feat: Add path scoping to rules and enforce project init workflow

- Add paths frontmatter to frontend, backend, and security rules so
  they only load when editing relevant files
- Add mandatory new-project detection to general rules that redirects
  to /requirements before any implementation
- Add write-then-verify protocol for feature tracking updates to
  prevent hallucinated file edits

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.claude/rules/backend.md

@@ -1,3 +1,10 @@
+---
+paths:
+  - "src/app/api/**"
+  - "src/lib/supabase*"
+  - "supabase/**"
+---
+
 # Backend Development Rules
 
 ## Database (Supabase)

.claude/rules/frontend.md

@@ -1,3 +1,11 @@
+---
+paths:
+  - "src/components/**"
+  - "src/app/**/page.tsx"
+  - "src/app/**/layout.tsx"
+  - "src/hooks/**"
+---
+
 # Frontend Development Rules
 
 ## shadcn/ui First (MANDATORY)

.claude/rules/general.md

@@ -1,5 +1,19 @@
 # General Project Rules
 
+## New Project Detection (MANDATORY)
+Before starting ANY work, check if the project has been initialized:
+1. Read `docs/PRD.md` - if it still contains placeholder text like "_Describe what you are building_", the project is NOT initialized
+2. Read `features/INDEX.md` - if the features table is empty, no features have been defined
+
+**If the project is not initialized:**
+- Do NOT write any code or create any components
+- Do NOT skip ahead to implementation
+- Instead, tell the user: "This project hasn't been set up yet. Let's start by defining what you want to build. Run `/requirements` with a description of your idea (e.g. `/requirements I want to build a task management app`)."
+- If the user already described their idea in the current message, run `/requirements` automatically with their description
+
+**If the project is initialized but the user requests a feature not yet in INDEX.md:**
+- Guide them to run `/requirements` first to create the feature spec before any implementation
+
 ## Feature Tracking
 - All features are tracked in `features/INDEX.md` - read it before starting any work
 - Feature specs live in `features/PROJ-X-feature-name.md`
@@ -19,11 +33,28 @@
 - Present options using clear choices rather than open-ended questions
 - Never proceed to the next workflow phase without user confirmation
 
-## Status Updates
+## Status Updates (MANDATORY - Write-Then-Verify)
-- Update `features/INDEX.md` when feature status changes
+After completing work on any feature, you MUST update tracking files. Follow this exact sequence:
-- Update the feature spec header status field
+
+1. **Read** the feature spec (`features/PROJ-X-*.md`) and `features/INDEX.md` BEFORE editing
+2. **Write** your changes using the Edit tool — do NOT just describe what you would write
+3. **Re-read** the file AFTER editing to verify the changes are actually present
+4. **If changes are missing**, repeat step 2 — never claim updates were made without verifying
+
+**What to update in the feature spec:**
+- Status field in the header (Planned → In Progress → In Review → Deployed)
+- Implementation notes: what was built, what changed, any deviations from the original spec
+- Bug fixes or design changes discovered during implementation
+
+**What to update in `features/INDEX.md`:**
+- Feature status column must match the feature spec header
 - Valid statuses: Planned, In Progress, In Review, Deployed
 
+**NEVER do this:**
+- Do NOT say "I've updated the feature spec" without actually calling the Edit tool
+- Do NOT summarize changes in chat as a substitute for writing them to the file
+- Do NOT skip updates because "it's obvious" or "minor"
+
 ## File Handling
 - ALWAYS read a file before modifying it - never assume contents from memory
 - After context compaction, re-read files before continuing work

.claude/rules/security.md

@@ -1,3 +1,11 @@
+---
+paths:
+  - "src/app/api/**"
+  - ".env*"
+  - "supabase/**"
+  - "next.config.*"
+---
+
 # Security Rules
 
 ## Secrets Management