Skip to content
v2.1

Bring each product up to the rules

Every repository: add a committed docs/decisions.md and a git-ignored handover/ folder with CONTINUE-HERE.md and TODO.md (section 13), and point the agent instruction files at them.

Every gap found while writing this page is now a required rule above. This is the per-product list of what each repository must add or change. “Verify” means we have not read that code yet: check it, then either tick it or turn it into a change. Products will be updated later; this list is the work order.

All products

Section titled “All products”
  • Replace the old organisation name SpaceWorks-HQ with SpaceWorks-Labs in READMEs, AGENTS.md / CLAUDE.md, contributing guides, issue templates, links and badges (the .github repository’s CONTRIBUTING.md included).
  • Link this page from each README and agent guide as the rules the product follows.
  • Give every project except Android and iOS its own landing page (with its GitHub, release, install and docs links) and its own feature docs, built from this design system (12.1).
  • Make every entry point follow the data: introduce when empty, open the only item directly, list several; docs, GitHub, features, list and introduction always one click away; sign-in returns to the same action (12.2).
  • Bring every README to the one structure: banner, centred promise with badges and quick links, intro, a look around in both themes, quickstart, then the remaining sections in order; native apps and the design system adapt it (12.3).

SpaceWorks

Section titled “SpaceWorks”
  • Already follows most rules. Verify the over-ceiling file list is current (rule 5) and that the hybrid installer questions cover website, database, Redis, storage and email (they do today).
  • Add a server-side provider-config endpoint for the apps if one does not exist yet (see Android and iOS).

Workspace

Section titled “Workspace”
  • Analytics providers: add the optional provider list (Plausible, Umami, GA4, Firebase Analytics, PostHog, Clarity, Sentry, Firebase Performance), all off by default, consent per purpose, route templates only, operator origin allow-list in the CSP, public identifiers only.
  • Hybrid: add per-part installer questions and outside-service probes for database, Redis, file storage, email and website. Verify the existing Netlify split and external storage/proxy overlays against them.
  • Areas: add an areas registry with a platform switch and a per-space switch; off hides everywhere; purge is separate from switch-off. Verify what docs/areas/ already covers.
  • Audit: add database triggers that make the audit table append-only (verify first).
  • OpenAPI: publish an OpenAPI document for the bearer API tokens and integration routes, with a CI check.
  • i18n: add translation catalogues and a literal-string guard.
  • Payments: decide whether Workspace takes money at all; if it ever does, follow rule 6 (Stripe, Razorpay, offline receipts).
  • Verify: LOC lint (present), CODEOWNERS (present), client tag on any event.

Events

Section titled “Events”
  • Analytics providers: drop the “no third-party trackers” wording in favour of the provider list, off by default, with consent and the origin allow-list. Keep the in-house event analytics.
  • Hybrid: the split layout and external S3 exist; add per-part questions and probes for database, Redis and email as well. Verify the existing installer questions.
  • Areas: add the areas registry with platform and per-space switches (paid events, hackathon, mentor desk, member IDs and so on become areas). Verify which instance settings already act as switches.
  • Audit: verify and add append-only database triggers.
  • OpenAPI: extend docs/mobile-api.openapi.yaml to cover every route, with a CI regeneration check.
  • i18n: add translation catalogues and a literal-string guard.
  • Verify: CODEOWNERS (present), LOC lint (present).

Machines

Section titled “Machines”
  • Analytics providers: add the provider list as above. Verify what the API monitor and super-admin monitoring already cover.
  • Hybrid: add per-part installer questions and probes; verify the Netlify split and no-Redis mode against them.
  • Areas: add the registry and switches (machines, job queue, pricing and payments, repairs, consumables, maintenance, printers, finance). Verify what exists.
  • Audit: verify append-only database triggers.
  • i18n: add catalogues and a guard.
  • Verify: OpenAPI covers every route (/api/v1/openapi.json exists), LOC lint (present), CODEOWNERS (present).

Inventory

Section titled “Inventory”
  • Analytics providers: add the provider list as above.
  • Hybrid: add per-part installer questions and probes; verify the existing external storage/proxy overlays and Netlify split.
  • Areas: add the registry and switches (lending, counts, transfers, purchases, labels, importer, payments, webhooks). Verify what lib/settings/sections.ts already gives.
  • Audit: verify append-only triggers (the README says the audit log is append-only; confirm it is enforced in the database).
  • i18n: add catalogues and a guard.
  • Verify: OpenAPI coverage, LOC lint (present), CODEOWNERS (present).

Bookings

Section titled “Bookings”
  • Analytics providers: add the provider list as above.
  • Hybrid: add per-part installer questions and probes; verify Netlify split and no-Redis mode.
  • Areas: add the registry and switches (approvals, paid bookings, refunds, passes, repairs, reports, integrations). Verify what exists.
  • Audit: verify append-only triggers.
  • i18n: add catalogues and a guard.
  • Verify: OpenAPI coverage, LOC lint (present), CODEOWNERS (present).

Organization

Section titled “Organization”
  • Analytics providers: add the provider list as above, beside the in-house org and platform analytics.
  • Hybrid: add per-part installer questions and probes; verify the Netlify split.
  • Areas: add the registry and switches (join forms, renewals, ID cards, units, receipts, payments).
  • Audit: verify append-only triggers.
  • OpenAPI: publish an OpenAPI document (none found) with a CI check.
  • CODEOWNERS: add it (maintainer owns every path) and enable branch protection on main.
  • i18n: add catalogues and a guard.
  • Verify: LOC lint (present).

Android

Section titled “Android”
  • Analytics SDKs: add Firebase Analytics, Crashlytics and Performance, PostHog, Sentry and Clarity, each inert until the deployment enables it, off by default, behind a consent screen with withdrawal, tagged client: android, no personal data, no advertising id. Read provider config from the server. Add tests that prove nothing starts before consent.
  • Contributor rules: change AGENTS.md rule 6 (no analytics or third-party SDKs) so it allows exactly these SDKs and still forbids any other without owner approval; record it in docs/CHANGELOG.md.
  • Payments: verify Razorpay support (the Stripe Android SDK is expected).
  • LOC lint: add a 300-line check (Kotlin, tests included, generated code exempt) to CI.
  • CODEOWNERS: add it and enable branch protection on main.
  • i18n: verify string resources cover every user-facing string and add a hard-coded-string lint.
  • Verify: the app refuses platform-admin accounts, parity with iOS.

iOS

Section titled “iOS”
  • Analytics SDKs: same as Android, tagged client: ios. Verify that no tracking identifier is used, so no App Tracking prompt is needed. Same consent, withdrawal and prove-it-offline tests.
  • Contributor rules: change AGENTS.md rule 6 the same way.
  • LOC lint: add a 300-line check (Swift, tests included, generated code exempt) to CI.
  • CODEOWNERS: add it and enable branch protection on main.
  • i18n: verify Localizable.xcstrings covers every user-facing string and add a literal-string lint.
  • Verify: Razorpay and Stripe checkout both reachable from the server-selected flow, parity with Android.

Website and Docs

Section titled “Website and Docs”

Current rule (v2.0.1, 13 November 2026): the separate SpaceWorks-Docs site is retired. Each project keeps its documentation in its own repository and serves it in its own docs viewer, beside its own landing page (12.1). The Docs items below now apply to each product’s in-app docs.

  • Analytics: verify whether either loads a provider. If so, it must be off until consent and listed; prefer a cookie-free option (Plausible or Umami) on the operator’s own origin.
  • Docs: add pages for this rule set (hybrid per-part choices, analytics providers on web and mobile, areas, role views) and keep screenshots current.
  • Website: verify the install one-liner and the area presets match each product’s installer.
  • Verify: CODEOWNERS and branch protection.

SpaceWorks-Design-System (this repository)

Section titled “SpaceWorks-Design-System (this repository)”
  • Keep this page current when a product’s status changes; update the matrix above in the same commit.
  • Verify the Android and iOS submodule pins, and that tokens, motion and loader files are the only inputs the apps consume.

Part of Space Works product rules, published from docs/product-rules.md. Edit it there.