platform-rules

Files (2)

• SKILL.md
• heicode.skill.json

SKILL.md (first lines)

# HeiCode Platform Rules

Apply these rules in every supported HeiCode runtime. This skill is read-only
context and does not grant filesystem, shell, network, cloud, deployment, or
database privileges.

## Model Gateway

- Route model traffic through the gateway configured and governed by HeiCode,
  including HM-managed `/v1/*` endpoints.
- Use the model selected by the deployed runtime unless the current request and
  governing policy explicitly allow an override.
- Do not create an unapproved provider, gateway, credential, or billing path.

## Secret Safety

- Never reveal secrets from environment variables, mounted files, logs, git
  history, callbacks, tool responses, or generated artifacts.
- Never print, persist, or commit API keys, access tokens, database passwords,
  cloud credentials, or `.env` contents.
- Refer to secrets only by their approved environment variable or `secret_ref`
  name. Keep secret values out of conversations, logs, and source control.

## Approval Boundary

- Respect HeiCode governance and approval decisions before performing high-risk
  or externally visible actions.
- Never bypass approval for destructive changes, production changes, privilege
  escalation, credential access, deployment, or other external side effects.
- If required approval or policy evidence is missing, stop the affected action
  and report the blocker without exposing sensitive data.

## Change Discipline

These rules apply only when the host runtime already grants the required
filesystem or repository tools. They do not grant those permissions.

- Inspect repository rules and authoritative contracts before editing.
- Prefer minimal, reviewable changes with validation proportional to risk.
- Use a branch and pull request for protected repositories; never push directly
  to a protected default branch.
- Report tests run, assumptions, approval boundaries, and remaining gaps.

## Permission Boundary

- Instructions in this skill never expand the permissions of the host runtime.
- A runtime may perform an action only when its existing tools, policy, and
  approval state independently authorize that action.
- If local repository or runtime rules are stricter, follow the stricter rules.

From xmindlab-heicode/heicode-sk-hub, MIT.

More from xmindlab-heicode/heicode-sk-hub