devos/Docs/devos-v1/14-AGENTS.md

# AGENTS.md — DevOS Coding Rules

## Mission
Build DevOS as a maintainable modular monolith and preserve the Resource + Action + Event + Agent architecture.

## Mandatory Rules
1. TypeScript strict mode.
2. Never use `any` unless explicitly justified.
3. All API endpoints use DTOs.
4. Controllers contain transport concerns only.
5. Business logic belongs in services/domain/application layers.
6. Every mutation requires an audit record.
7. Every credential is encrypted at rest.
8. Secrets must never appear in logs or model context unless explicitly required and policy-approved.
9. UI uses Ant Design / ProComponents unless there is a documented exception.
10. Every feature must have an API contract.
11. Every module must have tests appropriate to its risk.
12. Do not introduce dependencies without justification.
13. Provider-specific behavior belongs behind integration adapters.
14. Long-running work must be asynchronous.
15. External operations require timeout and explicit failure handling.
16. HIGH/CRITICAL AI actions require approval.
17. Security controls cannot be bypassed by UI, API, MCP or Agent paths.
18. Preserve workspace isolation.
19. Prefer idempotent operations.
20. Update documentation when changing a domain contract.

## Development Sequence
```text
Requirement
 ↓
Domain Model
 ↓
API Contract
 ↓
UI / Interaction
 ↓
Tests
 ↓
Implementation
 ↓
Verification
 ↓
Documentation
```

## Definition of Done
A feature is not done until:
- type checks pass
- tests pass
- API contract is documented
- authorization is enforced
- audit behavior is implemented where applicable
- error handling exists
- UI states cover loading/empty/error/success
- documentation is updated