Agent Guardrails

These rules are for AI agents working on Tauri 2 apps.

Source Priority

Rank	Source	Rule
1	Existing project files	Preserve actual config, package manager, commands, and platform targets
2	Official Tauri v2 docs	Use for capabilities, plugins, sidecars, updater, mobile, tests, and distribution
3	Tauri Rust API docs	Use for Rust signatures and command/state/plugin APIs
4	Microsoft WebView2 docs	Use for Windows runtime distribution decisions
5	Local case studies	Treat as examples, not defaults
6	Model memory and snippets	Reject unless verified against current Tauri 2 docs

Hard Stops

Do not clone repos, install packages, run third-party builds, run setup scripts, or mutate _repos/ unless the user approves it.
Do not copy broad Jan-style capabilities, asset wildcards, HTTP wildcards, shell permissions, or updater settings into a starter.
Do not claim mobile support from desktop success.
Do not claim release readiness from tauri dev.
Do not commit updater private keys, certificates, .pfx files, passwords, Apple credentials, store credentials, or signing secrets.
Do not enable sidecars without documenting binary provenance, target triples, permissions, arguments, ports, logs, cleanup, and release packaging.
Do not use Tauri 1 allowlist guidance in a Tauri 2 app.
Do not claim Windows release readiness without a WebView2 plan.

First Questions For A Tauri Task

Is this desktop-first, mobile-first, or both?
Which OS targets are in scope for this change?
Which native authority does the frontend need?
Which command, plugin, or sidecar owns that authority?
Which capability file grants it?
Which tests and release smoke prove it?

If the answer requires product judgment, ask one short question before editing.

Release Claim Discipline

Evidence	Allowed claim
Frontend tests pass	Renderer tests passed
Rust tests pass	Backend tests passed
`tauri dev` runs	Dev shell runs
Release artifact built	Artifact produced for this OS
Artifact installed and launched	Release smoke passed for this OS
Signed artifact verified	Signing proof exists
Updater install tested	Updater proof exists
Android/iOS build and device smoke passed	Mobile smoke passed for that platform

AI-Native Sidecar Rules

For model servers, MCP servers, Python tools, Go daemons, or CLIs:

Prefer a fixed command and fixed argument list.
Bind local APIs to loopback only unless the product explicitly needs LAN exposure.
Generate per-install tokens when a local API needs authentication.
Keep user prompts, tool inputs, files, and tokens out of process args when possible.
Capture stdout/stderr safely and redact secrets.
Shut down child processes on app exit and test cleanup.
Treat any sidecar update as a supply-chain and signing event.

Warning: Broad shell permission plus untrusted webview input is the easiest way to turn a desktop convenience feature into command execution. Do not ship that boundary casually.