AlexandrAI AGENTS.md
agents-md

AB Framework Admin Harness Agent Guide

Project-specific AGENTS.md guidance for the AB Framework admin harness role, generated operator console, BFF routes, network gate, session handling, and tests.

AGENTS.md

Guidance for coding agents working on the AB Framework admin harness role.

Project Overview

The admin harness owns the generated operator console, custom network-gated server, BFF API routes, httpOnly admin session cookie, upstream API client, and admin tests. Browser code must never receive upstream credentials directly.

Project Map

  • .claude/admin/AGENT.md defines the admin role.
  • .claude/admin/README.md documents generated admin expectations.
  • .claude/admin/skeleton/ contains operator console starter files.
  • .claude/agents/ab-admin-framework-agent.md owns admin generation.
  • .claude/agents/ab-security-review-agent.md reviews admin security.
  • .claude/scripts/verify-framework.mjs checks generated admin boundaries.

Setup Commands

bashnode .claude/scripts/verify-framework.mjs
node .claude/scripts/lint-claude-harness.mjs

Change Rules For Agents

  • Browser code calls BFF routes only.
  • Do not expose upstream credentials to browser JavaScript.
  • Enforce network gate before page serving.
  • Keep admin and public web modules separate.
  • Keep session cookies httpOnly in generated admin shape.
  • Keep upstream API client server-owned.
  • Add verifier coverage when admin skeleton contracts change.

Verification

bashnode .claude/scripts/verify-framework.mjs

Inspect generated <app>-admin output for BFF-only browser access.

Security Notes

Admin scaffolds are security-sensitive. Never place real credentials, private endpoints, bearer tokens, or upstream secrets in browser-visible files, docs, or generated examples.

PR Checklist

  • Network gate remains enforced.
  • BFF routes mediate upstream calls.
  • Session handling stays httpOnly.
  • Framework verifier passes.