These are handover constraints from the documentation. Treat the repository docs as canonical if they disagree.
¶ Release and production
- There is no staging.
api.replybox.utopiagroup.com.my is production.
- Pull requests have no CI checks. A green PR proves nothing.
- Nobody pushes, merges, deploys, or releases without owner approval for that exact change.
- Check Alembic heads before every release. Split heads are the most common deploy breaker.
- Record every release in
SHIPPED.md with evidence someone else can rerun.
- The Baileys connector must run exactly one instance.
- Do not rebuild the connector for a change that did not touch it.
- Deploy connector before API whenever a new queue or job kind requires connector support.
- The connector is disposable. Durable truth belongs in Postgres; durable sessions belong in encrypted object storage.
- Keep the four existing transports: Web to API REST, API to connector BullMQ, connector to API HMAC HTTP, API to Web Socket.IO.
- Do not add Redis pub/sub, direct connector DB writes, websocket side channels, or a second connector-to-API path.
- Put slow background work on its own queue, not the
whatsapp queue.
- Orchestration workers decide when to send and then call the existing producer; they do not talk to WhatsApp directly.
¶ Data and security
- Every user-facing row is tenant-scoped by
organization_id.
- Gate REST endpoints with
require_permission().
- Do not merge
CHANNEL_SESSION_KEY and MEDIA_OBJECT_KEY.
- Never commit or paste secrets into docs, tickets, wiki pages, or chat.
- Do not point test harnesses at a real database; the DB harness truncates between tests.