🤖 AGENTS.md: todo-ocaml

The one rule: the page works without JavaScript, and JavaScript only makes it nicer. Every action is a plain form POST that answers 303. The script in static/app.js posts the same forms with X-Fragment: todoapp and swaps in the HTML the server renders; it never holds state of its own.

Tenancy

• One instance for the whole app (todo-ocaml.bfj.oncarlos.com), one SQLite file.
• Each visitor's list is kept separately by an anonymous cookie (todomvc_list, 128 random bits from getrandom(2), HttpOnly; SameSite=Lax; Path=/, plus Secure over https). An unknown or garbled cookie gets a fresh, empty list. Every query that reads or writes a todo is scoped by that list id; an id outside the caller's list is a 404.
• No sign-in. Losing the cookie loses the list. That's accepted.
• Trust class C. Todo titles are stored as plain text in SQLite, not encrypted. That's a deliberate choice for a demo app holding nothing sensitive.

Working here

• Work only in apps/ocaml/. BRIEF.md and CONTRACT.md at the repo root are binding.
• Build with make build (x86, local) and make build-arm64 (shipped, inside the emulated arm64 root). Both use opam roots under .cache/.
• make test runs the unit and handler tests. Run the shared suite with scripts/test-app.sh before every deploy.
• Migrations only add. Never drop or rewrite data.
• Bind 127.0.0.1 only. Scratch goes in mktemp -d -p "$TMPDIR".