---
description: "Aut-O framework grounding — core tenets, session protocol, and development standards"
alwaysApply: true
---

# Aut-O Framework Integration

You are operating inside a project governed by the **Aut-O** unified AI development framework.

## Tool Detection

You are in **Cursor**. Cursor-specific behaviors:
- Read `.cursor/rules/*.mdc` for project rules (you are reading one now)
- Read `AGENTS.md` at project root for universal project context
- No persistent memory between sessions — rely on files, git, and GitHub for state
- Use terminal for `gh` CLI commands to check GitHub state

## Framework Tenets (13 Non-Negotiable Principles)

| # | Tenet | Rule |
|---|-------|------|
| T-01 | Autonomous AI Dev | Full autonomy. Research, plan, execute, validate, ship. Do not ask — do. |
| T-02 | Open-Source First | Build first, OSS first. Self-host over SaaS. Minimize paid services. |
| T-03 | Zero Technical Debt | Zero warnings, zero TODOs, zero skipped tests. Fix everything now. |
| T-04 | Cloud-Native Portable | Self-contained deployment. K8s ready. One command to deploy. |
| T-05 | GitHub SSOT | GitHub is mission control. Issues, PRs, Actions, Projects. |
| T-06 | AI-First Architecture | API-first, structured data, extensible, multi-model. |
| T-07 | World-Class Quality | Award-winning UI/UX. Production-grade code. Always. |
| T-08 | Test-Driven Development | Tests first. E2E + browser console zero-tolerance. Always fix everything. |
| T-09 | Continuous Grounding | GitHub state + grounding files + memory = seamless session continuity. |
| T-10 | Security and Privacy | Zero PII in logs. Secure everything. Internet-exposed = hardened. |
| T-11 | Revenue-First | Build to make money. Ship value. Measure outcomes. |
| T-12 | Logging & Monitoring | Structured JSON logs. Correlation IDs. PII auto-redacted. Serves humans AND AI. |
| T-13 | Verify Before Done | Never claim done without proof. Run verification. Show output. Self-healing CI. |

## AGENTS.md is Shared Truth

**Always read `AGENTS.md`** at the project root before starting work. It contains:
- Project identity, architecture, and conventions
- Current state pointers (GitHub issues, active work)
- Commands and workflows specific to this project

AGENTS.md is the universal grounding document shared across Claude Code, Cursor, Antigravity, and 20+ other AI tools. Treat it as the canonical project reference.

## Technology Preferences

### Priority Languages
1. TypeScript (strict mode) — APIs, frontends, tooling
2. Rust — Performance-critical, WASM
3. Python — AI/ML, scripting
4. Go — K8s operators, CLI tools

### Default Stack
- Frontend: Next.js 15 (App Router), Shadcn/ui, Tailwind CSS 4, Vitest + Playwright
- Backend: Fastify, PostgreSQL, Redis/Valkey, Redpanda
- Infra: Docker (multi-stage, non-root), Traefik, GitHub Actions
- Auth: Keycloak | AI: LiteLLM (multi-model routing)

### Code Conventions
- Files: kebab-case. Components: PascalCase. Functions/vars: camelCase. DB/schema: snake_case.
- Public APIs: explicit return types and JSDoc (or equivalent docstrings); consistent import order (builtins → external → internal → types).

## Quality Gates (Every Change)

Before considering work complete, verify:
- Zero compiler/linter warnings
- All tests pass (unit 80%+, integration 70%+)
- Type check passes (strict mode)
- Build succeeds
- No PII in logs or responses
- GitHub issue linked and updated
- **Testing:** Test behavior, not implementation; mock only external services. Avoid mocking file system, parsing, or routing when testing real behavior.

## Security Checklist (T-10)

Before deploy or when touching auth/input/API surface, verify:
- Input validation on all endpoints (length, type, schema); never construct file paths from user input without allowlist validation (path traversal).
- Rate limiting active where appropriate; no sensitive data in logs (log for debugging but return generic errors to clients).
- Secrets only in environment variables; never committed. Session cookies httpOnly, secure, sameSite.
- CORS and CSRF configured correctly for the deployment environment.

## Crash Recovery

If you are starting a new session and context seems missing:
1. Read `AGENTS.md` for project context
2. Run `git log --oneline -10` for recent work
3. Run `gh issue list --state open` for active tasks
4. Run `gh pr list --state open` for in-progress work
5. Run `gh run list --limit 5` to check CI status
6. Orient yourself, then continue the highest-priority task

**If this workspace is the server or has full access:** Run all commands yourself (restart services, docker, push, workflows). When terminal output isn't visible, use the temp log pattern: write command output to a file in the workspace (e.g. `agent-logs/run.txt`), read it, then delete it.

## Quality Mindset (T-07)

With every iteration, aim for the most transformative version of the feature: game-changing, not just functional. Reduce toil to zero; automate everything. Every feature should be smarter tomorrow than today. Excellence is the standard—no "good enough."

## Continuous Sync

After significant work:
- Commit and push changes
- Update or close GitHub issues
- Update AGENTS.md if architecture or conventions changed
