A small set of defaults, patterns and constraints that have proved useful in practice. Not rules, and not a methodology. Just the parts that kept working.
The same stack appears in every project. That is a decision made once, written down, and defended each time it is questioned.
Not ideals. What is left after enough failed repos to understand what these were protecting against.
Requirements before design. Design before tasks. Tasks before code. The spec is written before the code exists — as the design surface, not as documentation after the fact.
Four review gates on every significant decision: security, cost, architecture, code quality. Deterministic checks that run with the work, not after the incident. Open source. Used on this codebase.
Free tier budget tracked per service. Known cost traps explicitly banned before a decision gets made. LLM costs tracked per project. The discipline that makes running many parallel experiments sustainable.
Two agents working the same codebase, explicit ownership boundaries, shared context store for sync. The protocol matters more than the tools. Prevent split-brain by searching shared context before touching anything the other agent might own.
This site runs under its own governance constraints. The scanner scans real repos. Gatekeep runs on this codebase. Everything is in version control — including the deviations from standard, and the written rationale for each one.
Not inherited from a framework. Things that appear in every project's constraints file because they were the answer to a problem that was encountered.
Run governance checks against any public GitHub repo. Real findings. No demo data.
Every commit, decision, and deviation — including the ones that needed rework.
Governance as code, agentic development, multi-model reasoning. From the work, not about the work.