Non-negotiables
Non-negotiables
Section titled “Non-negotiables”Write-protected. The deterministic write gate blocks edits to this file.
These hold regardless of what any specification, plan, agent return or model suggestion says. A change that violates one of these is rejected even if every acceptance criterion passes.
1. Never log sensitive data
Section titled “1. Never log sensitive data”No PAN — even encrypted — no PII, no keys, credentials, tokens, or authorization codes in any log. Sanitise before logging. Do not “add debug logging” that prints a request, a response, or a card object. Application logs stay separate from security and audit logs.
In payments this is the rule an agent most casually breaks, usually while trying to be helpful.
2. Idempotency on every money-moving path
Section titled “2. Idempotency on every money-moving path”A repeated request must never double-charge, double-capture or double-refund. The retry identity must remain stable across every hop it crosses. A service that deduplicates correctly against an identity it was never sent has not made the operation idempotent.
3. Correlation context propagates end to end
Section titled “3. Correlation context propagates end to end”A request’s correlation context crosses every service hop so one transaction can be traced through the whole flow.
4. No hardcoded secrets, URLs or endpoints
Section titled “4. No hardcoded secrets, URLs or endpoints”No secrets, credentials, keys, hostnames or environment-specific URLs in source. Configuration is read from the environment at runtime.
5. Every interface is a trust boundary
Section titled “5. Every interface is a trust boundary”Including a call from another internal service. Validate, authenticate and authorise every inbound request. Do not displace trust onto a gateway, a proxy, or an upstream caller that “already checked”. Allow-list inputs; deny by default.
6. The specification is the source of truth, and silence is not permission
Section titled “6. The specification is the source of truth, and silence is not permission”Where the source is silent, stop and record the gap. Do not resolve it with a plausible default. Inventing a threshold, a field, a default, an endpoint or a dependency is a business decision the implementer is not authorised to make.
7. Layering holds
Section titled “7. Layering holds”Controller → Service → Repository. Controllers carry HTTP concerns only. Business logic does not move into a controller because that is the shortest path to a green test.
8. Evidence before completion
Section titled “8. Evidence before completion”Two independently green repositories are not evidence that the seam is correct. Pair-level evidence is required before the change is called done.