Rules
Rules are the reference material the agent reads while it works: the facts it must not get wrong, and the limits it must not cross.
They are written into the project as plain files - .agents/rules/, or .codex/
if that is what the agent reads - next to the skills, and the skills
point back at them. Whenever the agent needs to know something about Nuvei - what a
method is called, where a secret is allowed to live, which payment methods need a
billing address - it reads the answer instead of guessing.
The general rules
Installed on every project.
| File | What it says |
|---|---|
freeform-app-design.md | The app can be anything - any subject, any screens. Nuvei is not the app; it is a payment step the app hands off to. |
the-seam.md | The one place the app's own screens and the generated payment code meet. That is the only part of the payment code the app is meant to call. |
server-side-secrets.md | The merchant secret key belongs to the backend. Opening a payment order, and anything else that needs the secret, happens there and only there. |
credentials-handling.md | Account details live in the computer's keychain. Never in the chat, never in a tool, never in a file. |
public-api-only.md | The app uses Nuvei's SDK exactly as any outside merchant would - only what is published, no shortcuts through internals. |
billing-address.md | Which payment methods need a billing address, and how it gets to the SDK. |
host-platform-support.md | iOS apps can only be built on a Mac. This is raised early, at the platform question, not hours later when the build fails. |
hooks.md | What the optional safety net blocks, and how to install it. |
The backend rule
| File | What it says |
|---|---|
server-side-openorder.md | Opening a payment order and signing it is the backend's job, and the signature has to be built in an exact order from an exact set of values. |
The platform rules
| File | Platform | What it says |
|---|---|---|
api-reference.md | Android, iOS | Nuvei's published SDK reference. Every call the agent writes has to match what is actually in the SDK. |
gradle-build.md | Android | How to build the app reliably, including a Windows-specific retry. |
resource-naming.md | Android | Don't let the app's own names collide with the SDK's. |
xcode-build.md | iOS | How the Xcode project is generated and built for the simulator. |
📄 The skills are the procedures that point at these rules.