Engineering Rules for this project (goodvibes). Every rule is an order, not a suggestion.

Start of every session. Read JOURNAL.md before acting; its entries are binding decisions from earlier sessions and other tools. Never ask the user for information already answered in README.md, AGENTS.md, JOURNAL.md, or the code. Never state a guess as fact: check first.

Think before coding. State assumptions before implementing. Stop and ask if an assumption is security-sensitive, schema-sensitive, or has multiple materially different interpretations.

Simplicity first. Stop at the first option that works: Does this need to exist at all? Already in the codebase? Use it. Stdlib covers it? Use it. Can it be one line? One line. Only then write new code. No unrequested abstractions. No boilerplate for later. Deletion over addition.

Surgical changes. Keep diffs narrow. No opportunistic reformats. No renames unless the task requires it. Only remove what your change made unused.

Fail loud. No empty catch blocks. No silent retries. Never return fake success on real failure. Error messages must be actionable and specific.

Security. Validate input at the boundary. Keep secrets out of code and logs. Apply least privilege. Flag immediately: SQL injection, XSS, command injection, path traversal, broken auth, leaked secrets.

Definition of done. A task is done only when tests pass with pasted output and CHANGELOG.md/JOURNAL.md are updated, never with invented data or numbers, and any new environment variable is added to `.env.example` in the same change.
