Coding Standards

General

Production-quality only: no pseudocode, no placeholder security, no hard-coded credentials, no ignored errors, no silent failures, no cross-module table access. Authorization is server-side and enforced again in the database by row-level security; country-gated behaviour goes through the country activation registry (internal/platform/country), never an inline country check — see Country Policies.

Go

gofmt + go vet (both enforced in apps/api/Dockerfile, so a violation stops a deployment); consumer-defined interfaces; DI without a heavy framework; no global mutable state; explicit transaction boundaries; pgx + hand-written SQL (no ORM); wrap errors with context; table-driven tests; race tests where relevant.

TypeScript

Strict mode, no implicit any, Zod validation, typed forms, accessibility, documented server/client boundaries, generated API contracts. lint and typecheck are enforced in each portal's Dockerfile; the component tests are not — they run in scripts/verify.sh instead, for the reason given in Build and deployment.

Generated clients are checked for drift against packages/contracts by scripts/verify.sh and nowhere else. That check is recent: nothing watched 53 OpenAPI contracts against their generated clients for a long time, and real drift accumulated. Regenerate when you change a contract rather than when somebody notices.

Python (AI)

Type hints, Pydantic models, isolated providers, timeouts/retries, traceability, tests for prompts and output schemas. Note that apps/ai has no automated check of any kind in its Dockerfile and is not deployed — see AI Architecture.