# Shinecode AI Engineering Rules

## Purpose
AI is an engineering accelerator. AI is not the architect by default. AI is not the security authority. AI is not the product owner.
AI-generated code must operate within the Shinecode system.

## Core Architectural Directives
1. **Directory Boundaries:** Always respect the separation between `/sc/shinecode_core/` (backend/Laravel) and `/sc/shinecode_frontend/` (Next.js/React). 
2. **Booking Engine:** Do not attempt to build the booking wizard as a client-side SPA or Next.js component. The booking wizard must be implemented directly in Laravel Blade templates without heavy JS compilation steps.
3. **Dispatch Model:** Do NOT build UI for customers to check provider availability. Customers pick any future time, and Laravel broadcasts the job to all providers.
4. **Endpoint Obfuscation:** Always implement a conversion from `405 Method Not Allowed` to `404 Not Found` for protected API and application routes.


## Before Coding
The AI must:
1. Inspect existing implementation.
2. Read relevant documentation.
3. Search for existing components/utilities.
4. Understand API contracts.
5. Identify affected domains.
6. Explain significant architectural changes.

## Never
The AI must never:
- Expose secrets
- Disable security controls
- Disable tests
- Disable linting
- Suppress TypeScript errors without justification
- Add `any` to hide a type problem
- Invent API contracts
- Bypass authorization
- Duplicate existing components unnecessarily
- Add dependencies without justification