# AGENTS.md

Before coding, read in order:

1. `docs/00_README_FIRST.md`
2. `docs/01_PROJECT_CONSTITUTION.md`
3. `docs/10_TASK_STATE.md`
4. `docs/11_DECISIONS.md`
5. Task-related documents in `docs/`

Rules:

- Do not change the approved product scope, technology stack, database, or authentication approach without explicit approval.
- Do not remove existing features to simplify implementation or use mocks to claim production functionality is complete.
- Do not bypass authorization, resource policies, migrations, tests, audit requirements, or state-machine validation.
- Do not log tokens, full mobile numbers, identity documents, detailed addresses, child records, or beneficiary service descriptions.
- Do not expose sequential internal IDs; public resources use unpredictable public identifiers.
- Every business status change must be auditable, and critical writes must be transactionally consistent.
- Every schema change requires a migration; every API change must update shared contracts and API documentation.
- Prefer adapters around external providers; business services must not directly depend on vendor SDKs.
- Update `docs/10_TASK_STATE.md` after every task and preserve its history.
- Update `docs/11_DECISIONS.md` for architecture or product decisions; do not overturn accepted decisions because another approach seems newer.
- Run lint, typecheck, unit tests, integration tests, and build before marking work complete.