Skip to content

AGENTS.md

Latest commit

 

History

History
50 lines (44 loc) · 2.64 KB

AGENTS.md

File metadata and controls

50 lines (44 loc) · 2.64 KB
Raw

AGENTS.md

Cross-agent guidance for this repository, readable by any coding agent (Claude, Codex, Cursor, opencode, and others). This is the static homepage for Contextual Wisdom Lab — plain HTML/CSS/JS served via GitHub Pages (index.html, styles.css, i18n.js; no build step, no package manager). Preview locally with python3 -m http.server 4173.

Agent guidance (CWL governance)

Security & review gate

  • Every PR runs a central Security Scan required gate: osv-scan + dependency-review (diff-scoped) and trivy-fs (repo-wide, CRITICAL/HIGH, fixable only). It runs against every PR base, including stacked PRs.
  • A failing trivy-fs is a REAL finding, not a flake. Read the job log (it prints each finding's rule id / severity / file) or the run's SARIF results, then remediate — do NOT weaken, ignore, or disable the gate.
  • This repo is a static site with no package.json, lockfile, Dockerfile, or k8s manifests, so trivy-fs here most likely flags a checked-in secret or a misconfiguration in a committed config file. Fix it at the source (remove/rotate the secret, correct the config). Only for a genuine false positive, add a narrow, documented .trivyignore (or .trivyignore.yaml) entry explaining why.
  • Reproduce locally against the merge ref, not just the PR head, and refresh the DB first so a stale local DB doesn't miss findings: 
    trivy --download-db-only
trivy fs --severity CRITICAL,HIGH --ignore-unfixed .
  • The org code_scanning ruleset is intentionally CodeQL-only (multiple code-scanning tools can't converge on one PR ref). Gating is enforced by the Security Scan job result, not the code_scanning rule — do not add tools to that rule.

Code exploration

  • This repo has no .codegraph/ index, so use normal search (grep/find, editor search) to locate and understand code. If a .codegraph/ directory is ever added at the repo root, prefer CodeGraph (codegraph explore "<query>", or the code-review-graph MCP tools) BEFORE grep/find — it surfaces callers/callees/impact that text search misses.

Code-owner review gates — disabled (on hold)

As of 2026-08-04, code-owner review requirements (require_code_owner_reviews in branch protection, require_code_owner_review in rulesets) are disabled across the ContextualWisdomLab org: there is a single maintainer (solo developer), so a code-owner approval gate can never be satisfied. This is ON HOLD until the org has multiple maintainers — do NOT re-enable these settings or add CODEOWNERS-based merge gates before then.