This repository is policy infrastructure. Its output is enforceable standards, tool configs, and reusable workflows that all product repositories implement.
The one rule above all others: zero product names, repo names, concept names, or anything trademarkable in this repo. If a rule only makes sense with a product name attached, it belongs in that product's repo, not here. See docs/standards-catalog.md. Exception: see OQ-007 in QUESTIONS.md for the carve-out's exact scope and the three locations it applies to.
This is the HOW for the organization: language-agnostic principles, per-language implementation rules, enforcement configs, reusable workflows, and the enforcement matrix.
The WHY / WHAT (architecture decisions, product specs) lives elsewhere --- in the ADR registry and the product-specs repo. This repo cites them by number, never restates.
docs/standards-catalog.md--- master catalog, read this firstdocs/standards-handbook.md--- global principlesdocs/*-standard.md--- per-language standardsdocs/enforcement-matrix.md--- detailed enforcement mappingCI-Enforcement-Matrix.md--- summary matrix.github/workflows/--- reusable enforcement workflows
- Draft new standards citing ADR sources
- Draft reusable workflows enforcing existing standards
- Update tool configs to match updated standards
- Update the enforcement matrix for new workflows
- Update the catalog when standards are added
- Fix inconsistencies between prose and configs
- Invent standards without an ADR source. No ADR = no standard. File an open question instead.
- Add product names anywhere. Not in filenames, not in prose, not in code comments, not in examples. Exception: see OQ-007 in
QUESTIONS.md. - Edit governance snapshot files under
.github/instructions/governance/. Auto-synced, read-only. - Mark a matrix row ENFORCED without a workflow. Honesty rule: if no workflow checks it, the status is SPECIFIED.
- Create decision records. This repo has no ADRs. Decisions live in the ADR registry.
Cite ADR-NNN, INV-NNN, OQ-NNN by number in standards text and commit messages. Never paraphrase.
Before editing standards text:
- Contradicts an INV? → Block, cite number.
- Assumes an OPEN OQ is resolved? → Block, cite OQ.
- Duplicates an ADR/INV statement? → Replace with citation.
- Names a product? → Replace with generic concept.
If the ADR registry is inaccessible, do not fabricate numbers. Ask.
For each new or changed rule, maintain:
- Rule statement
- Enforcement status (ENFORCED / SPECIFIED / WARN)
- Tooling path (lint / static analysis / test / build gate)
- CI stage placement
If enforcement is not yet automated, mark SPECIFIED. Do not weaken the requirement language.
- Standards are measurable and enforceable
- Global principles are language-agnostic
- Stack-specific constraints only where justified
- Normative language: MUST, MUST NOT, REQUIRED, FORBIDDEN
- Separate rules from examples
- Security and privacy constraints are explicit
Maintain explicit standards for: PHP, WordPress, JavaScript, React, Node, CSS, SQL, PostgreSQL, Neo4j, XML, JSON, Laravel, Vite.
When a stack lacks a dedicated standard, update the handbook and matrices to capture rules and enforcement status.
Read .github/instructions/governance/ for current decisions, invariants, and open questions. These are the rules your standards enforce. Do not assume rules not in the governance reference.