neuronfs-governance-defaults

NeuronFS Governance Defaults

This skill provides default governance rules demonstrating NeuronFS patterns. These rules establish baseline AI behavior constraints using the vorq harness and 禁 (禁) micro-opcodes.

Core Philosophy

The filesystem IS the constraint engine. Rules are encoded as folder structures that force AI behavior:

• 禁 (禁) = NEVER_DO — 1-char Chinese = 8-char meaning
• 必 (必) = MUST_DO — forced lookup before action
• 命 (命) = MANDATE — absolute requirement

Default Rules

P0-brainstem: Critical Never-Do Rules

禁secrets_in_code

禁secrets_in_code 必vorq
FORBIDDEN: Hardcoded secrets, API keys, tokens, passwords
REASON: Security breach risk — secrets must be environment variables
SCOPE: Any .py, .js, .ts, .go, .java, .rs, .env file
EXAMPLE VIOLATION:
    api_key = "sk-abc123..."  # BAD
CORRECT APPROACH:
    import os
    api_key = os.getenv("API_KEY")  # GOOD
VERIFICATION: Run "grep -r 'sk-\|password\|token\|secret' ." before commit

禁rm_rf_root

禁rm_rf_root 必vorq
FORBIDDEN: rm -rf on root directory or system paths
REASON: Catastrophic data loss risk
GUARD: Must confirm with user before ANY rm -rf
SCOPE: /, /home, /usr, /etc, /var, ~, $HOME, ./*
EXCEPTION: Only in explicitly scoped temp directories with user confirmation

禁console_log_production

禁console_log_production 必vorq
FORBIDDEN: console.log, print(), System.out.println in production code
REASON: Pollutes logs, leaks debugging info in production
REPLACEMENT: Use structured logging (winston, pino, log4j, logging module)
CORRECT:
    import logging
    logger = logging.getLogger(__name__)
    logger.info("User action completed", extra={"user_id": user_id})

P1-limbic: Values and Style Constraints

命secure_defaults

命secure_defaults
MANDATE: Security by default in all code
RULES:
- Input validation on all user-supplied data
- Parameterized queries for database access
- HTTPS/TLS for all external communications
- Principle of least privilege
- Fail securely (default deny)