<!--
NON-NORMATIVE DOCUMENT

This file is historical/legacy/audit material and may contain aspirational language.
The canonical, current claims & limits are in: docs/CLAIMS_AND_LIMITS.md
-->

# Vaultfire Developer Guidelines

## JavaScript and TypeScript Syntax Requirements
- Run `npm run lint:syntax` before opening a pull request. The command executes ESLint with JSX/TS parsing enabled and fails on
  any warning or error.
- Husky blocks commits if syntax violations are detected. Fix all reported issues locally before attempting to commit.
- CI expects to find the most recent syntax scan at `logs/eslint-syntax.json`. Do not delete the directory; it is automatically
  regenerated by the lint script.

## Auth Implementation Expectations
- Prefer wallet-first authentication flows. Only trigger the fallback path exposed by `auth/altIdentity.ts` when the wallet
  check fails for a partner and their configuration opts into an alternative strategy.
- Never overwrite on-chain authority. Fallback sessions are transient helpers that keep access scoped to the configured partner
  surface area.

## Documentation Hygiene
- Update `CHANGELOG.md` whenever auth flows or security posture changes touch partner-visible behaviour.
- Keep hardening reports (`HARDENING_FIXES.md`, `SECURITY.md`) in lockstep with the implemented code and deployment logs.
