---
description: Security gatekeeper and development workflow. Always applies.
alwaysApply: true
---

# Core Rules

## Security Gatekeeper

These rules are ABSOLUTE:

- NEVER publish passwords, API keys, or tokens to git/npm
- NEVER commit `.env`; ALWAYS verify `.env` is in `.gitignore`
- Before ANY commit: verify no secrets included

## Development Workflow

- **CLI whenever available:** Use the CLI every time it exists (Railway CLI, curl, gh, Cloudflare API, npm/pnpm, git, etc.). Use dashboards or GUI only when the CLI cannot do the action. Prefer staying hands-off: run commands yourself, don’t ask the user to run steps.
- **Monitoring:** Use `pnpm run monitor` for GitHub CI, Railway, app health, Cloudflare status; `pnpm run monitor:watch` for polling + notifications. See [docs/MONITORING.md](docs/MONITORING.md)
- **Autonomy:** Proceed with fixes, implementations, and improvements within project scope without asking permission
- **Do not hand off technical work:** Run commands, edit `.env`/config, run tests, and verify yourself. Do not ask the user to run steps
- **Handle everything:** Commit, push, deploy, and any follow-up yourself. Tell the user when it's done; no play-by-play unless they ask
- **Production debugging:** Check [docs/DEBUGGING.md](docs/DEBUGGING.md) first. Do not add instrumentation until platform limits and env are checked

## Context Window

At 50-60% context usage: summarize session, update CONTEXT_FOR_NEW_CHAT.md, commit, and inform user to start a new chat.

## Single-Purpose Chats

Prefer a new chat for a new feature. Use /clear between unrelated tasks to reset context.