Start New Products. Scale with On-Memory.
OnMemory (on-memory) is Aldeon’s reusable AI engineering governance product: generate a complete starter kit (AGENTS.md, MEMORY.md, SKILL.md, and CI tests) to bootstrap new products with zero drift, or audit and compact existing codebases under a strict <20KB ceiling.
OnMemory Stack Composer & Multi-File Starter Kit
Select your new product’s architectural layers to instantly generate all 5 foundational governance files (MEMORY.md, SKILL.md, AGENTS.md, Zero-Leak CI Test, and CLI bootstrap script).
# MEMORY.md — MyNewProduct
> Active working memory for **MyNewProduct** governed by `on-memory`.
> All agents MUST read this before starting work and compact after completing tasks.
> Active size limit: < 20,000 bytes • Security: Zero Secrets / Air-Gapped.
---
## 1. Decisions Locked (Do Not Re-ask)
| Layer | Technology / Standard | Non-Negotiable Constraint |
| :--- | :--- | :--- |
| **Web UI** | React 19 + React Router 7 Edge SSR | Zero Backend DB in Web Portal; CSS .anim-rise hero |
| **Mobile Client** | Expo SDK + React Native + TypeScript Strict | EAS Build & Submit; in-app self-service account deletion |
| **Cloud Compute** | Python 3.12 Serverless + Step Functions + Terraform | Idempotent conditional writes; async presigned uploads |
| **Data & Auth** | Single-Table NoSQL + Cloud KMS Envelope Encryption | Encrypt all third-party OAuth tokens via KMS prior to write |
| **Monetization** | RevenueCat + StoreKit 2 + Play Billing Webhooks | Server-authoritative entitlement gating via webhooks |
---
## 2. Active Tech Stack & Architecture
- **Strict Type Safety:** `"strict": true` across all TypeScript packages; zero unvalidated `any`.
- **Tenant & Secret Isolation:** Zero hardcoded credentials; all environment variables injected at runtime.
---
## 3. Known Anti-Patterns & Pitfalls (5-Field Format)
### 3.1 Above-the-Fold Opacity Blocking SSR LCP
- **Symptom / Error Signature:** Mobile LCP > 3.8s despite fast edge SSR response.
- **Anti-Pattern (DO NOT REPEAT):** Using JS `initial={{ opacity: 0 }}` on above-the-fold hero headings.
- **Root Cause:** SSR HTML renders hidden text until client JS downloads and hydrates.
- **Verified Solution:** Use pure CSS keyframe classes (`.anim-rise`) for immediate Frame 1 paint.
- **Scope / Tags:** `Web SSR`, `Core Web Vitals`, `LCP`.
### 3.2 Client-Only Subscription Flags Without Webhook Sync
- **Symptom / Error Signature:** Subscription renewals or restores fall out of sync across devices.
- **Anti-Pattern (DO NOT REPEAT):** Trusting local boolean flags in AsyncStorage without server webhook reconciliation.
- **Root Cause:** Renewals, grace periods, and refunds occur out-of-band while the app is closed.
- **Verified Solution:** Bind authenticated user IDs via `Purchases.logIn(userId)` and reconcile state via idempotent Server-to-Server webhooks.
- **Scope / Tags:** `Mobile`, `Subscriptions`, `Store Compliance`.
### 3.3 Plaintext Third-Party OAuth Tokens at Rest
- **Symptom / Error Signature:** High-severity credential exposure risk in database snapshots.
- **Anti-Pattern (DO NOT REPEAT):** Storing raw `access_token` or `refresh_token` strings in NoSQL items.
- **Root Cause:** Disk-level encryption does not protect against application-level query leaks.
- **Verified Solution:** Encrypt all OAuth token payloads via Cloud KMS envelope encryption prior to write.
- **Scope / Tags:** `Security`, `KMS`, `OAuth`.
---
## 4. Recent Executions (Last 5)
- **2026-11:** `chore(on-memory)`: Initialized MyNewProduct with `on-memory` (<20KB ceiling, 5-field anti-patterns, and zero-leak CI gate).Live <20KB Memory Auditor & Zero-Leak Secret Scanner
Paste your existing MEMORY.md, CLAUDE.md, or .cursorrules below. Auditing runs 100% locally in browser memory (zero network calls) and auto-sanitizes leaked credentials in 1 click.
How on-memory guarantees zero exposure of restricted data
Air-Gapped Compile-Time Dataset
Web routes never import, read, or parse raw workspace MEMORY.md files from disk.
Zero Secret & Token Prefix Policy
All provider key prefixes, JWTs, OAuth tokens, and webhook signing secrets are blocked by CI.
Zero Internal Cloud & Store Identifiers
Cloud account numbers, billing merchant IDs, store container UUIDs, and project IDs are stripped.
Zero Private Endpoint & Path Exposure
Internal serverless invoke URLs, database hosts, and developer workstation paths are prohibited.
Preventing context drift and architectural hallucinations
Instead of accumulating unbounded logs that degrade model attention, every engineering task governed by on-memory executes a deterministic 3-phase protocol.
Phase 1: Read-Only Memory Alignment
Zero code generation until locked stack constraints and active ADRs are verified.
Before planning or editing any file, the engineering agent reads the scoped project MEMORY.md and the on-memory anti-pattern registry. This eliminates speculative file scanning and prevents re-introducing deprecated libraries.
<20KB Context Compaction Simulator
Compare an uncompacted raw agent log against compacted on-memory
# MEMORY.md — Governed by on-memory (11.2 KB / <20KB Cap)
## 1. Decisions Locked (Do Not Re-ask)
| Layer | Technology | Enforced Rule |
| :--- | :--- | :--- |
| **SSR Web** | React 19 + React Router 7 | Zero Backend DB in Web Portal |
| **Motion** | LazyMotion + CSS Keyframes | Hero uses pure CSS .anim-rise |
## 2. Known Anti-Patterns (5-Field Schema)
- **Symptom:** Mobile LCP > 4.0s on SSR landing pages.
- **Anti-Pattern:** Setting initial={{ opacity: 0 }} on above-the-fold hero headings.
- **Root Cause:** SSR HTML renders invisible text until client JS downloads & hydrates.
- **Verified Solution:** Use CSS @keyframes (.anim-rise) so SSR paints on Frame 1.
## 3. Recent Executions (Last 5)
- **2026-11:** Launched OnMemory (on-memory) product & CLI scaffolder with zero-leak CI gate.Real production lessons distilled into deterministic guardrails
Every resolved failure mode is documented with Symptom, Anti-Pattern, Root Cause, Verified Solution, and Impact.
Above-the-Fold JS Opacity Blocking SSR Largest Contentful Paint (LCP)
Mobile Lighthouse Largest Contentful Paint (LCP) degrades to 3,800ms–4,500ms despite <50ms edge SSR TTFB.
Applying JavaScript animation props like initial={{ opacity: 0 }} to primary hero headings or lead paragraphs.
Server-rendered HTML ships with inline style="opacity:0", forcing the browser to wait for client bundle download, parse, and React hydration before painting the LCP element.
Render above-the-fold hero typography with pure CSS keyframe classes (.anim-rise / .anim-fade) and reserve LazyMotion viewport animations for below-the-fold cards.
// Verified Pattern: Pure CSS SSR-Safe Entrance
<h1 className="anim-rise anim-delay-1 text-4xl font-bold tracking-tight">
{headline}
</h1>Envelope Encryption for Third-Party OAuth Tokens at Rest
Storing raw social publishing OAuth refresh tokens in NoSQL tables creates high-severity credential exposure risk.
Persisting plaintext access_token or refresh_token attributes directly in application database items.
Default disk-level table encryption protects physical media but does not prevent token exposure if an application query or snapshot is compromised.
Encrypt every OAuth token payload at the application layer using Cloud KMS asymmetric/symmetric envelope encryption before writing to storage, decrypting only inside ephemeral worker memory.
// Verified Pattern: KMS Envelope Encryption Before Write
ciphertext = kms_client.encrypt(
KeyId=os.environ["KMS_KEY_ALIAS"],
Plaintext=json.dumps(oauth_payload).encode("utf-8"),
)["CiphertextBlob"]Asynchronous Presigned Upload & Queue Handoff for AI Vision Pipelines
High-resolution stencil generation requests fail with 504 Gateway Timeout or 413 Payload Too Large on API gateways.
Base64-encoding multi-megabyte images into synchronous JSON POST bodies and awaiting multimodal inference inline.
API Gateways enforce strict payload ceilings (6MB–10MB) and hard 29-second synchronous timeout limits.
Upload binary media directly to isolated Cloud Storage via short-lived signed URLs, trigger an asynchronous job worker, and stream real-time status updates to the client.
// Verified Pattern: Direct Signed Upload + Async Job Status
const { uploadUrl, jobId } = await api.createStencilJob({ mimeType: 'image/png' });
await uploadToSignedUrl(uploadUrl, binaryBlob);
return subscribeToJobState(jobId);Multi-Item Container Submission for Initial In-App Subscriptions
First-time subscriptions remain stuck in READY_TO_SUBMIT while the app binary enters WAITING_FOR_REVIEW, causing paywall review rejection.
Submitting only the appStoreVersion resource without bundling newly created subscription groups and subscription items into the reviewSubmission items payload.
App Store Connect API v1 requires initial in-app purchases and subscription groups to be explicitly attached as reviewSubmissionItems alongside the app version.
Verify all localization metadata and review screenshots return READY_TO_SUBMIT, then attach the appStoreVersion and subscription resources inside a single atomic reviewSubmission container.
// Verified Pattern: Atomic Review Submission Container
post("/v1/reviewSubmissionItems", {
reviewSubmission: { id: "<SUBMISSION_CONTAINER_ID>" },
appStoreVersion: { id: "<VERSION_ID>" }
})Server-Authoritative Entitlement Gating via Webhook Synchronization
Subscription renewals, grace periods, or cross-device restores fall out of sync between mobile clients and web readers.
Persisting boolean isPro flags locally in AsyncStorage without server-side webhook reconciliation.
Subscription lifecycle events (renewals, billing retry, refunds) occur asynchronously out-of-band when the mobile app is closed.
Bind authenticated user IDs deterministically via Purchases.logIn(userId) and process idempotent Server-to-Server V2 / RevenueCat webhook events to update server-side entitlements.
// Verified Pattern: Deterministic Identity + Entitlement Check
await Purchases.logIn(authenticatedUser.id);
const info = await Purchases.getCustomerInfo();
const hasProAccess = Boolean(info.entitlements.active['pro_access']);Idempotent Event-Driven Mailroom Notifications with Composite Keys
Network retries during package OCR scanning trigger duplicate push and WhatsApp notifications to condominium residents.
Generating a new random UUID on the server for every retry attempt and firing notification side effects synchronously before committing state.
At-least-once delivery semantics in mobile networks and serverless event buses guarantee duplicate delivery under packet loss.
Require a client-generated idempotency key on package intake and enforce a conditional database write (attribute_not_exists) before emitting EventBridge notification events.
# Verified Pattern: Idempotent Conditional Put
table.put_item(
Item=package_record,
ConditionExpression="attribute_not_exists(pk) AND attribute_not_exists(sk)"
)Lazy-Loaded 3D Skeletal Avatar Runtime with WebRTC Fallback
Bundling Three.js / WebGL skeletal rigging directly into the main route chunk bloats initial page load by >650KB.
Importing heavy 3D rendering engines at the top level of SSR landing or navigation layouts.
Static top-level imports force Vite to bundle WebGL shaders and animation rigs into the critical hydration path.
Isolate the 3D Libras interpreter canvas behind a client-only dynamic import boundary with lightweight skeleton placeholders during SSR.
// Verified Pattern: Dynamic Client-Only 3D Canvas Split
const AvatarCanvas = lazy(() => import('../components/Avatar3DCanvas'));Strict Tenant & Credential Isolation Across Sibling Applications
Shared authentication pools or shared database tables across multiple consumer products create blast-radius and LGPD/GDPR compliance risks.
Reusing a single Firebase project, Supabase instance, or AWS IAM execution role across unrelated child products.
Centralized multi-app credentials allow a misconfigured rule in one product to access records belonging to another product.
Provision strictly namespaced, autonomous auth clients, storage buckets, and IAM roles per product while keeping the Aldeon Web Portal 100% database-free.
// Verified Pattern: Scoped Product Client Initialization
export const productAuth = createScopedAuthClient({
namespace: 'isolated-product-tenant',
persistSession: true,
});Mobile Viewport Auto-Zoom Prevention on Form Controls
Focusing a search bar or login input on iOS Safari forces the browser viewport to zoom in and shifts horizontal layout.
Styling <input>, <select>, or <textarea> elements with text-xs (12px) or text-sm (14px) on mobile viewports.
Mobile WebKit automatically zooms the viewport whenever a focused form control has a computed font-size below 16px.
Enforce text-base sm:text-sm (16px on mobile, 14px on desktop) across all interactive inputs and reinforce with a global @media (max-width: 768px) CSS guardrail.
/* Verified Pattern: Mobile 16px Input Guardrail */
@media (max-width: 768px) {
input, select, textarea { font-size: 16px !important; }
}In-App Self-Service Account & Cloud Asset Erasure (Guideline 5.1.1(v))
App Store or Google Play rejects builds when account deletion only logs the user out or requires sending an email ticket.
Providing an external mailto: link instead of an immediate, authenticated in-app account deletion flow.
Store review guidelines and LGPD/GDPR mandate immediate, self-service revocation of user identity, tokens, and generated cloud assets.
Implement a dedicated Settings -> Delete Account confirmation flow that purges user documents, deletes storage prefixes, revokes OAuth tokens, and deletes the auth record.
// Verified Pattern: Atomic Cascade Account Erasure
await api.purgeUserDataAndStorage(currentUser.uid);
await auth().currentUser?.delete();DOM Mutation Resilience Against Third-Party Browser Translators
React throws NotFoundError: Failed to execute removeChild on Node when users enable Chrome Google Translate or Grammarly.
Mixing raw text nodes with conditional sibling spans inside interactive buttons without protective element wrappers.
Browser translation extensions wrap raw text nodes in <font> tags outside React virtual DOM tracking, breaking reconciliation on state toggle.
Install an early idempotent Node.prototype.removeChild / insertBefore resilience patch in entry.client.tsx and wrap dynamic text labels in dedicated <span> elements.
// Verified Pattern: Safe DOM Reconciliation Guard
if (child.parentNode !== this) {
return child; // Prevent extension-mutated DOM crash
}Automated CI Bundle Budget & Zero-Secret Leak Enforcement
Gradual dependency additions silently bloat client entry bundles or accidentally inline private configuration keys into SSR chunks.
Relying on manual code review alone to catch bundle size regressions or accidental sensitive string inclusion.
Transitive imports and shared data modules can pull server-only constants or heavy libraries into the client build graph.
Gate every build on strict byte ceilings (perf:budget:strict) and automated regex security tests that scan all public data modules for forbidden token patterns.
# Verified Validation Pipeline
bun run typecheck && bun run build && bun run perf:budget:strict
npx vitest run src/__tests__/on-memory-security.test.tsLocked stack boundaries powered in production by on-memory
Aldeon Web Platform
MEMORY.md: 14.1 KB / 20.0 KBCentral Edge SSR Portal, Brand Showcase & Consolidated Web Host
Zero-Backend Umbrella Portal Boundary
The umbrella web platform serves strictly SSR routes, edge cache headers, and isolated client experiences without any central database.
CSS-First Above-the-Fold Motion & LazyMotion Code Splitting
Hero sections use zero-JS CSS keyframes (.anim-rise) while interactive cards use LazyMotion domAnimation features.