First cut

AGENTS.md

@@ -0,0 +1,24 @@
+# AGENTS.md — Rules for AI Agents Working in This Repo
+
+## Core Principles
+
+1. **Zod schemas are the contract.** Every content file, API payload, and LLM output is validated by Zod. Never write data that hasn't passed schema validation.
+
+2. **No direct LLM calls in request handlers.** All LLM work runs in the queue consumer. Handlers enqueue and return immediately (202 Accepted).
+
+3. **Canonical JSON everywhere.** All files under `content/`, `config/`, and `site-context.json` must use `stringifyCanonical()` — sorted keys, 2-space indent, trailing newline.
+
+4. **No git in the orchestrator.** Content persistence is filesystem-only via `writeContentFile`. Deployment of images happens outside this codebase.
+
+5. **Human confirmation before any write.** The propose → summary → YES/NO → apply pipeline must be followed for all edit channels (SMS, HTTP, editor).
+
+6. **SQLite, not Redis.** Idempotency, proposals, rate limits, and audit logs all live in a single SQLite file. No BullMQ, no Redis.
+
+## Anti-Patterns
+
+- Do NOT call `fs.writeFileSync` directly on content files. Always use `writeContentFile`.
+- Do NOT skip Zod validation before writing.
+- Do NOT put LLM calls inside Express route handlers.
+- Do NOT add git operations (commit, push, etc.) anywhere in the orchestrator.
+- Do NOT use `console.log` — use the structured `logger` from `server/src/logger.ts`.
+- Do NOT expose raw JSON or LLM output in SMS replies — use SMS_TEMPLATES.