🤖 AGENTS.md: todo-swift

The CARLOS bakeoff's TodoMVC, written in Swift.

The one rule

The page works with JavaScript off. Every action is a plain HTML form that posts and answers 303; JavaScript only makes the same requests without a page load. If a change works only with JavaScript, it's a bug.

Everything else follows from BRIEF.md and CONTRACT.md at the repo root, which are binding. Where this file and the contract disagree, the contract wins.

Tenancy declaration

Tenancy declaration: todo-swift, 2026-10-23, the bakeoff brief
One instance is:      the whole app  (person : instance = N:1)
Why this unit:        a todo list is tiny and anonymous; nothing is gained
                      by an instance per visitor, and the bakeoff measures
                      one process
Reached through:      model A (one instance), no sign-in; each visitor's
                      list is kept apart by an anonymous random cookie
                      (128 bits, HttpOnly, SameSite=Lax, Secure on https)
Central app:          none
Workloads and class:  instance = C (host-sighted)
Declared residue:     everything: todo titles and completed flags are
                      stored as plain text in SQLite, alongside each list's
                      cookie value and creation time
Keys live:            n/a
Hosting:              Carloku (account bfj, app todo-swift)
Licence class:        not published yet
Benefits claimed:     replication and hibernation from the platform;
                      one static binary, one SQLite file
Costs accepted:       the host (and anyone holding a replica) can read every
                      list; a lost cookie is a lost list, and there's no
                      recovery; lists are not erased when abandoned
Waiting on:           nothing

Class C is chosen on purpose: the bakeoff compares languages, not encryption, and a todo list holds nothing a visitor was promised would stay private. The page says nothing to suggest otherwise.

Working rules

• Work only in apps/swift/. The rest of the repo is read-only.
• One static linux-arm64 binary: make build-arm64. No shared library beyond libc (the Static Linux SDK links musl in).
• SQLite in WAL mode at --db. Migrations only add; never drop or rewrite data. They're numbered in Store.swift and tracked with PRAGMA user_version.
• Every database write is a single SQL statement, so requests that share the one connection can't interleave half a change.
• Bind 127.0.0.1 only when listening on TCP. Scratch goes in mktemp -d -p "$TMPDIR". Stop what you start.
• make test and the shared suite (scripts/test-app.sh) pass before a deploy.
• Commits end with a Co-Authored-By: trailer naming the model.