Instruction file imported from ChocoWork/speckit (.github/instructions/project.guardrails.instructions.md). Copyright stays with the author.

Role Of Instructions

Instructions define non-negotiable rules. Agents and prompts must follow these rules.

Priority Model

1. Safety and security rules
2. Process rules (SDD/TDD)
3. Technical constraints
4. Project style conventions

Required Process

• Use phased flow: Research -> Plan -> Implement.
• Do not implement before plan approval.
• Keep artifacts up to date: research.md, plan.md, todo.md.
• Mark assumptions as hypotheses and create validation tasks.

TDD Rules

• Start with failing tests (Red), then pass (Green), then refactor.
• Map tests to acceptance criteria IDs.
• Keep evidence in PR or task artifacts.

Technical Constraints

• Stack: Next.js + React + TypeScript + Supabase.
• Next.js and Supabase related operations must go through MCP-integrated paths.
• Type safety is strict; avoid any shortcuts.

Security Rules

• Never expose secrets in prompts, logs, code comments, or outputs.
• Use least-privilege access and keep auth boundaries explicit.
• RLS-first mindset for Supabase data access.

Quality Gates

• Minimum gates: lint, typecheck, unit, integration, security checks.
• CI must pass required gates before merge.

Hotfix Exception

Allowed only for incident-grade issues.

• Require dual approval (Tech Lead on-call + Security on-call).
• Use emergency mini-plan before implementation.
• Backfill missing test evidence within 24h.

Non-Goals

• Ad-hoc coding without artifacts
• Scope expansion beyond approved plan
• Bypassing MCP constraints for convenience