# Agents

These are the rules for agents working on this repository.

## Branches

- `main` is the stable branch, and `next` is the development branch.
- Every PR is cut from `next` and targets `next`.
- Only sneak merges `next` into `main`.
- Each issue lands on `next` as one squashed commit whose title ends
  ` (closes #N)`. A PR may instead be exactly two commits: first tests that fail
  against the current code, then the fix with no test assertion changed. Such a
  PR lands as both commits.

## Entrypoints

- Work through the `Makefile` targets, which call the scripts in `script/`. The
  README's [Entrypoints](README.md#entrypoints) section lists them.
- Never run `go`, `golangci-lint` or prettier directly.
- `make check` passes before every push.

## Editing

- Edit files by hand.
- Format only with `make fmt`, and run it before committing any change.

## Iron rules

- The request log records query strings exactly as received.
    - Secrets belong in POST data. An app that puts a secret in a query string
      is fixed in the app.
    - Never propose redacting a query string, Gitea's `?token=` included.
- The default of `SWW_RPROXY_TRUSTED_PROXIES` is the RFC 1918 set.
    - The set is:
        - `10.0.0.0/8`;
        - `172.16.0.0/12`;
        - `192.168.0.0/16`.
    - `SPEC.md` states that default.
    - Forwarded headers count only when the peer is a trusted proxy.