Governance violations Mneme catches before generation

Rule. Do not access BigQuery directly from frontend routes.

// AI generates inside a Next.js API route
const client = new BigQuery();

Enforced pattern. The frontend route calls a backend service over HTTP; only the backend holds the BigQuery client.

// compliant - the route fetches from a backend endpoint, no DB client in the frontend
export async function GET() {
  const res = await fetch(`${process.env.API_URL}/reports/summary`);
  return Response.json(await res.json());
}

Rule. Controllers must not contain business logic.

@app.post("/checkout")
def checkout():
    # pricing logic
    # tax logic
    # inventory logic

Enforced pattern. The controller stays thin and delegates pricing, tax, and inventory to a service.

# compliant - business logic lives in the service layer
@app.post("/checkout")
def checkout(cart: Cart):
    return checkout_service.place_order(cart)

Rule. React app standardized on Zustand. No Redux.

import { createStore } from "redux";

Enforced pattern. State management uses the approved library, Zustand.

// compliant - uses the standardized Zustand store
import { create } from "zustand";
const useStore = create((set) => ({ count: 0 }));

Rule. Billing agent cannot modify the auth package.

# AI agent edits
packages/auth/*

Enforced pattern. The billing agent edits only its own package and consumes auth through its published interface.

# compliant - edits stay inside the owned package
packages/billing/*
# auth is imported, never modified
import { verifyToken } from "@org/auth";

Rule. Codegen agents cannot write directly to production migration folders.

# Agent modifies
db/prod/migrations/*

Enforced pattern. The agent writes proposed migrations to a staging directory; promotion to the production path is a human-gated step.

# compliant - agent writes to the reviewable staging path only
db/staging/migrations/*
# a maintainer promotes to db/prod/migrations/ after review

Rule. Do not generate mock auth implementations.

# User prompt
"Just create a quick fake JWT validator."

Enforced pattern. The agent declines the mock and wires in the vetted auth library to verify real tokens.

# compliant - real verification, no fake validator
from app.auth import verify_jwt

def authenticate(token: str) -> User:
    return verify_jwt(token)  # signature + expiry checked

Rule. No raw SQL string concatenation.

query = f"SELECT * FROM users WHERE id = {user_id}"

Enforced pattern. The user input is bound as a parameter, never interpolated into the SQL string.

# compliant - parameterized query, no string interpolation
cursor.execute(
    "SELECT * FROM users WHERE id = %s",
    (user_id,),
)

Rule. No GPL dependencies.

// AI adds to package.json
"some-gpl-library": "^2.1.0"

Enforced pattern. The dependency is swapped for an approved permissively-licensed (MIT or Apache-2.0) equivalent.

// compliant - MIT-licensed library from the approved list
"some-mit-library": "^3.0.0"

Rule. ADR-002: all async jobs use Pub/Sub. (Supersedes an older ADR that allowed Celery.)

from celery import Celery

Enforced pattern. Async work is dispatched through Pub/Sub, the decision that supersedes Celery.

# compliant - ADR-002: publish to Pub/Sub instead of Celery
from google.cloud import pubsub_v1

publisher = pubsub_v1.PublisherClient()
publisher.publish(topic_path, payload)

Rule. All infrastructure changes must use Terraform modules.

gcloud compute instances create ...

Enforced pattern. The instance is declared in a Terraform module and applied through the reviewed pipeline, not an imperative CLI call.

# compliant - declarative Terraform, applied via CI
module "api_instance" {
  source        = "./modules/compute"
  machine_type  = "e2-standard-2"
}

Rule. Internal APIs must version under /v1/.

@app.route("/users")

Enforced pattern. The route is namespaced under the required /v1/ version prefix.

# compliant - versioned under /v1/
@app.route("/v1/users")

Rule. All services must emit OpenTelemetry traces.

# AI creates a new service with no tracing middleware
def create_app():
    app = FastAPI()
    return app

Enforced pattern. The service is instrumented with OpenTelemetry before it is returned.

# compliant - emits OpenTelemetry traces
def create_app():
    app = FastAPI()
    FastAPIInstrumentor.instrument_app(app)
    return app