From b592ca6bdf90bd3afa899597553affc4dfcdf97c Mon Sep 17 00:00:00 2001
From: Val Alexander <bunsthedev@gmail.com>
Date: Mon, 6 Jul 2026 03:31:16 -0500
Subject: [PATCH] docs: add AGENTS.md + CLAUDE.md agent-contributor guidance

Canonical entry point for agents opening PRs against the hosted webhook
forwarder: branch/PR workflow, thin-forwarder invariants (always verify
the GitHub webhook signature, no secrets in the repo), and contributor
attribution (GitHub-linked Co-authored-by trailer, numeric-id no-reply
form, never a .local email). CLAUDE.md points at AGENTS.md.
---
 AGENTS.md | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 CLAUDE.md | 10 ++++++++
 2 files changed, 78 insertions(+)
 create mode 100644 AGENTS.md
 create mode 100644 CLAUDE.md

diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..c37b4b3
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,68 @@
+# AGENTS.md — coven-github-webhook
+
+Guidance for **AI agents** (Codex, Claude Code, and any Coven familiar) opening
+pull requests against this repo. This is the agent-specific layer; read
+[`README.md`](README.md) for what this deployment bundle is.
+
+> **What this repo is:** the hosted webhook deployment bundle for the
+> `coven-github` integration — the small always-on service that receives GitHub
+> webhook events and forwards them to the Coven GitHub App backend.
+
+## Branch & PR workflow
+
+- **Never push to `main`.** Every change lands via a PR. Branch from current
+  `origin/main`.
+- **Fresh branch per task**; use a worktree if multiple sessions may touch this
+  repo:
+  ```sh
+  git fetch origin main
+  git worktree add -b <branch> /tmp/ghwebhook-<branch> origin/main
+  ```
+- Keep the diff scoped to one concern; conventional-commit subjects (`feat:`,
+  `fix:`, `docs:`, `chore:`, `refactor:`).
+- After merge: delete the remote branch, remove your local worktree/branch.
+
+## Before opening the PR
+
+- If you touched Python, keep it runnable on the target host: no new heavy deps
+  unless the deployment target supports them, and don't break the entrypoint.
+- Smoke-test the webhook handler locally where possible (a signed sample
+  payload) before relying on the hosted deploy.
+
+## Repo-specific invariants (don't break these)
+
+- This is a **thin hosted forwarder**, not the app logic. Familiar/authority and
+  GitHub-App behavior lives in `coven-github` — don't reimplement it here.
+- **Never commit webhook secrets, signing secrets, App private keys, or tokens.**
+  Configuration comes from the deploy environment, not the repo.
+- **Always verify the GitHub webhook signature** (`X-Hub-Signature-256`) before
+  acting on a payload. Don't add code paths that skip verification.
+
+## Attribution — credit contributors correctly
+
+When you re-land or build on someone else's work (a fork PR, an issue author's
+proposal, a co-author), **credit the human contributor with a working
+GitHub-linked trailer** so they appear in the contributors graph and on their
+profile:
+
+```
+Co-authored-by: Full Name <ID+username@users.noreply.github.com>
+```
+
+- Use the **numeric-id no-reply form**. Get the id with `gh api users/<login> --jq .id`.
+- **Never** use a machine or `.local` email (e.g. `name@Someones-Mac.local`) in a
+  co-author trailer — it links to no account and gives **zero** credit.
+- When a squash-merge folds a contributor's PR into an internal branch, preserve
+  their `Co-authored-by:` line in the squash commit message.
+- Credit **people**, not AI tools.
+
+## Secrets & safety
+
+- Never commit secrets, tokens, or private emails. Use `*.noreply.github.com`
+  for attribution.
+- Don't weaken signature verification or deployment safeguards to land a change;
+  surface the blocker instead.
+
+## Claude Code
+
+`CLAUDE.md` points here — this file is the source of truth for both.
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..68f4f44
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,10 @@
+# CLAUDE.md — coven-github-webhook
+
+**Read [`AGENTS.md`](AGENTS.md).** It is the canonical guide for AI agents
+(including Claude Code) contributing to this repo — the branch/PR workflow, the
+thin-forwarder invariants (verify webhook signatures, no secrets in the repo),
+and contributor attribution.
+
+Claude Code auto-loads this file; everything you need lives in `AGENTS.md` plus
+[`README.md`](README.md). There is no separate Claude-only workflow — follow
+`AGENTS.md`.