Security Boundaries & System Rules

Live content of .antigravity-ai/architecture-boundaries-and-rejections.md (Rules 1-7)

Back to Architecture Directory File: .antigravity-ai/architecture-boundaries-and-rejections.md
Live Disk Read
                ---
title: Architectural Boundaries & Permanent Feature Rejections
date: 2026-09-01
category: System Policy & Legal Boundaries
tags:
  - policy
  - legal-boundary
  - rejections
  - liability-protection
  - education-only
---

# πŸ›‘ Architectural Boundaries & Permanent Feature Rejections

> [!CAUTION]
> **CRITICAL SYSTEM DIRECTIVE: ALL CASE MANAGEMENT, COURT DOCKET TRACKING, COURT DATE TRACKING, AND LEGAL PRACTICE ITEMS ARE STRICTLY REJECTED AND FORBIDDEN.**
>
> Fix Family Courts operates **EXCLUSIVELY AS AN EDUCATIONAL CONSULTING AND CONSTITUTIONAL ANALYSIS PLATFORM**. We are NOT attorneys and do NOT provide legal representation, legal advice, or legal practice management.

---

## 🚫 REJECTED & PROHIBITED FUNCTIONALITY

Under no circumstances should any AI agent, developer, or integration introduce, build, or port any of the following features into `ffc-rebuild-26` or related systems:

1. **❌ NO Court Date Tracking or Calendaring:**
   - Tracking hearings, trial dates, motion settings, or docket calls.
   - *Reason:* Imposes catastrophic legal malpractice liability if a date or time is missed, changed, or inaccurate.
2. **❌ NO Case Docket or Legal Matter Tracking:**
   - Storing or displaying cause numbers, court divisions, presiding judges, opposing attorneys, or procedural legal stages.
   - *Reason:* Creates the appearance or functionality of a law firm case management system, violating educational boundaries.
3. **❌ NO Pleadings Generation or Legal Filings Vault:**
   - Drafting motions, court pleadings, evidentiary affidavits, or legal briefs for filing with a court.
   - *Reason:* Potential unauthorized practice of law (UPL) liability.
4. **❌ NO Legal Deadline Reminders or Countdown Timers:**
   - Alerting users to statutory deadlines, discovery cutoffs, or responsive filing timeframes.
5. **❌ NO Generic / Ambiguous Database Migration Commands:**
   - **PERMANENT SYSTEM RULE:** All database migration, rollback, or seeding commands suggested to the user or executed by the agent MUST explicitly include the named connection flag:
     `--database=ffc_rebuild_26`
   - *Reason:* Eliminates any possibility of accidental cross-database modification between `ffc_rebuild_26` and `ffc_default_25`. Generic commands (e.g. bare `php artisan migrate:fresh`) are strictly prohibited from suggestion.
6. **❌ ZERO Access to Any Other Database Connections:**
   - **PERMANENT SYSTEM RULE:** The agent is authorized to interact with exactly TWO databases on your local DB server:
     - `ffc_rebuild_26` βž” **Full Read/Write/Migration Access** (Active rebuild project).
     - `ffc_default_25` βž” **Strict Read-Only Access** (Source of truth for legacy posts/authors).
   - The agent is **strictly prohibited from connecting to, querying, reading from, or writing to ANY OTHER database connection**, whether local, remote, test, staging, or production, even if configured in files.
   - *Reason:* Absolute data isolation and security.
7. **πŸ“‚ DEDICATED EDITOR GROUP FOR FFC-REBUILD-26 (Option A Isolation):**
   - **PERMANENT WORKFLOW RULE:** All `ffc-rebuild-26` files opened during collaborative work or via links must remain isolated in their own dedicated Editor Group (Group 2 / Right Split).
   - When the user opens files directly in personal workflow, they remain in their standard single group.
   - The user can cleanly close all rebuild editors at any time with a single shortcut (`Ctrl+K, Ctrl+W` or "Close All in Group") without disturbing their main editor tabs.
8. **πŸ”’ MEMBERS & PORTALS NAVIGATION, MEMBERSHIP BUCKET & ENTITLEMENT SEGREGATION:**
   - **PERMANENT DESIGN RULE (Guest Navigation):** When the user is NOT logged in, the "Portals" / "Members" menu item will **ONLY display a single link to a page describing Members Only access** (matching the live page at `/divorce-child-custody-membership` / Document ID 2127). No internal consoles (`/customer`, `/client`, `/editor`, `/admin`) or login-required portals may be exposed in the public dropdown.
   - **PERMANENT DESIGN RULE (Authenticated Navigation):** When the user IS logged in, they will **ONLY see access to the specific level/portal they are signed up for** (e.g., Customer Hub for digital product owners, Client Portal for consulting clients, or higher administrative consoles if authorized) **AND the Members Only description page**.
   - **CUSTOMERS VS. MEMBERS SEPARATION:** Customers who only purchase digital products (e.g., books, motion templates, masterclass recordings) are **NOT considered members** under the current system architecture. They hold product entitlement records (`customer_entitlements`), not membership status.
   - **MEMBERSHIP BUCKET & GRANULAR TRAINING ACCESS:** "Members Only" is currently a single bucket for **"Gold Members"**. However, training courses require granular access and must be purchased separately. All training is currently housed under the "Members Only" login, so the system must enforce discrete course-level access verification rather than granting universal training access automatically.
9. **πŸ›‘οΈ HARD PANEL ISOLATION: SUPER ADMIN (`/admin`) VS. BUSINESS MASTER (`/operations`):**
   - **PERMANENT SECURITY RULE (Principle of Least Privilege):** Technical developer administration and operational business management must **NEVER share a single Filament panel namespace**.
   - **Root Admin Panel (`/admin`):** Strictly restricted to **Technical Architect & Super Admin (Ron Palmer) ONLY**. All other rolesβ€”including Business Master (Sherry Palmer)β€”are hard-blocked at the HTTP gate with an immediate `403 Forbidden` error. This panel houses developer tools, raw database utilities, redirect management, server diagnostics, and code-level configuration.
   - **Operations Console (`/operations`):** Dedicated workspace for **Business Master & Operations Director (Sherry Palmer)**. Houses day-to-day business operations: educational consulting calendars, client narrative review notes, customer product entitlements, and upload quota authorizations. It is completely decoupled from technical server/database internals.
   - **Upward Inheritance Maintained:** The Technical Architect & Super Admin automatically inherits access to `/operations` (and all lower panels), ensuring Ron can inspect or manage operational records at will.
10. **πŸ–ΌοΈ STRICT READ-ONLY & ZERO DELETION/MODIFICATION RULE FOR IONOS SFTP MEDIA (`images.fixfamilycourts.com`):**
    - **PERMANENT INVARIANT RULE:** The SFTP connection to `home333798556.1and1-data.host` / `images.fixfamilycourts.com` is **STRICTLY READ-ONLY** for all existing files and directories.
    - **APPLICATION & CMS IMAGE MANAGEMENT ENFORCEMENT:** This rule strictly governs the architecture and code of **ANY Image Management System, Media Library, Filament Resource, or File Upload Tool** built into the application:
      - **No Delete Controls on Existing Media:** The UI must NOT include delete buttons, purge actions, or bulk-delete options for existing remote media assets.
      - **No In-Place Overwrites:** Existing media files are completely immutable. The application is strictly forbidden from overwriting, replacing, or renaming any existing image.
      - **Hardcoded Upload Path Scoping:** Any file upload tool or media form must be programmatically restricted to upload **ONLY** into the specific, dedicated directory created and designated by Ron. The application code will reject any upload targeting or escaping into legacy directories.
      - **Read-Only Media Browsing:** The Media Manager may index, browse, preview, and copy embed URLs for existing assets, but has zero destructive capabilities.
    - **ZERO DELETIONS:** Under NO circumstances will any agent, script, background worker, or automated tool delete, unlink, remove, or truncate ANY existing image or asset on this connection.
    - **ZERO ALTERATIONS / MODIFICATIONS:** Under NO circumstances will any existing image or media asset be altered, modified, replaced, or overwritten.
    - **DEDICATED WRITABLE DIRECTORY ONLY (HUMAN-CONTROLLED):** Any new uploads, additions, or modifications will ONLY ever be permitted within a specific, dedicated folder that Ron explicitly sets up and designates for that purpose. Until that designated directory is explicitly defined by Ron, the entire remote connection remains completely immutable and read-only.
    - **PERMANENT ROLLBACK GUARANTEE & PATH NON-INTERFERENCE:**
      - All currently used image paths, filenames, and folder structures on `images.fixfamilycourts.com` must remain permanently in place and intact to ensure the old site can be rolled back to at any time with zero broken images.
      - Any future transition of the Image Tool to write to the subdomain root must NEVER overwrite, collide with, displace, or interfere with any existing legacy file or path.
      - Legacy duplicate or unreferenced image cleanup is strictly prohibited until the new production site is fully stabilized and Ron explicitly issues separate written authorization.
    - **PRESERVATION OF REMOTE TOOLS:** Under NO circumstances may any `.php` or script file on `images.fixfamilycourts.com` be touched, altered, or deleted, safeguarding Ron's custom standalone image browser.

---

## βœ… APPROVED & PERMITTED FUNCTIONALITY (Education & Consulting Only)

All client-facing and product features must align strictly with First Amendment educational self-advocacy:

1. **πŸŽ“ Educational Consulting Sessions:**
   - Booking and scheduling 1-on-1 educational consulting appointments with Ron Palmer / Fix Family Courts staff.
   - Providing video conference meeting links (Zoom/Google Meet).
   - Recording educational notes, concepts discussed, and recommended study reading/videos.
2. **πŸ“ Client Review Questions & Background Notes:**
   - Allowing clients to provide written background narratives and questions strictly for the consultant to review prior to an educational discussion.
   - Must carry an explicit disclaimer: *"Uploaded for educational discussion only; does not constitute a court filing or legal representation."*
3. **πŸ›‘οΈ Mandatory "Not An Attorney" Compliance System:**
   - Mandatory initial checkbox on contact/intake forms.
   - Time-limited cryptographic email double-validation link (48-hour expiration).
   - Immutable database audit trail (`legal_compliance_logs`) capturing IP address, user-agent, full email body snapshot, and invoice verification.
4. **πŸ“š Digital Self-Study Products & Publications:**
   - Books, video training courses, masterclasses, webinars, and educational articles.