The rules everything else follows from

Never invent cryptography. Every primitive comes from an audited library listed in the dependency policy below. If you find yourself writing a modular arithmetic loop, a hash function, a cipher, or anything that generates randomness, stop and open an issue instead.

Never add a dependency without asking. Every package is attack surface, and every package goes into the reproducible build manifest. See Dependency policy.

Never add network capability. Not for updates, not for fee estimation, not for price display, not for fonts. The build fails if any code path in packages/ can open a socket to a non-loopback address, and the lint rule that enforces this is not a suggestion. The one exception is apps/web, which is the public website and never ships to the device. See The website is not the device.

Never ship a feature whose spec is incomplete. A module without a passing *.spec.yaml does not merge. This is the distinguishing property of the project, not paperwork.

When a requirement conflicts with convenience, the requirement wins. If a rule seems wrong, say so in an issue before implementing around it.

---