AGENTS.md

Guidance for coding agents working on the AB Framework server harness role.

Project Overview

The server harness owns generated Node ESM API bootstrap, route modules, domain rules, storage adapters, migrations, server tests, HTTP helpers, security headers, rate limiting, and PostgreSQL runtime policy.

Project Map

• .claude/server/AGENT.md defines the server role.
• .claude/server/README.md documents generated server expectations.
• .claude/server/skeleton/ contains API starter files.
• .claude/agents/ab-server-framework-agent.md owns server-specific generation.
• .claude/agents/ab-security-review-agent.md reviews security controls.
• .claude/scripts/verify-framework.mjs checks module layout, migrations, indexes, and security controls.

Setup Commands

bashnode .claude/scripts/verify-framework.mjs
node .claude/scripts/lint-claude-harness.mjs

Change Rules For Agents

• Keep routes, domain logic, storage adapters, and HTTP helpers separate.
• Use PostgreSQL for runtime persistence in generated suites.
• Use parameterized queries only.
• Add indexes for lookup and listing paths.
• Apply security headers and rate limiting in generated server shape.
• Keep tests focused around domain and route behavior.
• Update verifier expectations when server skeleton contracts change.

Verification

bashnode .claude/scripts/verify-framework.mjs

Inspect generated <app>-server output for module boundaries and migration policy.

Security Notes

Generated server skeletons must not contain real credentials, private connection strings, or unsafe query construction. Keep examples placeholder-only.

PR Checklist

• Route/domain/storage split remains intact.
• Migrations and indexes are present when needed.
• Security headers and rate limiting are verified.
• Framework verifier passes.