Repositories and access

The two repositoriesCopy Anchor Link

The only hard coupling between them is the OpenAPI document exported from packages/contracts (ADR-001). The full trees are on the architecture page; what matters day to day:

What goes whereCopy Anchor Link

Who can do whatCopy Anchor Link

• Two-factor authentication is mandatory on every account listed on this page.
• Imad uses Write on hoco for contract reviews, the mobile and API docs pages and issues. He does not merge into apps/server, apps/dashboard or apps/web.
• Akram has Read only: he cannot push branches or apply labels. His edits to the design pages are filed as issues labelled docs with the exact text; Anis commits them within two working days. Labels on his design-QA issues are set at triage.
• Before go-live, hoco-mobile moves from Imad's personal account to an organisation account, together with the upload keystore and the Play Console ownership — who controls that organisation (HOCO or the team) is settled in the decision register (ADR-001).

Branch protectionCopy Anchor Link

Repository settings (both repositories). Default branch dev (so PRs target it and Closes #n closes issues on merge). Squash merging and merge commits allowed, rebase merging disabled, squash as the default button. "Automatically delete head branches" on. Tags v* and contracts-v* can be created by the repository owner only.

The bypass is the self-review path of a team where each repository has one main developer. It is never used on a PR labelled contract or mobile-impact in hoco, or touching a sensitive path in hoco-mobile — those wait for the other developer's approval (who reviews what).

Code owners. hoco already has .github/CODEOWNERS with * → @AnisBetehi and a prepared contracts line. On day one, Anis uncomments it with Imad's handle and adds the mobile docs pages:

# hoco — .github/CODEOWNERS
*                                   @AnisBetehi
/packages/contracts/                @AnisBetehi @imad-handle
/apps/docs/content/docs/mobile/     @AnisBetehi @imad-handle

hoco-mobile mirrors it (set up in MOB-01):

# hoco-mobile — .github/CODEOWNERS
*                          @imad-handle
/packages/hoco_api/        @imad-handle @AnisBetehi
/packages/hoco_core/       @imad-handle @AnisBetehi
/packages/hoco_offline/    @imad-handle @AnisBetehi
/apps/*/android/           @imad-handle @AnisBetehi
/apps/*/ios/               @imad-handle @AnisBetehi
/.github/                  @imad-handle @AnisBetehi

Replace imad-handle with Imad's GitHub username. An unknown handle is silently ignored by GitHub, so check that review requests actually arrive on the first contract PR.

SecretsCopy Anchor Link

Rules:

• Never in git, chat, email, screenshots or issue text. gitleaks runs on commit (when installed) and on every PR.
• A leaked secret is rotated first (within the hour), then the leak is cleaned up and the incident noted.
• One value per environment: no secret is shared between staging, pre-production and production. Production secrets are generated by Anis directly in Dokploy and never stored on a laptop.
• Each environment has its own BETTER_AUTH_SECRET and cookie prefix, so a staging session never reaches production (ADR-005).
• SIMULATE_SMS="true" on local and staging (codes are logged). Pre-production and production send real SMS; HOCO's testers use their own phones.
• Firebase client configuration files (google-services.json, firebase_options*.dart) are identifiers, not secrets: they are committed. Service-account JSON files never are.

Accounts production depends onCopy Anchor Link

Onboarding a new memberCopy Anchor Link

Day one:

• Read the overview, this section, the timeline and their own task list in team tasks. Docs writers also read apps/docs/AUTHORING.md.
• GitHub account with two-factor authentication; invited to the repositories at the role in the access table; CODEOWNERS updated if they own paths.
• Added to the team WhatsApp group, the calendar invitations of the weekly rhythm, the password-manager collection they need, the Claude Design projects.
• Mobile developers: Firebase projects, Play Console (internal testing), App Distribution team group.
• Machine set up from tools: clone, pnpm install, .env, pnpm db:start, pnpm dev all work; a commit with the message wip is rejected by the hook (proof that hooks are installed).

First week:

• First PR merged within two days — a small docs fix or a fix/ from the backlog — to practise the full flow (branch, commit, PR, review, staging).
• Walk the decision register and the open issues of their area with Anis (30 min).
• Shadow one Thursday demo and post stand-up messages from day two.
• Anis adds them to people in tasks.json with their fte and assigns tasks; the plan recomputes.

OffboardingCopy Anchor Link

• Open branches and PRs merged, handed over or closed; their tasks reassigned in tasks.json (team), and the plan recomputed.
• Anything owned in their name is transferred, never forked or copied: repositories (transfer hoco-mobile if Imad leaves), Firebase and Play roles, Claude Design project ownership, Dokploy users.
• Removed from both repositories, the Claude Design projects, Firebase, Play Console, App Distribution groups, Dokploy, Sentry, the docs-site login, the vault collections, the WhatsApp groups (the client group too) and the calendar invitations.
• Every secret they could read is rotated: Dokploy runtime secrets of the environments they accessed, CI secrets of their repository, the Android upload key if they held it (reset through Play support), API keys of the providers.
• CODEOWNERS updated; HOCO informed of the change of contact if they talked to HOCO.