---
inclusion: auto
---

# Project-Audit Standards

## Quality Gates (before every commit)

1. `gitleaks detect --source . --no-git` — no secrets in code
2. `ruff check .` — linting passes (if configured)
3. No hardcoded tokens or URLs with credentials in scripts

## Conventional Commits

```
feat(analysis): add team velocity dashboard
fix(export): handle UTF-8 in Confluence page titles
data(confluence): update page export for PI 41
docs(readme): update analysis findings
```

## Security (CRITICAL)

- NEVER commit `.secrets` or token values
- Scripts read tokens from `../../.secrets` (workspace root)
- Confluence/Jira URLs are safe to commit, tokens are not
- Data exports must not contain personal data (emails, phone numbers)

## File Naming

- All filenames OneDrive-safe
- No brackets `()`, no `&`, no `@`, no `#`
- Replace umlauts: ä→ae, ö→oe, ü→ue
- Use hyphens for spaces in page-derived filenames

## Architecture

- Standalone Python scripts (no framework, no package)
- Each script reads from APIs and writes to local files
- Knowledge graph in `knowledge/` (SQLite via ingest.py)
- Data exports in `data/` (gitignored if large)

## DB GitLab

- Repo: https://git.tech.rz.db.de/AndreKnie/project-audit
- Push with GITLAB_TOKEN_AUDIT (write scope)