# Project-Level Rules

> Project-specific specialisation and corrections. Loaded after `org.md` and
> `team.md` as strict-additive guidance; contradictions with broader policy
> are rejected. Populated by practices-discovery and the self-learning loop.
>
> Use sparingly: most teams don't need a project layer. Reach for it
> only when this specific project needs stable, durable guidance beyond the
> team practice (for example, package-specific release checks or an additional
> regression suite for a legacy component).

## Way of Working

<!-- Project-specific specialisation. Example: -->
<!-- This monorepo requires package-scoped branch names and a package owner -->
<!-- review in addition to the team's normal merge policy. -->

## Walking Skeleton

<!-- Project-specific specialisation. Example: -->
<!-- The walking skeleton must exercise the legacy service adapter as well -->
<!-- as the new service boundary. -->

## Testing Posture

<!-- Project-specific specialisation. -->

## Change Control

<!-- Project-specific. Mode: strict or relaxed. Strict here holds for every intent and cannot be changed from chat. -->

## Deployment

<!-- Project-specific specialisation. -->

## Code Style

<!-- Project-specific specialisation. -->

## Tech Stack

<!-- Technology choices locked for this project. -->

## Decided

<!-- Decisions made in earlier stages that should not be re-asked. -->
<!-- Format: DECIDED: [decision] (Stage [slug], [date]) -->

## Scope Overrides

<!-- Custom scope rules for this project. -->

## Forbidden

<!-- Populated by practices-discovery affirmation gate. -->
<!-- Format: NEVER [behavior] (affirmed [date]) -->
<!-- Example: NEVER throw exceptions across service layer boundaries (affirmed 2026-05-17) -->

- NEVER reference content, fonts, or assets by remote URL; everything ships (affirmed 2026-09-13)

with the page. (affirmed 2026-09-13)

## Mandated

<!-- Populated by practices-discovery affirmation gate. -->
<!-- Format: ALWAYS [behavior] (affirmed [date]) -->
<!-- Example: ALWAYS use Result<T,E> for fallible operations in service layer (affirmed 2026-05-17) -->

- ALWAYS generate pure HTML5 + CSS with no build step and no external (affirmed 2026-09-13)

dependencies, so the result runs entirely from the local filesystem (affirmed 2026-09-13)

(never beyond localhost). (affirmed 2026-09-13)

- ALWAYS make the rendered page printable cleanly to A4 from the browser's (affirmed 2026-09-13)

print dialog. (affirmed 2026-09-13)

- ALWAYS fetch or read content only through user-granted means (native file (affirmed 2026-09-13)

picker / drag-and-drop) when the page runs from `file://` — never rely on (affirmed 2026-09-13)

`fetch()` of sibling local files, because the opaque-origin policy blocks it (affirmed 2026-09-13)

in stock browsers (empirically verified: plain Chromium blocks (affirmed 2026-09-13)

`fetch('article.txt')` from a `file://` page, while the native file picker (affirmed 2026-09-13)

works). (affirmed 2026-09-13)

- ALWAYS make the page work with zero network requests (no CDN fonts, no (affirmed 2026-09-13)

remote `<script>`/`<style>`), so it is fully functional offline from `file://`. (affirmed 2026-09-13)

## Corrections

<!-- Project-specific corrections from human feedback. -->
<!-- Format: NEVER/ALWAYS [behavior] (learned [date]) -->