# 🤖 AGENTS.md: todo-swift

The CARLOS bakeoff's TodoMVC, written in Swift.

## The one rule

**The page works with JavaScript off.** Every action is a plain HTML form
that posts and answers 303; JavaScript only makes the same requests
without a page load. If a change works only with JavaScript, it's a bug.

Everything else follows from `BRIEF.md` and `CONTRACT.md` at the repo
root, which are binding. Where this file and the contract disagree, the
contract wins.

## Tenancy declaration

```
Tenancy declaration: todo-swift, 2026-10-23, the bakeoff brief
One instance is:      the whole app  (person : instance = N:1)
Why this unit:        a todo list is tiny and anonymous; nothing is gained
                      by an instance per visitor, and the bakeoff measures
                      one process
Reached through:      model A (one instance), no sign-in; each visitor's
                      list is kept apart by an anonymous random cookie
                      (128 bits, HttpOnly, SameSite=Lax, Secure on https)
Central app:          none
Workloads and class:  instance = C (host-sighted)
Declared residue:     everything: todo titles and completed flags are
                      stored as plain text in SQLite, alongside each list's
                      cookie value and creation time
Keys live:            n/a
Hosting:              Carloku (account bfj, app todo-swift)
Licence class:        not published yet
Benefits claimed:     replication and hibernation from the platform;
                      one static binary, one SQLite file
Costs accepted:       the host (and anyone holding a replica) can read every
                      list; a lost cookie is a lost list, and there's no
                      recovery; lists are not erased when abandoned
Waiting on:           nothing
```

Class C is chosen on purpose: the bakeoff compares languages, not
encryption, and a todo list holds nothing a visitor was promised would
stay private. The page says nothing to suggest otherwise.

## Working rules

- Work only in `apps/swift/`. The rest of the repo is read-only.
- One static linux-arm64 binary: `make build-arm64`. No shared library
  beyond libc (the Static Linux SDK links musl in).
- SQLite in WAL mode at `--db`. Migrations only add; never drop or
  rewrite data. They're numbered in `Store.swift` and tracked with
  `PRAGMA user_version`.
- Every database write is a single SQL statement, so requests that share
  the one connection can't interleave half a change.
- Bind `127.0.0.1` only when listening on TCP. Scratch goes in
  `mktemp -d -p "$TMPDIR"`. Stop what you start.
- `make test` and the shared suite (`scripts/test-app.sh`) pass before a
  deploy.
- Commits end with a `Co-Authored-By:` trailer naming the model.