[tobyhede]

Requested by Toby

Moves the working rules agents have been following for this repo into the repo itself, so every tool and contributor sees them, and fixes one doc that told agents to do the opposite.
Each item was checked against main's code, config or GitHub settings before writing it down.

• docs/agents/issue-tracker.md: it told agents to put CIP-#### keys in PR titles and bodies. The repo is public and Linear is private, so it now says never to, and to link the PR from the Linear side.
• AGENTS.md:
  • New "Commits and pull requests" section: no private issue keys, no agent session links, signed commits (the main ruleset requires them), no git filter-branch, and comment before pushing to a PR under review.
  • Short rules: failing test before a bug fix, spec and tickets before implementation, and release/2.2 fixes are re-implemented rather than cherry-picked.
  • The CI monitor step now gives a REST fallback (commits/<sha>/check-runs) for environments where gh pr checks can't use GraphQL.
• DEVELOPMENT.md:
  • "Merging into main": the required Build (Rust MSRV) check, one approval, signed commits, approvals not dismissed on push, and the extra-approval rule for unattributed changes. Read from the branch protection and ruleset APIs.
  • mise run test stops at the first failing stage, so a failing unit test hides the integration results.
  • Patch releases from an older line such as release/2.2: manual steps, and --latest=false / flavor: latest=false so Docker's latest stays on the current line. Note that release/2.2's release.yml does not set latest=false today.
• Proxy CONTEXT.md: a bare table name in more than one loaded schema does not resolve (Schema::resolve_table uses find_unique), and DO and CALL are forwarded as written (requires_type_check excludes them).
• tests/mise.tcp.toml, tests/mise.tls.toml: removes CS_DEVELOPMENT__ENABLE_MAPPING_ERRORS = "true". tests/docker-compose.yml never passed it to the Proxy container, and the default is false (config/tandem.rs), so integration tests already ran with mapping errors off. CI behaviour doesn't change. A Proxy started locally with mise --env tcp run proxy no longer gets it either, which now matches CI. Also fixes the stale doc comment in select/unmappable.rs that said the setting should be true.

Not included: anything that only rested on a single observation, and the conventional-commit / no-trailer commit style, which is still to be decided.

Acknowledgment

By submitting this pull request, I confirm that CipherStash can use, modify, copy, and redistribute this contribution, under the terms of CipherStash's choice.

---

Generated by Claude Code

[cipherstash-agent]

Review attestation — automated review via /code-review medium + company-skills:cross-check-review-findings, run against head 3abd3b3. No existing reviews or comments on the PR, so nothing was deduplicated.

Critical / blocking: none.

Verified against the head commit:

• ENABLE_MAPPING_ERRORS is no longer set anywhere under tests/, .github/ or the mise configs, and the default is false (config/tandem.rs:420), so removing it from mise.tcp.toml / mise.tls.toml doesn't change CI behaviour.
• requires_type_check (eql-mapper/src/eql_mapper.rs:61) excludes DO and CALL, matching the new CONTEXT.md text.
• Schema::resolve_table uses find_unique (eql-mapper/src/model/schema.rs:196).
• mise run test runs hygiene, then unit, then integration in sequence (mise.toml:133), matching the new DEVELOPMENT.md text.

Two minor, non-blocking inline notes: an over-broad doc comment in unmappable.rs, and a formatting nit in AGENTS.md.

I did not verify the GitHub ruleset and branch-protection claims in DEVELOPMENT.md, or the release/2.2 release.yml behaviour. Those need repo-admin or branch access.

---

Generated by Claude Code

[cipherstash-agent]

Minor: this doc comment sits above mod tests item unmappable_table_not_found but reads as a statement about the whole file. "PostgreSQL rejects it because the table does not exist" is true only for SELECT blah FROM vtha. The other tests here (unmappable_column_not_found, unmappable_native_cannot_be_unified_with_encrypted, unmappable_syntax_error) hit an existing table and fail for other reasons (missing column, type mismatch, parse error). Consider scoping the sentence to the first test, or saying "PostgreSQL or Proxy's parser rejects it".

Source: packages/cipherstash-proxy-integration/src/select/unmappable.rs:8-10 at 3abd3b3.

---

Generated by Claude Code

[cipherstash-agent]

Nit: the inserted REST fallback is spliced into the middle of the existing line, so "It must not edit files, run formatting that changes files, commit," now trails a ~130-character line. This file's own convention (one sentence per line, no hard wrapping) would put the new sentences and "It must not edit files…" each on their own line.

Source: AGENTS.md:80-83 at 3abd3b3.

---

Generated by Claude Code