nilesh.pandClaude Opus 4.8
035711f08c
- CLAUDE.md + AGENTS.md: canonical guiding principles for AI agents and developers (tenant isolation, no RLS, stack, security, conventions, environment gotchas) - SECURITY.md: required security controls (isolation, secrets, auth, input handling, least privilege) with VAPT status - GOVERNANCE.md: how changes are validated before merge — deterministic gates + AI review, risk tiers, human accountability - CONTRIBUTING.md: code hygiene, definition of done, file hygiene - docs/wiki/: product reference (overview, domain model, features, roles & access, API reference, glossary) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
1.2 KiB
Markdown
28 lines
1.2 KiB
Markdown
# AGENTS.md
|
|
|
|
This project's guidance for AI coding agents lives in **[CLAUDE.md](CLAUDE.md)**.
|
|
It is tool-agnostic — read it before generating or changing code here.
|
|
|
|
Quick pointers:
|
|
|
|
- **Guide (read first):** [CLAUDE.md](CLAUDE.md)
|
|
- **Security rules:** [SECURITY.md](SECURITY.md)
|
|
- **Governance rules:** [GOVERNANCE.md](GOVERNANCE.md)
|
|
- **Contributing & hygiene:** [CONTRIBUTING.md](CONTRIBUTING.md)
|
|
- **Product wiki:** [docs/wiki/](docs/wiki/README.md)
|
|
- **Generating Playwright tests:** [e2e/CLAUDE.md](e2e/CLAUDE.md)
|
|
- **QA scenario → test workflow:** [qa/README.md](qa/README.md)
|
|
- **Testing overview:** [TESTING.md](TESTING.md)
|
|
- **Security findings to respect:** [security/VAPT-REPORT.md](security/VAPT-REPORT.md)
|
|
|
|
The non-negotiables, in one line each:
|
|
|
|
1. Tenant isolation is enforced in the repository layer; tenant id comes from
|
|
the authenticated identity, every tenant query filters `tenant_id`, misses
|
|
return 404. **Do not add PostgreSQL RLS.**
|
|
2. Never commit secrets; `.env` is git-ignored and read at runtime.
|
|
3. A change isn't done until its tests pass and the evidence proves it; never
|
|
weaken an assertion.
|
|
4. Stay in scope; a human owns the merge for anything tenant- or
|
|
security-sensitive.
|