# AGENTS.md — Auth-Yes System Guidelines & Operating Protocol

## 1. Project Context

Auth-Yes is a standalone, ultra-low-friction, zero-trust Identity and Access
Management (IAM) fabric and WebAuthn Passkey authority.

- **Runtime:** Deno 2.x (TypeScript 5.x)
- **Architecture:** Modular Deno Workspace (`sdk/`, `server/`, `ui/`,
  `spire_ffi/`, `infra/`)
- **Web API & SSR:** Hono with pure Hono SSR JSX (Strictly React-free)
- **Workload Mesh:** ConnectRPC daemon + Rust SPIFFE/mTLS FFI crate
  (`spire_ffi/`)
- **Data Layer:** Dedicated PostgreSQL 18 + Valkey 8 (L1/L2 RESP3 Client
  Tracking)
- **Cookie Scope:** Wildcard `.atyg.org` domain scoping with host-collision
  sweep

## 2. Key Architecture Standards

1. **Zero-Dependency SDK:** `@auth-yes/sdk` must remain 100% free of
   backend/database imports. ConnectRPC contracts live in `sdk/gen/`.
2. **Security:** Session invalidation and revocation MUST always be handled
   server-side (`deleteCookie` across host and wildcard domains).
3. **Quality Gates:** Every PR must pass `deno fmt`, `deno task lint`,
   `deno task check`, and `deno test`.

## 3. History & Context Link

This repository was cleanly extracted from `ed-droid`.

- **Reference Conversation:**
  [Auth-Yes Genesis Transcript](conversation://6a3fa402-ae0a-4231-9991-b0ff79a61e0f)
  (`conversation://6a3fa402-ae0a-4231-9991-b0ff79a61e0f`)