webhook / rules

---
description: Non-negotiable product principles every change must respect.
globs:
alwaysApply: true
---

# Constitution — non-negotiables

Durable principles for this repository. Design for them from day one; they are not bolt-ons.

- **Compliance-by-design.** Encryption in transit and at rest; secrets in a KMS; append-only,
  hash-chained audit log; Postgres RLS tenant isolation; region pinning; PII/PHI scrubbed from logs.
- **MCP / AI-native parity.** Every capability is reachable identically from CLI / API / web / MCP.
- **Private-by-default.** Nothing is public, listed, or shared unless explicitly made so.
- **Cookieless ingestion on a separate apex.** Ingestion and the CLI tunnel live on `wbhk.my`:
  cookieless, no CORS, path-token routing, `404` for unknown tokens. Never serve ingestion from a
  primary application subdomain.
- **Standard-Webhooks-native.** Signing/verification follow Standard Webhooks (send and receive).
  Do not hand-roll signature schemes.
- **Open-core boundary.** Open core is Apache-2.0; proprietary code is fenced into `ee/`. Open-core
  code must not depend on `ee/`.
- **Transparent pricing (qualitative).** Keep event metering accurate and single-dimension; never
  add hidden per-step counters. (No prices or cost figures belong in this repo.)

## Engineering guardrails (non-negotiable)

- **Human-UI-testing hard stop.** When a change needs human UI/visual verification you cannot do
  yourself (rendering, layout, design, interaction, user-facing copy), STOP and explicitly flag it
  for human testing. Do not mark complete, approve, or merge until a human has verified it.
- **Never bypass tests.** Never use `git commit/push --no-verify`; never add `.only`/skip/disable
  tests or lower coverage thresholds to make CI pass. Fix the root cause. CI required checks are
  mandatory for everyone (including admins) — status checks have no bypass.

More agent context in webhook-co/webhook

24 other files this repository gives its agents.