berntpopp

Use when adding or changing an external HTTP provider call in SysNDD (gnomAD, Ensembl, UniProt, AlphaFold, MGI, RGD, PubMed, PubTator, MONDO, JAX/HPO) or touching external-call timeouts, retries, caching, or per-request time budgets

Use when wiring a SysNDD Vue 3 view or component to the backend API, adding a typed API client, handling API errors, or binding backend data into BootstrapVueNext tables and tooltips — especially around Plumber response shapes and BVN table/tooltip quirks

Use when adding or changing a SysNDD DB migration, editing a SQL view (especially ndd_entity_view or the core read views), touching the migration runner or manifest, restoring a database, or diagnosing a startup failure related to migrations

Use when reviewing or writing SysNDD code for security vulnerabilities or correctness bugs — authorization/role gates, SQL/expression injection, credential and secret handling, data exposure through public or MCP surfaces, resource-exhaustion/DoS from external calls, error/info leakage, and the repo's known R/Plumber footguns — especially before merging a diff or PR

Use when changing gene clustering (STRING/Leiden functional axis or phenotype MCA/HCPC), the analysis snapshot builder or validator, the memoised clustering cache, cache coherence, or LLM cluster summaries — or deploying a clustering change so public endpoints and summaries reflect it

Use when writing, running, or fixing SysNDD R/Plumber API tests (testthat) — including database-writing tests, running a single test inside the API container, mocking external providers, or diagnosing SKIP-vs-PASS, helper-loading, or path-resolution issues

Use when adding or changing durable async jobs, worker-executed code, job handlers, queue lanes or priorities in SysNDD — or diagnosing why a submitted job never runs, stays queued, or fails with "No durable async job handler registered"

Use when changing the SysNDD read-only MCP sidecar, its tools, repositories, resources, capabilities, schema version, or anything the MCP layer reads or exposes — especially when a product requirement would have MCP write, generate, fetch externally, or surface non-public data

Use when `make ci-local` fails locally or a GitHub Actions run reports a CI failure (format, lint, line-budget, typecheck, or test errors).

Use when reviewing a diff, PR, or change set for correctness and quality before merge or handoff. For a deep security-only pass, use security-review instead.

Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue.

Use when preparing to tag, publish, or deploy a genefoundry-router build.

Use when reviewing genefoundry-router security before deploy, when touching auth/proxy/logging/limits config, or when answering an infosec/DSB question.

Use when changing the router's authentication or authorization — JWT/OAuth modes, verifiers, resource/audience metadata, the secure-by-default bind guard, or the no-token-passthrough boundary.

Use when adding, removing, enabling/disabling, or reconfiguring a backend in the router's servers.yaml registry (URLs, namespaces, entrypoints, server_name/transform overrides).

Use when handling Dependabot PRs, CodeQL/Trivy alerts, or doing a routine dependency/CVE sweep for this repo.

Use when changing filtering, sorting, searching, column definitions, column metadata, or filter-related UI on the VarLens single-case variant view — or the cohort view — before deciding scope, writing the plan/spec, or opening the PR. Symptoms of about to violate: editing useFilterState.ts / FilterToolbar.vue / VariantTable.vue / variant-table/columns.ts and thinking "I'll add the cohort side later", "cohort is out of scope for this PR", or "the cohort view can catch up separately".

Use when a VarLens test or app run fails to load the native SQLite module — errors like NODE_MODULE_VERSION mismatch, "compiled against a different Node.js version", ERR_MODULE_NOT_FOUND on out/main/db-worker.js, or "was compiled against a different Node.js ABI" — or BEFORE running vitest, the Electron app, or packaging, to rebuild the module for the correct ABI first.

Use when reviewing a VarLens change for security issues or bugs before commit/PR/merge — auditing IPC, Electron window/fuses, database-key, external-URL, or import code — or running a pre-merge scan. Symptoms: adding an IPC channel that takes untrusted input, changing webPreferences/fuses, handling SQLcipher keys, calling shell.openExternal, adding a dependency, or hunting a suspected bug in a diff.

Use when about to claim a VarLens change is done, working, fixed, or ready to commit/PR — to pick and run the right make target for what you changed and report its actual output. Symptoms of about to skip this: "the diff looks clean", "types should pass", "this is a trivial change", "I'll let CI catch it", or claiming a UI change works without opening the app.

Use when adding, renaming, or changing an IPC channel between the VarLens renderer and main process — exposing new data or actions on window.api, wiring a new domain, or touching preload/contract/handler code. Symptoms include "how do I call main from the renderer", editing src/preload or src/main/ipc, a failing tests/shared/types/preload-contract.test.ts, or a renderer call that returns a SerializableError instead of data.

Use when building or changing VarLens renderer UI — Vue 3 + Vuetify 4 components, dialogs, side panels, data tables, colors, backgrounds, hover states, or theme work. Symptoms of about to get it wrong: reaching for surface-variant or a hardcoded hex for a background, a v-data-table-server whose row expansion silently does nothing, adding console.log in a component, or styling that looks fine in light theme but breaks in dark.

Use when extending or debugging VarLens VCF import — mapping a new INFO field to a DB column, changing annotation parsing (VEP CSQ or SnpEff ANN), touching multi-allelic splitting, genotype/sample handling, SV/CNV/STR extension fields, or anything under src/main/import/vcf/. Also use before assuming which column holds the impact level vs the Sequence Ontology term.

Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue.

Use when preparing to tag, publish, or promote a mgi-link build.

Use when reviewing this backend for security before deploy, when touching auth/logging/upstream-fetch/container config, or when answering an infosec/DSB question.

Use when handling Dependabot PRs, CodeQL/Trivy alerts, or doing a routine dependency/CVE sweep for this repo.

Use when adding, renaming, or modifying this backend's FastAPI routes, dependencies, middleware, or response behavior.

Use when adding, renaming, or changing this backend's MCP tools, resources, prompts, or input/output schemas.

Use before tagging, publishing, or promoting AutoPVS1-Link builds.

Use when modifying AutoPVS1 HTML fetching, parsing, URL construction, or fixture-backed scraper behavior.

Use when `make ci-local` fails or a GitHub Actions run reports a CI failure.

Use when adding, renaming, or modifying AutoPVS1-Link FastAPI routes, dependencies, middleware, or response behavior.

Use when adding, renaming, or changing AutoPVS1-Link MCP tools, resources, prompts, or schemas.

Use before tagging, publishing, or promoting PubTator-Link builds.

Use when GitHub Actions or local quality gates fail and the root cause is not already isolated.

Use when changing review re-RAG schema, repositories, migrations, or PostgreSQL integration behavior.

Use when adding or changing FastAPI routes, dependencies, middleware, or API response behavior.

Use when adding, renaming, or changing PubTator-Link MCP tools, resources, prompts, or schemas.

Use when adding, renaming, or modifying this backend's FastAPI routes, dependencies, middleware, or response behavior.

Use when CI fails on a PR or main in gencc-link. Walks through reproducing make ci-local locally and root-causing without bypassing checks.

Use when changing the GenCC SQLite schema. Coordinates schema.sql, the ingest builder/aggregates, and the repository together, then rebuilds the database and updates tests and fixtures.

Use when adding, renaming, or removing an MCP tool in gencc-link. Walks through the tool module, facade registration, the capabilities TOOLS tuple, tests, and the README/connection-guide tables.

Use when preparing a versioned release of gencc-link. Walks through the pre-release checklist — ci-local green, CHANGELOG, version bump, valid docker config — then tagging and watching the release workflow.

Use when `make ci-local` fails or a GitHub Actions run reports a CI failure.

Use when adding, renaming, or modifying a FastAPI route in genereviews-link.

Use when adding, renaming, or changing GeneReview-Link MCP tools, resources, or schemas.

Use when modifying NCBI E-utilities or NCBI Bookshelf scraping logic in eutils_client.py.

Use before tagging a release of genereviews-link.

Use when CI fails on a PR or main. Walks through reproducing locally and root-causing without bypassing checks.

Use when adding or modifying a FastAPI route in gtex-link. Walks through request/response models, route handler, service wiring, and tests.

Use when wiring a new upstream GTEx Portal endpoint into gtex-link. Walks through the spec, models, service, route, tests, and MCP exposure decision.

Use when adding, renaming, or removing an MCP tool in gtex-link. Walks through facade registration, profiles, descriptions, tests.

Use when preparing a versioned release of gtex-link. Walks through changelog, version bump, tag, and watching the release workflow.

Use when preparing to tag, publish, or promote a spliceailookup-link build.

Use when adding, renaming, or modifying this backend's FastAPI routes, dependencies, middleware, or response behavior.

Use when a CI check (lint, format, mypy, line-budget, or tests) fails in spliceailookup-link

Use when adding, renaming, or modifying an MCP tool in spliceailookup-link

Use when preparing to tag, publish, or promote a stringdb-link build.

Use when adding, renaming, or modifying this backend's FastAPI routes, dependencies, middleware, or response behavior.

Use when adding, renaming, or changing this backend's MCP tools, resources, prompts, or input/output schemas.

Use when adding, renaming, or modifying this backend's FastAPI routes, dependencies, middleware, or response behavior.

Use when adding, renaming, or changing this backend's MCP tools, resources, prompts, or input/output schemas.

Use when preparing to tag, publish, or promote a mavedb-link build.