Cheldrop — standing rules for Claude Code

• Before modifying ANY existing functionality, read docs/cheldrop-functional-spec.md, especially "What must not break". The roadmap is docs/cheldrop-build-plan.md — implement exactly one plan section per session, never more, never features not in the plan.
• Never rename the window.pubit IPC bridge. Never change the resource naming derivation chel-{subdomain}-{domain-with-dashes}. Never change the Workers asset hash formula SHA-256(base64(content) + extension) truncated to 32 hex chars (Phase 3.5 replaced the Pages one). getDb() stays a dynamic ESM import. The MCP contract is pasted into users' claude_desktop_config.json, so 127.0.0.1:3847/mcp and the x-cheldrop-mcp-secret header name do not change; MCP tools call ipc.js's exported functions and never reimplement a flow.
• The MCP surface is a standing context cost in every conversation a user has, so it stays small on purpose: a new capability is a parameter on an existing verb, not a new tool, unless its guardrails genuinely differ. Teaching belongs in the SKILL (loaded on demand); tool descriptions carry only what is needed to call correctly. Results are compact JSON with false/null keys dropped, and anything returned per-site multiplies by the user's site count — put it behind detail unless every caller needs it.
• Build only from ~/Developer/Cheldrop/app (never via the Dropbox symlink or any cloud-synced path — cloud xattrs break codesign). Build with npm run build:mac; after any main-process change, run npm run verify:mac and require all checks green.
• Decisions in force (2 Aug 2026): password protection is R2-only (client-side guard is being removed in plan Phase 3); live sync is available on the free tier's single site; the managed folder root is ~/Documents/Cheldrops/; cheldrop.yaml and cheldrop.css conventions are defined in the build plan's architecture section, and secrets never go in cheldrop.yaml.
• Commit after each verified feature with a descriptive message. If a change would violate the spec or the plan, stop and say so instead of coding around it.