Project maintenance

The recurring work that keeps the Hub healthy — dependency hygiene, review tooling, the documentation loop, and the few housekeeping habits that prevent slow rot.

Dependencies

Dependabot watches the repo (.github/dependabot.yml). Review bumps the same way as any PR — the CI matrix runs on them, and the neon-preview workflow deliberately skips Dependabot PRs (a dependency bump proves nothing against a fresh Neon branch, and Dependabot can't see secrets anyway). Prefer versions at least a week old over latest — new releases are where supply-chain surprises live.

The review loop

CI carries the mechanical checks — Prettier, ESLint, the build, both Node versions, the migration chain, the MCP handshake, payload-types drift. CodeRabbit reviews PRs with repo-scoped learnings and the invariants from AGENTS.md; its config lives in .coderabbit.yaml and encodes the project's non-negotiables (migrations carry no data, one authority store, deny-not-widen, lock ordering, the MCP never sees DATABASE_URL). When CodeRabbit flags something, the finding is usually right — the threads it opened on the authority consolidation were real bugs, not noise.

Documentation

This wiki is the long-form documentation; the README and contributor guides stay deliberately concise and link here. Update the wiki when:

• the architecture or a domain model changes (the authority consolidation required rewriting the permissions page — do that work, don't let pages go stale);
• a new endpoint domain or capability lands;
• an operational procedure changes (deploy, seed, rotate).

AGENTS.md in the repo is the machine-facing version of the same contract — keep its invariants accurate; reviewers and agents both read it.

Hygiene

• No member data in git, ever. Provisioning goes to databases; the repo gets schema and code.
• .env* files stay local. The gitignore already covers them; .env.example documents the shape without the values.
• Secrets rotate when exposed. A key in a committed file, a log, or a config someone screenshotted is a key to rotate — the Neon preview key and PAYLOAD_SECRET especially.
• Migrations are append-only. Fix forward; never edit an applied migration.
• Kill scratch processes. The dev server, the MCP smoke server, and Docker Postgres are all things people forget are running.

Where to watch

• CI — .github/workflows/verify.yml on every PR; red means stop.
• Audit trail — /api/member/admin/audit is the operational record; anomalies there precede incidents.
• unmappedRecords — a rising count in access profiles means role strings the registry doesn't know are accumulating; that's data drift, not a bug, but it needs an operator's eye.