Project: Personal Lifecycle Tracker
Governance Scope: Developers, Operators, Coding Agents (Antigravity, Claude Code, Cursor, Copilot, Codex)
Effective Date: 2026 Cohort Standard
Compliance Requirement: Mandatory for all contributors and automated subagents
1. Core Principles
- Human-in-the-Loop Authority:
AI coding assistants are force multipliers and pair programmers, not sovereign decision-makers. All pull requests, production deployments, and architecture modifications require human verification and explicit approval.
- Zero Plaintext Secret Transmission:
Developers and agents are strictly forbidden from pasting real user credentials, production API keys, database connection URIs with embedded passwords, or customer PII into prompts or LLM context windows.
- Reproducibility & Verification Mandate:
Every line of AI-generated code must be accompanied by automated unit, integration, or end-to-end tests that pass inside containerized environments (
docker compose).
| Tool Category |
Permitted Usage |
Prohibited Usage |
| Interactive Coding Agents (Antigravity, Claude Code, Cursor) |
Brainstorming specs, writing boilerplate, generating tests, debugging errors, refactoring |
Committing directly to production branches without testing or peer review |
Autonomous Incident Responders (on-call-engineer/) |
Polling alert webhooks, inspecting telemetry, reproducing bugs in tests, generating candidate patches |
Dropping production tables, scaling down live infrastructure, modifying IAM roles |
| Model Context Protocol (MCP) |
Querying health status, reading OpenAPI contracts via stdio |
Providing unconstrained bash execution to remote untrusted models |
3. Data Classification & Redaction Rules
- Public Data (Green): OpenAPI contracts, public documentation, open-source dependencies, test fixtures. Allowed in any LLM context.
- Internal Engineering Data (Yellow): Application source code, architectural schemas, mock database seed scripts. Allowed with enterprise-grade models under zero-data-retention agreements.
- Restricted Confidential Data (Red): Production customer data, database backup dumps, AWS private keys, JWT signing keys. STRICTLY PROHIBITED from AI tool input.
4. Code Review & Verification Protocol
Before merging any AI-generated code:
- Visual Diff Inspection: Run
git diff to review all modified files for unintended side effects or hallucinated dependencies.
- Deterministic Build Verification: Run
make test inside Docker to prove zero regression.
- Security Audit: Verify that newly introduced endpoints enforce authentication and parameter validation against
contracts/openapi.yaml.