounds and Ordering

Collection endpoints must enforce bounds and deterministic ordering.

Backend: Explicit Exception Handling

Backend broad exception handling must be explicit, never silent.

Backend: Pydantic Agent Observability

Pydantic AI agent creation/execution must include observability signals.

Backend: SpaceAccount Settings Change Matrix

SpaceAccount settings changes must stay cross-layer consistent.

Backend: StrEnum Unknown Fallback Pattern

String enum parsing from external/stored values must be resilient.

Python Service: Workflow Path Cohesion

Service workflows must keep trigger paths and execution paths coherent.

Python Service: Schema Drift Gate + Repair Path

Schema-dependent services must gate drift and provide deterministic repair.

Python Service: OpenAPI Source-of-Truth Discipline

Schema-derived client generation must have a clear source of truth.

Python Service: Automation PR Idempotence + Safety

Automation workflows that create/update PRs must be idempotent and safe.

Python Service: Container Reproducibility

Python production Dockerfiles must preserve reproducibility and runtime safety.

Python Service: OAuth Metadata Contract Tests

OAuth/OIDC metadata endpoints require contract tests.

Python Service: API Adapter Error-Mapping Coverage

API adapter error-mapping must be explicit and test-backed.

Python Service: External Network Tests Are Opt-In

External network tests are opt-in, bounded, and non-blocking by default.

External Notes+Collections Live Coverage Gate

External notes/collections route gate.

Mem-Client: No Deep MDS Imports Outside MDS

No deep MDS imports outside MDS rule.

Mem-Client: Styled Exports Start With Styled

Styled wrapper naming rule.

Mem-Client: MDS Component Names Start With MDS

MDS component naming prefix rule.

Mem-Client: MDS Storybook Completeness

MDS component Storybook coupling rule.

Mem-Client: Async Store Cleanup

Mem-client async side-effect cleanup rule.

Mem-Client: Analytics Payload Contract

Mem-client analytics event contract rule.

Backend: Model Changes Require Migrations

Backend model migration sync rule.

Mem-Client: Behavioral Refactor Rollout Notes

Large behavioral mem-client refactors need rollout/migration notes.

Mem-Client: Dependency Update Smoke Validation

Mem-client dependency/security updates require smoke validation evidence.

Mem-Client: Keyboard and Focus Preservation

Interactive mem-client UI changes should preserve keyboard/focus usability.

Mem-Client: High-Frequency Interaction Safety

High-frequency mem-client interaction handlers should be performance-safe.

Mem-Client: State Mutation Boundaries

Keep mem-client state mutations within clear store/action boundaries.

Mem-Client: Hydration Compatibility

Mem-client hydration/default changes must be backward-compatible with existing cache.

Mem-Client: Actionable Error States

Mem-client error-state UX must remain actionable.

Mem-Client: Validation Evidence

Mem-client behavior changes need validation evidence.

Backend: Validation Evidence

Backend behavior changes need validation evidence.

Backend: Feature Flag Hygiene

Feature flags in backend should be intentional and maintainable.

Backend: Runtime-Safe Migrations

Schema/data migrations must be runtime-safe.

Backend: Async Idempotency

Async backend state mutations must be idempotent under retries.