Imported from NoeBouchard/plentry (
AGENTS.md). Install upstream withnpx skills add NoeBouchard/plentry. Copyright stays with the author.
Plentry — agent instructions
You are working on Plentry, a concierge grocery + meal-planning app (HelloFresh alternative). Treat this like a SaaS product: do not ship untested behaviour, and keep the vault current.
This GitHub repo is the app (index.html + Supabase Edge Functions). In the Cursor workspace “Kitchen planner”, the same files live under plentry/.
Read first
doc/REQUIREMENTS.md— locked MVPdoc/INVARIANTS.md— test IDsdoc/FLOWS.md— checkout / Ops / Mealsdoc/CURRENT-STATE.md— what is livedoc/AGENT-PLAYBOOK.md— how to change the appdoc/ENGINEERING.md— branch → PR → CI → merge (merge is not live)- Security work:
doc/SECURITY.md - There is no React/Next app. Do not add a bundler.
If doc/ is missing, stop. Do not invent product facts from doc/archive/ or this README.md stub.
Harness (required before production)
npm test
On GitHub this is the repo root. In the Kitchen planner workspace: cd plentry && npm test.
Must exit 0 before any production ship: Vercel static, supabase functions deploy, or telling the founder it is live. See doc/TESTING.md. If a change breaks a test, fix the app or update the test in the same change — never delete assertions to go green. If tests fail, stop — do not deploy.
Branch and PR
Product changes go on feat/… or fix/…, then a pull request. Wait for GitHub Actions test. Do not push product work straight to main. Do not vercel deploy from a PR. Money / XSS / RLS / pay PRs: /review-bugbot and /review-security before merge. CI is the merge gate; local npm test is still the production gate. git push is never ship.
After staging changes (required)
Update the vault in the same work:
doc/CURRENT-STATE.md— what is true nowdoc/CHANGELOG.md— append date, what, whydoc/ROADMAP.mdif next steps changeddoc/SECURITY.mdif you added or closed a risk- MVP contract files if they moved:
REQUIREMENTS.md,INVARIANTS.md,FLOWS.md
In the Kitchen planner workspace, edit root doc/ then npm run vault so this doc/ stays identical.
Deploy (only if the user asks)
Since PR #12 (4699353a, 15 Oct 2026) a merge to main does not auto-deploy production. git.deploymentEnabled.main is false. Other branches still get preview deployments. Production static is a Vercel REST create with autoAssignCustomDomains: false, then a promote. See doc/RUNBOOK.md. git push is not production.
Always run tests first. Do not run a Vercel or functions deploy if npm test failed.
npm test
# static: REST create + promote in doc/RUNBOOK.md
# if functions changed:
supabase functions deploy pay ai newcoming
Never
- Put secrets in
index.htmlor the vault - Capture more than the Stripe hold
- Add a second front-end framework
- Skip
npm test, or ship to production while tests are red - Push product changes straight to
main, or treat merge as production
