enforcing-taubyte-constraints

这段内容是审核时保存的快照。外部来源才是完整且最新的版本。

---
name: enforcing-taubyte-constraints
description: Numbered catalog of the non-negotiable Taubyte rules — naming, push ordering, domain CLI-management, matcher consistency, function layout, build/runtime env placement, and Dream vs remote build triggers — with one-line statements and cross-links to the skill that owns each rule's deep coverage. Use as a final pre-push checklist, when reviewing a teammate's change, or when you need a single audit point that touches every "must / never" rule across the collection.
---

# Enforcing Taubyte Constraints

## When to use

- Final review pass before `tau push` / `git push`
- Auditing a session's actions ("did I cover all the hard rules?")
- Reviewing a teammate's PR against a Taubyte project
- Onboarding a new agent / engineer to the project

## How to use this skill

Each rule is a one-liner. The link points to the skill that explains and enforces the rule. Read the rule list top-to-bottom; if any rule is unclear or violated, jump to the linked skill before continuing.

## Architecture & sources of truth

1. **GitHub is the single source of truth.** Clouds (remote and Dream) build and serve from what's pushed; never bypass git. → [understanding-taubyte-architecture](../understanding-taubyte-architecture/SKILL.md)
2. **Config repo is `tau`-managed.** Don't hand-edit `config/...` YAML; mutations go through `tau new` / `tau edit` / `tau delete`. → [editing-taubyte-resources](../editing-taubyte-resources/SKILL.md)
3. **Domains are CLI-managed always.** Never `vim config/domains/<x>.yaml`; use `tau new domain` / `tau edit domain` / `tau delete domain`. → [creating-taubyte-resources](../creating-taubyte-resources/SKILL.md)

## Naming & validation

4. **Project name = snake_case.** Dashes break `tau validate config` with `invalid variable name`. → [bootstrapping-taubyte-projects](../bootstrapping-taubyte-projects/SKILL.md)
5. **`config/config.yaml` must have a real `notification.email`.** Empty values fail config-compile with `mail: no address`. → [bootstrapping-taubyte-projects](../bootstrapping-taubyte-projects/SKILL.md)
6. **Forbidden flag**: never pass `--generated-fqdn-prefix` / `--g-prefix` to `tau new domain`. Use `--generated-fqdn` alone or `--fqdn <controlled>`. → [creating-taubyte-resources](../creating-taubyte-resources/SKILL.md)
7. **Database `--min < --max`.** `--min 1 --max 1` fails. → [creating-taubyte-resources](../creating-taubyte-resources/SKILL.md)
8. **One function per `(path, method)`.** Never comma-separated methods; split into separate function resources. → [authoring-taubyte-function-types](../authoring-taubyte-function-types/SKILL.md)

## Context hygiene

9. **Verify `tau --json current` before any mutation** (push, delete, inject, `tau new` resource). The `Project` field must equal the on-disk project. → [selecting-taubyte-context](../selecting-taubyte-context/SKILL.md)
10. **After `tau new project`, immediately re-run `tau select project --name <same>` then verify.** Selection drift after `new project` is the usual cause of "wrong project" pushes. → [bootstrapping-taubyte-projects](../bootstrapping-taubyte-projects/SKILL.md)
11. **Clear application after app-scoped work**: `tau clear application` before returning to project-level resources. → [selecting-taubyte-context](../selecting-taubyte-context/SKILL.md)

## Code authoring rules

12. **Function root layout (Go)**: `empty.go` and `go.mod` at the function root. **Never** create a `lib/` subdirectory; never hand-author `main.go`. **Corollary:** careless **`tau build`** can still **generate** those paths as root-owned junk — **never commit them**; delete, `git rm --cached`, and `.gitignore` before push. → [writing-taubyte-functions](../writing-taubyte-functions/SKILL.md), [verifying-taubyte-functions](../verifying-taubyte-functions/SKILL.md)
13. **Package name is NOT `main`.** Use `lib` (or any other name). → [writing-taubyte-functions](../writing-taubyte-functions/SKILL.md)
14. **`//export <name>` must equal `e