carlos / todomvc-bakeoff Public

docs(rust): AGENTS.md with the one rule and tenancy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Paul Campbell pushed by claude 1 day ago 3696f6b9ad1719feb9fcda8cde468d23fa83d2ae parent 2eeda2a

1 file changed, +26 −0

diff --git a/apps/rust/AGENTS.md b/apps/rust/AGENTS.md

new file mode 100644

index 0000000..761d669

--- /dev/null

+++ b/apps/rust/AGENTS.md

@@ -0,0 +1,26 @@

+# 🤖 AGENTS.md: todo-rust

+The one rule: **the page works with JavaScript off.** Every action is a

+plain HTML form POST answered with a 303. JavaScript only makes the same

+requests without a page load; it never adds behaviour the server lacks.

+## Tenancy

+- **One instance for the whole app** (`todo-rust.bfj.oncarlos.com`, one

+ SQLite file).

+- **Each visitor's list is kept separately by an anonymous cookie**

+ (`todo_list`: 128 random bits, hex, `HttpOnly; SameSite=Lax; Path=/`,

+ `Secure` over https). Every query is scoped to the list that cookie

+ names; an id from another list answers 404.

+- **No sign-in.** Losing the cookie loses the list.

+- **Trust class C.** Todo text is stored as plain text in SQLite. That is

+ a deliberate choice for a demo app with anonymous lists, written down

+ here so nobody mistakes it for an oversight.

+## Working here

+- Work only in `apps/rust/`. `BRIEF.md` and `CONTRACT.md` at the repo

+ root are binding.

+- Servers bind `127.0.0.1` only. Scratch goes in `mktemp -d -p "$TMPDIR"`.

+- Migrations only add (`src/db.rs`, keyed by `PRAGMA user_version`).

+- Commits end with a `Co-Authored-By:` trailer naming the model.