# MVP Safety Gate Implementation Pattern

Use this when implementing the user's Finance System repo/MVP tasks. The key lesson from the first MVP bootstrap is that safety infrastructure must be implemented before any real financial import.

## Required sequence before real data

1. Create repo skeleton and package layout.
2. Add defensive `.gitignore` before adding data-like files.
3. Add `.env.example`; never create/commit a real `.env`.
4. Configure runtime outside the repo, defaulting to `~/jarvis_runtime/finance-system/`.
5. Add settings validation that rejects runtime paths inside the Git repo.
6. Add SQLite connection and schema migration foundation.
7. Add synthetic fixtures only.
8. Add CSV dry-run and row-hash duplicate detection.
9. Add audit-log basis for confirmed changes.
10. Add Git safety scan and run it before `git add`, before commit, and before push.

## Git safety scanner design notes

- Block top-level runtime/data dirs: `data/`, `imports/`, `exports/`, `reports/`, `backups/`, `secrets/`, `logs/`, `runtime/`, `local_runtime/`.
- Do **not** block source package directories named `imports` or `reports` under `src/`; match only top-level runtime/data directories.
- Block `.env`, SQLite/DB dumps, spreadsheets, PDFs/DOCX, and raw CSV/JSON except explicitly synthetic paths such as `tests/fixtures/`, `examples/synthetic/`, and config-example paths.
- Ignore `.git/` and `__pycache__/` during scans; compile/test steps can otherwise create false positives.
- If the scanner itself must contain token marker strings for tests, construct them from concatenated literals or whitelist only the scanner/test files. Never include actual token values.

## Verification commands

From repo root:

```bash
find . -type d -name __pycache__ -prune -exec rm -rf {} +
PYTHONPATH=src python -m compileall src tests
PYTHONPATH=src pytest tests -q
find . -type d -name __pycache__ -prune -exec rm -rf {} +
PYTHONPATH=src python -m jarvis_finance.cli.main git-safety-scan .
PYTHONPATH=src python -m jarvis_finance.cli.main init-db
```

Confirm the generated DB is under `~/jarvis_runtime/finance-system/data/`, not inside the repo.

## GitHub token handling

If the GitHub token is stored in Google Drive, download it only to a temporary directory or the runtime secrets directory outside the repo and never print it. If API/repo access fails, report only the permission class/status, never the token. Prefer a fine-grained PAT scoped to only `Gamexgit/FinanceManager` with minimal `Contents: Read and write` permission. Recommend rotation/removal from Drive after setup.

For FinanceManager pushes with the Drive file `Github_token_FinanceManager`, follow `references/github-token-push-from-drive.md`: retrieve with `gog` using `GOG_KEYRING_PASSWORD`, save only under `~/jarvis_runtime/finance-system/secrets/` or a temporary directory, run compile/pytest/Git-safety first, fetch remote with a temporary authenticated URL, stop if remote has advanced, push without force, unset token variables, and verify remote HEAD.

## Reporting format after each task

For each completed task, report briefly:

- what changed
- tests/checks executed
- Git-safety status
- risks/open points

Keep reports technical and avoid echoing real financial data, token contents, or local DB contents.