Cogitave engineering standards
Learn the standards floor that governs every repository in the Cogitave estate: the AGENTS.md rules, naming, commits and versioning, testing and quality, API design, configuration, secure SDLC, CI/CD, and observability and reliability. By the end you'll be able to make changes that pass the org gates by default. Day 0: this path is scaffolded - the module bodies are authored in a later content phase.
Modules9
Duration236 min
Levelintermediate
Prerequisites
- Basic familiarity with Git and the command line.
- Completion of the "Contributor onboarding" path is recommended.
Modules in this path
- Apply the AGENTS floor State the seven non-negotiable rules every Cogitave contributor and agent obeys, say what enforces each one - a hook, a CI gate, an org ruleset, or policy-as-code - and apply them to your own first change.
- Apply the naming standards Name a new identifier, file, repo, or branch the way the estate does - keyword-first, no redundant prefix, cased by role - and tell a functional keyword apart from a product codename, so your first artifact passes the naming gate by default.
- Commits and versioning Write Conventional Commits whose type, scope, and breaking marker drive Semantic Versioning; see how release-please turns merged commits into a human-approved Release-PR, changelog, and tag; and how the trunk-based, protected-main model gates every release.
- Test to the standard and pass the quality gate Learn how Cogitave tests a change - the pyramid/trophy shape, the diff-coverage and mutation gates, flaky-test quarantine, the runnable harness, and the craftsmanship review bar - so you can test your own change and get it through the gate.
- Design and version a Cogitave API Shape a clean, consistent API against the Cogitave API design standard - resources, standard methods, typed errors, cursor pagination, idempotency - then version and deprecate it under the versioning policy so no consumer is ever broken without consent.
- Manage configuration and secrets Classify every value as a constant, a deployment parameter, or a secret; load configuration through the standard precedence chain, parsed once and fail-closed; and keep secrets out of git by referencing them at runtime and committing only encrypted-at-rest .env files.
- Build with the secure SDLC State the security baseline - threat modeling, least privilege, and IAM - and follow the secure development lifecycle that shifts security left, so each stage of a change carries its own security gate instead of a check bolted on at the end.
- Read the pipeline that ships your change Follow a change from a pull request through the canonical CI stage set to a gated production deploy - the ordered gates a pipeline runs, why CI is the real gate, and how the deployment model promotes one signed artifact dev to staging to prod.
- Observability and reliability Instrument a service with OpenTelemetry-spec traces, metrics, and logs, understand why agent traces are kept as evidence, and reason about reliability through SLIs, SLOs, error budgets, and the policy that turns a spent budget into a release freeze.