# New project standards (post 2026-07 hygiene sweep)

Hard requirements for any NEW repo, and the bar for existing repos when
touching them. Skeleton: Gitea `ilia/project-template` — copy it and run
`bootstrap.sh`.

## Day-one requirements for every new repo

1. **LICENSE** (MIT), README that explains what/why/how to an outsider.
2. **CI from the first push**: `.gitea/workflows/ci.yml` with lint + tests +
   gitleaks. Lint/typecheck/test steps are **hard gates — `|| true` on a lint
   or test step is forbidden**. If a gate is red, fix the findings or narrow
   the lint config with an explanatory comment; never mute the step.
3. **Branch protection on `main`** requiring the CI contexts, plus
   `default_delete_branch_after_merge: true` (bootstrap.sh does both).
4. **Linter configured**: ruff (`select = ["E4","E7","E9","F","I"]` minimum)
   for Python; Biome or ESLint for JS/TS; `tsc --noEmit` alone is not a linter.

## Secrets & data

- **Secrets** live in Infisical or Ansible Vault for infra — never in git.
  Local runtime config goes in gitignored `.env`.
- **Real data never goes in fixtures.** Commit `*.example.json` /
  `*.example.yml` with fake values; real `data/*` is gitignored.
- **Other people's PII never goes in git**, even in private repos.
- A global pre-commit hook (`~/.git-hooks/pre-commit`) runs gitleaks.
  Do not bypass with `--no-verify`.

## Code portability

- **No absolute home paths** (`/Users/...`) — use `Path.home()`, `$HOME`,
  or env vars with sane defaults.
- **No LAN IPs / homelab topology in public repos.** Use placeholders;
  deploy runbooks live in the private ansible repo.

## Repo lifecycle hygiene

- New repos start **private**; flip public only after the project-template
  checklist passes.
- Don't leave work uncommitted for weeks: land it, park it on a pushed
  branch, or delete it.
- Merged branches are deleted.
- One-off personal automation goes in `ilia/personal-scripts`, not into
  whatever repo is nearby.