:::warning AUTO-GENERATED — do not edit This page is generated from the MCP server snapshot content/backend-mcp.json. Edit the source MCP server (not this file), then run npm run generate. :::

Backend — Guardrails & Non-negotiables

These rules are enforced by the MCP server and must not be bypassed.

{
  "antiHallucinationPolicy": {
    "summary": "Never invent APIs, endpoints, types, fields, tables, columns, colors, component names, or package imports. Retrieve every fact from an MCP tool, a real schema, or an existing project file. If a tool/schema/file does not confirm it, STOP and ask — do not fabricate.",
    "rules": [
      "GROUND, DON'T GUESS: Every endpoint, field, table, column, type, color, or component MUST come from an MCP discovery tool or an existing project file. If you did not see it there, it does not exist.",
      "VALIDATE BEFORE USE: Run the relevant validate_* tool before writing code that depends on a discovered fact. A failed result means STOP — do not build on it.",
      "TYPES FROM SCHEMA/SOURCE: Type and validation schemas MUST mirror the real response/DB schema or documented contract. Include ONLY fields confirmed to exist — never add plausible-looking ones.",
      "IMPORTS FROM KNOWN MODULES: Only import symbols actually exported by installed dependencies or files that exist in the project. Do not import a package that is not declared in the project's manifest.",
      "CITE YOUR SOURCE: When you write an endpoint, type, field, color, or component, state which tool call, schema, or project file it came from. Unsourced facts are not allowed.",
      "FAIL CLOSED: If discovery is inconclusive (tool errors, empty result, ambiguous mapping), ask the user a specific question rather than proceeding on an assumption.",
      "COMPILER IS THE ORACLE: Run the project's verify gate before declaring done. A hallucinated fact becomes a type/build/lint error — fix the root cause, do not suppress it.",
      "SCHEMA DISCOVERY: Every table, column, and field MUST come from a real database schema (introspected via `dynamix_wrapper`) or an existing project file. NEVER add plausible-looking tables/columns — query the schema; if a column is absent, it is not available, so ask the user rather than guessing a name.",
      "VALIDATE ENDPOINTS: Call `validate_backend_endpoint` (backend-mcp) before writing any route — a failed result means STOP, do not build the endpoint — and target real routes from `list_backend_endpoints`.",
      "ALLOWED IMPORTS: Only import symbols that are actually exported by installed packages (`dynamix_wrapper`, `python_logger`, etc.) or files that exist in the project. Do not import packages that are not declared as dependencies.",
      "VERIFY GATE: Run the verify gate (ruff + mypy + pytest + auth-lint) before declaring done. A hallucinated table/column becomes a runtime or type error — fix the root cause, do not suppress it."
    ]
  },
  "nonNegotiables": [
    "Protect EVERY route with the `@require_auth` decorator (zero-trust). No public route is permitted except an explicit `/health` allowlist entry.",
    "Validate the JWT signature against JWKS at `https://auth.rystadenergy.com/`; verify the `iss` and `exp` claims; extract `re_id` and `role` from the token payload. For audience, validate scope/role and keep `aud` configurable (do not hardcode).",
    "Access the database ONLY via `dynamix_wrapper`: reads use `get_sqlalchemy_connection_string()` + a read-only SQLAlchemy SELECT; writes go through `dbconnect.update_table()`. NEVER import `pyodbc`, `create_engine`, or `psycopg2` or otherwise open a connection directly.",
    "Log ONLY via `python_logger.setup_logger`. Never call `print` and never use a bare `logging.getLogger`.",
    "Validate the request and response at the boundary with schemas. Keep secrets out of code — read them from environment variables only.",
    "One endpoint per chart/visual — never batch multiple charts into a single response. Every endpoint ships with its own tests, and the verify gate must pass before 'done'."
  ],
  "enforcedBy": [
    "ruff — custom banned-import/call rules reject `pyodbc`, `create_engine`, `psycopg2`, and `print` (fail the lint if any appear).",
    "mypy — type checking; hallucinated fields/schemas fail to type-check.",
    "pytest — per-endpoint tests must pass before 'done'.",
    "AST auth-lint check — asserts every route is decorated with `@require_auth` (only the `/health` allowlist is exempt).",
    "core.gateway (runtime) — JWT/JWKS validation and `re_id`/`client_id`/`role` claim gating cannot be bypassed from the client."
  ]
}