Cline rules

1<!-- Generated by EEIK generate_adapters.py on 2026-08-10 — do not edit by hand -->
2# Golden Rules — this project
3 
4Non-negotiable engineering standards. Apply to all code Cline writes or edits.
5 
6# Golden Rules Standard
7 
8**Applies To:** All projects, all languages, all domains  
9**Enforced By:** `code-reviewer` agent, CI/CD hooks, `security-auditor` agent  
10**Status:** Non-negotiable
11 
12---
13 
14## The 12 Golden Rules
15 
16These rules apply to every line of code committed to any EEIK-managed project. They are not preferences — violation of a BLOCKER rule prevents merge.
17 
18---
19 
20### Rule 1 — Constructor Injection Only
21 
22**No `@Autowired` on fields. All injected fields are `final`.**
23 
24```java
25// ❌ VIOLATION — field injection
26@Service
27public class OrderService {
28    @Autowired
29    private OrderRepository orderRepository;
30}
31 
32// ✅ CORRECT — constructor injection
33@Service
34public class OrderService {
35    private final OrderRepository orderRepository;
36 
37    public OrderService(OrderRepository orderRepository) {
38        this.orderRepository = orderRepository;
39    }
40}
41```
42 
43**Why:** Fields cannot be `final`. Cannot test without Spring context. Dependencies are invisible.
44 
45---
46 
47### Rule 2 — No Hardcoded Secrets
48 
49**No credentials, API keys, passwords, or AWS account IDs in source code.**
50 
51```java
52// ❌ VIOLATION
53String apiKey = "sk-live-abc123...";
54String dbPassword = "SuperSecret123";
55 
56// ✅ CORRECT — environment variable or Secrets Manager
57String apiKey = System.getenv("API_KEY");
58// or via @Value, or SecretsManagerClient
59```
60 
61**Why:** Source code is version-controlled and shared. Secrets in code become public.
62 
63---
64 
65### Rule 3 — SLF4J, Not System.out
66 
67**Use `log.info(...)` with parameterised messages. Never `System.out.println()`.**
68 
69```java
70// ❌ VIOLATION
71System.out.println("Processing order: " + orderId);
72 
73// ✅ CORRECT
74log.info("Processing order id={}", orderId);
75```
76 
77**Why:** `System.out` bypasses the logging framework — no level control, no structured output, no MDC context.
78 
79---
80 
81### Rule 4 — No SELECT *
82 
83**Always specify explicit column lists in SQL.**
84 
85```sql
86-- ❌ VIOLATION
87SELECT * FROM orders WHERE customer_id = :customerId;
88 
89-- ✅ CORRECT
90SELECT id, customer_id, status, total_amount, created_at
91FROM orders
92WHERE customer_id = :customerId;
93```
94 
95**Why:** Schema additions silently increase payload size and break mapping. Query plans are harder to optimise.
96 
97---
98 
99### Rule 5 — Parameterised Queries Only
100 
101**No SQL string concatenation. Use named parameters.**
102 
103```java
104// ❌ VIOLATION — SQL injection risk
105String sql = "SELECT * FROM orders WHERE id = '" + orderId + "'";
106 
107// ✅ CORRECT
108String sql = "SELECT id, status FROM orders WHERE id = :orderId";
109namedJdbcTemplate.queryForObject(sql, Map.of("orderId", orderId), rowMapper);
110```
111 
112**Why:** String concatenation enables SQL injection. Non-negotiable security rule.
113 
114---
115 
116### Rule 6 — java.time Only (Java projects)
117 
118**No `java.util.Date`, `java.util.Calendar`, or `java.sql.Timestamp`.**
119 
120```java
121// ❌ VIOLATION
122Date now = new Date();
123Calendar cal = Calendar.getInstance();
124 
125// ✅ CORRECT
126Instant now = Instant.now();
127LocalDate today = LocalDate.now();
128ZonedDateTime zonedNow = ZonedDateTime.now(ZoneId.of("Europe/London"));
129```
130 
131**Why:** `Date` and `Calendar` are mutable, non-thread-safe, and poorly designed. `java.time` is ISO 8601-correct.
132 
133---
134 
135### Rule 7 — jakarta.* in Spring Boot 3.x (Java projects)
136 
137**No `javax.*` imports in Spring Boot 3.x code.**
138 
139```java
140// ❌ VIOLATION in Spring Boot 3.x
141import javax.persistence.Entity;
142import javax.validation.constraints.NotNull;
143 
144// ✅ CORRECT
145import jakarta.persistence.Entity;
146import jakarta.validation.constraints.NotNull;
147```
148 
149**Why:** Spring Boot 3.x requires Jakarta EE 10. `javax.*` causes `ClassNotFoundException` at runtime.
150 
151---
152 
153### Rule 8 — Conventional Commits
154 
155**All commit messages follow `type(scope): description` format.**
156 
157```
158# ❌ VIOLATION
159"fix stuff"
160"wip"
161"updated OrderService"
162 
163# ✅ CORRECT
164feat(orders): add order cancellation endpoint
165fix(payments): handle null amount in authorisation
166chore(deps): upgrade Spring Boot to 3.3.0
167test(orders): add Testcontainers integration test for cancellation
168```
169 
170**Types:** `feat`, `fix`, `refactor`, `test`, `chore`, `docs`, `perf`, `ci`, `build`, `revert`
171 
172---
173 
174### Rule 9 — No Partial Implementations
175 
176**Every committed method body is complete. No `// TODO implement this` in production code.**
177 
178```java
179// ❌ VIOLATION
180public BigDecimal calculatePremium(Policy policy) {
181    // TODO: implement premium calculation
182    return null;
183}
184 
185// ✅ CORRECT — if not yet implementable, throw explicitly
186public BigDecimal calculatePremium(Policy policy) {
187    throw new UnsupportedOperationException(
188        "Premium calculation not yet implemented — tracked in TD-042"
189    );
190}
191```
192 
193---
194 
195### Rule 10 — No Empty Catch Blocks
196 
197**Every catch block at minimum logs the exception.**
198 
199```java
200// ❌ VIOLATION
201try {
202    publishEvent(event);
203} catch (Exception e) {
204    // swallowed
205}
206 
207// ✅ CORRECT
208try {
209    publishEvent(event);
210} catch (Exception e) {
211    log.error("Failed to publish event type={} id={}: {}", 
212               event.getType(), event.getId(), e.getMessage(), e);
213}
214```
215 
216---
217 
218### Rule 11 — No Thread.sleep() in Tests
219 
220**Use Awaitility for async assertions.**
221 
222```java
223// ❌ VIOLATION
224Thread.sleep(2000);
225assertThat(orderRepository.findById(id)).isPresent();
226 
227// ✅ CORRECT
228await().atMost(5, SECONDS).until(() ->
229    orderRepository.findById(id).isPresent()
230);
231```
232 
233---
234 
235### Rule 12 — Optional.get() Only with Guard
236 
237**Never call `Optional.get()` without a preceding `isPresent()` or use `orElseThrow()`.**
238 
239```java
240// ❌ VIOLATION
241Order order = orderRepository.findById(id).get(); // NoSuchElementException risk
242 
243// ✅ CORRECT
244Order order = orderRepository.findById(id)
245    .orElseThrow(() -> new OrderNotFoundException(id));
246```
247 
248---
249 
250## Enforcement
251 
252| Severity | Rules | Gate |
253|----------|-------|------|
254| BLOCKER (pre-merge) | 2 (no secrets), 5 (SQL injection) | CI security scan |
255| BLOCKER (code review) | 1, 3, 4, 6, 7, 9, 10, 12 | `code-reviewer` agent |
256| MAJOR (code review) | 8, 11 | `code-reviewer` agent |
257 
258Rules 1–12 are checked by the `code-reviewer` agent on every PR review.
259 
260