# 🤖 AGENTS.md: todo-go-rastrillo

The one rule: **a visitor's list is reachable only through that
visitor's own cookie.** Every read and every write of a todo goes
through the `owned(r)` seam (`scope.Owned` on the session's subject), and
a todo that isn't in the caller's list doesn't exist: 404, never 403.

## Tenancy declaration (2026-10-23)

- **One instance for the whole app.** Carloku app `todo-go-rastrillo`,
  host `todo-go-rastrillo.bfj.oncarlos.com`, channel `edge`.
- **Each visitor's list is kept separately by an anonymous cookie.** The
  first request without a live session creates a `visitors` row and
  signs that browser in to it through Rastrillo's `sessions` (method
  `anonymous`): a 256-bit random token in an `HttpOnly; SameSite=Lax;
  Path=/` cookie, `Secure` and `__Host-` on https. Only the token's
  SHA-256 is stored. An unknown or garbled cookie gets a fresh, empty
  list.
- **No sign-in.** There are no accounts, no email, no passwords. Losing
  the cookie loses the list.
- **Trust class C.** Todo titles are stored as plain text in the SQLite
  file and the server can read them. That's chosen: it's a demo app
  holding to-do items, and it's written down here and in the README.

## Working rules

- The binding spec is the repo's `BRIEF.md` and `CONTRACT.md`. The UI is
  TodoMVC's markup and CSS, not Rastrillo's design system.
- Cross-site protection is the contract's Origin check (`origin.go`),
  not `csrf.Protect` alone: a POST with no `Origin` header is allowed.
- Migrations only add. Never edit a shipped file in
  `internal/todo/migrations/`; add a new one.
- `make test` before every commit; the shared suite before every deploy.
- Never bind anything other than `127.0.0.1` locally.