← Code-Übersicht

code-rules.yaml

Pfad: code-rules.yaml

Ext: yaml

Größe: 3069 Bytes

Geändert: 2026-07-16T09:53:43+02:00

Frühere Version vom 2026-07-16T09:53:43+02:00 · zur aktuellen Fassung

# Code Rules – demo.karlkratz.com
version: 1.0
project:
  name: demo.karlkratz.com
  type: vanilla-php
  runtime: frankenphp
  description: |
    Öffentliche Single-Tenant-Site für Schulungszwecke.
    Richtlinie: keine Zusatz-Build- oder Paketmanager-Schritte (kein Composer/NPM/Python-Runtime-Build im Projektbetrieb).

core_principles:
  enabled: true
  list:
    - Domain-Driven-Design
    - Hexagonal Architecture (Ports & Adapter)
    - Clean Architecture
    - SRP
    - Separation of Concerns
    - DRY

architecture:
  php_namespace: Demo\\
  source_root: src/
  layers:
    domain: src/Domain/
    application: src/Application/
    infrastructure: src/Infrastructure/
  composition_root: public/index.php
  dependency_direction:
    rule: only_inward
    description: |
      Höhere Schichten (HTTP/Persistence/etc.) dürfen Domäne und Anwendungen nutzen,
      nicht umgekehrt. Domäne kennt keine Infrastruktur.

php_rules:
  strict_types: true
  final_classes: true
  docblocks:
    every_function: true
  constructor_injection_only: true
  output_escaping:
    required: true
    methods:
      - htmlspecialchars
      - json_encode(JSON_THROW_ON_ERROR)
  persistence:
    driver: PDO
    prepared_statements_only: true
    orm_or_active_record: false
  coding_rules:
    soC:
      required: true
    dry:
      required: true
  loc:
    enabled: true
    unit: lines_without_comments
    soft_limit: 80
    hard_limit: 150
    file_type_defaults:
      ActionController: 80
      ServiceAdapter: 100
      View: 150
      Other: 150

configuration:
  paths:
    credentials:
      source: APP_CREDENTIALS_DIR
      fallback: getenv
      project_note: |
        Im Demo-/Schulungs-Kontext werden Credentials als JSON-Dateien unter /credentials erwartet.
  forbidden_literals:
    - absolute_path_literals
    - hardcoded_ports
    - hardcoded_credentials

documentation_and_evidence:
  assertions_must_reference_file_line: true
  no_speculation_in_docs: true
  evidence_command_required:
    for_claims_about_code_or_data: true
    note: "Jede Aussage im Review/Status zu Code-Verhalten muss auf überprüfbaren Befund zurückführbar sein."

operational_rules:
  caddy_security_headers: true
  no_root_edit_required_for_code_changes: true
  reload_after_code_change: false
  reload_after_config_change:
    command: systemctl reload frankenphp-site@demo

verification:
  static_analysis:
    php_syntax:
      command: php -l <file>
    tests:
      command: phpunit tests
      notes:
        - Use Cases gegen Fake-Ports
        - Testklassen flach in tests/
        - Namespace: Tests
        - Autoloader in setUp() registrieren
    phpstan:
      command: phpstan analyse --level=8 <paths>
      bootstrap_required: true
      no_composer_autoload: true

forbidden_actions:
  destructive_without_consent:
    - delete_data
    - overwrite_files
  package_installation:
    enabled: true
    rule: only_on_explicit_approval

allowed_scope:
  scope_is_by_request: true
  avoid_unrequested_features: true
  no_new_gates_unless_requested: true