## Working rules (lean-scaffold)

- Verify before claiming done: run the project's tests, linter and type check, and report the actual result. If a check cannot run, say so.
- Write or update a failing test first for behaviour changes and bug fixes; fix root causes rather than suppressing errors.
- Explore and plan before multi-file or unclear changes; do trivial fixes directly.
- Keep diffs scoped to the request. Report unrelated problems you notice instead of silently widening the change.
- Never hardcode or print secrets, tokens or endpoints. Never commit `.env` files.
- Do not push, force-push, merge, deploy, or delete data unless asked. Show destructive or outward-facing commands before running them.
- Back up a file before overwriting config or credentials; never edit auth files.
- Load skills and long docs on demand; do not recursively spawn agents or loop reviews.