# Codex Notes

This cPanel site is managed by `/home/cpanel-git-auto/app`.

- Automatic commits are handled by the server cron; do not create manual commits unless explicitly asked.
- Do not revert unrelated changes in this document root.
- Check `/home/cpanel-git-auto/app/README.md` for the server-level Git automation guide.
- Database dumps with data must not be added to Git. Schema-only files may live in `.db-schema/`.

## Reservation platform governance

- Read `docs/DECISIONS_IMPLEMENTATION.md` before changing application code. It overrides contradictory legacy specifications.
- The application stack is Laravel 13 / PHP 8.4 / MariaDB with Blade, CSS and native JavaScript modules. Do not add React, Inertia, TypeScript, Tailwind, Livewire, Alpine or jQuery.
- Keep the application as a modular monolith. Modules communicate through application services and transactional outbox events, not by mutating another module's tables directly.
- Every hotel-owned record must be scoped by `property_id`; enforce tenant isolation in policies, queries, validation and tests.
- Inventory, financial and stock movements are append-only ledgers. Corrections use reversing entries.
- Never call WooDoo, a payment provider or any external HTTP service while a business database transaction is open.
- Never store or log PAN, CVV or complete virtual-card numbers.
- WooDoo is an interchangeable connectivity provider. Core ARI and reservation calls use Wired XML-RPC; the JSON API is used only for explicitly documented capabilities.
- Do not build Reservit or HotelRunner migration adapters unless the user explicitly reauthorizes them.
- Run the relevant PHPUnit, static-analysis, JavaScript and browser tests after each vertical slice.