# Freedom Outfitting (FO) - Development Governance v1.1 (9/10/26)
> **Priority:** The rules in this document are non-negotiable and override all other instructions or defaults.
> **LAST UPDATED:** Thursday September 10th, 2026 - 8:22am
> **Note:** Bare rules adapted from MPU governance. Host stack matches the shared cPanel/LiteSpeed account used by TOTR, MPU, and RTP (diag dump 2026-09-10).

## Document map
- [Scope](#scope-non-negotiable)
- [Language](#language-requirement-non-negotiable)
- [Server & stack](#server-environment--project-stack-non-negotiable)
- [Configuration & deploy](#configuration-files--server-pulls-non-negotiable)
- [Proceed gate](#proceed-gate-non-negotiable)
- [Git & commits](#github--commit-protocol-non-negotiable)
- [Code insertion](#code-insertion-protocol-section-blocks)
- [PHP, security, formatting](#php-coding-standards)
- [Delivery protocol](#assistant-delivery-protocol-non-negotiable)
- [Approval sequence](#approval-gate-rule-non-negotiable)
- [Recursive audit](#recursive-audit-protocol-non-negotiable)
- [Timestamps & misc rules](#last-updated-timestamp-rules-non-negotiable)
- [Headers, CSS, assets](#header--section-block-formatting-non-negotiable)
- [Maintenance & staff access](#maintenance-mode--staff-access-fo)
- [Closing rule](#most-importantly)

---

## Scope (Non-Negotiable)

- **FO site repo:** All work in the Freedom Outfitting repository follows this document.
- **Project brief:** See `DROPIN.md` for client goals, design direction, and page scope.
- **Not WordPress:** Hand-built site only. No WordPress, page builders, or stock theme kits unless Chuck explicitly changes this rule.
- **Store & management:** Public storefront plus staff/management tools are in scope (custom hand-built, not WooCommerce/WordPress).

---

## Language Requirement (Non-Negotiable)
- All assistant responses, code comments, internal reasoning, and any text generated during the session **must** be in English only.
- No other language may be used under any circumstances.
- This rule overrides all other preferences or defaults.
- **No em dashes** (`—`) in assistant chat, commits, PR text, comments, UI copy, or new file writing. Use commas, periods, colons, parentheses, or a regular hyphen (`-`) instead.

---

## Server Environment & Project Stack (Non-Negotiable)

Shared host with TOTR / MPU / RTP (cPanel account `roxythep` on `lax028.arandomserver.com`). Values from server diagnostics dated 2026-09-10 unless Chuck updates them.

- **Application:** Hand-built marketing site with **store** and **management** (admin) areas, plus contact/quote mailer as needed.
- **PHP Version:** 8.5.10 on live host (exact at diag time). Target PHP 8.3+ (procedural with selective OOP where appropriate).
- **Database:** MariaDB **10.11.19**. PDO only for application code; MySQLi must not be used in FO app code (extension may exist on the host).
- **Web Server:** LiteSpeed (Apache-compatible; `.htaccess` supported). Server API: `litespeed`.
- **Control Panel:** cPanel
- **OPcache:** Enabled (128 MB memory)
- **Limits (host defaults at diag time):** `memory_limit` 256M; `upload_max_filesize` / `post_max_size` 64M; `max_execution_time` 30s
- **Frontend:** HTML5, CSS3, vanilla JavaScript (ES6). **No inline** `<style>` blocks, `style=""` attributes, inline `<script>` bodies, or `onclick=""` handlers in templates.
- **Development Domain:** dev.freedomoutfitting.com (HTTPS)
- **Development Document Root:** `/home/roxythep/dev.freedomoutfitting.com/`
- **Production Domain:** freedomoutfitting.com / www.freedomoutfitting.com (HTTPS)
- **Production Document Root:** TBD (confirm with Chuck when the live folder is created; likely under `/home/roxythep/`)
- **Timezone (site):** `America/Phoenix` (matches host `date.timezone`)

---

## Configuration Files & Server Pulls (Non-Negotiable)

### Config files (when PHP bootstrap exists)
- **`includes/php/config.php`** — Tracked defaults shipped with git. **GitHub wins** on deploy for this file. Do not store secrets here.
- **`includes/php/config.local.php`** — Gitignored. **Secrets only** (database password, SMTP password, payment secrets, and only credential fields Chuck defines). Merged last so secrets always win.
- **`includes/php/config.local.php.example`** — Tracked template when needed.
- **Do not commit** `config.local.php`, `.env`, credentials, logs, or uploads.

### Server `git pull`
1. Pull on the target host from the tracked branch (see Git section).
2. Confirm `config.local.php` remains present on the server and is not staged for commit.
3. After pull, smoke-test HTTPS, contact/quote mail path, store browse path, and management login when those exist.

---

## Proceed Gate (Non-Negotiable)

Chuck (Webmaster) controls when implementation starts.

### Counts as **Proceed** (implement)
- `Proceed`, `Please proceed`, `Yes proceed`, and close variants with the same intent (`OK proceed`, `Go ahead and proceed`).

### Does **not** count as Proceed (plan / advise only)
- Questions, “advise,” “suggest,” “how should we,” “what do you think”
- `Before you proceed` / `before you proceed, …` (answer first; do not edit)
- `I'm ok with that if you want` / `feel free` without **Proceed**
- Task lists alone (`Let's do 1, 2, 3`) unless the same message also says **Proceed**

### Same message
- Question **and** **Proceed** in one message → answer briefly, then implement.
- **Before you proceed** plus questions → answer only.

### Scope of **Proceed**
When Chuck says **Proceed** for an agreed task, the assistant delivers **end-to-end**: implement, **commit**, and **push** (see Git section). Do not stop after writing files and wait for a separate “commit and push” unless Chuck opts out in that message.

Site **audits** may run at a pace Chuck sets; do not expand scope beyond the current audit slice unless he asks.

---

## GitHub & Commit Protocol (Non-Negotiable)

### Repository practices
- **Repository:** Private GitHub repository for Freedom Outfitting (create/connect when Chuck is ready).
- **Default branch:** Prefer `main` for production-aligned work when Chuck and the assistant work directly (typical: push to `main`, then `git pull` on host). Current local clone may still use `master` until renamed.
- **Pull requests:** Use feature branches and PRs when Chuck requests them or when policy requires review; otherwise do not open a PR by default.
- **Never commit** secrets, API keys, `config.local.php`, or server-only overrides.

### After **Proceed** — required git steps
1. Inspect `git status`, `git diff`, and recent commits.
2. Stage only files for the agreed task (no secrets, no unrelated local edits).
3. Commit using the **Commit Message Protocol** below.
4. Push to the tracked remote branch. If push would require force or messy conflict resolution, stop and ask Chuck.

If there is nothing to commit, say so; do not push empty work.

### Commit Message Protocol

All commit messages **must** follow this structure.

#### Rules
- **Type prefix:** Conventional scopes (`feat`, `fix`, `refactor`, `docs`, `style`, `config`).
- **Subject line:** Short, concise summary of primary change.
- **Body structure:** Detailed breakdown by category and file reference using top-level dash (`-`) and nested tab-indented asterisk (`*`) bullet points.
- **NO TIMESTAMPS:** NEVER include a `Timestamp :` line anywhere in the commit message.
- **Co-authored-by:** Include on assistant-authored commits (see template).
- The format **MUST** follow the "Required Commit Template & Example" below.

#### Required Commit Template & Example

````
feat(home): add dark hero and primary quote CTA

- Hero Layout (index.php / css/home.css):
	* Add full-bleed hero with Freedom brand mark and primary headline.
	* Wire Request a Quote button to the contact route.

- Contact Path (contact/index.php):
	* Keep quote form fields aligned with Andrew-approved labels.

Co-authored-by: {AI Name} <{AI Email Address}>
````

---

## Code Insertion Protocol (Section Blocks)

When providing insertable code, the assistant **must**:
1. Include the appropriate section header block (see [Header & Section Block Formatting](#header--section-block-formatting-non-negotiable)).
2. Specify the insertion point with exactly one of:
	- `Insert BEFORE: [existing section header]`
	- `Insert AFTER: [existing section header]`
	- `Replace the section starting with: [existing section header]`

Anchor by **section title text**, not line numbers.

---

## PHP Coding Standards

### Core PHP
- **Code blocks for delivery:** Plain triple backticks, **no** language tag. First line inside PHP blocks: `<?php` alone, no blank line before it.
- **Opening tags:** `<?php` only; short `<?` forbidden. In new/edited files, `<?php` must be line 1 when the file is PHP-first.
- **Timezone:** `America/Phoenix` (set globally in config when bootstrap exists).
- **Charset:** UTF-8 everywhere.
- **Error reporting:** Development — `E_ALL`, display on. Production — `E_ALL`, display off, log on.
- **`<?=`** only in HTML/template output, never for logic.

### Approved PHP 8.3+ features
`match`, named arguments, constructor property promotion, `str_contains()` / `str_starts_with()` / `str_ends_with()`, `array_is_list()`, `json_validate()`, typed properties, enums, `#[Override]`.

### Database (PDO)
- DSN with `charset=utf8mb4`; `PDO::ERRMODE_EXCEPTION`; default `PDO::FETCH_ASSOC`.
- Prepared statements with named placeholders (`:name`); emulated prepares off.
- Database and server may default to `latin1` or other collations; always override with `utf8mb4` in the DSN.

### Security
- Passwords (if ever used): `password_hash()` / `password_verify()` with `PASSWORD_DEFAULT`.
- Sessions (if ever used): httponly, secure, SameSite `Lax`.
- CSRF on all POST requests, verified server-side.
- Environment: bootstrap detects host when multi-env is set up; config fallback otherwise.

### Indentation and whitespace (Non-Negotiable)
- Structural indentation: **tabs only**.
- Align `=>` in arrays and `match` arms with tabs for readability.
- No trailing whitespace; no double blank lines; no blank line between a section header and the code that follows.

### Nested arrays (Non-Negotiable)
- Multi-line values: `=>` on its own line, value indented one tab deeper.
- Single-line scalar values: keep `=>` inline.

### Path building (Non-Negotiable)
- Never hardcode paths once helpers exist. Use `config('paths.*')` plus `root_path()`, `root_url()`, `nav_url()`, `asset_url()` when those helpers are in place.
- **Exception:** `bootstrap.php` is loaded with an absolute path and does not use `config('paths.*')` for its own load.

---

## Assistant Delivery Protocol (Non-Negotiable)

### Fence rules
- Plain triple backticks, no language identifier, drop-in ready content.
- Full replacements are 100% complete — no placeholders or “rest unchanged.”
- Vague “change line 47” instructions are forbidden.

### Formats
1. **Complete section replacement** — full block including section header.
2. **Search-and-replace** — file path, exact search block (character-for-character from source), exact replacement (tabs in replacement). Insertions use `Insert BEFORE/AFTER` with anchor block.
3. **Complete file replacement** — entire file under multi-file header.

**S&R order:** Top to bottom; first block for a file should update `LAST UPDATED`.

---

## Approval Gate Rule (Non-Negotiable)

For **all** code deliveries:

1. **ANALYZE** — Removals, additions, refactors, security, governance compliance.
2. **PRESENT INITIAL SUMMARY** — Bullets only; **no code blocks**.
3. **WAIT** — For `Proceed` or feedback.
4. **REVISED SUMMARY** (if needed) — Still no code blocks.
5. **WAIT** — For final **Proceed**.
6. **DELIVER CODE** — Write files in the workspace after **Proceed**.
7. **COMMIT AND PUSH** — Per [Git section](#github--commit-protocol-non-negotiable); do not wait for a separate push request.

Audits must follow the [Recursive Audit Protocol](#recursive-audit-protocol-non-negotiable).

---

## Recursive Audit Protocol (Non-Negotiable)

When Chuck requests an audit or review of file(s):

1. **Identify dependencies** — All `require` / `include` (and helpers like `root_path()`).
2. **Trace recursively** until the tree is mapped.
3. **Audit every file** in the tree, not just the entry file.
4. **Present holistically** — Findings and fixes in dependency order.

**Example:** Audit of `/index.php` that loads `bootstrap.php` → `config.php`, `helpers.php` must include all of those files.

---

## LAST UPDATED Timestamp Rules (Non-Negotiable)
- Every file change updates `LAST UPDATED`.
- Partial S&R: first block for that file updates `LAST UPDATED`.
- **Source of time:** The assistant resolves **current system time** in `America/Phoenix` at edit time. Do **not** ask Chuck for the clock unless he overrides for that session.
- **Format:** `Day Month 00th, 2026 - h:mm am` example: `Thursday September 10th, 2026 - 8:22am` (weekday, month name, ordinal day with st/nd/rd/th, comma, year, space-hyphen-space, time, lowercase am/pm, no leading zero on the hour).
- Never invent a time; always resolve it from the system clock in `America/Phoenix`.

---

## Question Acknowledgment Rule (Non-Negotiable)
- Answer **every** question in order.
- If clarification is needed, say which question and why — never skip silently.

---

## Code Fence Usage Rule (Non-Negotiable)
- No nested triple backticks inside delivered code fences. Use `'''` or write “triple backtick” with a note.

---

## Multi-File Delivery Format (Non-Negotiable)

```
# File 1 — /path/to/filename.ext (FO) — Updated file
[plain triple backticks code block — no language identifier]
```

- Dependency order; no prose between files.

---

## Cache-Buster Rules (Static Assets Only)
- **Yes:** CSS, JS, images, fonts via `asset_url()` when helpers exist — production `?v=filemtime`, development `?v=time()`.
- **No:** PHP pages, routes, navigation links — use `nav_url()` (dev cache-bust only in development).

---

## CSS Loader Pattern (PHP/HTML/TEXT Files)
- Page flags (e.g. `$HomeCSS = true`) in page PHP; governed loaders in `header.php` when that pattern is adopted.

---

## Header & Section Block Formatting (Non-Negotiable)
- **60 characters wide** in delivered files (full hash/asterisk run).
- **SITE: FO**, **FILE**, and **LAST UPDATED** required in file headers.

### PHP / HTML / TEXT
```
############################################################
# SITE: FO
# FILE: {path-from-project-root}
# LAST UPDATED: {current resolved system time in America/Phoenix}
############################################################

############################################################
# SECTION TITLE - Brief description
############################################################
```

Example LAST UPDATED value: `Thursday September 10th, 2026 - 8:22am`

### CSS / JS
```
/************************************************************
 * SITE: FO
 * FILE: {path-from-project-root}
 * LAST UPDATED: {current resolved system time in America/Phoenix}
 ************************************************************/
```

---

## CSS Declaration Consolidation (Non-Negotiable)
- Combine selectors that share identical declarations; keep separate if any property differs.

---

## Human Readable Output (Non-Negotiable)
- User-facing strings and logs: clear natural language; structured log context (actor, record, result), not raw JSON dumps unless requested.

---

## Maintenance Mode & Staff Access (FO)

> Optional until implemented. Pattern reserved from MPU bare rules; define FO-specific shortcuts with Chuck.

- Flag file: `includes/maintenance.flag` (via governed paths) when maintenance mode is added.
- Public visitors see a maintenance page (503) when the flag exists and they are not bypassed.
- Staff / management login and bypass shortcuts: define with Chuck when admin tools exist (do not copy MPU `?mpuadmin` / `?diags` names unless Chuck asks).

---

## Governed paths Array

Reference — authoritative list will live in `includes/php/config.php` once bootstrap exists. Starter expectation (tweak freely):

- `about/`, `admin/` (or `management/`), `builds/`, `contact/`, `css/`, `images/`, `includes/`, `js/`, `php/`, `phpmailer/` (if used), `shop/` (or `store/`)
- `root` is set dynamically in bootstrap from active environment.

---

## Most importantly
Never guess. If information is missing or unclear, ask Chuck or inspect the codebase — do not assume.