The repo guide already prescribed the seven-rules format but did
not rule out the Conventional-Commits alternative, and recent
history has drifted into mixing both styles. Several existing
commits use a "fix(scope): ..." prefix that the project does not
consume for any tooling (no changelog generator, no semantic
release, no commit-lint), so the prefix only adds noise and hurts
log readability.
Add an alwaysApply Cursor rule that explicitly bans Conventional
Commits and restates the seven-rules format with concrete good and
bad examples. Update contrib/claude/commit.md with the same
prohibition so the documentation and the rule agree, and
cross-link both from the existing signing rule so an agent reading
git-commit-signing.mdc lands on the style rule too.
Signed-off-by: Émile Ré <emile@probo.com>
The contrib/claude/commit.md guideline already required signing,
but relying on local git config (format.signoff, commit.gpgsign)
silently produced unsigned commits on machines without that
config. Make the requirement explicit so agents always pass both
flags.
Signed-off-by: Émile Ré <emile@probo.com>
url.JoinPath does not percent-encode slashes or reserved characters in
its arguments, so user-supplied values (group IDs, slugs, team IDs) must
be wrapped with url.PathEscape to prevent path traversal. Update cursor
rule and contrib guide to codify this as a mandatory practice.
Signed-off-by: Émile Ré <emile@probo.com>
Remove dead 23505 checks on single-GID primary keys (oauth2_consent,
risk_assessment, risk_assessment_scenario, risk_assessment_scope).
Add missing constraints to membership_profile and
statement_of_applicability. Document composite-PK vs GID-PK rule in
cursor rules and contrib guide.
Signed-off-by: Émile Ré <emile@probo.com>
Track .cursor/rules/ in git so coding conventions are shared
across the team. Everything else under .cursor/ stays ignored.
Signed-off-by: Émile Ré <emile@probo.com>
