Skip to content

docs: add AGENTS.md engineering protocol and CONTRIBUTING.md - #10

Merged
vernonstinebaker merged 2 commits into
mainfrom
docs/agents-and-contributing
Oct 3, 2026
Merged

vernonstinebaker merged 2 commits into
mainfrom
docs/agents-and-contributing

Conversation

@vernonstinebaker

Copy link
Copy Markdown
Contributor

NullClaw Chat UI had neither an AGENTS.md nor a CONTRIBUTING.md. Added both: the gateway wire-protocol compatibility contract (protocol/ and session/ directories), the dual build targets (web app + NullHub module.js), and validation gates (vitest, svelte-check, both builds). Docs-only.

Captures the gateway wire-protocol compatibility contract (protocol/ and
session/ as the compatibility surface), the dual build targets (app +
NullHub module.js), and the validation gates.

@DonPrus DonPrus left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed both documents against the implementation, README, package scripts, CI/release workflows, and current main. There are no existing PR discussions to resolve, no duplicate contributor guide, and no merge conflict. The protocol/session compatibility boundary and both build targets are correctly identified; CI runs the documented checks and builds both release bundles.

One non-blocking wording improvement: it would be great to replace “pairing tokens are ephemeral client-side state” with the actual storage contract. src/lib/session/auth-storage.ts persists the access token and shared key in localStorage with an expiry (default 86,400 seconds), and README documents session restoration. Calling them ephemeral may lead future changes to assume they only live in memory. “Keep tokens and keys out of logs; persisted browser auth must respect its TTL and be cleared on rejection” would match the implementation. Similarly, the exact cipher name is ChaCha20-Poly1305.

Approved: this is documentation-only with no blocking issue. Validation was source/documentation comparison and a clean merge-tree check; I did not rerun the application suite for these text additions.

@vernonstinebaker

Copy link
Copy Markdown
Contributor Author

Addressed both points in 5934c52:

  • Cipher named exactly: X25519 + ChaCha20-Poly1305 (matches src/lib/protocol/e2e.ts using chacha20poly1305 from @noble/ciphers, and docs/protocol.md §Symmetric encryption).
  • Replaced "pairing tokens are ephemeral client-side state" with the actual storage contract: auth-storage.ts persists the access token and shared key in localStorage with DEFAULT_TOKEN_TTL_SECS = 86_400, and clears on expiry, on invalid payload, and on unauthorized — the wording now matches README:111 ("cleared automatically when TTL expires or when the session is rejected").

Documentation-only, pure addition to two new files. CI running; approval retained.

@vernonstinebaker
vernonstinebaker merged commit 578ed86 into main Oct 3, 2026
1 check passed
@vernonstinebaker
vernonstinebaker deleted the docs/agents-and-contributing branch October 3, 2026 16:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants