Cursor rule

1---
2description: EEIK Golden Rules — apply to ALL code in ALL files
3globs: ["**/*.java", "**/*.ts", "**/*.py", "**/*.kt"]
4alwaysApply: true
5---
6<!-- Generated by EEIK generate_adapters.py on 2026-08-10 — do not edit by hand -->
7 
8# Golden Rules Standard
9 
10**Applies To:** All projects, all languages, all domains  
11**Enforced By:** `code-reviewer` agent, CI/CD hooks, `security-auditor` agent  
12**Status:** Non-negotiable
13 
14---
15 
16## The 12 Golden Rules
17 
18These rules apply to every line of code committed to any EEIK-managed project. They are not preferences — violation of a BLOCKER rule prevents merge.
19 
20---
21 
22### Rule 1 — Constructor Injection Only
23 
24**No `@Autowired` on fields. All injected fields are `final`.**
25 
26```java
27// ❌ VIOLATION — field injection
28@Service
29public class OrderService {
30    @Autowired
31    private OrderRepository orderRepository;
32}
33 
34// ✅ CORRECT — constructor injection
35@Service
36public class OrderService {
37    private final OrderRepository orderRepository;
38 
39    public OrderService(OrderRepository orderRepository) {
40        this.orderRepository = orderRepository;
41    }
42}
43```
44 
45**Why:** Fields cannot be `final`. Cannot test without Spring context. Dependencies are invisible.
46 
47---
48 
49### Rule 2 — No Hardcoded Secrets
50 
51**No credentials, API keys, passwords, or AWS account IDs in source code.**
52 
53```java
54// ❌ VIOLATION
55String apiKey = "sk-live-abc123...";
56String dbPassword = "SuperSecret123";
57 
58// ✅ CORRECT — environment variable or Secrets Manager
59String apiKey = System.getenv("API_KEY");
60// or via @Value, or SecretsManagerClient
61```
62 
63**Why:** Source code is version-controlled and shared. Secrets in code become public.
64 
65---
66 
67### Rule 3 — SLF4J, Not System.out
68 
69**Use `log.info(...)` with parameterised messages. Never `System.out.println()`.**
70 
71```java
72// ❌ VIOLATION
73System.out.println("Processing order: " + orderId);
74 
75// ✅ CORRECT
76log.info("Processing order id={}", orderId);
77```
78 
79**Why:** `System.out` bypasses the logging framework — no level control, no structured output, no MDC context.
80 
81---
82 
83### Rule 4 — No SELECT *
84 
85**Always specify explicit column lists in SQL.**
86 
87```sql
88-- ❌ VIOLATION
89SELECT * FROM orders WHERE customer_id = :customerId;
90 
91-- ✅ CORRECT
92SELECT id, customer_id, status, total_amount, created_at
93FROM orders
94WHERE customer_id = :customerId;
95```
96 
97**Why:** Schema additions silently increase payload size and break mapping. Query plans are harder to optimise.
98 
99---
100 
101### Rule 5 — Parameterised Queries Only
102 
103**No SQL string concatenation. Use named parameters.**
104 
105```java
106// ❌ VIOLATION — SQL injection risk
107String sql = "SELECT * FROM orders WHERE id = '" + orderId + "'";
108 
109// ✅ CORRECT
110String sql = "SELECT id, status FROM orders WHERE id = :orderId";
111namedJdbcTemplate.queryForObject(sql, Map.of("orderId", orderId), rowMapper);
112```
113 
114**Why:** String concatenation enables SQL injection. Non-negotiable security rule.
115 
116---
117 
118### Rule 6 — java.time Only (Java projects)
119 
120**No `java.util.Date`, `java.util.Calendar`, or `java.sql.Timestamp`.**
121 
122```java
123// ❌ VIOLATION
124Date now = new Date();
125Calendar cal = Calendar.getInstance();
126 
127// ✅ CORRECT
128Instant now = Instant.now();
129LocalDate today = LocalDate.now();
130ZonedDateTime zonedNow = ZonedDateTime.now(ZoneId.of("Europe/London"));
131```
132 
133**Why:** `Date` and `Calendar` are mutable, non-thread-safe, and poorly designed. `java.time` is ISO 8601-correct.
134 
135---
136 
137### Rule 7 — jakarta.* in Spring Boot 3.x (Java projects)
138 
139**No `javax.*` imports in Spring Boot 3.x code.**
140 
141```java
142// ❌ VIOLATION in Spring Boot 3.x
143import javax.persistence.Entity;
144import javax.validation.constraints.NotNull;
145 
146// ✅ CORRECT
147import jakarta.persistence.Entity;
148import jakarta.validation.constraints.NotNull;
149```
150 
151**Why:** Spring Boot 3.x requires Jakarta EE 10. `javax.*` causes `ClassNotFoundException` at runtime.
152 
153---
154 
155### Rule 8 — Conventional Commits
156 
157**All commit messages follow `type(scope): description` format.**
158 
159```
160# ❌ VIOLATION
161"fix stuff"
162"wip"
163"updated OrderService"
164 
165# ✅ CORRECT
166feat(orders): add order cancellation endpoint
167fix(payments): handle null amount in authorisation
168chore(deps): upgrade Spring Boot to 3.3.0
169test(orders): add Testcontainers integration test for cancellation
170```
171 
172**Types:** `feat`, `fix`, `refactor`, `test`, `chore`, `docs`, `perf`, `ci`, `build`, `revert`
173 
174---
175 
176### Rule 9 — No Partial Implementations
177 
178**Every committed method body is complete. No `// TODO implement this` in production code.**
179 
180```java
181// ❌ VIOLATION
182public BigDecimal calculatePremium(Policy policy) {
183    // TODO: implement premium calculation
184    return null;
185}
186 
187// ✅ CORRECT — if not yet implementable, throw explicitly
188public BigDecimal calculatePremium(Policy policy) {
189    throw new UnsupportedOperationException(
190        "Premium calculation not yet implemented — tracked in TD-042"
191    );
192}
193```
194 
195---
196 
197### Rule 10 — No Empty Catch Blocks
198 
199**Every catch block at minimum logs the exception.**
200 
201```java
202// ❌ VIOLATION
203try {
204    publishEvent(event);
205} catch (Exception e) {
206    // swallowed
207}
208 
209// ✅ CORRECT
210try {
211    publishEvent(event);
212} catch (Exception e) {
213    log.error("Failed to publish event type={} id={}: {}", 
214               event.getType(), event.getId(), e.getMessage(), e);
215}
216```
217 
218---
219 
220### Rule 11 — No Thread.sleep() in Tests
221 
222**Use Awaitility for async assertions.**
223 
224```java
225// ❌ VIOLATION
226Thread.sleep(2000);
227assertThat(orderRepository.findById(id)).isPresent();
228 
229// ✅ CORRECT
230await().atMost(5, SECONDS).until(() ->
231    orderRepository.findById(id).isPresent()
232);
233```
234 
235---
236 
237### Rule 12 — Optional.get() Only with Guard
238 
239**Never call `Optional.get()` without a preceding `isPresent()` or use `orElseThrow()`.**
240 
241```java
242// ❌ VIOLATION
243Order order = orderRepository.findById(id).get(); // NoSuchElementException risk
244 
245// ✅ CORRECT
246Order order = orderRepository.findById(id)
247    .orElseThrow(() -> new OrderNotFoundException(id));
248```
249 
250---
251 
252## Enforcement
253 
254| Severity | Rules | Gate |
255|----------|-------|------|
256| BLOCKER (pre-merge) | 2 (no secrets), 5 (SQL injection) | CI security scan |
257| BLOCKER (code review) | 1, 3, 4, 6, 7, 9, 10, 12 | `code-reviewer` agent |
258| MAJOR (code review) | 8, 11 | `code-reviewer` agent |
259 
260Rules 1–12 are checked by the `code-reviewer` agent on every PR review.
261 
262 
263## Enforcement
264 
265These rules are BLOCKERS in code review. No exceptions.
266Full standards: `capability-packs/core/standards/golden-rules.md`
267