Governance Best Practices

Q: Minimum governance for a two-person mobile team?

CONTRIBUTING.md, lockfile + npm ci, expo lint + tsc in CI, PR template with device evidence, and one docs/eol-registry.md row per SDK. Add champions and SBOM when a third app or enterprise customer appears.

Q: How do governance and expo-rules differ?

Governance is process (who, when, how decisions are recorded). expo-rules are technical non-negotiables (secrets, OTA, navigation). Both appear in PR review; violations of either can block merge.

Q: Biggest governance failure on RN teams?

Undocumented SDK drift - multiple runtimeVersion families in production with no EOL calendar, leading to OTA bricks and security patches that never reach the oldest app.

Q: Who maintains governance docs?

Staff / platform lead authors; Lead enforces in review; EM sponsors calendar time. Everyone proposes ADR updates when reality diverges from policy.

A condensed summary of the 25 most important governance practices for Expo SDK 57 mobile teams - drawn from every page in this section.

Publish standards in docs/CONTRIBUTING.md: Naming, folders, and native touch rules live in git - not Slack pins that new hires never see (Standards Basics).
Feature barrels are merge blockers: Import only from @/features/<name> - deep imports couple refactors; enforce with ESLint no-restricted-imports (Coding Standards & Style Guides).
Thin app/, fat src/features/: Route files re-export screens; business logic never lives in Expo Router filenames - aligns with Expo Project Rules Checklist.
Native touch rules have named owners: plugins/, app.config.ts, and checked-in ios/ / android/ require platform CODEOWNERS - CNG teams regenerate, never hand-edit (Native Module Rules).
One command surface for quality: format:check, lint, typecheck, test - identical in Husky, laptop, and GitHub Actions (CI Quality Gates).
Zero-warning ESLint on main: expo lint -- --max-warnings 0 in CI - warnings become ignored debt within one sprint (Linting Basics).
Prettier and ESLint do not fight: Pick Prettier for formatting and import order; disable overlapping ESLint stylistic rules (Prettier & Import Sorting).
PR template encodes human gates: Device evidence, native diff attachments, and standards checkboxes - policy beats honor system (Coding Standards & Style Guides).
ADR for every intentional exception: "Temporary" native edits or architecture violations without ADR become permanent - use Architecture Decision Records.
Commit lockfiles; CI uses npm ci: Floating installs hide native/JS skew until TestFlight - never gitignore package-lock.json (Dependency & Supply-Chain Governance).
npx expo install for Expo packages: Manual version pins cause doctor failures and production native crashes - Expo Rules Best Practices.
npm audit fails on high/critical in CI: Document accepted risk in docs/security-exceptions.md with expiry - exceptions without dates are not accepted (Dependency & Supply-Chain Governance).
SBOM per store release tag: CycloneDX from lockfile archived with EAS build_id - enterprise audits ask what shipped in build abc123, not today's main.
Native OSS licenses ship in-app: iOS Settings bundle and Android OSS screen updated on every native bump - legal review on GPL-class additions.
N-1 SDK support window only: Production supports current SDK and one prior - three SDK generations in the wild breaks OTA and support (SDK Upgrade Policy).
Named upgrade champion per SDK bump: Accountable for branch, expo-doctor, preview matrix, and runtimeVersion ADR - not a volunteer in sprint 47 (SDK Upgrade Skill).
SDK upgrades on dedicated branches + worktrees: Never mix expo upgrade with feature work on main - hotfixes stay possible on parallel worktree (Interactive Rebase & Worktrees).
expo-doctor and preview eas build are merge gates: OTA cannot fix native skew from a bad SDK merge - full build matrix before production (Release and OTA Rules).
EOL registry with owners and deadlines: RN architecture, Expo SDK, OS floors, and API deprecations in docs/eol-registry.md - reviewed quarterly (Deprecation & EOL Tracking).
OS floor bumps are product decisions: ASC / Play analytics + ADR before raising deploymentTarget / minSdkVersion - engineering preference alone is insufficient.
Spikes are time-boxed with ADR outcomes: ADOPT, DEFER, or REJECT documented; spike branches deleted after demo - no Friday merge without flags and QA (Spikes, PoCs & New Architecture).
Brownfield spikes use isolated artifacts: expo-brownfield AAR/XCFramework - never copy-paste JS bundles into host assets (Brownfield Basics).
New Architecture validated on release-like builds: Expo Go is not proof - EAS preview + device smoke before org-wide NA enablement on RN 0.86.
Risk calendar aligns three clocks: Store binary, OTA bundle, and backend API deprecation on one shared doc - mobile EOL must not lag API removal (Release Train Calendar).
Staff+ governance is measured by durability: Policies, runbooks, and ADRs adopted by squads after you move on - not lines of code or heroic release weekends (Career Growth: Senior → Lead → Staff).

FAQs

Minimum governance for a two-person mobile team?

CONTRIBUTING.md, lockfile + npm ci, expo lint + tsc in CI, PR template with device evidence, and one docs/eol-registry.md row per SDK. Add champions and SBOM when a third app or enterprise customer appears.

How do governance and expo-rules differ?

Governance is process (who, when, how decisions are recorded). expo-rules are technical non-negotiables (secrets, OTA, navigation). Both appear in PR review; violations of either can block merge.

Biggest governance failure on RN teams?

Undocumented SDK drift - multiple runtimeVersion families in production with no EOL calendar, leading to OTA bricks and security patches that never reach the oldest app.

Who maintains governance docs?

Staff / platform lead authors; Lead enforces in review; EM sponsors calendar time. Everyone proposes ADR updates when reality diverges from policy.

Standards Basics - naming, folders, native touch
Coding Standards & Style Guides - enforcement cookbook
Dependency & Supply-Chain Governance - audit and SBOM
SDK Upgrade Policy - N-1 and champions
Deprecation & EOL Tracking - registry
Spikes, PoCs & New Architecture - safe experimentation
Career Growth: Senior → Lead → Staff - principal path
Expo Project Rules Checklist - technical non-negotiables
Linting & Formatting Best Practices - quality gate summary

Stack versions: This page was written for React 19.2.3, React Native 0.86.0, and Expo SDK 57 (expo ~57.0.4).

Governance Best Practices

A condensed summary of the 25 most important governance practices for Expo SDK 57 mobile teams - drawn from every page in this section.

Publish standards in docs/CONTRIBUTING.md: Naming, folders, and native touch rules live in git - not Slack pins that new hires never see (Standards Basics).
Feature barrels are merge blockers: Import only from @/features/<name> - deep imports couple refactors; enforce with ESLint no-restricted-imports (Coding Standards & Style Guides).
Thin app/, fat src/features/: Route files re-export screens; business logic never lives in Expo Router filenames - aligns with Expo Project Rules Checklist.
Native touch rules have named owners: plugins/, app.config.ts, and checked-in ios/ / android/ require platform CODEOWNERS - CNG teams regenerate, never hand-edit (Native Module Rules).
One command surface for quality: format:check, lint, typecheck, test - identical in Husky, laptop, and GitHub Actions (CI Quality Gates).
Zero-warning ESLint on main: expo lint -- --max-warnings 0 in CI - warnings become ignored debt within one sprint (Linting Basics).
Prettier and ESLint do not fight: Pick Prettier for formatting and import order; disable overlapping ESLint stylistic rules (Prettier & Import Sorting).
PR template encodes human gates: Device evidence, native diff attachments, and standards checkboxes - policy beats honor system (Coding Standards & Style Guides).
ADR for every intentional exception: "Temporary" native edits or architecture violations without ADR become permanent - use Architecture Decision Records.
Commit lockfiles; CI uses npm ci: Floating installs hide native/JS skew until TestFlight - never gitignore package-lock.json (Dependency & Supply-Chain Governance).
npx expo install for Expo packages: Manual version pins cause doctor failures and production native crashes - Expo Rules Best Practices.
npm audit fails on high/critical in CI: Document accepted risk in docs/security-exceptions.md with expiry - exceptions without dates are not accepted (Dependency & Supply-Chain Governance).
SBOM per store release tag: CycloneDX from lockfile archived with EAS build_id - enterprise audits ask what shipped in build abc123, not today's main.
Native OSS licenses ship in-app: iOS Settings bundle and Android OSS screen updated on every native bump - legal review on GPL-class additions.
N-1 SDK support window only: Production supports current SDK and one prior - three SDK generations in the wild breaks OTA and support (SDK Upgrade Policy).
Named upgrade champion per SDK bump: Accountable for branch, expo-doctor, preview matrix, and runtimeVersion ADR - not a volunteer in sprint 47 (SDK Upgrade Skill).
SDK upgrades on dedicated branches + worktrees: Never mix expo upgrade with feature work on main - hotfixes stay possible on parallel worktree (Interactive Rebase & Worktrees).
expo-doctor and preview eas build are merge gates: OTA cannot fix native skew from a bad SDK merge - full build matrix before production (Release and OTA Rules).
EOL registry with owners and deadlines: RN architecture, Expo SDK, OS floors, and API deprecations in docs/eol-registry.md - reviewed quarterly (Deprecation & EOL Tracking).
OS floor bumps are product decisions: ASC / Play analytics + ADR before raising deploymentTarget / minSdkVersion - engineering preference alone is insufficient.
Spikes are time-boxed with ADR outcomes: ADOPT, DEFER, or REJECT documented; spike branches deleted after demo - no Friday merge without flags and QA (Spikes, PoCs & New Architecture).
Brownfield spikes use isolated artifacts: expo-brownfield AAR/XCFramework - never copy-paste JS bundles into host assets (Brownfield Basics).
New Architecture validated on release-like builds: Expo Go is not proof - EAS preview + device smoke before org-wide NA enablement on RN 0.86.
Risk calendar aligns three clocks: Store binary, OTA bundle, and backend API deprecation on one shared doc - mobile EOL must not lag API removal (Release Train Calendar).
Staff+ governance is measured by durability: Policies, runbooks, and ADRs adopted by squads after you move on - not lines of code or heroic release weekends (Career Growth: Senior → Lead → Staff).

FAQs

Minimum governance for a two-person mobile team?

How do governance and expo-rules differ?

Biggest governance failure on RN teams?

Undocumented SDK drift - multiple runtimeVersion families in production with no EOL calendar, leading to OTA bricks and security patches that never reach the oldest app.

Who maintains governance docs?

Staff / platform lead authors; Lead enforces in review; EM sponsors calendar time. Everyone proposes ADR updates when reality diverges from policy.

Standards Basics - naming, folders, native touch
Coding Standards & Style Guides - enforcement cookbook
Dependency & Supply-Chain Governance - audit and SBOM
SDK Upgrade Policy - N-1 and champions
Deprecation & EOL Tracking - registry
Spikes, PoCs & New Architecture - safe experimentation
Career Growth: Senior → Lead → Staff - principal path
Expo Project Rules Checklist - technical non-negotiables
Linting & Formatting Best Practices - quality gate summary

Stack versions: This page was written for React 19.2.3, React Native 0.86.0, and Expo SDK 57 (expo ~57.0.4).

Governance Best Practices

FAQs

Related

Search Documentation

Governance Best Practices

FAQs

Related