Contents

Module header
- Module header
Tooling expectations
- Tooling expectations
Spelling gate
- Spelling gate
CSS modules conventions
- CSS modules conventions
Package boundaries
- Package boundaries
Transport abstraction practice
- Transport abstraction practice
Command registry practice
- Command registry practice
Configuration format practice
- Configuration format practice
Configuration layering and reloadability practice
Visible-only WebGL rendering practice
- Visible-only WebGL rendering practice
WebGL context-loss recovery practice
- WebGL context-loss recovery practice
Pseudo-terminal (PTY) batching and frame-timing benchmark practice
- Pseudo-terminal (PTY) batching and frame-timing benchmark practice
Tab decoration provider practice
- Tab decoration provider practice
Context key and `when` practice
- Context key and `when` practice
esbuild build pipeline and safeguards
- esbuild build pipeline and safeguards
Electron runtime alignment
- Electron runtime alignment
GPU fallback launch switch
- GPU fallback launch switch
Chromium startup log noise suppression
- Chromium startup log noise suppression
React version alignment
- React version alignment
React component composition and translation patterns
- React component composition and translation patterns
Formatting and linting
- Formatting and linting
Vulnerability auditing practice
- Vulnerability auditing practice
Type checking
- Type checking
Tests
Default test gate

Vulnerability auditing practice

Updated Jul 27, 2026

Supply-chain changes must include a vulnerability scan pass before merge:

Run bun install first, so audit output reflects the current lockfile and postinstall build graph.
Generate a human-readable advisory report with bun audit.
Verify there are no critical, high, or moderate advisories with bun audit --audit-level=moderate.
Produce machine-readable evidence with bun audit --json --audit-level=moderate when logs or follow-up automation require it.

Roadmap item 1.4.2 is satisfied only when the moderate-threshold audit run is clean. If remediation requires dependency overrides, keep overrides in package.json and re-run the full gate sequence before marking work complete. For the current Electron 40 toolchain ([email protected]), keep ajv aligned with @develar/schema-utils and ajv-keywords@3 by pinning it to 6.14.0; moving back to Ajv 8 without upgrading that stack will break bun install during postinstall. Follow the Electron runtime alignment section above for the canonical packaged dependency mirror command: node bin/copy-node-modules.mjs.