The guidance in here is not Claude-specific — it is what this project is,
what it refuses to do, and the rules that are invisible from the code. Any
agent working here needs it, and AGENTS.md is the name they all look for.
CLAUDE.md stays as a pointer so Claude Code still finds it, and holds no
guidance of its own; two copies would drift and the wrong one would be read.
Every cross-reference in the source comments, docs, workflow and skills now
names AGENTS.md, and the image ignores both.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The suite gained three tests that assert on .github/workflows — the
freshness-cache restore, the per-attempt cache key and the rebase-and-
retry push, all defects that live in YAML and fail silently. But
.dockerignore excluded .github, so those three tests failed inside the
image build and took the whole build down with them.
Put .github in the build context. It reaches the build stage only; the
runtime stage still copies nothing but public/ and serve.ts, and the
image is unchanged (verified: /app holds public and serve.ts, nothing
else).
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
The server is a placeholder for the one in docs/ARCHITECTURE.md — it serves
public/ and a health endpoint, nothing more. Reads are confined to public/ by
resolving the path and checking it stays inside the root; string-matching
".." is not enough, since encodings and URL normalisation both change what
the string looks like and only the resolved path says which file would open.
The image runs typecheck and tests during build, ships no source or
toolchain, and runs unprivileged.
CI's feed job fails if the event count collapses. A source that quietly stops
yielding events is what a parser-only pipeline is most prone to, and nothing
else would surface it. Everything is offline, so a red pipeline always means
the code changed rather than a wiki being down.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
