Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.

PROJECT CONVENTIONS

    License: GNU Affero General Public License, version 3 or later.
    SPDX identifier: AGPL-3.0-or-later.
    Copyright holder/commit author: Doan Luu Duc Tai <doan@luuduct.ai>, 2026.
    Sign commits with RSA-2048 key:
        3346AA3150F8F16828BB0D14F8C66DF77AFECEA6

    Every nontrivial first-party source/config/template/prose file needs the AGPL
    copyright and permission header. LICENSE stays unmodified. Binary public keys
    and empty WKD policy files retain protocol format. Generated Cargo.lock keeps
    Cargo metadata plus project notice. JSON npm manifests use top-level // legal
    metadata; compiler JSONC uses its usual header syntax. Preserve generated
    JavaScript legal markers.

    No explanatory source comments. Express intent through names/structure.
    Required legal headers are the exception. Prose uses .txt; generated HTML
    license page is an explicit exception. Rust doc attributes supply crate
    metadata without comments.

    One root .env holds deployment overrides/configured secrets. Never commit
    .env or var/. Publish only root .env.example; ignore variants/nested examples.
    Its comments document public defaults/private placeholders. Public GPG keys,
    paths, templates, shared config logic, and source belong in Git. Hostnames
    stay visible in rendered pages; .env centralization is no access boundary.
    TLS account/certificate private keys, databases, and generated private state
    live under var/data, not .env. Keep GPG secret key/revocation certificate
    outside the project.

STRICTNESS

    Forbid every enabled Clippy group/individual rule; no blanket allows.
    Rust/Rustdoc use forbid where generated code supports it. Three Rust settings
    stay deny for pinned Serde derives; unaffected members remain independently
    forbidden. No first-party lint allowances. LINTING.txt records tested
    workarounds, generated-attribute evidence, and narrow duplicate exceptions.
    Private app namespaces keep narrow visibility while redundant_pub_crate and
    unreachable_pub both remain enforced.

    cargo-deny rejects duplicate versions, wildcard requirements, unknown
    registries/Git sources, and yanked versions. Chat has exact-version duplicate
    exceptions reviewed in CHAT-OPENSSL-MIGRATION.txt. Ignore no RustSec advisory.
    Scope first-party AGPL/required dependency license allowances per package.
    Allowlist retains requested permissive licenses and Zlib; unused allowances
    may produce informational audit warnings.

    Strict TypeScript separates browser/worker/Node environments and validates
    untrusted responses. npm dependencies stay exact, development-only,
    integrity-locked; disable installation lifecycle scripts. Typed ESLint rejects
    unsafe any/assertions, unchecked promises, and suppression directives. Check
    both supported compiler APIs and npm advisories. See TYPESCRIPT.txt/LINTING.txt.

    Human license names follow https://www.gnu.org/licenses/license-list.html:
    display Expat License for SPDX MIT. Preserve original copyright, legal text,
    crate metadata, and machine SPDX identifiers. cargo-about covers Rust.
    Container applications/OS packages retain their additional upstream licenses.

PORTABILITY

    All first-party files/state live below stack/. Standard host integration:
    packages, subordinate UID/GID allocations, one low-port sysctl, user linger,
    systemd user-service link. Host SSH keys, firewall policy, accounts, and disks
    are host administration, excluded from application exports.

    Releases include static x86_64 Linux management/chat commands, WASM browser
    crypto, exact corresponding sources, native linux/amd64 container images.
    Compatible x86_64 Linux hosts can run them. ARM needs a native release build;
    production rejects mismatched images. Development may fetch/build native
    images on architecture mismatch. Public container/Rust sources permit new
    targets without restoring an OS.

    Preserve upstream whitespace/line endings in generated third-party legal
    texts. .gitattributes exempts only THIRD-PARTY-LICENSES.html from whitespace
    errors. First-party checks stay strict; workspace audits cover every member.

STATIC ASSET CACHING

    Main-site stylesheet URLs include web/styles.css SHA-256 as query version.
    Update both website templates after CSS changes. Render test checks the
    published hash, preventing stale CSS/new markup pairs. Tooltip text uses
    native hidden plus CSS visibility, so stylesheet failure cannot expose it.