# 🤖 AGENTS.md: todo-nim

The bakeoff's TodoMVC, written in Nim, deployed to Carloku as `todo-nim`
on account `bfj` (`https://todo-nim.bfj.oncarlos.com`).

## The one rule

**The page works with JavaScript off.** Every action is a plain HTML form
that posts and gets a 303 back. JavaScript only makes the same requests
without a page load and swaps in the HTML the server renders. If a change
needs JavaScript to function, it's the wrong change.

## Tenancy

- **One instance for the whole app.** Every visitor shares one process
  and one SQLite file.
- **Each visitor's list is kept separately by an anonymous cookie.** The
  first visit gets a random 128-bit value in an `HttpOnly; SameSite=Lax`
  cookie (`Secure` on Carloku). Every query is scoped to that list, and an
  id from someone else's list answers 404. A cookie the app doesn't
  recognise gets a fresh, empty list.
- **No sign-in.** Losing the cookie means losing the list.
- **Trust class C.** Todo titles are stored as plain text in SQLite, not
  encrypted. That's a deliberate choice: the data is low-value, has no
  owner identity attached, and a todo list doesn't justify key handling.

## Working here

- Source is in `src/`. `make test` runs the unit tests, `make build` the
  local binary; the README has the rest.
- The CSS is `shared/base.css` and `shared/index.css`, embedded at compile
  time and served byte for byte. Don't copy or edit them here.
- Migrations only add. Append a new entry to `migrations` in
  `src/store.nim`; never edit or remove one that has shipped.
- Bind `127.0.0.1` only. Scratch goes in `$TMPDIR`.