# Repository Safety Rules

The JARVIS repo must be safe before any frontend, gateway or adapter bootstrap.

## Never commit

- Productive SQLite databases.
- Health or Finance raw data.
- CSV/XLS/XLSX imports or exports.
- PDFs or generated reports.
- Encrypted or unencrypted backup bundles.
- OAuth files.
- credential JSON files.
- tokens, passwords, passphrases, API keys.
- runtime directories or logs.
- media/raw screenshots unless explicitly allowlisted later.

## Allowed exceptions

- `.env.example` with placeholders only.
- `.env.demo.example` with placeholders only.
- Synthetic JSON contract examples.
- Documentation that describes forbidden patterns without containing real values.
- Future intentionally allowlisted fixtures, but only after ADR and safety tests.

## `.env.example` usage

`.env.example` documents variable names and safe placeholders. It must not contain:

- real hostnames
- private Tailscale names/IPs
- local runtime paths
- tokens/secrets
- usernames/passwords

Real `.env` files are ignored and must stay local.

## Demo data

Demo data must be synthetic. Do not derive demo data from real Health or Finance exports, even if partially anonymized.

## Operator demo runtime

`make demo` and `make smoke-operator-demo` may create PID and log files only under ignored `.tmp/operator-demo/`. Do not commit `.tmp/`, PID files, local logs, runtime databases, media, raw API responses, screenshots, or local `.env.demo` files. The committed `.env.demo.example` must remain placeholder-only.

## Fixtures

Fixtures must be:

- synthetic
- small
- documented
- covered by safety checks

CSV/XLSX/PDF fixtures are blocked by default. If later needed, add an ADR and explicit allowlist before committing.

## Health Safe Status Marker

Allowed: the schema, synthetic fixtures, tests, and handoff docs for the Health Safe Status Marker. Forbidden remains unchanged for real marker/runtime files: do not commit productive marker files, HealthManager runtime files, paths, filenames, Drive IDs, medical content, reports, logs, screenshots, or `.env` files.

The smoke script must create its marker under ignored `.tmp/` and clean up after itself.

## AutoShorts Runtime Safety

Allowed: AutoShorts read-only contract docs, sanitizer code, synthetic JSON fixtures, and local smoke scripts. Forbidden: productive AutoShorts runtime files, videos, images, audio, subtitles, render manifests with paths, logs, screenshots, OAuth files, tokens, platform credentials, and real output packages.

Jarvis AutoShorts adapter output must never contain local paths, media filenames, media URLs, scripts, prompts, voiceovers, captions/descriptions, render commands, upload actions, publish actions, or secrets.

## Screenshots and media

Images and media are blocked by default. Future screenshots require:

- no Health/Finance raw data
- no private URLs
- no personal names
- ADR or documented allowlist

## Before every commit

Run:

```bash
make verify
git status --short
git diff --cached --stat
git diff --cached
```

## Why `.gitignore` is not enough

`.gitignore` does not protect already-tracked files, unusual filenames, copied artifacts, or accidental secrets inside text files. Therefore the safety script is mandatory.

The rule is simple: trust `.gitignore` the way one trusts a toddler with a fountain pen — helpful, but supervision required.


## FinanceManager Read-only Adapter

Phase 5A adds an optional FinanceManager read-only adapter behind `FINANCE_ADAPTER_MODE`. Default is `mock`. `live_readonly` requires `FINANCE_API_BASE_URL` and calls only the approved GET endpoints documented in `docs/integrations/finance-readonly-adapter.md`. `disabled` returns a safe degraded Finance snapshot. Exact Finance values remain blocked; `ALLOW_EXACT_FINANCE_VALUES=1` is rejected.

Smoke, only with local FinanceManager running:

```bash
export FINANCE_API_BASE_URL=http://127.0.0.1:<finance-port>
make smoke-finance-live-readonly
```

Rollback:

```bash
FINANCE_ADAPTER_MODE=mock
```

## Phase 6A Health probe safety additions

Health probe code and tests may contain synthetic forbidden terms only in dedicated sanitizer, redaction, smoke, and fixture files. Production API output must not contain medical terms, local paths, database names, Drive identifiers, PDF/OCR text, tracker names, report text, file names, or raw Health payloads.

Before commit, remove `.tmp/`, dashboard `dist/`, Playwright artifacts, logs, screenshots, videos, raw Health JSON, Health databases, reports, PDFs, OCR output, and runtime files.

## Health safe inventory rules

Phase 6B documentation may classify source categories but must not preserve real runtime paths, real filenames, raw Health output, medical values, report excerpts, tracker rows, PDF/OCR text, logs, Drive identifiers, or database rows. Dirty examples must remain synthetic and be limited to dedicated test fixtures or sanitizer tests.