# Rules for people and AI agents in this project

These rules apply to every change, whoever or whatever writes it. They come from the Last Mile Labs playbook (lastmilelabs.io): keep the speed of AI building, add the control a real product needs. Adjust the Stack section to your project; keep the rest.

## Stack

- Frontend: React with TypeScript in strict mode (the usual output of Lovable, Bolt, v0 and Floot).
- Backend: Supabase or Postgres with server functions. Replace with your own if different.
- Hosting: write down where production runs and who can deploy.

## Never

- Never put a secret in frontend code, config committed to git, or a prompt. Only public keys (such as the Supabase anon key) may reach the browser.
- Never create a database table without access rules (row-level security) and one policy per access pattern.
- Never change the database by hand in production. Every schema change is a migration file in the repository.
- Never squash, rebase or force-push commits that a builder (Lovable, Bolt, Riff, Floot) pushed. It breaks the sync.
- Never merge a change nobody has run. "Implemented, not yet tested" is an honest status; "working" without a run is not.
- Never remove or weaken a test to make it pass.

## Always

- Validate every input at the boundary (forms, API routes, webhooks) before using it.
- Put pricing, permissions and data writes in server code, not in screens.
- Keep files under 300 lines and functions under 80. Split before adding.
- Make one change at a time, small enough to review and undo.
- Run the type check, lint and tests before calling a change done, and say what you ran.
- When you touch sign-up, payments or data writes, add or update a test for it.
- Explain any change you cannot test, and what a person should check by hand.

## When unsure

- Ask before deleting data, changing access rules, rotating keys or touching payments.
- Prefer the boring, documented option over a clever one.
- If a fix breaks something else twice, stop and describe the problem instead of trying a third prompt.

## Commands

Fill these in for your project so every agent runs the same checks:

- Install: `npm install`
- Run locally: `npm run dev`
- Type check: `npx tsc --noEmit`
- Lint: `npm run lint`
- Tests: `npm test`
- Build: `npm run build`

## Skills in this kit

Skills live in the skills folder of your tool. Use them by name or let the agent pick them:

- `stage-assessment`: where the project stands and what to do next.
- `security-review`: secrets, access rules, server checks, inputs, dependencies.
- `access-rules`: write and test row-level security.
- `secrets-hygiene`: find, remove and rotate leaked keys.
- `quality-gate`: set up CI that blocks broken changes.
- `critical-path-tests`: tests on the paths that make money or lose data.
- `release-check`: what to confirm before a deploy.
- `backup-drill`: prove you can restore yesterday's data.
- `last-mile-audit`: the 20 percent a demo skips.
- `handover-runbook`: write the runbook a new developer needs.