# 🤖 AGENTS.md: todo-zig

TodoMVC for the CARLOS bakeoff, written in Zig. The brief and contract at
the repo root (`BRIEF.md`, `CONTRACT.md`) are binding; this file adds what
is particular to this app.

## The one rule

**The page works without JavaScript.** Every action is a plain HTML form
that posts and gets a 303 back. The script in `static/app.js` only
intercepts those same forms and swaps in the fresh markup the server
renders. If a feature can't be done with a form and a redirect, it isn't
done.

## Tenancy

- **One instance for the whole app.** Every visitor is served by the same
  process and the same SQLite file.
- **Each visitor's list is kept separately by an anonymous cookie.** The
  cookie holds 256 random bits; the database stores only its SHA-256, so
  the database alone can't be used to take over a list. A cookie the app
  doesn't recognise gets a fresh, empty list.
- **No sign-in.** There are no accounts, passwords or email addresses.
- **Trust class C.** Todo text is stored as plain text in SQLite. That is
  a deliberate choice: the data is low-value, anonymous and typed by the
  visitor, and nothing is gained by sealing it.

## Working here

- Zig 0.17.0 from `scripts/env.sh`; never reinstall it. SQLite comes in
  as the official amalgamation through `build.zig.zon` and is compiled by
  Zig as C.
- All Zig caches live in `.cache/` (see the `Makefile`), so
  `make clean-deps` can drop compiled artifacts without touching anything
  outside this directory.
- Migrations in `src/db.zig` only ever add. Never drop or rewrite data.
- Bind `127.0.0.1` only; scratch goes in `mktemp -d -p "$TMPDIR"`.