# 🤖 AGENTS.md: todo-rust

The one rule: **the page works with JavaScript off.** Every action is a
plain HTML form POST answered with a 303. JavaScript only makes the same
requests without a page load; it never adds behaviour the server lacks.

## Tenancy

- **One instance for the whole app** (`todo-rust.bfj.oncarlos.com`, one
  SQLite file).
- **Each visitor's list is kept separately by an anonymous cookie**
  (`todo_list`: 128 random bits, hex, `HttpOnly; SameSite=Lax; Path=/`,
  `Secure` over https). Every query is scoped to the list that cookie
  names; an id from another list answers 404.
- **No sign-in.** Losing the cookie loses the list.
- **Trust class C.** Todo text is stored as plain text in SQLite. That is
  a deliberate choice for a demo app with anonymous lists, written down
  here so nobody mistakes it for an oversight.

## Working here

- Work only in `apps/rust/`. `BRIEF.md` and `CONTRACT.md` at the repo
  root are binding.
- Servers bind `127.0.0.1` only. Scratch goes in `mktemp -d -p "$TMPDIR"`.
- Migrations only add (`src/db.rs`, keyed by `PRAGMA user_version`).
- Commits end with a `Co-Authored-By:` trailer naming the model.