carlos / todomvc-bakeoff Public

Download this file

1	# 🤖 AGENTS.md: todo-go-rastrillo
2
3	The one rule: **a visitor's list is reachable only through that
4	visitor's own cookie.** Every read and every write of a todo goes
5	through the `owned(r)` seam (`scope.Owned` on the session's subject), and
6	a todo that isn't in the caller's list doesn't exist: 404, never 403.
7
8	## Tenancy declaration (2026-10-23)
9
10	- **One instance for the whole app.** Carloku app `todo-go-rastrillo`,
11	host `todo-go-rastrillo.bfj.oncarlos.com`, channel `edge`.
12	- **Each visitor's list is kept separately by an anonymous cookie.** The
13	first request without a live session creates a `visitors` row and
14	signs that browser in to it through Rastrillo's `sessions` (method
15	`anonymous`): a 256-bit random token in an `HttpOnly; SameSite=Lax;
16	Path=/` cookie, `Secure` and `__Host-` on https. Only the token's
17	SHA-256 is stored. An unknown or garbled cookie gets a fresh, empty
18	list.
19	- **No sign-in.** There are no accounts, no email, no passwords. Losing
20	the cookie loses the list.
21	- **Trust class C.** Todo titles are stored as plain text in the SQLite
22	file and the server can read them. That's chosen: it's a demo app
23	holding to-do items, and it's written down here and in the README.
24
25	## Working rules
26
27	- The binding spec is the repo's `BRIEF.md` and `CONTRACT.md`. The UI is
28	TodoMVC's markup and CSS, not Rastrillo's design system.
29	- Cross-site protection is the contract's Origin check (`origin.go`),
30	not `csrf.Protect` alone: a POST with no `Origin` header is allowed.
31	- Migrations only add. Never edit a shipped file in
32	`internal/todo/migrations/`; add a new one.
33	- `make test` before every commit; the shared suite before every deploy.
34	- Never bind anything other than `127.0.0.1` locally.
35