🤖 AGENTS.md: todo-zig

TodoMVC for the CARLOS bakeoff, written in Zig. The brief and contract at the repo root (BRIEF.md, CONTRACT.md) are binding; this file adds what is particular to this app.

The one rule

The page works without JavaScript. Every action is a plain HTML form that posts and gets a 303 back. The script in static/app.js only intercepts those same forms and swaps in the fresh markup the server renders. If a feature can't be done with a form and a redirect, it isn't done.

Tenancy

• One instance for the whole app. Every visitor is served by the same process and the same SQLite file.
• Each visitor's list is kept separately by an anonymous cookie. The cookie holds 256 random bits; the database stores only its SHA-256, so the database alone can't be used to take over a list. A cookie the app doesn't recognise gets a fresh, empty list.
• No sign-in. There are no accounts, passwords or email addresses.
• Trust class C. Todo text is stored as plain text in SQLite. That is a deliberate choice: the data is low-value, anonymous and typed by the visitor, and nothing is gained by sealing it.

Working here

• Zig 0.17.0 from scripts/env.sh; never reinstall it. SQLite comes in as the official amalgamation through build.zig.zon and is compiled by Zig as C.
• All Zig caches live in .cache/ (see the Makefile), so make clean-deps can drop compiled artifacts without touching anything outside this directory.
• Migrations in src/db.zig only ever add. Never drop or rewrite data.
• Bind 127.0.0.1 only; scratch goes in mktemp -d -p "$TMPDIR".