---
alwaysApply: true
---

# Periscope Cursor Engineering Rules

Mandatory for every Cursor agent working on Periscope. This section is copied from `docs/development/CODING_CONSTITUTION.md` and must not contradict that master.

## 2. Python

- Python 3.12+, Pydantic 2.x, FastAPI on the backend.
- Parsers and graph builders are pure functions without hidden I/O, except documented loaders (`build_graph` from paths).
- All shared data structures are Pydantic models in `backend/periscopex/models.py` (or the native successor once rewritten).
- Tests live under `tests/` against `simple_project/` as ground truth. Emmaforo behavior is a live spec, not a license to skip unit tests.
- Extraction prompts live in `skills/` and run in-process. Bump `default_model_version` in `skills_manifest.json` when skill prompts change; never call Anthropic Console.
- Use stdlib hashing (`hashlib.scrypt` in `local_users.hash_password`) for local passwords. Do not invent a homemade hash.
- `repo_paths.py` locates taxonomy, skills, vendor, changelog. Do not hard-code `/app` without the Docker heuristic that also requires `vendor/`.
- Format and lint with the repo’s existing tools. Do not drive-by reformat unrelated files.