# 🤖 AGENTS.md: todo-ocaml

The one rule: **the page works without JavaScript, and JavaScript only
makes it nicer.** Every action is a plain form POST that answers 303. The
script in `static/app.js` posts the same forms with `X-Fragment: todoapp`
and swaps in the HTML the server renders; it never holds state of its own.

## Tenancy

- **One instance for the whole app** (`todo-ocaml.bfj.oncarlos.com`), one
  SQLite file.
- **Each visitor's list is kept separately by an anonymous cookie**
  (`todomvc_list`, 128 random bits from `getrandom(2)`, `HttpOnly;
  SameSite=Lax; Path=/`, plus `Secure` over https). An unknown or garbled
  cookie gets a fresh, empty list. Every query that reads or writes a todo
  is scoped by that list id; an id outside the caller's list is a 404.
- **No sign-in.** Losing the cookie loses the list. That's accepted.
- **Trust class C.** Todo titles are stored as plain text in SQLite, not
  encrypted. That's a deliberate choice for a demo app holding nothing
  sensitive.

## Working here

- Work only in `apps/ocaml/`. `BRIEF.md` and `CONTRACT.md` at the repo root
  are binding.
- Build with `make build` (x86, local) and `make build-arm64` (shipped,
  inside the emulated arm64 root). Both use opam roots under `.cache/`.
- `make test` runs the unit and handler tests. Run the shared suite with
  `scripts/test-app.sh` before every deploy.
- Migrations only add. Never drop or rewrite data.
- Bind `127.0.0.1` only. Scratch goes in `mktemp -d -p "$TMPDIR"`.