# AGENTS.md for platform

This file applies to `platform/`.

## Backend Structure

Keep definitions out of business logic:

- Request/response structs go in `dto/` or a dedicated contract package.
- Database tables go in `model/` with field comments and tags before migrations or repositories reference them.
- API route declarations and handlers go in `api/`.
- Business aggregates and value objects go in `domain/`.
- Protocol payloads go in `protocol/`.
- Shared helper functions go in `shared/` only when at least two packages need them.

## API Rules

Every HTTP/API handler must have OpenAPI-style comments when implemented. Request bodies, response bodies, and errors must reference named DTO structs.

## Database Rules

Prefer model-first table definitions. Do not define table schemas only inside migration SQL. Migrations may use raw DDL only when the model remains the source of truth.

## Platform Boundaries

Plugins and platform_web must never receive run credentials, raw host paths, or AI provider keys. All access must pass through platform authorization and bounded DTOs.