# AGENTS.md

This project's guidance for AI coding agents lives in **[CLAUDE.md](CLAUDE.md)**.
It is tool-agnostic — read it before generating or changing code here.

Quick pointers:

- **Guide (read first):** [CLAUDE.md](CLAUDE.md)
- **Security rules:** [SECURITY.md](SECURITY.md)
- **Governance rules:** [GOVERNANCE.md](GOVERNANCE.md)
- **Contributing & hygiene:** [CONTRIBUTING.md](CONTRIBUTING.md)
- **Product wiki:** [docs/wiki/](docs/wiki/README.md)
- **Generating Playwright tests:** [e2e/CLAUDE.md](e2e/CLAUDE.md)
- **QA scenario → test workflow:** [qa/README.md](qa/README.md)
- **Testing overview:** [TESTING.md](TESTING.md)
- **Security findings to respect:** [security/VAPT-REPORT.md](security/VAPT-REPORT.md)

The non-negotiables, in one line each:

1. Tenant isolation is enforced in the repository layer; tenant id comes from
   the authenticated identity, every tenant query filters `tenant_id`, misses
   return 404. **Do not add PostgreSQL RLS.**
2. Never commit secrets; `.env` is git-ignored and read at runtime.
3. A change isn't done until its tests pass and the evidence proves it; never
   weaken an assertion.
4. Stay in scope; a human owns the merge for anything tenant- or
   security-sensitive.