Decision records¶

Every rule canon enforces traces to one of these records. There are 25: 24 accepted, and 1 kept for history.

Go¶

Record	Strength	Status
Terminal UX uses the Charmbracelet libraries	should	accepted
One cobra command per file in cmd/	must	accepted
CLI configuration resolves flag, then env, then file	should	accepted
Every function and method has a doc comment	should	accepted
Wrap errors with %w and context; never log and return	must	accepted
Critical paths have benchmarks, and input parsers have fuzz targets	should	accepted
Every Go repo runs the golangci-lint baseline	must	accepted
HTTP APIs are spec-first with OpenAPI and generated code	must	accepted
Hand-written Go code keeps 90% test coverage	must	accepted

Record	Strength	Status
Python is linted and formatted with ruff	must	accepted
Python projects are managed with uv and a committed lock file	should	accepted

Record	Strength	Status
Use alpine for small runtime images	should	superseded
Use distroless or scratch for runtime images	must	accepted
Dockerfiles follow hadolint's best practices	should	accepted
Containers run as a non-root user	must	accepted
Pin every base image by tag and digest	must	accepted

Record	Strength	Status
Terraform modules are typed, documented and linted	should	accepted
Terraform passes a security scan before merge	must	accepted
Pin Terraform and provider versions with bounded constraints	must	accepted

Record	Strength	Status
YAML is linted with yamllint	should	accepted

Record	Strength	Status
Workflows declare least-privilege token permissions	must	accepted
Pin third-party GitHub Actions to a full commit SHA	must	accepted

Record	Strength	Status
Open-source repos ship the standard community files	should	accepted
Commits and PR titles follow Conventional Commits	should	accepted
Release assets are signed keylessly with cosign	must	accepted