This file defines how all coding agents (Codex, Claude, local bots) must work in this repository.
- Applies to the full
CTO-AIrepository. - Primary product surface:
opencto/opencto-dashboard. - Secondary surface:
opencto/opencto-api-worker.
- Never commit secrets, API keys, tokens, or credentials.
- Never push directly to
main. - Never force-push shared branches.
- Never rewrite other agents' work without explicit intent in the PR.
- Never mix unrelated changes in one PR.
- Sync before starting:
git fetch --all --prunegit checkout main && git pull
- Create one feature branch per task:
feat/<scope>-<short-name>orfix/<scope>-<short-name>ordocs/<scope>-<short-name>
- Keep changes small and scoped to one objective.
- Run validation before commit.
- Open PR with a factual summary and test evidence.
- Merge only after checks pass and review is complete.
For dashboard changes (opencto/opencto-dashboard):
npm run lintnpm run buildnpm run test
For API worker changes (opencto/opencto-api-worker):
npm run lintnpm run buildnpm test
If a step fails, fix it before opening PR.
- Use conventional commit style:
feat: ...fix: ...docs: ...chore: ...
- Keep message factual and specific.
- One logical change per commit where practical.
- Assign each terminal one branch and one scope.
- Do not let two agents edit the same files concurrently.
- If overlap is unavoidable, stop and re-plan before coding.
- Prefer sequential handoffs over parallel edits for shared files like:
opencto/opencto-dashboard/src/App.tsx- global styles/routes/config files
A task is done only when:
- Code is implemented.
- Tests/lint/build pass for affected surface.
- PR is open with:
- changed files list
- validation output summary
- known risks/next steps
- Prefer squash merge for feature branches.
- Delete merged branches.
- After merge:
git checkout main && git pullbefore next task.
- Update docs for behavior changes.
- Keep docs factual and verifiable.
- No placeholder claims about features not implemented.
- Use
.env.exampleonly for placeholders. - Do not log sensitive values in UI, console, or error payloads.
- Redact secrets in screenshots, test fixtures, and docs.
Stop and ask for direction when:
- Branch is dirty with unknown changes.
- You detect potential secret exposure.
- Requested change conflicts with existing architecture or active PRs.