digital-psychology/.ai/forbidden.md

Forbidden — Never

AI obeys NEVER rules strictly.

Code

• Never use panic on request paths.
• Never ignore errors (_ = err on important paths).
• Never create circular dependencies.
• Never put SQL in handlers.
• Never put gin.Context in repositories.
• Never use package-level mutable globals for request state.
• Never use SELECT * in new SQL.
• Never introduce any casually in TypeScript.
• Never put fetch directly in Vue pages.

API / data

• Never invent response shapes other than {code,message,data}.
• Never use POST for pure read/query.
• Never skip migration when schema changes.
• Never hand-apply schema changes on shared/prod DB instead of migrations.
• Never edit already-merged migration files on main (fix forward).
• Never hard-delete user PII without explicit task (use soft delete).

Security / deploy / environment

• Never hardcode passwords, tokens, or secrets.
• Never commit .env or private keys.
• Never use Docker image tag latest in production.
• Never log full birthday + answers payloads casually.
• Never introduce a Docker-only local coding workflow for Go/Vue.
• Never require application image rebuild after every local code change.
• Never put local secrets into Docker images.
• Never mix local/dev config with production config or prod compose as daily default.
• Never assume docker compose up must start api + web for development.

Product / process

• Never invent medical efficacy or 吉凶祸福 copy.
• Never reverse an Accepted ADR without a new ADR + approval.
• Never modify files outside the current task.
• Never extend Legacy root HTML unless the task is migration.
• Never guess requirements — ASK FIRST.