clawker: Instructions file for GitHub Copilot

Copilot code review instructions

You review pull requests for this repository. AGENTS.md at the repository root, the package AGENTS.md files, and the Serena memories under .serena/memories/ are the coding standard. This file tells you what to look for first and how to write each comment.

Read the head branch of the pull request. Compare every added or changed line against the priorities below, in order.

Priority 1: lint suppression

Flag every added or changed lint suppression. One comment per occurrence.

Markers to find in the diff:

• //nolint and // nolint (with or without a linter list)
• #nosec
• //lint:ignore
• Changes to exclusions, exclude, or nolintlint settings in .golangci.yml

The repository rule (.serena/memories/conventions.md) is: do not add a lint suppression without explicit maintainer approval. Correct the code so the linter passes. An explanation text after the marker is not sufficient on its own. In each comment:

1. Quote the marker and the linter it silences.
2. State that the rule requires maintainer approval.
3. Propose the code change that removes the need for the suppression.

Priority 2: control plane servers and listeners

Applies to new or changed calls to grpc.NewServer, net.Listen, net.ListenConfig, http.Server, and ListenAndServe in these paths:

• controlplane/**
• internal/controlplane/**
• cmd/clawkercp/**
• clawkerd/**

The canonical authorization code is controlplane/auth:

• auth.NewAuthInterceptor builds the interceptor from a Hydra introspector and a method-to-scope map.
• AuthInterceptor.UnaryInterceptor, AuthInterceptor.StreamInterceptor, and AuthInterceptor.GRPCServerOptions attach it to a gRPC server.
• controlplane/server/grpc_stack.go shows the required chain order: recovery interceptor, then ready-gate interceptor, then auth interceptor.

Report each of these as a blocking finding:

• No auth. A gRPC server on the admin or agent surface without the controlplane/auth interceptor chain. A hand-written token check, a header check, or a copy of the interceptor logic is not acceptable; the server must use controlplane/auth.
• Reused auth material. A listener that loads certificate, key, or CA files that belong to another lane, or that shares a tls.Config with another lane. Each listener has its own certificate lane in its own subpackage (controlplane/infracerts, controlplane/otelcerts, controlplane/sdscerts are the pattern). See "Why not otelcerts" in controlplane/sdscerts/AGENTS.md.
• mTLS without a pin. A listener that uses client certificates instead of bearer tokens must set ClientAuth: tls.RequireAndVerifyClientCert and pin the peer CN or SAN in VerifyPeerCertificate. clawkerd/listener.go is the reference. The pull request description must say why bearer authorization does not apply to that listener.
• Crash path. panic, log.Fatal, or os.Exit on the control plane boot or serve path, or a serve goroutine without a recover. See the CP failure rules in controlplane/AGENTS.md. A degraded subsystem must emit a structured log line with event=<subsystem>_unavailable.