Normal users should follow the user guide. Developers should start with the exact pinned toolchains and build/test commands in README, then architecture, testing and contributing.
Before reading a workspace file, run sonar analyze secrets <path> as required by AGENTS.md. Stop if a secret is reported. Original references, raw captures, credentials, local MCP settings, application data, dependencies, builds and test reports stay out of public Git. Use reviewed sanitized fixtures and disposable data; replay/test events must not run production actions or change ordinary financial totals by default.
Build frontend assets before building the host. The editor and overlay runtime are separate bundles. The host's public OpenAPI snapshot and generated TypeScript contracts must remain synchronized; regeneration instructions are in foundation API. New migrations and protocol/API compatibility behavior belong in their owning goal's documentation and tests.
Windows builds, ZIP/installer packaging and native package checks run in GitHub Actions. Backend tests emit OpenCover/TRX; frontend tests emit LCOV. SonarQube imports both coverage reports and enforces the new-code gate. Fork code never receives trusted secrets; do not bypass protected checks.
For a bounded task, invoke a stable goal from the implementation plan, check its actual prerequisites and record acceptance evidence. Compiling or passing mock tests does not establish live integration, audible output or Windows qualification. G10 qualification preserves the MVP history; 1.0.1 notes cover the cumulative G11–G24 delivery. The tray plan records exact current evidence and accepted limits.
The G13 utility guide lists migration, offline production-engine Rumble replay, event replay, owned sample generation, backup, shape-only log sanitization and aggregate diagnostic export. Run fixtures against disposable data and an explicit loopback HTTP host. The requirements matrix records all original numbered sections and their evidence limits.