12 · How we develop (safely)

Rules for a real product on a live multi-tenant server — especially until git is fully online.

Change workflow

flowchart TD
  A[Idea / bug] --> B{Touches money auth tenancy?}
  B -->|yes| C[Read OAO chapter + code + audit note]
  B -->|no| D[Read feature map anchor]
  C --> E[Smallest reversible change]
  D --> E
  E --> F[Syntax check / local smoke]
  F --> G[pm2 restart only if needed]
  G --> H[Verify path live]
  H --> I[Update DocHub / AUDIT-FINDINGS if truth changed]

Hard rules

  1. Staging = production for risk purposes.
  2. No parallel money ledgers — use Core Invoicing.
  3. No shared-schema multi-tenancy shortcuts — dedicated DBs.
  4. Trace frontend → API before declaring a feature missing.
  5. Prefer ensure-if-missing / additive over destructive migrations on all tenants.
  6. Ask before secret rotation, mass DB changes, Nginx rewrites of staging, dual-router deletion.
  7. Update the map (this DocHub + OAO) when architecture truth changes.

Trust order for docs

  1. Live code + live DB + pm2 / Nginx reality
  2. documentation/OAO/AUDIT-FINDINGS.md
  3. documentation/OAO/* chapters
  4. This DocHub (orientation; keep in sync)
  5. ForGrok.md
  6. Older docs/ and root status markdown (historical)