AGENTS.md@evals/rules/contexts/web git:20260925.a6a93b6A

Immutable. This exact content never changes and is served at /api/v1/blob/f34e83d707e7e8cd.

# Engineering rules

- Read README.md, relevant docs/ files and nearby tests before changing code.
  Work only in the assigned worktree; preserve unrelated edits.
- Use atomic conventional commits and a pull request. Never push directly to main.
  Never force-push, including `--force` or `--force-with-lease` on git or gh.
  Never use `--no-verify` or `--admin` to bypass checks or branch protection.
  Never rebase a pushed branch; update it with `git fetch origin` then
  `git merge origin/main` in the assigned worktree.
- Never merge a PR marked "do not merge", or with failing or pending required
  checks. Merge only when authorized. After updating a branch, require new checks
  on its new head; a previous green SHA is not evidence for the current one.
- Wait on CI with `lacquer wait pr <N>`; never `gh pr checks --watch` or polling.
  Exit 0 is passed; 1 failed, 2 timed out, 3 no checks, 4 wait failed.
  Before a follow-up push run `lacquer ci-round begin <N>` with `--reason` for a
  failure fix or `--review` for requested changes. Stop on exit 10; never reset
  the round budget without human authorization.
- Never commit or log secrets. Commit examples, not real `.env`, `Secrets.xcconfig`,
  signing keys or credentials. Never put server/service-role keys in a client
  binary, public environment variable, bundle, response or log. Declare secret
  names rather than values in the manifest; use the configured secret store.
- Local checks must match CI strictness. Read `.github/workflows/` and the local
  check configuration; run their exact commands for the affected components.
  Treat warnings as errors. Do not suppress failures, hide stderr, add `|| true`,
  weaken checks or edit generated checks to get green. Fix shared configuration
  at its source or explicitly exclude project-owned files in `.lacquer.toml`.
- Add a regression test, prove it fails on the broken behavior, then passes with
  the fix. Build and run relevant tests. Zero selected tests, skipped checks and
  unreadable results are not success. Report commands, results and limitations.
- Keep build output inside the assigned worktree. Never kill a simulator or process
  this run did not create; record owned IDs and clean up only those resources.
- Preserve the PR number, branch, worktree, CI-round budget, verification evidence
  and next action across compaction. Resume from that state.
- In Codex, read `.codex/README.md` for guard activation and coverage limits.
  These rules still apply when runtime guards are inactive or cannot inspect a tool.
- Before briefing or starting work, run `lacquer decisions` and `lacquer decisions --fleet`; quote the operator's words verbatim.

# Web / TypeScript

- Read the installed framework's vendored docs before using its APIs.
- From this component directory, use its package.json `packageManager` and lock:
  `pnpm install --frozen-lockfile` for declared pnpm, otherwise `npm ci`.
  Run `./node_modules/.bin/biome ci --error-on-warnings .`, then the package
  scripts `typecheck`, `test:coverage`, `build` and `docs` using that manager
  (for example `pnpm run typecheck` or `npm run typecheck`).
- Local checks in the repository's lefthook.yml map to `.github/workflows/web-ci.yml`.
  Use project-pinned binaries, strict TypeScript and warnings-as-errors. Prove
  every intended workspace package, including the root app, was checked; an empty
  task selection or stale cache is not verification.
- Commit `.env.example`, never real `.env`. Keep server credentials out of public
  environment variables and client bundles. Authenticate server actions, validate
  external input and enforce authorization at data access boundaries.