512b7a0f6c
Non-negotiable structural rules that apply to every Claude Code session in
this repo and to every commit, enforced via three defense-in-depth layers:
1. PreToolUse hook in .claude/settings.json blocks any Write/Edit that
would push a file past the 500-line hard cap. Auto-loads for any
Claude session in this repo regardless of who launched it.
2. scripts/githooks/pre-commit (installed via scripts/install-hooks.sh)
enforces the LOC cap, freezes migrations/ unless [migration-approved],
and protects guardrail files unless [guardrail-change] is present.
3. .gitea/workflows/ci.yaml gets loc-budget + guardrail-integrity jobs,
plus mypy --strict on new Python packages, tsc --noEmit on Node
services, and a syft+grype SBOM scan.
Per-language conventions are documented in AGENTS.python.md / AGENTS.go.md /
AGENTS.typescript.md at the repo root — layering (router->service->repo for
Python, hexagonal for Go, colocation for Next.js), tooling baseline, and
explicit "what you may NOT do" lists.
Adds scripts/check-loc.sh (soft 300 / hard 500, reports 205 hard and 161
soft violations in the current codebase) plus .claude/rules/loc-exceptions.txt
(initially empty — the list is designed to shrink over time).
Per-service READMEs for all 10 services + PHASE1_RUNBOOK.md for the
backend-compliance refactor. Skeleton packages (compliance/{domain,
repositories,schemas}) are the landing zone for the clean-arch rewrite that
begins in Phase 1.
CLAUDE.md is prepended with the six non-negotiable rules.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
56 lines
1.9 KiB
Markdown
56 lines
1.9 KiB
Markdown
# backend-compliance
|
|
|
|
Python/FastAPI service implementing the DSGVO compliance API: DSR, DSFA, consent, controls, risks, evidence, audit, vendor management, ISMS, change requests, document generation.
|
|
|
|
**Port:** `8002` (container: `bp-compliance-backend`)
|
|
**Stack:** Python 3.12, FastAPI, SQLAlchemy 2.x, Alembic, Keycloak auth.
|
|
|
|
## Architecture (target — Phase 1)
|
|
|
|
```
|
|
compliance/
|
|
├── api/ # Routers (thin, ≤30 LOC per handler)
|
|
├── services/ # Business logic
|
|
├── repositories/ # DB access
|
|
├── domain/ # Value objects, domain errors
|
|
├── schemas/ # Pydantic models, split per domain
|
|
└── db/models/ # SQLAlchemy ORM, one module per aggregate
|
|
```
|
|
|
|
See `../AGENTS.python.md` for the full convention and `../.claude/rules/architecture.md` for the non-negotiable rules.
|
|
|
|
## Run locally
|
|
|
|
```bash
|
|
cd backend-compliance
|
|
pip install -r requirements.txt
|
|
export COMPLIANCE_DATABASE_URL=... # Postgres (Hetzner or local)
|
|
uvicorn main:app --reload --port 8002
|
|
```
|
|
|
|
## Tests
|
|
|
|
```bash
|
|
pytest compliance/tests/ -v
|
|
pytest --cov=compliance --cov-report=term-missing
|
|
```
|
|
|
|
Layout: `tests/unit/`, `tests/integration/`, `tests/contracts/`. Contract tests diff `/openapi.json` against `tests/contracts/openapi.baseline.json`.
|
|
|
|
## Public API surface
|
|
|
|
404+ endpoints across `/api/v1/*`. Grouped by domain: `ai`, `audit`, `consent`, `dsfa`, `dsr`, `gdpr`, `vendor`, `evidence`, `change-requests`, `generation`, `projects`, `company-profile`, `isms`. Every path is a contract — see the "Public endpoints" rule in the root `CLAUDE.md`.
|
|
|
|
## Environment
|
|
|
|
| Var | Purpose |
|
|
|-----|---------|
|
|
| `COMPLIANCE_DATABASE_URL` | Postgres DSN, `sslmode=require` |
|
|
| `KEYCLOAK_*` | Auth verification |
|
|
| `QDRANT_URL`, `QDRANT_API_KEY` | Vector search |
|
|
| `CORE_VALKEY_URL` | Session cache |
|
|
|
|
## Don't touch
|
|
|
|
Database schema, `__tablename__`, column names, existing migrations under `migrations/`. See root `CLAUDE.md` rule 3.
|