2 What should it cover?Each area becomes one file. Anything you leave out is listed in the index as deliberately not covered, so an agent does not mistake a missing file for a missing concern.
Your rules
How work happens here Read at the start of any session that will change code — before deciding what is safe to do unattended. Business context and commercialisation Read before any decision that is commercial rather than technical — pricing, visibility, what may be published, who the customer is. Operations Read before touching anything live, and before deciding a failure is yours to fix rather than to report. Documentation Read before writing or moving any documentation — before deciding where a fact belongs, not after it has been written somewhere. Language and editorial style Read before writing anything a person outside the project will read — not when proofreading it afterwards. Data handling and privacy Read before storing, logging or sending anything that could identify a person — including in a test fixture. Design system Read before introducing any colour, size or component that is not already in the token set. Accessibility Read before building any interface element — before choosing how it works, not when testing it. Localisation Read before adding any user-facing string, and before assuming a layout survives a longer language. Supportability Read before writing an error message, a log line a user might send us, or anything that tells a person how to get help. Brand and claims Read before writing anything that names the product or says what it does — before the claim is drafted, not when it is reviewed. Open source and licences Read before adding a dependency, copying code from anywhere, or touching a licence file — not when preparing a release. How work happens here Read at the start of any session that will change the text — before deciding what is yours to change and what is the author's. How work happens here Read at the start of any research session — before deciding which sources count and where the work stops. The question, the evidence bar and the dead ends Read before searching for anything — so an avenue already closed is not walked again. How work happens here Read at the start of any session that will change a design — before deciding what may change without review.
Services you use
Payments6 specifics held Read before touching anything that takes or refunds money — and before treating a sandbox result as evidence. Hosting and domains3 specifics held Read before deploying, and before concluding a failure is in the application rather than the host. Desktop distribution8 specifics held Read before concluding a signing, notarisation or update step needs a person — most of it does not. Analytics5 specifics held Read before adding or changing a tracking script, and before trusting a dashboard that reads zero. Testing against external services2 specifics held Read before the first test run that could reach a service you do not own — not after the first charge. Licensing5 specifics held Read before changing how the app decides it is licensed — and before deciding a failed check means the customer has not paid. Sign-in and sessions7 specifics held Read before touching sign-in, sessions or any secret that signs them — and before trusting anything the client says about who it is. Database and migrations11 specifics held Read before running any migration or write against a database you did not create in this session. Transactional email7 specifics held Read before sending any email from code — including from a test, a script or a staging environment.
3 About your rulesThe questions the rules you chose need answering. A question several files ask is asked once and fills them all. Anything left blank stays as a visible placeholder, and the index tells an agent to ask rather than guess. Your answers live in the link, so regenerating later re-applies them to the current text.
The rules you chose ask nothing.
Branching model How work reaches the main line. The default describes what this author's projects actually do.
Review requirement When and how a human sees the work. This changes the tempo of every rule below.
Escalation path Who is told, and how. If the answer is nobody, say so — that is a real answer and it changes the advice.
How you find out something is wrong A dashboard for a service; user reports or crash telemetry for shipped software. Whatever actually reaches you first.
Assistive technology commitment What is actually tested against, rather than what is theoretically supported.
Claims the product never makes Words and promises that need evidence, a lawyer or a decision before they appear anywhere public.
Which dependency licences are acceptable The rule, not a list of packages. Nothing in the repository states it, which is why it is asked.
Who reads this, and what they already know The second half matters more than the first. An agent that does not know what the audience already knows will explain the wrong things at length.
How something reaches a reader, and who decides Name the gate. Without it "publish" is undefined and a saved draft in the CMS looks like the end of the job.
What this publication does not write about, and why The single least inferable thing here, and the most expensive to get wrong. Give the reason as well as the rule — a rule without its reason gets argued around by the next agent.
The question this project exists to answer The real one, not the tidy version. If the stated question is a proxy for something else, say what the something else is — an agent optimising the proxy is the most expensive failure available here.
Answered once for 2 files: How work happens here; The question, the evidence bar and the dead ends.
What counts as evidence here Varies enormously by field and cannot be inferred. A clinical reviewer and a market analyst both say "evidence" and mean incompatible things.
Answered once for 2 files: How work happens here; The question, the evidence bar and the dead ends.
Where the agent may look Name the boundary. Silence here reads as the open web, which is rarely what anyone means and occasionally a confidentiality problem.
How a design change reaches a user, and who decides Name the gate. Without it "ship" is undefined, and an agent will read a merged branch or a saved file as the end of the job.
4 About those servicesChoose a service above and its questions appear here. Nothing is asked that the set does not need. Service areas are offered for software projects only. Every tool here also hasits own page , with the rules that matter for it.
How does the project take money, if it does? Not answered None / not applicable Polar — includes a hard-won lesson Stripe — includes a reported case Paddle — includes a hard-won lesson Lemon Squeezy — general guidance
Where does the thing run? Not answered Cloudflare Pages or Workers — includes a hard-won lesson Vercel — includes a hard-won lesson Netlify — includes a hard-won lesson Self-hosted — general guidance
Is there a desktop application, and what builds it? Not answered None / not applicable Tauri — includes a hard-won lesson Electron — includes a reported case Native (Xcode, MSVC) — general guidance
What measures usage, if anything does? Not answered None / not applicable Plausible — includes a hard-won lesson PostHog — includes a hard-won lesson Google Analytics — includes a hard-won lesson
Does the project call a network service you do not own? Not answered Yes — a payments, model, social or partner API — includes a hard-won lesson No — everything it talks to is ours — general guidance
Does anything need to be signed for distribution? Not answered None / not applicable Apple (macOS / iOS) — includes a hard-won lesson Windows — general guidance
How does the software decide whether a customer is licensed? Not answered None / not applicable Keygen — includes a hard-won lesson Lemon Squeezy licence keys — includes a hard-won lesson Polar licence keys — includes a hard-won lesson Self-built — includes a hard-won lesson
How do people sign in, if they do? Not answered None / not applicable Clerk — includes a reported case Auth.js — includes a reported case Supabase Auth — general guidance Cloudflare Access — general guidance Self-built — general guidance
Where does the data live? Not answered None / not applicable Postgres — includes a reported case SQLite — includes a reported case Cloudflare D1 — includes a reported case Supabase — includes a reported case Turso — includes a reported case
What sends email from the application, if anything? Not answered None / not applicable Mailgun — general guidance Postmark — includes a reported case Resend — general guidance Amazon SES — includes a reported case