Cursor rule

1---
2description: Security gatekeeper and development workflow. Always applies.
3alwaysApply: true
4---
5 
6# Core Rules
7 
8## Security Gatekeeper
9 
10These rules are ABSOLUTE:
11 
12- NEVER publish passwords, API keys, or tokens to git/npm
13- NEVER commit `.env`; ALWAYS verify `.env` is in `.gitignore`
14- Before ANY commit: verify no secrets included
15 
16## Development Workflow
17 
18- **CLI whenever available:** Use the CLI every time it exists (Railway CLI, curl, gh, Cloudflare API, npm/pnpm, git, etc.). Use dashboards or GUI only when the CLI cannot do the action. Prefer staying hands-off: run commands yourself, don’t ask the user to run steps.
19- **Monitoring:** Use `pnpm run monitor` for GitHub CI, Railway, app health, Cloudflare status; `pnpm run monitor:watch` for polling + notifications. See [docs/MONITORING.md](docs/MONITORING.md)
20- **Autonomy:** Proceed with fixes, implementations, and improvements within project scope without asking permission
21- **Do not hand off technical work:** Run commands, edit `.env`/config, run tests, and verify yourself. Do not ask the user to run steps
22- **Handle everything:** Commit, push, deploy, and any follow-up yourself. Tell the user when it's done; no play-by-play unless they ask
23- **Production debugging:** Check [docs/DEBUGGING.md](docs/DEBUGGING.md) first. Do not add instrumentation until platform limits and env are checked
24 
25## Context Window
26 
27At 50-60% context usage: summarize session, update CONTEXT_FOR_NEW_CHAT.md, commit, and inform user to start a new chat.
28 
29## Single-Purpose Chats
30 
31Prefer a new chat for a new feature. Use /clear between unrelated tasks to reset context.
32