Canonical pointer for AI coding agents working on this repo. If you're a human, you probably want README.md or CLAUDE.md.
- CLAUDE.md — project conventions, stack overview, request flow, where-to-look table. Treat as authoritative.
- docs/HARNESS.md — the steering meta-doc: when a class of issue recurs, which file do you edit to prevent it next time.
These are enforced mechanically. New violations fail npm run validate
or the .claude/hooks/stop.sh end-of-turn check.
| Invariant | Enforced by |
|---|---|
D1 access (.prepare / .exec / .batch) only in +server.ts or src/lib/server/db/ |
src/archtest/db-access.test.ts |
No process.env in src/** — Cloudflare Workers uses platform.env |
eslint no-restricted-globals + src/archtest/env.test.ts |
No console.log in src/lib/server/** — use console.error for real errors |
src/archtest/server-console.test.ts |
No @ts-ignore / @ts-nocheck |
eslint @typescript-eslint/ban-ts-comment |
No eval / new Function |
eslint no-eval / no-implied-eval |
| Commit subjects follow Conventional Commits | .github/workflows/conventional-commits.yml |
The full convention list lives in CLAUDE.md → "Conventions".
npm run lint # eslint, ~2s warm
npm run check # svelte-check, ~10s
npx vitest run # unit tests, ~1sOr the umbrella:
npm run validate # lint + check + test + build, ~30sInstall the git hooks once with npm run install:hooks and the
pre-commit (lint diff) + pre-push (full validate) run automatically.
The failure message names the violating file and the rule. Two options:
- You added a violation by accident — move the call into an allowed
path (e.g. DB access into
src/lib/server/db/or a+server.ts). - The allowed-paths list is genuinely too narrow — edit the
allowedPathsarray in the test, and explain in your commit message why the new path is justified. There is no baseline file; the test itself is the audit trail.
git push --forceagainstmain.git commit --amendon commits already pushed.git reset --harddiscarding uncommitted work.wrangler d1 execute --remote ...against production D1 (read-only is fine; writes are not).wrangler deploydirectly — CI deploys on push tomain.- Anything that modifies production OAuth secrets or rotates JWTs.
Everything else (Edit/Write/Read in repo, npm run *, wrangler ... --local, vitest) is safe to run without confirmation.
Project-specific skills live under .claude/skills/:
ship-pr— canonical post-edit flow: push →gh pr create→ wait for CI → review diff → triage (self-fix small / escalate decisions / merge directly when clean) →gh pr merge --squash→ local cleanup. Use this instead of callinggh pr create/gh pr mergedirectly. Do not use--auto— it skips the review gate. Do not ask for confirmation on a clean merge — the loop closes itself when nothing requires a decision.