This repo uses Ultracite (Biome) for formatting + linting. Prefer simple, explicit code and keep the project easy to change.
- Format + fix:
bun x ultracite fix - Check (CI-style):
bun x ultracite check - Diagnose tooling:
bun x ultracite doctor
- Ship maintainable changes: clear intent, low cognitive load, type-safe, accessible, secure.
- Prefer deletion over preservation: if you refactor, remove old paths. Avoid keeping parallel implementations.
- Make progress autonomously: don’t stop at “requested change done” if there’s an obvious adjacent technical completion.
- Be honest about uncertainty: when you can’t confirm something, say so and add checks/logging/tests rather than guessing.
- Data quality is a first-class feature: if the system pulls from sources, treat correctness and provenance as requirements.
- No fallbacks, no masking: fallback behavior in app code, tests, and CI is forbidden. Missing required env, upstream failures, or LLM/schema failures must fail hard and loudly.
You should proceed without asking for confirmation when the work is:
- A clear bug fix, type-safety improvement, or dead-code removal
- A refactor that reduces complexity and deletes the old version
- Adding missing tests, assertions, or validation needed to make existing behavior reliable
- Improving observability (structured logs/metrics) to verify behavior
- Tightening security defaults (e.g.,
rel="noopener"on external links)
You must ask before:
- Introducing a new feature that isn’t implied by existing code or we haven’t discussed as needed/valuable
- Making a large dependency addition or major architectural change
After completing a task, do one more pass:
- Identify the next highest-leverage cleanup directly related to the change and do it (unless it would change behavior).
- Use
constby default;letonly when reassignment is required. - Prefer
unknownoverany; narrow with guards instead of assertions. - Use
as constfor literal/immutable objects when it improves types. - Prefer
for...offor loops with side effects; avoid accumulator spreads in hot paths. - Avoid cleverness; name things clearly and extract magic numbers into constants.
- Always
awaitpromises you create or call inasyncfunctions. - Use
try/catchwhere you can add meaning: context or cleanup, then rethrow/fail. - Throw
Errorobjects with descriptive messages (include key identifiers). - Fail fast with early returns to reduce nesting.
- Add
rel="noopener"fortarget="_blank". - Don’t use
eval(). - Validate and sanitize external input (network, files, env vars, user input).
- Avoid
dangerouslySetInnerHTMLunless absolutely necessary and justified.
- Don’t allocate in tight loops unnecessarily.
- Use top-level regex literals (don’t build regexes repeatedly in loops).
- Prefer specific imports over namespace imports when reasonable.
- Function components only; hooks at top-level only.
- Use semantic HTML + accessible labels/alt text; keyboard support with mouse handlers.
- Next.js: prefer
<Image>for images; use appropriate metadata APIs for head content. - Avoid defining components inside components.
- Put assertions inside
test()/it()blocks. - Use
async/await(nodonecallbacks). - Never commit
.only/.skip. - Keep suites flat; test behavior and edge cases, not implementation trivia.
Any code that ingests, scrapes, syncs, or transforms external data must include:
- Provenance: where the data came from (source URL/system, timestamp, identifiers).
- Normalization: deterministic transforms (documented and testable).
- Validation: schema/shape checks and constraints (reject or quarantine bad data).
- Traceability: ability to map a stored field back to a source attribute.
When you touch data ingestion, parsing, or derived fields, include a Data Quality Grade using this rubric:
- A: strong provenance + robust validation + idempotent transforms + good coverage/monitoring
- B: provenance + basic validation; some edge cases known but bounded
- C: partial provenance or weak validation; correctness depends on assumptions
- D: brittle parsing, unclear provenance, or frequent silent fallbacks
- F: unvalidated/untraceable data or behavior that can silently corrupt outputs
Alongside the grade, include:
- Source(s): what you pull from and why it’s authoritative
- Assumptions: explicit assumptions about the source format/semantics
- Failure modes: what happens on missing/invalid/changed source data
- Detection: how issues are surfaced (logs/metrics/tests) vs silently ignored
- Backfill/replay (if relevant): can you re-run deterministically without duplication?
- Sampled real source payloads/records and compared derived fields
- Verified units/timezones/encodings and identifier stability
- Confirmed null/empty/unknown semantics (don’t coerce silently)
- Added at least one guardrail: schema validation, invariant checks, or tests
- Logged/flagged anomalies with enough context to debug (no noisy spam)
If you can’t verify against the source (no access / no sample data), say so clearly and:
- add validation + logging to detect drift,
- add tests using representative fixtures,
- grade no higher than C.
- Prefer small, coherent commits.
- Keep branches tidy; delete stale branches.
- Keep required checks fast and merge-critical; rely on auto-merge when enabled.
- Before finalizing: run
bun x ultracite fix, thenbun x ultracite check.
- Do not ask the user about routine git nuance.
- Analyze impact first: inspect working tree, commit content, branch state, and CI/merge requirements.
- After analysis, choose the safest correct git action and execute it.
- Default to autonomous git handling (branching, rebasing/merging, pushing, PR updates, and enabling auto-merge) unless the action is destructive.
- Only interrupt for explicit destructive-risk operations or conflicting product intent that cannot be resolved from repo context.
Formatters and linters can’t ensure:
- business correctness,
- good naming,
- sound architecture,
- correct edge-case handling,
- good UX/accessibility,
- data correctness vs the real source.
Prioritize those over micro-style debates.
- Use
.memory/directory to store any temporary artifacts. - This directory is gitignored, so it will not be committed to the repository, but it is intentionally configured to be visible to codex.
- For preview-debug sessions against Vercel deployment protection, load
VERCEL_AUTOMATION_BYPASS_SECRETfrom a local gitignored file such as.memory/vercel-automation.env(or another local.envoutside git).
- Use
agent-browseror antigravity browser to browse the web, take screenshots, etc.. - d3k is a tool that can be used to run the dev server and see the ouput of console logs, server logs, etc.. in 1 unified view. you should always run the dev server and validate the app to reproduce issues and verify fixes.