# 🤖 AGENTS.md: todo-haskell

The one rule: **every visitor's list is theirs alone.** Every query that
reads or changes a todo is scoped to the list named by the caller's own
cookie, and a request naming anything outside that list changes nothing
and answers 404.

## Tenancy

- **One instance for the whole app.** `todo-haskell` runs as a single
  Carloku instance on `todo-haskell.bfj.oncarlos.com`, with one SQLite
  file.
- **Each visitor's list is kept separately by an anonymous cookie.** The
  first visit mints a random 256-bit value, stores it as a row in
  `lists`, and sets it as the `todo_list` cookie (`HttpOnly;
  SameSite=Lax; Path=/`, plus `Secure` over https). A value the app
  doesn't hold gets a fresh empty list, never an error.
- **No sign-in.** Losing the cookie loses the list; that's accepted.
- **Trust class C.** The todo text is stored in SQLite as plain text. The
  operator can read it. That's a deliberate choice for a demo app, not an
  oversight, and nobody should store anything secret in it.

## Rules for changing this app

- Work only in `apps/haskell/`. The bakeoff's `BRIEF.md` and
  `CONTRACT.md` are binding.
- Migrations only ever add. Never drop or rewrite a table or a column.
- Servers bind `127.0.0.1` or a unix socket, nothing else.
- Cabal's store lives under `.cache/`, set by the `Makefile`. Don't
  point it anywhere shared.
- Commits end with a `Co-Authored-By:` trailer naming the model.