🤖 AGENTS.md: todo-haskell

The one rule: every visitor's list is theirs alone. Every query that reads or changes a todo is scoped to the list named by the caller's own cookie, and a request naming anything outside that list changes nothing and answers 404.

Tenancy

• One instance for the whole app. todo-haskell runs as a single Carloku instance on todo-haskell.bfj.oncarlos.com, with one SQLite file.
• Each visitor's list is kept separately by an anonymous cookie. The first visit mints a random 256-bit value, stores it as a row in lists, and sets it as the todo_list cookie (HttpOnly; SameSite=Lax; Path=/, plus Secure over https). A value the app doesn't hold gets a fresh empty list, never an error.
• No sign-in. Losing the cookie loses the list; that's accepted.
• Trust class C. The todo text is stored in SQLite as plain text. The operator can read it. That's a deliberate choice for a demo app, not an oversight, and nobody should store anything secret in it.

Rules for changing this app

• Work only in apps/haskell/. The bakeoff's BRIEF.md and CONTRACT.md are binding.
• Migrations only ever add. Never drop or rewrite a table or a column.
• Servers bind 127.0.0.1 or a unix socket, nothing else.
• Cabal's store lives under .cache/, set by the Makefile. Don't point it anywhere shared.
• Commits end with a Co-Authored-By: trailer naming the model.