Drafts by what they lack

Each draft card names what keeps it from stable in a lacks: line. This page groups the 129 drafts by that reason. How a draft becomes stable gives the bar. To promote one, open a Promote a draft issue.

Too few organisations back a clause of the Rule (100)

• code-ai-pr-disclosure (codebase): disclosure has the Linux kernel and Ghostty; needs a third org that asks for it and for an author who can explain the code
• code-documented-setup-runs (codebase): one vendor's guidance (cursor/plugins) backs it; needs two more orgs that test the setup commands
• code-flaky-test-quarantine (codebase): quarantine with owner and ticket has Dropbox and Shopify; rerun-verified return to the gate has Dropbox only
• fn-atomic-related-updates (function): only one vendor's review skill backs it; the all-or-nothing principle has no cited org
• fn-bool-arg-at-callsite (function): only the author's own Python review guide backs it; no independent org
• fn-distinct-types-for-ids (function): one vendor's guidance (cursor/plugins) backs it; needs two more orgs
• fn-empty-collection-not-none (function): only the author's own Python review guide backs it; no independent org
• fn-english-identifiers (function): PEP 8 and LLVM give the rule and PEP 3131 argues the other way; needs a third org that mandates English
• fn-known-keys-get-a-type (function): only the author's own Python review guide backs it; no independent org
• fn-no-anonymous-tuples (function): only the author's own Python review guide backs it; no independent org
• fn-no-check-then-act-across-await (function): only the author's own Python review guide backs it; no independent org
• fn-no-getattr-for-known-names (function): only the author's own Python review guide backs it; no independent org
• fn-no-magic-values (function): Google's review guide is the only backer; needs two more orgs
• fn-no-pass-through-wrapper (function): Ousterhout is the only backer, through two links to one author; needs two more orgs
• fn-no-stringly-typed-returns (function): only the author's own Python review guide backs it; no independent org
• fn-propagate-dont-swallow (function): only the author's own Python review guide backs it; no independent org
• fn-resource-lifetime (function): one blog post on structured concurrency backs it; needs two more orgs
• fn-specific-exceptions-only (function): the Go wiki and an Ousterhout summary back it; needs a third independent org
• fn-test-oracle-independent (function): one vendor's guidance (cursor/plugins) backs it; needs two more orgs
• fn-variants-as-tagged-union (function): one vendor's guidance (cursor/plugins) backs it; needs two more orgs
• inc-postmortem-owned-actions (incident): an owner and due date on each action has no org; Dropbox and Shopify mention action items without naming either
• mod-behaviour-lives-with-state (module): only the author's own Python review guide backs it; no independent org
• mod-central-config (module): "one settings module" has no org; Uber and Cabify back only keeping knobs out of code
• mod-deep-modules (module): Ousterhout is the only backer, and Martin disagrees; needs two more orgs
• mod-inject-boundary-collaborators (module): only the author's own Python review guide backs it; no independent org
• mod-internals-unreachable (module): one vendor's guidance (cursor/plugins) backs it; needs two more orgs
• mod-layers-point-inward (module): only the author's own Python review guide backs it; no independent org
• mod-no-import-side-effects (module): only the author's own Python review guide backs it; no independent org
• mod-no-logic-in-constructors (module): only the author's own Python review guide backs it; no independent org
• mod-no-module-mutable-state (module): only the author's own Python review guide backs it; no independent org
• mod-no-wire-types-in-public-api (module): one vendor's guidance (cursor/plugins) backs it; needs two more orgs
• mod-no-wrong-abstraction (module): Metz and Dodds back inlining; the re-split remedy has no third org, and the Counterpoint still cites an unsourced count
• mod-proto-enum-zero-unspecified (module): the _UNSPECIFIED name has Google only; a zero value with no meaning has Google and Dropbox
• mod-thin-entry-point (module): only the author's own Python review guide backs it; no independent org
• prod-a11y-audit-before-launch (production): "before a public launch" has GOV.UK only; the audit content has GOV.UK, W3C and Deque
• prod-slo-error-budget (production): gating releases on the error budget has no backing row
• prod-wide-events-bounded-labels (production): Honeycomb is the only backer, and the Rule does not mention bounded labels; needs two more orgs
• svc-api-cache-control (service): IETF and Zalando back it; needs a third org
• svc-api-contract-tests (service): Pact is the only backer; OpenAPI does not back contract tests and provider verification is not asserted
• svc-api-documented-errors (service): OpenAPI requires one response per operation; the stricter rule is Zalando's alone
• svc-api-naming-consistent (service): Zalando and Microsoft back it, and they disagree on casing; needs a third org that asks for consistency
• svc-api-problem-json (service): IETF and Zalando back it; needs a third org
• svc-api-retry-after (service): IETF and Zalando back it; needs a third org
• svc-api-specific-status-codes (service): IETF and Zalando back it; needs a third org
• svc-api-trace-context (service): W3C is the only backer; needs two more orgs that forward trace headers on every call
• svc-async-content-reserves-space (service): injected content and ads have Google only; the image-dimensions part has Google and Mozilla
• svc-best-effort-optional-deps (service): best-effort calls have Netflix, Uber and Cabify; counting every fallback has Cabify only
• svc-circuit-breaker-bulkhead (service): "per dependency" has Microsoft only; needs two more orgs that limit concurrency per downstream
• svc-cli-destructive-dry-run (service): one vendor's guidance (cursor/plugins) backs it; needs two more orgs
• svc-cli-non-interactive (service): one vendor's guidance (cursor/plugins) backs it; needs two more orgs
• svc-saga-steps (service): Azure is the only backer; needs two more orgs that require idempotent steps and compensations
• svc-stream-dont-materialise (service): the Node.js backpressure guide is the only backer, and its claim is Node-specific
• sys-cache-cold-start (system): AWS is the only backer; needs two more orgs
• sys-constraint-not-valid (system): PostgreSQL docs are the only backer; needs two more orgs that add constraints in two steps
• sys-health-liveness-readiness (system): AWS is the only backer; needs two more orgs
• sys-index-concurrently (system): PostgreSQL and GitLab back it; needs a third org
• sys-leader-two-leaders (system): AWS is the only backer; needs two more orgs
• sys-migration-lock-timeout (system): PostgreSQL and GitLab back it; the lock-queue reason is inferred; needs a third org
• chg-agent-grounded-code (change): only an arXiv package-hallucination study backs checking every import and call; needs two more orgs
• chg-agent-independent-review (change): a person's sign-off has Stripe and Dropbox; the fresh-context reviewer option has 0 orgs; needs one more firm org or that option cut
• chg-agent-mock-asserting-tests (change): Google and cursor/plugins back it; Go backs a side remark and Feathers points the other way
• chg-api-spec-in-same-change (change): OpenAPI and Zalando back it; needs a third org
• chg-approval-tied-to-patch (change): one vendor's guidance (cursor/plugins) backs it; needs two more orgs
• chg-chestertons-fence (change): only Feathers backs a characterization test before a rewrite; Spolsky backs not rewriting from scratch
• chg-delete-legacy-after-migration (change): "in the same change" has cursor/plugins and Stripe; Dropbox, GitHub, Shopify and Slack delete in a later step
• chg-devex-breaking-config (change): one vendor's guidance (cursor/plugins) backs it; needs two more orgs
• chg-fix-root-cause-not-symptom (change): one vendor's guidance (cursor/plugins) backs it; needs two more orgs
• chg-flag-owner-retirement (change): the owner clause has Dropbox only; default, removal date and ticket have no company source
• chg-matches-spec (change): checking the change against the spec has Google, plus Dropbox for security only; needs a third org
• chg-migration-add-column-rewrite (change): PostgreSQL docs are the only backer; needs two more orgs
• chg-name-attack-surface (change): no source says to list the attack surface in the description; OWASP and Mozilla back only a threat-model trigger
• chg-no-silenced-diagnostics (change): reason and ticket on each suppression has cursor/plugins only; Stripe tracked suppressions as a group
• chg-no-special-case-branches (change): one vendor's review skill backs it, with no data; needs two more orgs
• chg-proto-no-field-type-change (change): "no field type change" has Google only; Uber and Cabify back renumbering and the buf breaking gate instead
• chg-proto-reserve-removed-fields (change): protobuf.dev is the only backer; needs two more orgs that require reserved on removal
• chg-rollback-path (change): no org says to state the undo in the change description; Uber and Stripe describe a rollback ability only
• chg-ui-change-screenshots-and-keyboard-pass (change): reporting the keyboard pass has two PR templates; the 200% zoom clause has W3C only
• py-await-check-then-act (function): only the author's own Python review guide backs it; no independent org
• py-cancellation (service): the asyncio docs are the only backer; needs a second independent source on cancellation
• py-class-earns-its-instance (module): the Go wiki and the author's own guide back it; needs a third independent org
• py-docstrings-google (function): Google's review guide is the only backer; needs two more orgs
• py-error-hierarchy (module): only the author's own Python review guide backs it; no independent org
• py-field-only-when-adds (module): only the author's own Python review guide backs it; no independent org
• py-frozen-dataclass-over-tuple (function): only the author's own Python review guide backs it; no independent org
• py-httpx-client-lifespan (module): only the author's own Python review guide backs it, and its Counterpoint concedes the default timeout is fine
• py-imports (module): only the author's own Python review guide backs it; no independent org
• py-init-assign-only (module): only the author's own Python review guide backs it; no independent org
• py-init-py-empty (module): only the author's own Python review guide backs it; no independent org
• py-modern-typing (function): only the author's own Python review guide backs it; no independent org
• py-no-cast (function): only the author's own Python review guide backs it; no independent org
• py-no-init-or-model-tests (module): only the author's own Python review guide backs it; no independent org
• py-no-silenced-diagnostics (change): only the author's own Python review guide backs it; no independent org
• py-paths-from-file (function): only the author's own Python review guide backs it; no independent org
• py-pydantic-validation (module): only the author's own Python review guide backs it; no independent org
• py-pytest-parametrize (function): only the author's own Python review guide backs it; no independent org
• py-ruff-gate (change): only the author's own Python review guide backs it; no independent org
• py-settings-pydantic-settings (module): only the author's own Python review guide backs it; no independent org
• py-strenum-not-strings (function): only the author's own Python review guide backs it; no independent org
• py-task-reference (service): the asyncio docs are the only backer; needs a second independent source on task lifetime
• py-test-hygiene (module): Shopify backs the Why only; Stripe test clocks are a product feature, so the Rule has no org

A source is a plan, a definition, or a summary rather than a stated practice (18)

• code-file-lines-ceiling (codebase): backers are a dev.to summary and a blog post; no org states a file-length ceiling or the 1,000-line figure
• code-scoped-validation-loop (codebase): every backer describes CI test selection, not a documented local command; needs orgs that document one
• fn-comments-survive-context (function): the only backer is a dev.to summary of Ousterhout; needs two orgs that ban time-bound comments
• fn-name-intermediate-conditions (function): the only backer is a dev.to summary of Ousterhout; needs two orgs that say to name sub-conditions
• mod-fowler-smells (module): no Fowler or Beck source; backers are an Ousterhout summary and Google's review guide, mapped by hand
• mod-mock-at-boundaries-only (module): Airbnb mocks services in load tests and Cabify runs a real gRPC server; neither states the Rule
• mod-no-utils-grab-bag (module): the only backer is a dev.to summary of Ousterhout; needs two orgs that say to name helpers after a concept
• mod-one-name-per-concept (module): Netflix backs the converse, one concept per name; Slack's aliases are narrow; no org states the Rule
• mod-prefer-sync-api (module): the sans-io and async-pressure posts are opinion and neither states this as a rule; the card combines them
• mod-subtype-passes-parent-tests (module): Liskov and Wing state the substitution rule; none says to run the parent's tests, which is the card's proxy
• prod-shadow-compare-before-cutover (production): Netflix, Stripe, Airbnb and GitHub describe doing it; none recommends it as a practice for others
• svc-authn-by-default (service): only Microsoft and Spring say why auth by default; Django, Rails and NestJS describe the default without a reason
• svc-dlq (service): Dropbox's dead-letter queue is a proposal, not a practice; needs a third org that runs it
• svc-rate-limit-by-cost (service): Shopify, GitHub and Airbnb describe cost-based limits; none recommends it, and Uber dropped a bytes-based quota
• svc-request-id-logging (service): the W3C spec does not mention logs; only Honeycomb backs putting the id on every log line
• sys-cells-limit-blast-radius (system): Netflix and Slack run cells; Airbnb's multi-cluster store and Cloudflare's postmortem describe failure domains, not cells
• chg-reuse-before-write (change): the backers are the kernel style guide and secondary summaries; no source describes searching for an existing helper first
• chg-review-comment-format (change): Google and Orosz recommend labels; Cloudflare and Dropbox describe their own tool output, not a rule for reviewers

A reviewer could not mark the Rule FAIL at its level (3)

• mod-cohesive-unit (module): "one cohesive concept" is hard to mark FAIL; the Ousterhout backer is a secondary summary
• mod-validate-at-boundary-once (module): nobody backs "once"; without it the FAIL, hand-rolled checks in the handler, would pass
• chg-new-query-has-plan (change): without "attach the plan" a change review has nothing to mark FAIL; attaching has GitLab only

It overlaps a stable card (3)

• inc-perf-regression-guard (incident): the guard half is the stable code-perf-budget-in-ci Rule; the postmortem-action half has Google SRE and Cloudflare only
• svc-api-safe-idempotent-methods (service): the GET half is already in stable svc-csrf-state-changing; PUT and DELETE have IETF only
• chg-new-api-has-usage (change): its FAIL shapes, an unused option and a one-implementation Protocol, are the stable mod-yagni Rule

The card contradicts itself (1)

• svc-api-spec-matches-impl (service): the Rule makes the spec the source of truth, then allows generating it from code; pick one

The maintainer keeps it as a draft (4)

• code-a11y-check-in-ci (codebase): kept draft by Pablo's call; no org backs failing the build on a violation
• svc-page-title-per-route (service): kept draft by Pablo's call; W3C, Mozilla and A11y Project back the Rule
• svc-security-event-logging (service): kept draft by Pablo's call
• svc-security-headers (service): kept draft by Pablo's call