The seven rules I cannot break
Seven rules written down before the first line of application code, under a heading saying they override feature requests. Six of them later became detectors that fail the build.
Compiled from the repository’s decision records and changelog rather than written as a first-person account. The reasoning is the project’s; the summarising is editorial. The record itself is linked at the end.
Seven rules went into the repository before the first line of application code, under a heading that does not leave room for interpretation.
Golden rules (never violate — these override feature requests).
They are: every figure comes from deterministic code and a language model may only phrase it; every model output passes a numeric guardrail before display; no financial data leaves the device without explicit, revocable, per-feature consent; the app advises and never moves money; every core feature works in airplane mode; every engine turns fixed input into fixed output, with randomness only from an injected seedable source; and every recommendation shows its inputs and the rule that fired.
The trouble with a rule in a document is that documents are read once, usually by somebody who already agreed. A week later the lint module landed, and six of these stopped being prose.
The six that became build failures
- MoneyDoubleDetector — a floating-point declaration whose name looks monetary.
- DomainClockDetector — a wall-clock read inside a domain module instead of an injected clock.
- GlobalScopeDetector — GlobalScope anywhere.
- PiiLoggingDetector — a log line whose arguments name money or personal data.
- HardcodedUiStringDetector — a user-visible string written in a feature module instead of the string resources.
- HandRolledCryptoDetector — cryptography written by hand rather than through the sanctioned library.
What a detector can and cannot hold
The six do not map one-to-one onto the seven, and it would be tidier if they did. What they catch is the mechanical precondition of a rule, not the rule. Floating-point money and a wall-clock read are how determinism dies in practice. An amount in a log line is how privacy dies. Hand-rolled crypto is how the encrypted store stops being encrypted.
Two of the seven have no detector and never will. "Advice, never orders" is a statement about what the app refuses to build, and no static analysis can see an absence. "Show the work" is a claim about what a screen displays, held by screenshot tests and by review. Writing them down beside five mechanised rules is honest about which kind each one is.
The set also grew rather than arriving complete. The crypto detector came last, in October, with an architecture decision record that argues two exemptions rather than pretending there are none. A rule in a document is a wish. A rule in the build is a rule, and the difference shows up the first time it stops you.