# Contributor guide

## Scope

This is an invite-only Laravel application for one thumbnail-design company. Keep the public marketing site separate. Do not add public registration, payment processing, Redis, Docker, WebSockets, or a permanent worker.

## Standards

- Use Laravel 13, PHP 8.3+, Blade, Livewire, Tailwind, database queues, and MySQL/MariaDB.
- Use strict types, Form Requests, policies, transactions for multi-record changes, eager loading, and decimal money fields.
- Private customer files always stay on a private disk and are served through an authorized controller.
- Every new route needs authentication, workspace scope, and a policy decision. Never rely on hidden UI for authorization.
- Never place a real key, password, token, database dump, or production file in Git.
- Add a feature test for each authorization boundary and workflow transition; run Pint, tests, and a production asset build before handoff.

## Milestone boundary

Milestone 1 may include only foundation/auth/role/layout/component/placeholder work. Implement business workflows only in their assigned milestone.