AGENTS.md

Before coding, read in order:

Rules:

Do not change the approved product scope, technology stack, database, or authentication approach without explicit approval.
Do not remove existing features to simplify implementation or use mocks to claim production functionality is complete.
Do not bypass authorization, resource policies, migrations, tests, audit requirements, or state-machine validation.
Do not log tokens, full mobile numbers, identity documents, detailed addresses, child records, or beneficiary service descriptions.
Do not expose sequential internal IDs; public resources use unpredictable public identifiers.
Every business status change must be auditable, and critical writes must be transactionally consistent.
Every schema change requires a migration; every API change must update shared contracts and API documentation.
Prefer adapters around external providers; business services must not directly depend on vendor SDKs.
Update docs/10_TASK_STATE.md after every task and preserve its history.
Update docs/11_DECISIONS.md for architecture or product decisions; do not overturn accepted decisions because another approach seems newer.
Run lint, typecheck, unit tests, integration tests, and build before marking work complete.