Engineering Golden Rules

Purpose

These rules define the minimum engineering standard expected on AIC projects. They apply to internal accelerators, customer deliverables, proof-of-concepts that may become production assets, and subcontractor-delivered code.

The Rules

Rule 1: No unsupported runtime

Do not start new delivery on unsupported .NET versions. Legacy work must have a migration or containment plan.

Rule 2: No unpinned SDK

Every repository must include a global.json that pins the .NET SDK used by the project.

Rule 3: No nullable-disabled production code

Nullable reference types must be enabled. Null handling must be deliberate.

Rule 4: No warnings hidden by default

Warnings must be visible. Production code should treat compiler and important analyzer warnings as errors.

Rule 5: No secrets in source control

Secrets, keys, connection strings, tokens and certificates must never be committed to repositories.

Rule 6: No business logic in UI or transport layers

WPF views, MAUI pages, controllers, endpoints and middleware must not contain core business logic. They orchestrate and delegate.

Rule 7: No unreviewed code into main

Main branch must be protected. Pull requests require review and automated checks.

Rule 8: No API without a contract

APIs must define request and response models, error responses, security behaviour and OpenAPI documentation.

Rule 9: No release without rollback thinking

Every deployment must have a rollback, roll-forward or containment approach.

Rule 10: No technical exception without an owner

Exceptions must identify owner, risk, expiry date and remediation route.

Engineering Gate Checklist

Question	Required answer
Is the runtime supported?	Yes
Is the SDK pinned?	Yes
Is formatting automated?	Yes
Are analyzers configured?	Yes
Are tests automated?	Yes
Are secrets externalised?	Yes
Are dependencies reviewed?	Yes
Is logging structured?	Yes
Is release repeatable?	Yes
Is evidence retained?	Yes