AGENTS.md

Repository Instructions

1. Read DESIGN.md before changing architecture or behavior. It is the V1 source of truth.
2. Put a scoped specification in docs/specs/ and an executable plan in docs/plans/ before implementation.
3. Use test-first development for behavior: write a failing test, observe the expected failure, add the minimum code, and run focused plus related tests.
4. Keep HTTP Routers thin. Put business behavior outside transport code and introduce an external-I/O boundary only when a real caller needs it.
5. Never trust a client-provided identity or resource owner. Authorization is enforced server-side on every resource access.
6. Never commit credentials, print secrets in health/error responses, expose internal data services, or mount the Docker Socket outside the future isolated Provisioner.
7. Never weaken production permissions or sandbox isolation to make a test easier.
8. Use uv for Python and pnpm for Web. Preserve and verify uv.lock and apps/web/pnpm-lock.yaml whenever dependencies change.
9. Before claiming completion, run the verification commands in README.md and report any command that could not be executed.
10. Automated tests and routine verification must never call a real Embedding model. Mock Embedding paths. Explicit paid smoke may call DeepSeek or doubao-seed-2-0-lite-260428; starting Context workers against live work is a runtime action, not a model-free test.