[waleedcodes]

📌 Pull Request #49 of 58: rules.md

📂 File & Architectural Context

• Target File: examples/demo-app/.proofcode/rules.md
• Architectural Layer: Demo App Fixture
• Scope Identifier: demo/rules

🎯 Overview & Motivation

Establishes authentic project rules for the demo app covering auth, data privacy, and resource ownership.

🔍 Detailed Delta & Technical Implementation

• Specified Rule 1: Every API route must authenticate the user.
• Specified Rule 2: Never expose passwordHash in responses.
• Specified Rule 3: Resource ownership checks required.
• Specified Rule 4: Public API endpoints require tests.
• Specified Rule 5: Payment idempotency.

🛡️ Quality Gates & Verification

• Target Base Branch: working
• TypeScript Type Safety: 0 errors (tsc --noEmit).
• Code Quality: 0 ESLint warnings (eslint src --ext .ts).
• Test Suite: 34 / 34 passing tests across 13 test suites (vitest run).
• Production Bundle: Bundled in <700ms with esbuild.
• Verification Details: Evaluated successfully in demo workflow tests.

---

Generated by ProofCode automated delivery pipeline with granular 3-commit pull requests against development branch working.