# Advera: notes for AI coding agents

- Critical rules (approvals, publishing, entitlements, status transitions) live in SQL functions in `supabase/migrations`. Change them there and add a test in `tests/db`.
- Browser reads go through `asUser` (RLS); mutations go through `app.*` functions via `asService` after `requirePermission`.
- Never send provider tokens, service-role keys or `CREDENTIAL_ENCRYPTION_KEYS` to the browser or logs.
- Never publish without a valid approval of the current version; never raise budgets automatically.
- Run `npm test`, `npm run test:db`, `npx tsc --noEmit` and `npx eslint .` before committing.