CTRL-REPO-CLIENT-01: Repository-local agent controls for thoth-client

[ja573]

Owning issue: #54
Parent programme: thoth-pub/thoth#818
Shared doctrine merge: thoth-pub/thoth@ec7868a (thoth-pub/thoth#820)

Objective

Add a root AGENTS.md applying Thoth's merged shared engineering-control doctrine to this repository — the standalone Python thothlibrary client — without changing package, public API, runtime, CI, release or publication behaviour.

Base and branch

Authorized base:  develop @ 9d3aae2dc05fca3bcdf09236719145a1759a508c
Actual base:      9d3aae2dc05fca3bcdf09236719145a1759a508c
Task branch:      feature/engineering/ctrl-repo-client-01
PR target:        develop

Changes

File	Change
AGENTS.md	Added (410 lines)

No other path modified. No deletion, move or rename.

Content

The file records:

1. repository identity — the standalone Python thothlibrary distribution, explicitly distinguished from the internal Rust thoth-client workspace member inside thoth-pub/thoth;
2. pointers to the canonical shared doctrine, with the owning issue as live task ledger, deny-by-default and granular non-transitive authorization, and no self-approval;
3. verified branch topology (develop development, master default/release; conforms to the shared develop -> master pattern);
4. mandatory task identity required before substantive work;
5. the GraphQL boundary — ThothClient in thothlibrary/client.py, default endpoint https://api.thoth.pub, /graphql path, schema version 1.0.0, bearer PAT injection, and explicitly queries and mutations, so live mutations are external writes requiring separate authorization;
6. the REST/export boundary — ThothRESTClient in thothlibrary/rest.py, format/specification/platform discovery and work/publisher export routes, and the upstream changes that may require compatibility work here;
7. cross-repository compatibility, including that external consumers of published thothlibrary are not fully enumerable from Thoth's repositories;
8. public Python package/API and versioning considerations;
9. safe validation using the repository's actual test path only;
10. the prohibition on building package artefacts for a documentation-only task;
11. the verified .github/workflows/tests.yml triggers and scope;
12. the verified .github/workflows/publish-to-pypi.yml release: published trigger — publishing a GitHub release is also a PyPI publication;
13. secrets and external-effect rules;
14. exact-head independent review;
15. HOLD/STOP conditions.

Validation

git diff --cached --check                                       -> clean (exit 0)
git diff --name-status <base> HEAD                              -> A  AGENTS.md  (only)
python3 -m unittest thothlibrary.tests.test_rest \
    thothlibrary.thoth-1_0_0.tests.tests                        -> Ran 26 tests, OK (0.040s), Python 3.11.6

No package build artefacts were created (dist/, build/, *.egg-info absent). No live API call, no credential use, no release, tag or publication.

Automatic side effects

Opening this PR triggers the Tests workflow. It does not trigger the PyPI workflow, which requires a published GitHub release.

Status

Draft. Independent exact-head review is required before merge. Merge, release, tag and PyPI publication are not authorized under this task.

🤖 Generated with Claude Code