nilesh.pandClaude Opus 4.8
035711f08c
- CLAUDE.md + AGENTS.md: canonical guiding principles for AI agents and developers (tenant isolation, no RLS, stack, security, conventions, environment gotchas) - SECURITY.md: required security controls (isolation, secrets, auth, input handling, least privilege) with VAPT status - GOVERNANCE.md: how changes are validated before merge — deterministic gates + AI review, risk tiers, human accountability - CONTRIBUTING.md: code hygiene, definition of done, file hygiene - docs/wiki/: product reference (overview, domain model, features, roles & access, API reference, glossary) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1.2 KiB
1.2 KiB
AGENTS.md
This project's guidance for AI coding agents lives in CLAUDE.md. It is tool-agnostic — read it before generating or changing code here.
Quick pointers:
- Guide (read first): CLAUDE.md
- Security rules: SECURITY.md
- Governance rules: GOVERNANCE.md
- Contributing & hygiene: CONTRIBUTING.md
- Product wiki: docs/wiki/
- Generating Playwright tests: e2e/CLAUDE.md
- QA scenario → test workflow: qa/README.md
- Testing overview: TESTING.md
- Security findings to respect: security/VAPT-REPORT.md
The non-negotiables, in one line each:
- Tenant isolation is enforced in the repository layer; tenant id comes from
the authenticated identity, every tenant query filters
tenant_id, misses return 404. Do not add PostgreSQL RLS. - Never commit secrets;
.envis git-ignored and read at runtime. - A change isn't done until its tests pass and the evidence proves it; never weaken an assertion.
- Stay in scope; a human owns the merge for anything tenant- or security-sensitive.