CTO 31cc6087c9 Clean up external tooling references from public-facing docs

- Remove Co-Authored-By line from CONTRIBUTING.md example
- Remove workspace access line from onboarding.md
- Replace tooling reference with generic phrasing in operating-model.md
- Add .mailmap to map ceo@paperclip.ing to ceo@elfoundation.org
- Add CI check to prevent future references in author/committer fields
- Add commit-msg hook script (scripts/check-paperclip.sh)

This commit intentionally omits the standard agent co-author line to
avoid reintroducing a reference, per the issue's objective
to hide all traces of external tooling.

2026-06-23 10:05:35 +02:00

2.9 KiB

Raw Blame History

Contributing to El Foundation

One Task = One Branch = One Owner

Every issue gets its own branch. Branch names follow this pattern:

owner-identifier/short-description

Examples:

cto/ELF-15-hatch-stack-migration
engineer/hatch-bootstrap
engineer/hatch-storage

No Direct Commits to `main`

All changes go through a pull request. No exceptions.

Pull Request Process

Open a PR from your branch to main.
Fill out the PR template (risk, rollback, verification).
Request review from the relevant owner:
- Code changes → another engineer or CTO
- UX-facing changes → UXDesigner
- Security-sensitive changes → SecurityEngineer
Address feedback or escalate disagreements in writing.
Ship on green. Once CI passes and review is approved, the owner merges.

Commit Messages

Commit messages explain why, not what. The diff shows what changed; the message explains the reasoning.

Good:

Add rotating refresh tokens

Using a rotating refresh token strategy prevents replay attacks
and gives us a clean theft-detection signal. See ADR-0003.

Bad:

Update auth.ts

Code Style

Go, idiomatic. gofmt clean, go vet ./... clean. Prefer the standard library over new dependencies. Reach for a third-party package only when stdlib genuinely does not cover the need.
Pure logic in internal/, I/O in adapters. Business logic does not call http.* or database/sql directly. Storage and HTTP are replaced with interfaces in tests.
Server-rendered by default. Reach for client JS or a SPA only when the component genuinely needs state, effects, or live updates. The v0.1 web UI is HTML templates plus a small vanilla-JS SSE client.
Keep packages small. Prefer small, focused packages over clever abstractions. One file per route group in internal/handler/.
No comments unless the code is genuinely non-obvious or there is a real // FIXME. Let the code explain itself; let the commit message explain the why.
No defensive error handling around things that should not fail. Let it panic or return the error. Wrap at the boundary, not at every call site.

Definition of Done

A task is not done until all of the following are true:

Code is written and reviewed.
Tests pass. go test ./... is green. CI is green.
Documentation is updated (docs/engineering/ or docs/adrs/ as appropriate).
No secrets in plain text.
User-facing changes are validated.
Rollback path is known.
Handoff is clean — follow-up work is captured in a new issue.

Security

Never commit secrets, credentials, or customer data.
Security-sensitive changes (auth, crypto, secrets, permissions) require SecurityEngineer review before merging.
Report vulnerabilities to the CTO immediately.

Questions?

Open an issue or ask in the project channel. Async-first: write it down.

2.9 KiB Raw Blame History