jackyu66gitandCursor
0f320e040b
Add host-first environment contracts (Local vs CI vs Prod), deps-only compose, and the Profile → Portrait → deep-access mock payment slice with device identity and auto-migrate on API startup. Co-authored-by: Cursor <cursoragent@cursor.com>
45 lines
1.7 KiB
Markdown
45 lines
1.7 KiB
Markdown
# Forbidden — Never
|
|
|
|
AI obeys NEVER rules strictly.
|
|
|
|
## Code
|
|
|
|
- Never use `panic` on request paths.
|
|
- Never ignore errors (`_ = err` on important paths).
|
|
- Never create circular dependencies.
|
|
- Never put SQL in handlers.
|
|
- Never put `gin.Context` in repositories.
|
|
- Never use package-level mutable globals for request state.
|
|
- Never use `SELECT *` in new SQL.
|
|
- Never introduce `any` casually in TypeScript.
|
|
- Never put `fetch` directly in Vue pages.
|
|
|
|
## API / data
|
|
|
|
- Never invent response shapes other than `{code,message,data}`.
|
|
- Never use POST for pure read/query.
|
|
- Never skip migration when schema changes.
|
|
- Never hand-apply schema changes on shared/prod DB instead of migrations.
|
|
- Never edit already-merged migration files on `main` (fix forward).
|
|
- Never hard-delete user PII without explicit task (use soft delete).
|
|
|
|
## Security / deploy / environment
|
|
|
|
- Never hardcode passwords, tokens, or secrets.
|
|
- Never commit `.env` or private keys.
|
|
- Never use Docker image tag `latest` in production.
|
|
- Never log full birthday + answers payloads casually.
|
|
- Never introduce a **Docker-only** local coding workflow for Go/Vue.
|
|
- Never require application **image rebuild** after every local code change.
|
|
- Never put local secrets into Docker images.
|
|
- Never mix local/dev config with production config or prod compose as daily default.
|
|
- Never assume `docker compose up` must start api + web for development.
|
|
|
|
## Product / process
|
|
|
|
- Never invent medical efficacy or 吉凶祸福 copy.
|
|
- Never reverse an Accepted ADR without a new ADR + approval.
|
|
- Never modify files outside the current task.
|
|
- Never extend Legacy root HTML unless the task is migration.
|
|
- Never guess requirements — ASK FIRST.
|