ENGINEERING GOVERNANCE
Developer Guide Overview
Understand the scope, responsibilities, quality gates, and stability rules for True Care System development.
Production stability and security notice
Development changes must preserve working functionality, Provider isolation, role-based access, HIPAA auditability, released Mobile compatibility, and integration stability. Never deploy AI-generated or unreviewed code directly to production.
Engineering Scope
The guide applies to the NestJS API, Next.js Web application, React Native / Expo Mobile application, PostgreSQL database, Prisma schema, background jobs, Sandata integration, Supabase services, reporting, documentation, and future AI agents.
Developer Responsibilities
| Topic | Standard |
|---|---|
| Understand before editing | Read the current implementation and verify how production users depend on it. |
| Maintain tenant isolation | Never trust client-supplied Provider identifiers without server-side authorization. |
| Protect PHI | Avoid exposing protected information in logs, errors, screenshots, exports, or test data. |
| Preserve auditability | Do not bypass HIPAA, support-session, or administrative logging. |
| Validate end-to-end impact | A backend change may affect Web, Mobile, payroll, billing, reports, or Sandata. |
| Keep changes reviewable | Use focused files and commits with clear intent. |
| Prepare rollback | Know how to reverse code, configuration, and SQL changes. |
Definition of Done
- Requirement is implemented without unrelated changes.
- Provider scope and permissions are confirmed.
- Type checking and build checks pass.
- Database steps are documented where applicable.
- Existing workflows are smoke-tested.
- Audit and security behavior remain intact.
- Deployment and rollback notes are available.