Agent workflow
Realm is an "AI coding agent friendly" project. Maintainers (humans) and coding agents follow the role split below.
Documentation split
Hard rules (agents must obey)
- Pages Router; do not switch to App Router
- Do not replace
server.js - Internal navigation uses
useTransition().navigateTo() - Do not infer language from IP / country
- Do not dynamically
requirelocale data - Do not reintroduce
reading-time - Do not attach
--font-displayto translated / user content coscliuses only temporary env-injected credentials- Protected MDX does not enter static products
- Preserve the reducer / effect race fixes in
useBlogPostState.ts/lib/blog-post-state.ts
Read the corresponding docs/GOTCHAS.md entry before changing related code.
Decision boundaries
Agents can do these directly:
- Edit
data/<topic>/<locale>.tscontent - Edit
locales/<locale>.jsoncopy - Edit
data/site.tsSEO / fonts / social - Add
tests/<area>/<name>.test.ts - Modify
components/...internals (without changing external interfaces) - Modify
scripts/...internals - Modify
docs/...content (without restructuring)
Agents must report first before:
- Adding / removing env vars
- Changing
package.jsondependencies / devDependencies - Changing
next.config.js/server.js/proxy.ts/i18n/config.ts - Changing
pages/[locale]/_app.tsx/_document.tsx - Changing
hooks/useBlogPostState.ts/lib/blog-post-state.ts(protected-post state machine) - Changing
scripts/assets-publish.mjs(involves coscli credentials and pointer flip) - Changing
data/site.tsfonts.googleStylesheet(requires re-fetch and upload)
Agents must never do these:
- Commit COS secrets, GitHub PATs, TOTP secrets, or access-grant secrets anywhere
- Remove the corresponding fixes for fragile conventions recorded in GOTCHAS.md
- Change the locale resolution order
- Bypass
enforceRateLimit()to expose revalidate / protected-verify as unlimited endpoints - Place protected post bodies in
_next/data/...JSON (even encrypted)
PR template
Every change PR must describe:
- Intent (one sentence)
- Impact (which files / routes / locales)
- Manual verification (dev side + desktop / mobile)
- Related issue (if any)
- CI pass proof (
pnpm checkoutput + four SSR paths returning 200) - Rollback steps (in case a post-release revert is needed)
CI gates
= pnpm lint + pnpm typecheck + pnpm test + pnpm build. All four must pass before merging.
Vercel deployment auto-runs SSG pre-rendering; any SSG error (missing getStaticPaths, locale mismatch, circular import) fails at the build step.
Design specs
Complex changes (multi-file / multi-day / multi-locale impact) must first produce docs/superpowers/specs/<date>-<topic>-design.md. A spec includes:
- Current state (reference current implementation plus existing docs)
- Goal (the user-visible or maintenance-visible problem being solved)
- Design (API shape, data flow, key decisions)
- Verification (dev side, prod side, rollback)
Agents may draft specs, but final sign-off is the maintainer's call.