# 🤖 AGENTS.md: todo-spinel

The one rule: **this app is Ruby compiled ahead of time, and nothing else
runs in production.** Everything the server does is written in the
Spinel-compilable subset of Ruby (`app.rb`, via tep) or in the small C
shims tep already ships. No Ruby interpreter, no shared library beyond
libc, no client framework, no JS build step.

## Tenancy

- **One instance for the whole app.** A single process and a single
  SQLite file (`--db`) serve every visitor.
- **Each visitor's list is kept separately by an anonymous cookie.** The
  first visit sets `tid=<22 base64url characters>` (128 bits from the
  kernel's `getrandom`),
  `HttpOnly; SameSite=Lax; Path=/`, plus `Secure` over https. Every query
  is scoped by that value; an id from someone else's list is a 404. The
  `visitors` table holds every token the server has issued; any other
  cookie value is replaced with a fresh one.
- **No sign-in.** There are no accounts, passwords or e-mail addresses.
- **Trust class C.** Todo text is stored as plain text in SQLite. That's
  a deliberate choice for a demo app: nothing in it is meant to be
  secret, and the platform's at-rest protection of the database is the
  only protection it gets.

## Working here

- Work only in `apps/spinel/`. `BRIEF.md` and `CONTRACT.md` at the repo
  root are binding.
- The toolchain checkouts (spinel, tep, spinelkit) are read-only. The
  Makefile copies tep into `.cache/` and applies `patches/*.patch` there.
- Servers bind `127.0.0.1` only. Scratch goes in `$TMPDIR`. No `sudo`.