jackyu66gitandCursor
2fb1dfee14
Archive the differentiated YuXinGu product docs, AI engineering system, design contract, and Go/Vue scaffold. Next execution prioritizes Cece-parity over early innovation (see .ai/product/STRATEGY.md). Co-authored-by: Cursor <cursoragent@cursor.com>
38 lines
1.2 KiB
Markdown
38 lines
1.2 KiB
Markdown
# Forbidden — Never
|
|
|
|
AI obeys NEVER rules strictly.
|
|
|
|
## Code
|
|
|
|
- Never use `panic` on request paths.
|
|
- Never ignore errors (`_ = err` on important paths).
|
|
- Never create circular dependencies.
|
|
- Never put SQL in handlers.
|
|
- Never put `gin.Context` in repositories.
|
|
- Never use package-level mutable globals for request state.
|
|
- Never use `SELECT *` in new SQL.
|
|
- Never introduce `any` casually in TypeScript.
|
|
- Never put `fetch` directly in Vue pages.
|
|
|
|
## API / data
|
|
|
|
- Never invent response shapes other than `{code,message,data}`.
|
|
- Never use POST for pure read/query.
|
|
- Never skip migration when schema changes.
|
|
- Never hard-delete user PII without explicit task (use soft delete).
|
|
|
|
## Security / deploy
|
|
|
|
- Never hardcode passwords, tokens, or secrets.
|
|
- Never commit `.env` or private keys.
|
|
- Never use Docker image tag `latest` in production.
|
|
- Never log full birthday + answers payloads casually.
|
|
|
|
## Product / process
|
|
|
|
- Never invent medical efficacy or 吉凶祸福 copy.
|
|
- Never reverse an Accepted ADR without a new ADR + approval.
|
|
- Never modify files outside the current task.
|
|
- Never extend Legacy root HTML unless the task is migration.
|
|
- Never guess requirements — ASK FIRST.
|