Skip to content

AGENTS.md

Latest commit

 

History

History
16 lines (11 loc) · 1.18 KB

AGENTS.md

File metadata and controls

16 lines (11 loc) · 1.18 KB
Raw

Agent Guidance

Before changing or reviewing authentication, authorization, privileges, or role-gated UI, read skills/auth-check-patterns/SKILL.md.

Before adding or extending report types (API schema, scoped pages, grid cards, report-server handlers), read skills/adding-reports/SKILL.md.

Before adding or materially changing tests, read skills/test-type-safety/SKILL.md.

Before merging API, auth, role-gated UI, report, upload, invite, committee membership, or audit-log changes, run the illegible-bug checklist:

  • Trust boundary: every route is withPrivilege, withBackendCheck, or withPublic.
  • Negative auth: tests cover unauthenticated, insufficient privilege, and cross-user/cross-scope access.
  • State race: find-then-write flows use transactions, unique constraints, conditional updates, or P2002 handling.
  • Validation: request bodies and query params use Zod/shared validators, not TypeScript casts.
  • Data scope: list/file/report/PII responses prove owner, jurisdiction, or privilege scope.
  • Audit/state invariants: privileged mutations preserve audit and domain invariants.