Project Context for AI Agents

Local-first by default. No user data leaves the device without explicit, per-action opt-in.

E2EE: all user entities encrypted at rest; server only ever sees ciphertext (zero-knowledge).

All user content is wrapped in a Private<T> newtype whose Debug/Display redacts — so plaintext is structurally unloggable. Key material uses zeroize and is never Debug.

NEVER log, telemeter, panic-message, or commit: keys, passphrases, or decrypted user content. No plaintext user data in test fixtures.

Ban third-party telemetry/crash-reporting SDKs. Anything leaving the device requires explicit allowlist review.

Errors reference IDs, never user values.

No plaintext user-derived data (signals, indexes, caches) persisted outside the encrypted store; plaintext exists in memory only while unlocked.

Decrypted data lives in memory only while unlocked. Lock-on-background is mandatory and non-configurable; idle-timeout is configurable (conservative default). Keys zeroize on lock; re-derive from passphrase on unlock.

Recovery codes are shown once, never persisted in plaintext. Onboarding states honestly: lose the key, lose the data.

Optional cloud (post-MVP): the previewed payload IS the serialized bytes sent (one code path; a test asserts preview_input == send_input). HARD-DISABLED for work-tagged items. UI states it is not E2EE.

Debug/benchmark builds never contain real user data and never weaken encryption — incl. the Xiaomi adb inference benchmark (synthetic data only).

Organizer — move-or-sacrifice: no code path mutates/deletes a protected block except a guarded API that writes a SacrificeLog entry. Sync conflicts on protected blocks require user resolution — never auto-drop.

Friction asymmetry: protecting time is one tap; overriding/sacrificing requires a deliberate, logged confirm. Drift surfaces via the Guide’s reflective tone — never an alert/badge/nag. No productivity gamification (no streaks/scores on work).

Nutrition — always a band: energy/macros are the typed Estimate { low, high, confidence }; UI components accept Estimate, not f64; aggregation sums bands (low+low, high+high); never collapse to a point in UI. (Exact counts stay scalars.)

Nutrition — no mandatory goal: no-goal is a complete default state; nothing in the UI implies a goal is missing; goal code paths gated off by default; no red/green "over budget".

Variable fidelity, no penalty: fidelity is metadata only, never styled as deficient; no completeness/streak score penalizes low fidelity. The lowest-fidelity entry (L0) is the fastest path (one action); nutrition capture never blocks on clarification.

Guide reflects, never scolds: triggers fire on patterns, never single events — each GuideTrigger declares a window (≥2 events or a duration); a unit test asserts no single-event window. A banned-tone test scans copy (over budget, failed, should, lazy, cheat, red/green). Entry shape: Truth · Turn · Do · Footnote; Do is one schedulable action.

Publish membrane is a code boundary: outbound data is a sanitized DTO; the internal Item + raw fields (dump, energy, clarifications, roll-over counts) are Private<T> and never serialized to any external sink. Only edited description + minutes + project may cross.

Substrate is built ONCE (store, crypto, keys, sync, inference, calendar, Guide) and reused by every app face. Don’t reimplement per app.

Dependency direction is ONE-WAY: apps → {ui, domain-core, substrate}. A test parses cargo metadata and FAILS the build if substrate/domain-core/ui depend on an app crate.

A meal IS a DailyBlock/ScheduledBlock — one calendar-block entity, not a parallel timeline.

Inference, calendar providers, and storage backends sit behind traits in substrate; concrete backends never leak above that boundary.

Each crate documents its public API as if it will be published (it may be extracted into its own repo).

Workspace-level deny(clippy::unwrap_used, clippy::expect_used); allowed only in cfg(test) and build scripts. Fallible ops return typed Results; "unavailable" states (model, calendar, network) are normal and UI-handled.

Frontend (Leptos/WASM) does no blocking IO/inference — it calls async Tauri commands into the Rust core; frontend crates compile to wasm32.

Tauri v2 only; declare capabilities/permissions explicitly.

Derived signals (domain shares, drift, meal patterns, calibration) are computed locally; never assume a server computes anything.

Cargo.lock is committed (workspace ships binaries).

CRDT document schemas are versioned from day one; migrations are forward-only and fixture-tested before any entity field change.