1msg-mcp: Instructions file for Codex

Quality and ownership

Profile A, Node 24.22.2. SDK/tooling maintainers own this repository. The public package entrypoints are defined in package.json; framework registration and executable consumers must remain intact. Imports must be acyclic at runtime, production cannot import tests, and dependency boundaries are enforced in .dependency-cruiser.cjs. quality.config.mjs is the source inventory and exact generated-path declaration.

Configuration belongs in the existing config/bootstrap adapters; pure conversion/validation helpers must not gain transport or environment reads. SDK and HTTP calls belong in the existing transport/client adapters. Keep complete scenarios readable at their application entrypoints; avoid pass-through facade layers. Comments on new/changed functions describe purpose, inputs/results, invariants and relevant failure/resource ownership. Check comments against behavior rather than repeating the function name.

Install with the frozen lockfile, then pnpm --dir tools/quality --ignore-workspace install --lockfile-dir "$PWD/quality/tooling" --frozen-lockfile --ignore-scripts. Run pnpm run hooks:install for local Husky/lint-staged feedback. Run all commands listed in .github/workflows/quality.yml before review: formatter, static and typed ESLint, strict production/test typecheck, dependency-cruiser, both Knip graphs, jscpd runtime gate and full report, complexity, guard negative fixtures, tests, build and packed-entrypoint smoke. No CI skip variable disables typed lint.

Historical debt is recorded per finding in quality/baselines, with adoption SHA, evidence, owner, issue and expiry. Initial allowances are replayed against the default branch; new findings and increases are forbidden. Remove entries when fixed. Generated paths have producer provenance; authored tooling is always checked.

The quality-required job fails on failed/skipped/cancelled prerequisites. Configure branch protection to require it; YAML alone does not change server protection. Tests use isolated/local inputs; never point them at production services.

Generated MCP files are owned by the pinned API producer. Run pnpm run test:generated to replay the exact producer against the checksummed public contract and locked SDK declarations, including changed/deleted/ignored-output negative fixtures. Update the producer provenance before deliberately running node quality/mcp/generate.mjs --write; never hand-edit the two generated files.

The strict source program excludes only quality/mcp/vendor/apis/**: these incomplete API snapshots are checksummed generator inputs, not executable modules. test:generated verifies their exact provenance; generated runtime outputs remain in the strict program. All authored TS/TSX/MTS/CTS files remain covered.

Jest uses the strict quality TypeScript program with isolated module compilation for NodeNext. Tests must release their listeners/transports and terminate naturally; forced process exit is not a substitute for cleanup.