# Forbidden — Never

AI obeys NEVER rules strictly.

## Code

- Never use `panic` on request paths.
- Never ignore errors (`_ = err` on important paths).
- Never create circular dependencies.
- Never put SQL in handlers.
- Never put `gin.Context` in repositories.
- Never use package-level mutable globals for request state.
- Never use `SELECT *` in new SQL.
- Never introduce `any` casually in TypeScript.
- Never put `fetch` directly in Vue pages.

## API / data

- Never invent response shapes other than `{code,message,data}`.
- Never use POST for pure read/query.
- Never skip migration when schema changes.
- Never hard-delete user PII without explicit task (use soft delete).

## Security / deploy

- Never hardcode passwords, tokens, or secrets.
- Never commit `.env` or private keys.
- Never use Docker image tag `latest` in production.
- Never log full birthday + answers payloads casually.

## Product / process

- Never invent medical efficacy or 吉凶祸福 copy.
- Never reverse an Accepted ADR without a new ADR + approval.
- Never modify files outside the current task.
- Never extend Legacy root HTML unless the task is migration.
- Never guess requirements — ASK FIRST.