---
description: Files and directories agents must not edit, and should not use as context examples
alwaysApply: true
---

# No-go zones

Do not edit, refactor, or quote as context examples. If you think you need to change one of these, stop and ask.

## Generated / vendored

- `node_modules/` — generated dependency tree
- `.next/`, `apps/*/.next/` — Next.js build output
- `.turbo/`, `apps/*/.turbo/`, `packages/*/.turbo/` — Turborepo cache
- `dist/`, `build/` — build outputs in any package
- `*.tsbuildinfo` — TS incremental cache
- `next-env.d.ts` — Next.js generated types
- `pnpm-lock.yaml` — pnpm lockfile; never hand-edit. Update via `pnpm install` or `pnpm add`.

## Append-only / historical

- `packages/database/migrations/` — Drizzle migrations are append-only. Create **new** ones via `pnpm db:generate`, never edit existing SQL.
- `plans/**/Plan-*-archive/` — frozen archived plans (if any) — leave alone.

## Secrets / credentials

- `.env`, `.env.local`, `.env.development.local`, `.env.test.local`, `.env.production.local`
- `.env.*` (anything matching) — including `.env.coolify` if used
- `credentials/`, `*-service-account-key.json`
- `certs/`, `*.pem`, `*.key`
- `docker/.env*` — Coolify deploy env files; never commit

`.env.example` is safe to edit.

## Deploy infrastructure (high-risk)

- `docker/Dockerfile` — touch only when you mean to ship; CI doesn't run this
- `docker/docker-compose.coolify.yml` — Coolify production compose; coordinate with the deploy
- `docker/next.config.docker.ts` — docker-specific Next config override

If you need to change any of these, surface it as a separate brief.

## Local-only / per-developer

- `.code-review-graph/` — local MCP graph index (per-developer)
- `.worktrees/`, `*-worktrees/` — local worktree orchestration
- `.convoys/.metrics.jsonl` — local self-analytics; gitignored
- `.convoys/.pending-mcp-sync.jsonl` — local Echodo MCP outbox (v0.4+); gitignored
- `.DS_Store` — macOS Finder metadata

## Editing rules of thumb

- **New Drizzle migrations only.** Edit `packages/database/src/schema.ts` (or per-domain schema files), then `pnpm db:generate` to produce a new migration. Never hand-edit a previous migration's SQL.
- **Backlog markdown lives under `plans/`** and is synced with Echodo's DB via the importer in `packages/database`. See `config/CursorSync.md` before touching sync code.
- **MCP server is the agent's surface to Echodo.** Modify `apps/mcp-server/` carefully — agents (including this one) rely on its tool stability. Stdio transport, not HTTP.
- If you find yourself wanting to "fix" a generated artifact, regenerate it via the proper command instead.