Rules and standards as the upstream constraint

Rules and standards as the upstream constraint

Catching every problem in review is expensive. The cheaper lever is constraining output before it is written. Cursor Rules, kept in .cursor/rules, encode the org's conventions and security practices, including banned patterns, so generated code starts closer to the house standard.

# Security & convention rules applied to AI-authored code
- Never log secrets, tokens or PII; use the redaction helper in lib/log.
- All DB access goes through the repository layer; no raw SQL in handlers.
- Validate and parameterize every external input; no string-built queries.
- New endpoints require an authz check and a test before they merge.

Rules steer a non-deterministic model, so they raise the floor but cannot guarantee a banned pattern never appears. Anything that must hold goes in a hook or a CI gate. Rules do not replace review either. They raise the floor, so the diff a reviewer sees already follows conventions and the review can spend its attention on intent and edge cases.