- clarify frontend may only rely on backend-issued session token cookie for auth - forbid frontend browser storage for domain/business data - require backend-mediated LLM calls across agent workflows
Add five custom agent files to .github/agents/: - orchestrator.agent.md — end-to-end delivery pipeline (classify, branch, plan, implement, commit, version bump, PR) - planner.agent.md — read-only technical lead; produces ordered TDD implementation plans - backend.agent.md — Kotlin/Spring Boot specialist (services, controllers, JPA, scheduler) - frontend.agent.md — React/TypeScript specialist (components, pages, hooks, shadcn/ui) - infra.agent.md — DevOps/architecture owner (Docker, Compose, Nginx, CI/CD, env vars)
