AGENTS.md git:20260923.cfd5ac7A

Immutable. This exact content never changes and is served at /api/v1/blob/c662bae531b2f483.

# Agent instructions for this repo

Read `docs/ARCHITECTURE.md`, `src/core/types.ts` and `docs/VALIDATION.md` before making changes. They define
the product contract and distinguish implemented capabilities from observed live validation.

Rules:
- **Secrets:** never print, `cat`, log or paste a secret, and never ask a human to paste one into
  chat. In code, wrap credentials in `Secret` (src/core/secret.ts). Pass them only via child stdin or
  an HTTP header/body, and never on argv or in errors, logs, previews, state or reports.
- **Writes:** nothing touches a real account without the human approving the specific `plan` first.
  Live payments and DNS need explicit confirmation, and nothing that costs money is ever automated.
- **Tests:** every change ships with vitest tests that use `test/helpers.ts` / `test/fakes.ts` mocks.
  Tests never hit the network. Before finishing, run `pnpm vitest run && pnpm tsc --noEmit && pnpm build`.
- **Bundle:** `pnpm build` generates the runtime, installer helpers and `skills/golive/release.json`.
  Keep generated artifacts consistent with their source; never hand-edit runtime bytes or hashes.
  Runtime dependencies must stay at zero. Use Node 24 for tests and Node 20 for runtime compatibility.
- **Git:** commit or push only when the human asks.