Codify control-first linting and exception handling standard

[MariusStorhaug]

Summary

Define an organization-wide coding standard that treats linters and static/security checks as control gates, not optional guidance.

Proposed standard

1. Assume configured lint/security controls are correct by default.
2. Align implementation with controls first.
3. If a rule appears too strict or mismatched, do not silently bypass, disable, or tune it down in passing.
4. Any suppression/bypass must be explicit, minimal, and documented with rationale in code and PR.
5. PRs should call out every intentional control exception in a dedicated section.

Why

This creates predictable engineering behavior across repos, reduces accidental policy drift, and makes risk acceptance explicit and reviewable.

Acceptance criteria

• Add this policy in MSXOrg/docs under coding/review standards.
• Provide a short PR template snippet for "Control exceptions" disclosure.
• Provide one concrete example of acceptable suppression and one unacceptable silent bypass.

[MariusStorhaug]

Adding one more requirement:

• Provide installation/synchronization examples for native shells per OS, not only PowerShell.
  • Windows: PowerShell + cmd (where relevant)
  • macOS/Linux: POSIX shell (bash/zsh compatible)
• Keep commands functionally equivalent so users can follow the same workflow regardless of shell.
• Prefer canonical repository URLs in examples (full https://github.com/... form).

Rationale: not all clients run PowerShell; docs should be first-class for each platform’s native shell.

[MariusStorhaug]

This should be part of the AGENTS template in MSXOrg/docs, not just repo-local guidance.

Requested template additions

1) Canonical context resolution section (required)

Add a standard section that says agents must derive context from Git metadata/remotes and then follow a deterministic source order.

2) Link-based context loading table (required)

Use a canonical table layout with explicit links (not only source descriptions). Suggested columns:

• Order
• Layer
• Source
• Link
• When to use
• Notes

Suggested default rows in the template:

1. Local repo guidance (README/CONTRIBUTING/local docs index)
2. Project/framework guidance (example: PSModule docs)
3. Central org guidance (example: MSXOrg docs)

3) Multi-scope layer for mixed environments (required)

Template must support users who operate in multiple orgs/hosts (e.g., work GHEC with data residency + personal GitHub.com).
Add an optional “Scope routing” layer before loading docs:

• If repo/remote belongs to Work scope -> use Work central guidance links
• If repo/remote belongs to Private scope -> use Private central guidance links
• If unknown -> require explicit user confirmation or use safest minimal baseline

This keeps one reusable template that can be used across both work and private repos.

4) Install/sync instructions: native shell parity (required)

When template includes setup/install instructions, require equivalent examples for:

• Windows native shell(s)
• macOS/Linux POSIX shell
  Commands should be functionally equivalent and use canonical repo URLs.

Practical template shape (suggested)

• Purpose
• Scope routing (optional: Work/Private/Other)
• Canonical context resolution
• Context loading table (link-based)
• Control-first policy (align with lint/security gates; explicit exceptions only)
• Install/sync examples by native shell

This would make AGENTS template portable across orgs/hosts while still allowing repo-specific overrides.