| Dimension | Shared | Only in A | Only in B | Overlap |
|---|---|---|---|---|
| Sections | 0 | 9 | 14 | 0% |
| Commands | 0 | 2 | 0 | 0% |
| Section tags | 2 | 0 | 6 | 25% |
What each file covers
Sections
0 shared · 9 only in A · 14 only in B- − Dart/Flutter Security
- − Secrets Management
- − Network Security
- − Input Validation
- − Data Protection
- − Android-Specific
- − iOS-Specific
- − WebView Security
- − Obfuscation and Build Security
- + Everything Claude Code (ECC) — Agent Instructions
- + Core Principles
- + Available Agents
- + Agent Orchestration
- + Security Guidelines
- + Coding Style
- + Testing Requirements
- + Development Workflow
- + Workflow Surface Policy
- + Git Workflow
- + Architecture Patterns
- + Performance
- + Project Structure
- + Success Metrics
Commands
0 shared · 2 only in A · 0 only in B- − flutter build apk --obfuscate --split-debug-info=./debug-info/
- − flutter analyze
Section tags
2 shared · 0 only in A · 6 only in B- + test
- + code-style
- + architecture
- + git-pr
- + performance
- + agent-behaviour
- build
- security
Line diff
ThanhTrunggDEV/DontBeLazy · .cursor/rules/dart-security.mdc
@@ −1 @@
1---
2paths:
3 - "**/*.dart"
4 - "**/pubspec.yaml"
5 - "**/AndroidManifest.xml"
6 - "**/Info.plist"
7---
8# Dart/Flutter Security
9
10> This file extends [common/security.md](../common/security.md) with Dart, Flutter, and mobile-specific content.
11
12## Secrets Management
13
14- Never hardcode API keys, tokens, or credentials in Dart source
15- Use `--dart-define` or `--dart-define-from-file` for compile-time config (values are not truly secret — use a backend proxy for server-side secrets)
16- Use `flutter_dotenv` or equivalent, with `.env` files listed in `.gitignore`
17- Store runtime secrets in platform-secure storage: `flutter_secure_storage` (Keychain on iOS, EncryptedSharedPreferences on Android)
18
19```dart
20// BAD
21const apiKey = 'sk-abc123...';
22
23// GOOD — compile-time config (not secret, just configurable)
24const apiKey = String.fromEnvironment('API_KEY');
25
26// GOOD — runtime secret from secure storage
27final token = await secureStorage.read(key: 'auth_token');
28```
29
30## Network Security
31
32- Enforce HTTPS — no `http://` calls in production
33- Configure Android `network_security_config.xml` to block cleartext traffic
34- Set `NSAppTransportSecurity` in `Info.plist` to disallow arbitrary loads
35- Set request timeouts on all HTTP clients — never leave defaults
36- Consider certificate pinning for high-security endpoints
37
38```dart
39// Dio with timeout and HTTPS enforcement
40final dio = Dio(BaseOptions(
41 baseUrl: 'https://api.example.com',
42 connectTimeout: const Duration(seconds: 10),
43 receiveTimeout: const Duration(seconds: 30),
44));
45```
46
47## Input Validation
48
49- Validate and sanitize all user input before sending to API or storage
50- Never pass unsanitized input to SQL queries — use parameterized queries (sqflite, drift)
51- Sanitize deep link URLs before navigation — validate scheme, host, and path parameters
52- Use `Uri.tryParse` and validate before navigating
53
54```dart
55// BAD — SQL injection
56await db.rawQuery("SELECT * FROM users WHERE email = '$userInput'");
57
58// GOOD — parameterized
59await db.query('users', where: 'email = ?', whereArgs: [userInput]);
60
61// BAD — unvalidated deep link
62final uri = Uri.parse(incomingLink);
63context.go(uri.path); // could navigate to any route
64
65// GOOD — validated deep link
66final uri = Uri.tryParse(incomingLink);
67if (uri != null && uri.host == 'myapp.com' && _allowedPaths.contains(uri.path)) {
68 context.go(uri.path);
69}
70```
71
72## Data Protection
73
74- Store tokens, PII, and credentials only in `flutter_secure_storage`
75- Never write sensitive data to `SharedPreferences` or local files in plaintext
76- Clear auth state on logout: tokens, cached user data, cookies
77- Use biometric authentication (`local_auth`) for sensitive operations
78- Avoid logging sensitive data — no `print(token)` or `debugPrint(password)`
79
80## Android-Specific
81
82- Declare only required permissions in `AndroidManifest.xml`
83- Export Android components (`Activity`, `Service`, `BroadcastReceiver`) only when necessary; add `android:exported="false"` where not needed
84- Review intent filters — exported components with implicit intent filters are accessible by any app
85- Use `FLAG_SECURE` for screens displaying sensitive data (prevents screenshots)
86
87```xml
88<!-- AndroidManifest.xml — restrict exported components -->
89<activity android:name=".MainActivity" android:exported="true">
90 <!-- Only the launcher activity needs exported=true -->
91</activity>
92<activity android:name=".SensitiveActivity" android:exported="false" />
93```
94
95## iOS-Specific
96
97- Declare only required usage descriptions in `Info.plist` (`NSCameraUsageDescription`, etc.)
98- Store secrets in Keychain — `flutter_secure_storage` uses Keychain on iOS
99- Use App Transport Security (ATS) — disallow arbitrary loads
100- Enable data protection entitlement for sensitive files
101
102## WebView Security
103
104- Use `webview_flutter` v4+ (`WebViewController` / `WebViewWidget`) — the legacy `WebView` widget is removed
105- Disable JavaScript unless explicitly required (`JavaScriptMode.disabled`)
106- Validate URLs before loading — never load arbitrary URLs from deep links
107- Never expose Dart callbacks to JavaScript unless absolutely needed and carefully sandboxed
108- Use `NavigationDelegate.onNavigationRequest` to intercept and validate navigation requests
109
110```dart
111// webview_flutter v4+ API (WebViewController + WebViewWidget)
112final controller = WebViewController()
113 ..setJavaScriptMode(JavaScriptMode.disabled) // disabled unless required
114 ..setNavigationDelegate(
115 NavigationDelegate(
116 onNavigationRequest: (request) {
117 final uri = Uri.tryParse(request.url);
118 if (uri == null || uri.host != 'trusted.example.com') {
119 return NavigationDecision.prevent;
120 }
121 return NavigationDecision.navigate;
122 },
123 ),
124 );
125
126// In your widget tree:
127WebViewWidget(controller: controller)
128```
129
130## Obfuscation and Build Security
131
132- Enable obfuscation in release builds: `flutter build apk --obfuscate --split-debug-info=./debug-info/`
133- Keep `--split-debug-info` output out of version control (used for crash symbolication only)
134- Ensure ProGuard/R8 rules don't inadvertently expose serialized classes
135- Run `flutter analyze` and address all warnings before release
136
ThanhTrunggDEV/DontBeLazy · .cursor/AGENTS.md
@@ +1 @@
1# Everything Claude Code (ECC) — Agent Instructions
2
3This is a **production-ready AI coding plugin** providing 48 specialized agents, 183 skills, 79 commands, and automated hook workflows for software development.
4
5**Version:** 1.10.0
6
7## Core Principles
8
91. **Agent-First** — Delegate to specialized agents for domain tasks
102. **Test-Driven** — Write tests before implementation, 80%+ coverage required
113. **Security-First** — Never compromise on security; validate all inputs
124. **Immutability** — Always create new objects, never mutate existing ones
135. **Plan Before Execute** — Plan complex features before writing code
14
15## Available Agents
16
17| Agent | Purpose | When to Use |
18|-------|---------|-------------|
19| planner | Implementation planning | Complex features, refactoring |
20| architect | System design and scalability | Architectural decisions |
21| tdd-guide | Test-driven development | New features, bug fixes |
22| code-reviewer | Code quality and maintainability | After writing/modifying code |
23| security-reviewer | Vulnerability detection | Before commits, sensitive code |
24| build-error-resolver | Fix build/type errors | When build fails |
25| e2e-runner | End-to-end Playwright testing | Critical user flows |
26| refactor-cleaner | Dead code cleanup | Code maintenance |
27| doc-updater | Documentation and codemaps | Updating docs |
28| cpp-reviewer | C/C++ code review | C and C++ projects |
29| cpp-build-resolver | C/C++ build errors | C and C++ build failures |
30| docs-lookup | Documentation lookup via Context7 | API/docs questions |
31| go-reviewer | Go code review | Go projects |
32| go-build-resolver | Go build errors | Go build failures |
33| kotlin-reviewer | Kotlin code review | Kotlin/Android/KMP projects |
34| kotlin-build-resolver | Kotlin/Gradle build errors | Kotlin build failures |
35| database-reviewer | PostgreSQL/Supabase specialist | Schema design, query optimization |
36| python-reviewer | Python code review | Python projects |
37| java-reviewer | Java and Spring Boot code review | Java/Spring Boot projects |
38| java-build-resolver | Java/Maven/Gradle build errors | Java build failures |
39| loop-operator | Autonomous loop execution | Run loops safely, monitor stalls, intervene |
40| harness-optimizer | Harness config tuning | Reliability, cost, throughput |
41| rust-reviewer | Rust code review | Rust projects |
42| rust-build-resolver | Rust build errors | Rust build failures |
43| pytorch-build-resolver | PyTorch runtime/CUDA/training errors | PyTorch build/training failures |
44| typescript-reviewer | TypeScript/JavaScript code review | TypeScript/JavaScript projects |
45
46## Agent Orchestration
47
48Use agents proactively without user prompt:
49- Complex feature requests → **planner**
50- Code just written/modified → **code-reviewer**
51- Bug fix or new feature → **tdd-guide**
52- Architectural decision → **architect**
53- Security-sensitive code → **security-reviewer**
54- Autonomous loops / loop monitoring → **loop-operator**
55- Harness config reliability and cost → **harness-optimizer**
56
57Use parallel execution for independent operations — launch multiple agents simultaneously.
58
59## Security Guidelines
60
61**Before ANY commit:**
62- No hardcoded secrets (API keys, passwords, tokens)
63- All user inputs validated
64- SQL injection prevention (parameterized queries)
65- XSS prevention (sanitized HTML)
66- CSRF protection enabled
67- Authentication/authorization verified
68- Rate limiting on all endpoints
69- Error messages don't leak sensitive data
70
71**Secret management:** NEVER hardcode secrets. Use environment variables or a secret manager. Validate required secrets at startup. Rotate any exposed secrets immediately.
72
73**If security issue found:** STOP → use security-reviewer agent → fix CRITICAL issues → rotate exposed secrets → review codebase for similar issues.
74
75## Coding Style
76
77**Immutability (CRITICAL):** Always create new objects, never mutate. Return new copies with changes applied.
78
79**File organization:** Many small files over few large ones. 200-400 lines typical, 800 max. Organize by feature/domain, not by type. High cohesion, low coupling.
80
81**Error handling:** Handle errors at every level. Provide user-friendly messages in UI code. Log detailed context server-side. Never silently swallow errors.
82
83**Input validation:** Validate all user input at system boundaries. Use schema-based validation. Fail fast with clear messages. Never trust external data.
84
85**Code quality checklist:**
86- Functions small (<50 lines), files focused (<800 lines)
87- No deep nesting (>4 levels)
88- Proper error handling, no hardcoded values
89- Readable, well-named identifiers
90
91## Testing Requirements
92
93**Minimum coverage: 80%**
94
95Test types (all required):
961. **Unit tests** — Individual functions, utilities, components
972. **Integration tests** — API endpoints, database operations
983. **E2E tests** — Critical user flows
99
100**TDD workflow (mandatory):**
1011. Write test first (RED) — test should FAIL
1022. Write minimal implementation (GREEN) — test should PASS
1033. Refactor (IMPROVE) — verify coverage 80%+
104
105Troubleshoot failures: check test isolation → verify mocks → fix implementation (not tests, unless tests are wrong).
106
107## Development Workflow
108
1091. **Plan** — Use planner agent, identify dependencies and risks, break into phases
1102. **TDD** — Use tdd-guide agent, write tests first, implement, refactor
1113. **Review** — Use code-reviewer agent immediately, address CRITICAL/HIGH issues
1124. **Capture knowledge in the right place**
113 - Personal debugging notes, preferences, and temporary context → auto memory
114 - Team/project knowledge (architecture decisions, API changes, runbooks) → the project's existing docs structure
115 - If the current task already produces the relevant docs or code comments, do not duplicate the same information elsewhere
116 - If there is no obvious project doc location, ask before creating a new top-level file
1175. **Commit** — Conventional commits format, comprehensive PR summaries
118
119## Workflow Surface Policy
120
121- `skills/` is the canonical workflow surface.
122- New workflow contributions should land in `skills/` first.
123- `commands/` is a legacy slash-entry compatibility surface and should only be added or updated when a shim is still required for migration or cross-harness parity.
124
125## Git Workflow
126
127**Commit format:** `<type>: <description>` — Types: feat, fix, refactor, docs, test, chore, perf, ci
128
129**PR workflow:** Analyze full commit history → draft comprehensive summary → include test plan → push with `-u` flag.
130
131## Architecture Patterns
132
133**API response format:** Consistent envelope with success indicator, data payload, error message, and pagination metadata.
134
135**Repository pattern:** Encapsulate data access behind standard interface (findAll, findById, create, update, delete). Business logic depends on abstract interface, not storage mechanism.
136
137**Skeleton projects:** Search for battle-tested templates, evaluate with parallel agents (security, extensibility, relevance), clone best match, iterate within proven structure.
138
139## Performance
140
141**Context management:** Avoid last 20% of context window for large refactoring and multi-file features. Lower-sensitivity tasks (single edits, docs, simple fixes) tolerate higher utilization.
142
143**Build troubleshooting:** Use build-error-resolver agent → analyze errors → fix incrementally → verify after each fix.
144
145## Project Structure
146
147```
148agents/ — 48 specialized subagents
149skills/ — 183 workflow skills and domain knowledge
150commands/ — 79 slash commands
151hooks/ — Trigger-based automations
152rules/ — Always-follow guidelines (common + per-language)
153scripts/ — Cross-platform Node.js utilities
154mcp-configs/ — 14 MCP server configurations
155tests/ — Test suite
156```
157
158`commands/` remains in the repo for compatibility, but the long-term direction is skills-first.
159
160## Success Metrics
161
162- All tests pass with 80%+ coverage
163- No security vulnerabilities
164- Code is readable and maintainable
165- Performance is acceptable
166- User requirements are met
167
@@ −1 +1 @@
1−---
2−paths:
3− - "**/*.dart"
4− - "**/pubspec.yaml"
5− - "**/AndroidManifest.xml"
6− - "**/Info.plist"
7−---
8−# Dart/Flutter Security
1+# Everything Claude Code (ECC) — Agent Instructions
92
10−> This file extends [common/security.md](../common/security.md) with Dart, Flutter, and mobile-specific content.
3+This is a **production-ready AI coding plugin** providing 48 specialized agents, 183 skills, 79 commands, and automated hook workflows for software development.
114
12−## Secrets Management
5+**Version:** 1.10.0
136
14−- Never hardcode API keys, tokens, or credentials in Dart source
15−- Use `--dart-define` or `--dart-define-from-file` for compile-time config (values are not truly secret — use a backend proxy for server-side secrets)
16−- Use `flutter_dotenv` or equivalent, with `.env` files listed in `.gitignore`
17−- Store runtime secrets in platform-secure storage: `flutter_secure_storage` (Keychain on iOS, EncryptedSharedPreferences on Android)
7+## Core Principles
188
19−```dart
20−// BAD
21−const apiKey = 'sk-abc123...';
9+1. **Agent-First** — Delegate to specialized agents for domain tasks
10+2. **Test-Driven** — Write tests before implementation, 80%+ coverage required
11+3. **Security-First** — Never compromise on security; validate all inputs
12+4. **Immutability** — Always create new objects, never mutate existing ones
13+5. **Plan Before Execute** — Plan complex features before writing code
2214
23−// GOOD — compile-time config (not secret, just configurable)
24−const apiKey = String.fromEnvironment('API_KEY');
15+## Available Agents
2516
26−// GOOD — runtime secret from secure storage
27−final token = await secureStorage.read(key: 'auth_token');
28−```
17+| Agent | Purpose | When to Use |
18+|-------|---------|-------------|
19+| planner | Implementation planning | Complex features, refactoring |
20+| architect | System design and scalability | Architectural decisions |
21+| tdd-guide | Test-driven development | New features, bug fixes |
22+| code-reviewer | Code quality and maintainability | After writing/modifying code |
23+| security-reviewer | Vulnerability detection | Before commits, sensitive code |
24+| build-error-resolver | Fix build/type errors | When build fails |
25+| e2e-runner | End-to-end Playwright testing | Critical user flows |
26+| refactor-cleaner | Dead code cleanup | Code maintenance |
27+| doc-updater | Documentation and codemaps | Updating docs |
28+| cpp-reviewer | C/C++ code review | C and C++ projects |
29+| cpp-build-resolver | C/C++ build errors | C and C++ build failures |
30+| docs-lookup | Documentation lookup via Context7 | API/docs questions |
31+| go-reviewer | Go code review | Go projects |
32+| go-build-resolver | Go build errors | Go build failures |
33+| kotlin-reviewer | Kotlin code review | Kotlin/Android/KMP projects |
34+| kotlin-build-resolver | Kotlin/Gradle build errors | Kotlin build failures |
35+| database-reviewer | PostgreSQL/Supabase specialist | Schema design, query optimization |
36+| python-reviewer | Python code review | Python projects |
37+| java-reviewer | Java and Spring Boot code review | Java/Spring Boot projects |
38+| java-build-resolver | Java/Maven/Gradle build errors | Java build failures |
39+| loop-operator | Autonomous loop execution | Run loops safely, monitor stalls, intervene |
40+| harness-optimizer | Harness config tuning | Reliability, cost, throughput |
41+| rust-reviewer | Rust code review | Rust projects |
42+| rust-build-resolver | Rust build errors | Rust build failures |
43+| pytorch-build-resolver | PyTorch runtime/CUDA/training errors | PyTorch build/training failures |
44+| typescript-reviewer | TypeScript/JavaScript code review | TypeScript/JavaScript projects |
2945
30−## Network Security
46+## Agent Orchestration
3147
32−- Enforce HTTPS — no `http://` calls in production
33−- Configure Android `network_security_config.xml` to block cleartext traffic
34−- Set `NSAppTransportSecurity` in `Info.plist` to disallow arbitrary loads
35−- Set request timeouts on all HTTP clients — never leave defaults
36−- Consider certificate pinning for high-security endpoints
48+Use agents proactively without user prompt:
49+- Complex feature requests → **planner**
50+- Code just written/modified → **code-reviewer**
51+- Bug fix or new feature → **tdd-guide**
52+- Architectural decision → **architect**
53+- Security-sensitive code → **security-reviewer**
54+- Autonomous loops / loop monitoring → **loop-operator**
55+- Harness config reliability and cost → **harness-optimizer**
3756
38−```dart
39−// Dio with timeout and HTTPS enforcement
40−final dio = Dio(BaseOptions(
41− baseUrl: 'https://api.example.com',
42− connectTimeout: const Duration(seconds: 10),
43− receiveTimeout: const Duration(seconds: 30),
44−));
45−```
57+Use parallel execution for independent operations — launch multiple agents simultaneously.
4658
47−## Input Validation
59+## Security Guidelines
4860
49−- Validate and sanitize all user input before sending to API or storage
50−- Never pass unsanitized input to SQL queries — use parameterized queries (sqflite, drift)
51−- Sanitize deep link URLs before navigation — validate scheme, host, and path parameters
52−- Use `Uri.tryParse` and validate before navigating
61+**Before ANY commit:**
62+- No hardcoded secrets (API keys, passwords, tokens)
63+- All user inputs validated
64+- SQL injection prevention (parameterized queries)
65+- XSS prevention (sanitized HTML)
66+- CSRF protection enabled
67+- Authentication/authorization verified
68+- Rate limiting on all endpoints
69+- Error messages don't leak sensitive data
5370
54−```dart
55−// BAD — SQL injection
56−await db.rawQuery("SELECT * FROM users WHERE email = '$userInput'");
71+**Secret management:** NEVER hardcode secrets. Use environment variables or a secret manager. Validate required secrets at startup. Rotate any exposed secrets immediately.
5772
58−// GOOD — parameterized
59−await db.query('users', where: 'email = ?', whereArgs: [userInput]);
73+**If security issue found:** STOP → use security-reviewer agent → fix CRITICAL issues → rotate exposed secrets → review codebase for similar issues.
6074
61−// BAD — unvalidated deep link
62−final uri = Uri.parse(incomingLink);
63−context.go(uri.path); // could navigate to any route
75+## Coding Style
6476
65−// GOOD — validated deep link
66−final uri = Uri.tryParse(incomingLink);
67−if (uri != null && uri.host == 'myapp.com' && _allowedPaths.contains(uri.path)) {
68− context.go(uri.path);
69−}
70−```
77+**Immutability (CRITICAL):** Always create new objects, never mutate. Return new copies with changes applied.
7178
72−## Data Protection
79+**File organization:** Many small files over few large ones. 200-400 lines typical, 800 max. Organize by feature/domain, not by type. High cohesion, low coupling.
7380
74−- Store tokens, PII, and credentials only in `flutter_secure_storage`
75−- Never write sensitive data to `SharedPreferences` or local files in plaintext
76−- Clear auth state on logout: tokens, cached user data, cookies
77−- Use biometric authentication (`local_auth`) for sensitive operations
78−- Avoid logging sensitive data — no `print(token)` or `debugPrint(password)`
81+**Error handling:** Handle errors at every level. Provide user-friendly messages in UI code. Log detailed context server-side. Never silently swallow errors.
7982
80−## Android-Specific
83+**Input validation:** Validate all user input at system boundaries. Use schema-based validation. Fail fast with clear messages. Never trust external data.
8184
82−- Declare only required permissions in `AndroidManifest.xml`
83−- Export Android components (`Activity`, `Service`, `BroadcastReceiver`) only when necessary; add `android:exported="false"` where not needed
84−- Review intent filters — exported components with implicit intent filters are accessible by any app
85−- Use `FLAG_SECURE` for screens displaying sensitive data (prevents screenshots)
85+**Code quality checklist:**
86+- Functions small (<50 lines), files focused (<800 lines)
87+- No deep nesting (>4 levels)
88+- Proper error handling, no hardcoded values
89+- Readable, well-named identifiers
8690
87−```xml
88−<!-- AndroidManifest.xml — restrict exported components -->
89−<activity android:name=".MainActivity" android:exported="true">
90− <!-- Only the launcher activity needs exported=true -->
91−</activity>
92−<activity android:name=".SensitiveActivity" android:exported="false" />
93−```
91+## Testing Requirements
9492
95−## iOS-Specific
93+**Minimum coverage: 80%**
9694
97−- Declare only required usage descriptions in `Info.plist` (`NSCameraUsageDescription`, etc.)
98−- Store secrets in Keychain — `flutter_secure_storage` uses Keychain on iOS
99−- Use App Transport Security (ATS) — disallow arbitrary loads
100−- Enable data protection entitlement for sensitive files
95+Test types (all required):
96+1. **Unit tests** — Individual functions, utilities, components
97+2. **Integration tests** — API endpoints, database operations
98+3. **E2E tests** — Critical user flows
10199
102−## WebView Security
100+**TDD workflow (mandatory):**
101+1. Write test first (RED) — test should FAIL
102+2. Write minimal implementation (GREEN) — test should PASS
103+3. Refactor (IMPROVE) — verify coverage 80%+
103104
104−- Use `webview_flutter` v4+ (`WebViewController` / `WebViewWidget`) — the legacy `WebView` widget is removed
105−- Disable JavaScript unless explicitly required (`JavaScriptMode.disabled`)
106−- Validate URLs before loading — never load arbitrary URLs from deep links
107−- Never expose Dart callbacks to JavaScript unless absolutely needed and carefully sandboxed
108−- Use `NavigationDelegate.onNavigationRequest` to intercept and validate navigation requests
105+Troubleshoot failures: check test isolation → verify mocks → fix implementation (not tests, unless tests are wrong).
109106
110−```dart
111−// webview_flutter v4+ API (WebViewController + WebViewWidget)
112−final controller = WebViewController()
113− ..setJavaScriptMode(JavaScriptMode.disabled) // disabled unless required
114− ..setNavigationDelegate(
115− NavigationDelegate(
116− onNavigationRequest: (request) {
117− final uri = Uri.tryParse(request.url);
118− if (uri == null || uri.host != 'trusted.example.com') {
119− return NavigationDecision.prevent;
120− }
121− return NavigationDecision.navigate;
122− },
123− ),
124− );
107+## Development Workflow
125108
126−// In your widget tree:
127−WebViewWidget(controller: controller)
109+1. **Plan** — Use planner agent, identify dependencies and risks, break into phases
110+2. **TDD** — Use tdd-guide agent, write tests first, implement, refactor
111+3. **Review** — Use code-reviewer agent immediately, address CRITICAL/HIGH issues
112+4. **Capture knowledge in the right place**
113+ - Personal debugging notes, preferences, and temporary context → auto memory
114+ - Team/project knowledge (architecture decisions, API changes, runbooks) → the project's existing docs structure
115+ - If the current task already produces the relevant docs or code comments, do not duplicate the same information elsewhere
116+ - If there is no obvious project doc location, ask before creating a new top-level file
117+5. **Commit** — Conventional commits format, comprehensive PR summaries
118+
119+## Workflow Surface Policy
120+
121+- `skills/` is the canonical workflow surface.
122+- New workflow contributions should land in `skills/` first.
123+- `commands/` is a legacy slash-entry compatibility surface and should only be added or updated when a shim is still required for migration or cross-harness parity.
124+
125+## Git Workflow
126+
127+**Commit format:** `<type>: <description>` — Types: feat, fix, refactor, docs, test, chore, perf, ci
128+
129+**PR workflow:** Analyze full commit history → draft comprehensive summary → include test plan → push with `-u` flag.
130+
131+## Architecture Patterns
132+
133+**API response format:** Consistent envelope with success indicator, data payload, error message, and pagination metadata.
134+
135+**Repository pattern:** Encapsulate data access behind standard interface (findAll, findById, create, update, delete). Business logic depends on abstract interface, not storage mechanism.
136+
137+**Skeleton projects:** Search for battle-tested templates, evaluate with parallel agents (security, extensibility, relevance), clone best match, iterate within proven structure.
138+
139+## Performance
140+
141+**Context management:** Avoid last 20% of context window for large refactoring and multi-file features. Lower-sensitivity tasks (single edits, docs, simple fixes) tolerate higher utilization.
142+
143+**Build troubleshooting:** Use build-error-resolver agent → analyze errors → fix incrementally → verify after each fix.
144+
145+## Project Structure
146+
128147 ```
148+agents/ — 48 specialized subagents
149+skills/ — 183 workflow skills and domain knowledge
150+commands/ — 79 slash commands
151+hooks/ — Trigger-based automations
152+rules/ — Always-follow guidelines (common + per-language)
153+scripts/ — Cross-platform Node.js utilities
154+mcp-configs/ — 14 MCP server configurations
155+tests/ — Test suite
156+```
129157
130−## Obfuscation and Build Security
158+`commands/` remains in the repo for compatibility, but the long-term direction is skills-first.
131159
132−- Enable obfuscation in release builds: `flutter build apk --obfuscate --split-debug-info=./debug-info/`
133−- Keep `--split-debug-info` output out of version control (used for crash symbolication only)
134−- Ensure ProGuard/R8 rules don't inadvertently expose serialized classes
135−- Run `flutter analyze` and address all warnings before release
160+## Success Metrics
161+
162+- All tests pass with 80%+ coverage
163+- No security vulnerabilities
164+- Code is readable and maintainable
165+- Performance is acceptable
166+- User requirements are met
136167
