c6c1364dd6
* Sync agent pipeline artifacts to 0.6.0. Add model routing defaults, L2 role updates, convoy telemetry, and manifest tracking without touching unrelated in-progress work. * Record tcg-vault interactive sync (kept local L1/L3 customizations). Update last_synced_at after reviewing behind/conflict artifacts; no overwrites applied. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(agent-pipeline): sync 0.6.0 — implementer Mode 2 fix pass + UI designer - role-implementer Mode 2 (fix pass) and role-reviewer hand-off - role-ui-designer + model-routing updates from upstream 783e2a3 - manifest last_synced_at bumped Co-authored-by: Cursor <cursoragent@cursor.com> * chore(agent-pipeline): sync v0.7.0 model routing Composer Standard for architect, Grok for audit fan-out, Sonnet 5 escalation path. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(agent-pipeline): finish 0.6.0/0.7.0 sync on branch Install security baseline, convoy planning, security-audit and ui-ux-pro-max skills; align PR template and metrics docs with convoy-metrics-gate; refresh manifest hashes while keeping tcg-vault-local L1/L3 customizations. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
37 lines
2.8 KiB
Text
37 lines
2.8 KiB
Text
---
|
|
description: Files and directories agents must not edit, and should not use as context examples
|
|
alwaysApply: true
|
|
---
|
|
|
|
# No-go zones
|
|
|
|
Do not edit, refactor, or quote as context examples. If you think you need to change one of these, stop and ask.
|
|
|
|
## Generated / vendored
|
|
|
|
- `node_modules/` — generated dependency tree
|
|
- `.next/` — Next.js build output
|
|
- `.vercel/` — Vercel CLI local config + build cache
|
|
- `out/`, `build/` — build outputs if present
|
|
|
|
## Append-only / historical
|
|
|
|
- `components/Layout.js.backup` — legacy snapshot; delete with a real PR, never edit
|
|
- `scripts/add-*.js`, `scripts/fix-*.js`, `scripts/seed-*.js` — historical migration / seed jobs already executed. Write a NEW dated script (or a real migration) for further schema changes; never edit ones that already ran.
|
|
|
|
## Secrets / credentials
|
|
|
|
- `.env`, `.env.local`, `.env.development.local`, `.env.test.local`, `.env.production.local`
|
|
- Anything matching `.env*.local`
|
|
- Never commit `JWT_SECRET`, `POSTGRES_URL`, `RESEND_API_KEY`, `BLOB_READ_WRITE_TOKEN`, `GEMINI_API_KEY`, OpenAI/Anthropic keys.
|
|
|
|
## Local-only / per-developer
|
|
|
|
- `.code-review-graph/` — local MCP graph index (only if `user-code-review-graph` is installed)
|
|
- `.convoys/.metrics.jsonl` — convoy role-event telemetry (tracked in git when metrics gate is installed; otherwise gitignored)
|
|
|
|
## Editing rules of thumb
|
|
|
|
- **Schema changes:** ship as a `node-pg-migrate` migration under `migrations/` at the repo root (post-`migration-tool` convoy, 2026-05-26). Generate via `npm run migrate create <name> -- -j js`, then edit the generated file. Do NOT edit `scripts/setup-neon-db.js` for any **DDL change** (`CREATE TABLE`, `ALTER`, new columns, constraint changes) — the bootstrap script's DDL was relocated to `migrations/1779853647564_initial-schema.js` and `setup-neon-db.js` now owns only env-var validation, the migration-runner spawn, and the admin-row seed. **Operational changes to `setup-neon-db.js` are still allowed** (env-var gating, error-message hardening, module-system fixes) — the `drop-public-setup` convoy set that precedent. The legacy `scripts/migrations/YYYY-MM-DD-<slug>.js` placeholder is preserved for the lone existing pre-tool migration (`2026-05-24-rename-admin-email.js`) and is **not** used for new work; new migrations go in the repo-root `migrations/` directory and are wrapped by the tool.
|
|
- **Auth refactors:** `lib/permission-middleware.js`, `pages/api/auth-utils.js`, `lib/auth-secret.js`, and `lib/use-auth.js` are the four documented auth surfaces. Tighten them inside a single convoy; don't cherry-pick. (The legacy `lib/auth-context.js` and `lib/admin-auth.js` were deleted by `single-auth-provider`; do not resurrect them.)
|
|
- **Card-import jobs:** `pages/api/cards/import-*.js` hit external APIs with rate limits. Don't run them ad-hoc against prod data; use staging.
|