> For the complete documentation index, see [llms.txt](https://framework.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://framework.aic.io/technical-guidelines-code-standards-and-tech-stack/engineering-operating-model/engineering-golden-rules.md).

# Engineering Golden Rules

### Purpose

These rules define the minimum engineering standard expected on AIC projects. They apply to internal accelerators, customer deliverables, proof-of-concepts that may become production assets, and subcontractor-delivered code.

### The Rules

#### Rule 1: No unsupported runtime

Do not start new delivery on unsupported .NET versions. Legacy work must have a migration or containment plan.

#### Rule 2: No unpinned SDK

Every repository must include a `global.json` that pins the .NET SDK used by the project.

#### Rule 3: No nullable-disabled production code

Nullable reference types must be enabled. Null handling must be deliberate.

#### Rule 4: No warnings hidden by default

Warnings must be visible. Production code should treat compiler and important analyzer warnings as errors.

#### Rule 5: No secrets in source control

Secrets, keys, connection strings, tokens and certificates must never be committed to repositories.

#### Rule 6: No business logic in UI or transport layers

WPF views, MAUI pages, controllers, endpoints and middleware must not contain core business logic. They orchestrate and delegate.

#### Rule 7: No unreviewed code into main

Main branch must be protected. Pull requests require review and automated checks.

#### Rule 8: No API without a contract

APIs must define request and response models, error responses, security behaviour and OpenAPI documentation.

#### Rule 9: No release without rollback thinking

Every deployment must have a rollback, roll-forward or containment approach.

#### Rule 10: No technical exception without an owner

Exceptions must identify owner, risk, expiry date and remediation route.

### Engineering Gate Checklist

| Question                   | Required answer |
| -------------------------- | --------------- |
| Is the runtime supported?  | Yes             |
| Is the SDK pinned?         | Yes             |
| Is formatting automated?   | Yes             |
| Are analyzers configured?  | Yes             |
| Are tests automated?       | Yes             |
| Are secrets externalised?  | Yes             |
| Are dependencies reviewed? | Yes             |
| Is logging structured?     | Yes             |
| Is release repeatable?     | Yes             |
| Is evidence retained?      | Yes             |