🤖 AGENTS.md: todo-nim

The bakeoff's TodoMVC, written in Nim, deployed to Carloku as todo-nim on account bfj (https://todo-nim.bfj.oncarlos.com).

The one rule

The page works with JavaScript off. Every action is a plain HTML form that posts and gets a 303 back. JavaScript only makes the same requests without a page load and swaps in the HTML the server renders. If a change needs JavaScript to function, it's the wrong change.

Tenancy

• One instance for the whole app. Every visitor shares one process and one SQLite file.
• Each visitor's list is kept separately by an anonymous cookie. The first visit gets a random 128-bit value in an HttpOnly; SameSite=Lax cookie (Secure on Carloku). Every query is scoped to that list, and an id from someone else's list answers 404. A cookie the app doesn't recognise gets a fresh, empty list.
• No sign-in. Losing the cookie means losing the list.
• Trust class C. Todo titles are stored as plain text in SQLite, not encrypted. That's a deliberate choice: the data is low-value, has no owner identity attached, and a todo list doesn't justify key handling.

Working here

• Source is in src/. make test runs the unit tests, make build the local binary; the README has the rest.
• The CSS is shared/base.css and shared/index.css, embedded at compile time and served byte for byte. Don't copy or edit them here.
• Migrations only add. Append a new entry to migrations in src/store.nim; never edit or remove one that has shipped.
• Bind 127.0.0.1 only. Scratch goes in $TMPDIR.