decision-guardian 1.1.0

package/templates/database.md

@@ -0,0 +1,81 @@
+<!-- DECISION-DB-001 -->
+## Decision: Migration Files Are Immutable
+**Status**: Active
+**Date**: 2024-03-01
+**Severity**: Critical
+**Files**:
+- `migrations/**/*`
+- `db/migrations/**/*`
+
+### Context
+Never modify existing migration files. Create new migrations instead. Modifying past migrations breaks deployed databases.
+
+---
+
+<!-- DECISION-DB-002 -->
+## Decision: Schema Version Lock
+**Status**: Active
+**Date**: 2024-03-15
+**Severity**: Critical
+**Files**:
+- `src/db/schema.ts`
+- `prisma/schema.prisma`
+- `drizzle/**/*.ts`
+
+**Rules**:
+```json
+{
+  "match": "any",
+  "conditions": [
+    {
+      "files": ["prisma/schema.prisma"],
+      "content": {
+        "mode": "regex",
+        "pattern": "@@map|@@ignore|model\\s+\\w+"
+      }
+    },
+    {
+      "files": ["src/db/schema.ts", "drizzle/**/*.ts"],
+      "content": {
+        "mode": "string",
+        "patterns": ["createTable", "dropTable", "alterTable", "addColumn", "dropColumn"]
+      }
+    }
+  ]
+}
+```
+
+### Context
+Schema changes must be paired with migrations and reviewed by the database team.
+
+---
+
+<!-- DECISION-DB-003 -->
+## Decision: Connection Pool Configuration
+**Status**: Active
+**Date**: 2024-04-01
+**Severity**: Warning
+**Files**:
+- `config/database.*`
+- `src/db/pool.*`
+- `.env*`
+
+**Rules**:
+```json
+{
+  "match": "any",
+  "conditions": [
+    {
+      "files": ["config/database.*", "src/db/pool.*"],
+      "content": {
+        "mode": "regex",
+        "pattern": "(pool_size|max_connections|min_connections|idle_timeout)\\s*[:=]",
+        "flags": "i"
+      }
+    }
+  ]
+}
+```
+
+### Context
+Pool configuration changes can cause production outages. Must be load-tested before deployment.

package/templates/security.md

@@ -0,0 +1,89 @@
+<!-- DECISION-SEC-001 -->
+## Decision: No Hardcoded Secrets
+**Status**: Active
+**Date**: 2024-04-01
+**Severity**: Critical
+**Files**:
+- `src/**/*.ts`
+- `src/**/*.js`
+- `config/**/*`
+
+**Rules**:
+```json
+{
+  "match": "any",
+  "conditions": [
+    {
+      "files": ["src/**/*.ts", "src/**/*.js", "config/**/*"],
+      "content": {
+        "mode": "regex",
+        "pattern": "(api[_-]?key|secret|password|token|private[_-]?key)\\s*[:=]\\s*['\"][^'\"]{8,}['\"]",
+        "flags": "i"
+      }
+    }
+  ]
+}
+```
+
+### Context
+Hardcoded secrets must never appear in source code. Use environment variables or a secrets manager.
+
+---
+
+<!-- DECISION-SEC-002 -->
+## Decision: Auth Middleware Required
+**Status**: Active
+**Date**: 2024-04-15
+**Severity**: Critical
+**Files**:
+- `src/routes/**/*.ts`
+- `src/api/**/*.ts`
+
+**Rules**:
+```json
+{
+  "match": "any",
+  "conditions": [
+    {
+      "files": ["src/routes/**/*.ts", "src/api/**/*.ts"],
+      "content": {
+        "mode": "string",
+        "patterns": ["router.get(", "router.post(", "router.put(", "router.delete(", "app.get(", "app.post("]
+      }
+    }
+  ]
+}
+```
+
+### Context
+All route handlers must use the authentication middleware. Changes to route files require security review.
+
+---
+
+<!-- DECISION-SEC-003 -->
+## Decision: Security-Critical Dependencies
+**Status**: Active
+**Date**: 2024-05-01
+**Severity**: Warning
+**Files**:
+- `package.json`
+- `package-lock.json`
+
+**Rules**:
+```json
+{
+  "match": "any",
+  "conditions": [
+    {
+      "files": ["package.json"],
+      "content": {
+        "mode": "json_path",
+        "paths": ["dependencies.jsonwebtoken", "dependencies.bcrypt", "dependencies.helmet", "dependencies.cors"]
+      }
+    }
+  ]
+}
+```
+
+### Context
+Changes to security-critical dependencies require extra review and testing.