# Forbidden — Never

AI obeys NEVER rules strictly.

## Code

- Never use `panic` on request paths.
- Never ignore errors (`_ = err` on important paths).
- Never create circular dependencies.
- Never put SQL in handlers.
- Never put `gin.Context` in repositories.
- Never use package-level mutable globals for request state.
- Never use `SELECT *` in new SQL.
- Never introduce `any` casually in TypeScript.
- Never put `fetch` directly in Vue pages.

## API / data

- Never invent response shapes other than `{code,message,data}`.
- Never use POST for pure read/query.
- Never skip migration when schema changes.
- Never hand-apply schema changes on shared/prod DB instead of migrations.
- Never edit already-merged migration files on `main` (fix forward).
- Never hard-delete user PII without explicit task (use soft delete).

## Security / deploy / environment

- Never hardcode passwords, tokens, or secrets.
- Never commit `.env` or private keys.
- Never use Docker image tag `latest` in production.
- Never log full birthday + answers payloads casually.
- Never introduce a **Docker-only** local coding workflow for Go/Vue.
- Never require application **image rebuild** after every local code change.
- Never put local secrets into Docker images.
- Never mix local/dev config with production config or prod compose as daily default.
- Never assume `docker compose up` must start api + web for development.

## Product / process

- Never invent medical efficacy or 吉凶祸福 copy.
- Never reverse an Accepted ADR without a new ADR + approval.
- Never modify files outside the current task.
- Never extend Legacy root HTML unless the task is migration.
- Never guess requirements — ASK FIRST.
- Never implement **new feature behavior** or **expand** an existing feature without an Active Feature Spec under `product/feature-spec/`（见 `product/feature-design.md`）。Bugfix 若暴露 Spec 错误必须同步修正 Spec。
- Never treat `feature-map.md` alone as sufficient design input for coding.