DevOS v1 + Phase 2: unified resource model, infra ops, website deployment, AI chat ops

- Monorepo: NestJS API (Fastify) + React web (antd/ProComponents) + shared packages
- PostgreSQL/Prisma (unified resources, relations graph, audit, events, jobs)
- Auth/RBAC/workspace isolation, credential vault (AES-256-GCM)
- Servers/SSH, Docker discovery & lifecycle, Job Center
- Websites & deployments (git provider credential clone, env, health verification)
- Domains/DNS (Cloudflare adapter), certificates (TLS probe), monitoring
- Automation (cron/event/webhook HMAC + notifications), AI Gateway, MCP (29 tools)
- AI chat window (LLM function-calling + rules fallback, SSE streaming, approvals)
- Notes: Vditor WYSIWYG markdown editor, non-blocking autosave
- Tests: 35 unit/security tests; UI audit clean (desktop+mobile, deep links)

Docs/devos-v1/14-AGENTS.md

@@ -0,0 +1,56 @@
+# AGENTS.md — DevOS Coding Rules
+
+## Mission
+Build DevOS as a maintainable modular monolith and preserve the Resource + Action + Event + Agent architecture.
+
+## Mandatory Rules
+1. TypeScript strict mode.
+2. Never use `any` unless explicitly justified.
+3. All API endpoints use DTOs.
+4. Controllers contain transport concerns only.
+5. Business logic belongs in services/domain/application layers.
+6. Every mutation requires an audit record.
+7. Every credential is encrypted at rest.
+8. Secrets must never appear in logs or model context unless explicitly required and policy-approved.
+9. UI uses Ant Design / ProComponents unless there is a documented exception.
+10. Every feature must have an API contract.
+11. Every module must have tests appropriate to its risk.
+12. Do not introduce dependencies without justification.
+13. Provider-specific behavior belongs behind integration adapters.
+14. Long-running work must be asynchronous.
+15. External operations require timeout and explicit failure handling.
+16. HIGH/CRITICAL AI actions require approval.
+17. Security controls cannot be bypassed by UI, API, MCP or Agent paths.
+18. Preserve workspace isolation.
+19. Prefer idempotent operations.
+20. Update documentation when changing a domain contract.
+
+## Development Sequence
+```text
+Requirement
+ ↓
+Domain Model
+ ↓
+API Contract
+ ↓
+UI / Interaction
+ ↓
+Tests
+ ↓
+Implementation
+ ↓
+Verification
+ ↓
+Documentation
+```
+
+## Definition of Done
+A feature is not done until:
+- type checks pass
+- tests pass
+- API contract is documented
+- authorization is enforced
+- audit behavior is implemented where applicable
+- error handling exists
+- UI states cover loading/empty/error/success
+- documentation is updated