The first screen (online or not, a Check button, every language with a draft notice), the desktop and Android heads, the server's /api/info and /api/ip, a release tool that builds deb, rpm, a Windows exe, macOS zips, a signed APK and the server, and the Gitea workflows that run it. Rules adapted from passolo; AGPL-3.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB
3.2 KiB
AGENT.md — operating contract for agents working on MeWeb
Read this first. PATTERNS.md is canonical for how code is written (cite "PATTERNS #n"); CLAUDE.md is the
quick reference (commands, map, pitfalls). When a tool in the repo enforces a rule (the compiler, .editorconfig,
tools/lint.cs), the tool is the source of truth.
What MeWeb is
me-web? tells an ordinary person whether their own connection and device can host a server, and what stands in
the way: no public address (CGNAT), blocked ports, a firewall on the provider's router, a dynamic address, a mail
port closed, a residential blocklist. It runs every automatic check it can, draws the path from the device to the
provider, explains each finding in plain words, and works mostly offline from an embedded knowledge database.
Avalonia 12 on .NET 10 for Linux, Windows, macOS and Android (src/MeWeb.App + heads), a small server for the
checks that need a vantage point outside the user's network (src/MeWeb.Server, meweb.arasaka.software).
Free software under AGPL-3.0, published by Arasaka di Hvozdikov Yevheniy.
Conventions that differ from defaults (full rulings in PATTERNS.md)
- No comments in source — none, of any kind (#42).
- No
private, no_prefixes,Nullabledisabled, 2-space indent,vareverywhere (#92). - Primary constructors,
IOptionsMonitor<T>,CancellationTokenlast and forwarded (#1, #87, #88). - Routes only in
src/MeWeb.Shared/Endpoints.cs(#9); DTOs are classes namedView*,Upsert*,*Form(#34). - UI text: resx keys only, sentence case, every language present, drafts labelled (#39, #50, #125).
- Every outbound host is declared in the app's "What this app contacts" screen (#120).
Hard rules — DO NOT
- Never commit a secret. This repository is public. The Android keystore, the update-feed key, Mongo
credentials and blocklist keys live in Gitea Actions secrets or in
/etc/meweb/meweb.envon the server, never in git, never in a log, never printed. - Never regenerate or delete the Android signing key. A new key stops every installed app from updating.
- Never run the release workflow on code from a pull request. CI runs on the production box: only pushes to
masterandv*tags trigger it. - Never
pkill -f/killall. Stop exactly the PID you started. - Never create a branch, force-push or rewrite history (#46).
- Never widen what the app contacts without updating the declared list in the same change (#120).
- Never change a user's network without consent (#122), and never point the probe at anything but the caller's own address (#123).
- Never recreate a test project. Verification is the
/verifyladder.
Evidence
Report the evidence level honestly: E1 code-traced, E2 exercised here (build, curl, headless screenshots), E3 live on a real device or a real network. Never report E3 from an E2 check.
Git policy
- Trunk only:
master, remotegit.thepra.dev/Arasaka/MeWeb(public). - A
v<Version>tag releases every platform and deploys the server; the tag must equalVersioninDirectory.Build.props. - Stage explicit paths, review
git statusandgit diff --cached --statbefore committing.