Repo & process contract

Repo hygiene and process: secrets via SOPS only (no plaintext env), the Python toolchain (uv), import/path conventions, file & directory naming, and commit conventions. The dependency allowlist is its own contract — see Dependencies.

The rule

1. 🔒 Secrets go through SOPS only. No plaintext .env files anywhere, under any name. A .gitignore is NOT protection. Docs reference SOPS pointers + commands, never raw values.
2. 🔒 uv is the only Python package manager/toolchain for the backend. No repo-local .venv (cross-drive hardlink failures) — UV_PROJECT_ENVIRONMENT points uv at an environment outside the checkout. Python dependencies are declared in pyproject.toml and allowlisted in governance/allowed-deps.json.

Enforced by

scripted scan + dependency-cruiser — derived from these rules

• Secrets scan — flags any plaintext secret / .env file committed to the repo.
• Venv scan (pending) — flags a repo-local .venv.

Open items (confirm to lock)

• Imports & path conventions — define and lock.
• File & directory naming — define and lock.
• Commit conventions (commitlint) — confirm and lock.