From 340c66bce4dd781166163aaa5634d5a358a1b1fb Mon Sep 17 00:00:00 2001 From: Brion Date: Fri, 11 Sep 2026 13:51:30 +0530 Subject: [PATCH] Point agent instructions at the SDK development specification Signed-off-by: Brion --- AGENTS.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index d2547d9..2ed976d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -4,6 +4,27 @@ Flutter plugin providing the ThunderID authentication SDK (`thunderid_flutter`). Bridges to native iOS (`ThunderID` Swift SDK) and Android (`dev.thunderid:android`) via a `MethodChannel`. The `samples/quickstart` directory contains a standalone demo app. +## SDK development specification + +Every change to this SDK goes through the ThunderID SDK development specification. It is +maintained in the product repository and governs all four SDK repositories, so it is linked +here rather than copied. + +- [SDK development specification](https://github.com/thunder-id/thunderid/blob/main/docs-internals/sdk-development/spec.md): + the contract this SDK implements. Layering, operational modes, configuration keys, client + surface, error model, security floor, platform packaging, testing, and the cross-SDK parity + rules. +- [SDK threat model](https://github.com/thunder-id/thunderid/blob/main/docs-internals/sdk-development/threat-model.md): + the security posture the specification's floor comes from. +- [`sdk-development` skill](https://github.com/thunder-id/thunderid/blob/main/.agent/skills/sdk-development/SKILL.md): + loads both documents and drives the work, from locating the SDK checkouts through validation + to raising the linked pull requests. + +Read the specification before adding or changing an operation, configuration key, error, or UI +component. A capability that lands here usually needs to land in the sibling SDKs too, and the +pull request has to answer that question either way, by linking the sibling pull requests or +by saying why they are not needed. + ## Vendor naming rules The SDK is white-labelable: a consuming app can override the brand/vendor namespace via `ThunderIDConfig.vendor`, so storage keys, log tags, and similar runtime names shouldn't be pinned to one brand.