platform: Instructions file for Codex

AGENTS.md - Operating Manual For Autonomous AI Assistants

1. Authority

This file contains cross-cutting repository constraints. Task-specific procedures live in plugins/tuturuuu/skills/*/references/ and apps/docs.

Read the root and nearest applicable AGENTS.md. Load a focused skill only when its capability helps the current task; read linked references by topic rather than loading a stack of checklists before every edit. Repository rules supplement the user's request and higher-priority runtime instructions.

Use plugins/tuturuuu/skills/ for Tuturuuu-specific workflows. In particular: $tuturuuu-platform owns web/shared UI, $tuturuuu-database owns schema/RLS, $tuturuuu-agent-coordination owns shared-worktree safety, and $tuturuuu-pr-merge-sync owns authorized integration and production sync.

Continue authorized work through implementation, relevant verification, fixes, and scoped commit/push publication under the completion contract. Do not pause for review after a first draft unless review was requested or a concrete decision, permission, or access is missing. A skill does not authorize unrelated external actions or expand release scope. Define completion from the request: implementation and required checks, plus PR, merge, or production evidence only when that delivery is authorized.

For autonomous multi-lane execution, use the shared T3 contract and the portable program guidance. Relay these and current custody overrides in child briefs.

2. Hard Prohibitions

• Start long-lived development servers only when requested or needed for an explicitly requested runtime verification. Finite local setup and tests needed to validate the authorized change may run without repeated confirmation. Do not run builds on this machine; use CI builds for the exact commit instead. This does not authorize deployments or production database writes.
• Do not run bun sb:push or bun sb:linkpush from an agent checkout. The gated supabase-production.yaml workflow applies eligible migrations after authorized production sync, successful staging migration, and a successful production deployment marker. Verify its exact-SHA result separately; if it skips or fails, stop and report the blocker rather than pushing manually.
• Do not commit secrets, API keys, tokens, credentials, or raw sensitive values. Reference environment variables by name only.
• Do not manually edit package.json to add or update dependencies. Use the package manager command for the owning workspace.
• Gradually adopt Oxlint/Oxfmt through explicit owned-file paths with bun oxc:lint, bun oxc:format, and bun oxc:write. Retain Biome gates until each scope records rule/formatting parity and migrates CI, editors and generators together. Do not run global formatters or Vite+ monorepo migrators for scoped work. See adoption guidance.
• Plan cf CLI adoption over Wrangler per verified operation. Preserve existing commands/configuration until authentication, target identity, bindings/migrations, emitted artifacts and rollback parity are established; retain Wrangler for gaps. Do not run global configuration migration or infer production authorization from CLI adoption. See the adoption guidance linked above.
• For Cloudflare work that adds or amplifies billable operations, require bounded work/retries, idempotent progress, terminal-state scheduling and a tested durable stop fence. Verify operation-count and failure/restart regressions; ingress rate limits, billing alerts and per-invocation CPU caps are not total-spend caps. Record service-specific cost/stop evidence in the adoption guidance.
• Maintain first-party domain/service libraries independently of React frameworks. Inject request identity, storage, navigation and localization at framework adapters; keep portable entrypoints free of Next.js/React Router/Cloudflare runtime imports and request globals. Preserve public exports and enforce these boundaries with focused tests when extracting shared modules.
• Do not use native browser dialogs, emojis in UI code, hard-coded hue classes, client-side raw app API fetches, or useEffect for data fetching.
• Do not add export const dynamic / export const revalidate route segment configs. Every Next app runs with cacheComponents enabled, which rejects them at build time. Opt an authed page or Supabase-backed GET route handler into request-time rendering with await connection() instead (see $tuturuuu-platform → Cache Components).
• Do not resolve actors in a registered satellite app with @tuturuuu/utils/user-helper (getCurrentUser, getCurrentWorkspaceUser) — those read Supabase auth directly. Use getSatelliteAppSessionUser('<app>') and pass the id into an injectable helper (e.g. @tuturuuu/utils/workspace-user-link). bun check enforces this via the internal-app-auth guard.
• Do not add a catch-all page ([...slug]) under [locale]/[wsId] in a satellite that proxies /api/* to web. Next checks fallback rewrites only AFTER dynamic routes, so the catch-all swallows /api/v1/... as locale="api", wsId="v1" and breaks every proxied API call. Put non-migrated-route redirects in the app's proxy.ts middleware instead.
• Use native console.* for server runtime logs, preserving severity (console.error, console.warn, etc.). Do not add serverLogger runtime imports or automatic console log-drain installation.
• Do not modify, format, stage, commit, delete, rename, or clean up files you did not intentionally touch.
• Do not use destructive Git or filesystem commands unless the user clearly asks for that operation and the scope is explicit, except for the narrowly scoped post-merge worktree and local task-branch cleanup mandated below.