# Agent Foundation Implementation Plan

> **For agentic workers:** Use superpowers:executing-plans to implement this plan inline, task by task.

**Goal:** Establish the approved contributor guidance and privacy boundaries.

**Architecture:** Keep AGENTS.md concise and authoritative. Separate product,
architecture, data policy, and delivery sequence into linked documents.

**Tech Stack:** Markdown and Git; the application will use Python, Django,
PostgreSQL, Docker Compose, and pytest.

**Spec:** [Approved foundation design](../specs/2026-09-06-agent-foundation-design.md).

## Global constraints

- The project is named Gizmoduck and is the clean successor to Robopato.
- The backend uses Python and Django.
- Persistent storage uses PostgreSQL with migrations from the beginning.
- Local infrastructure uses Docker Compose.
- Automated tests use pytest.
- Bank-account transactions are imported from CSV.
- Credit-card transactions are imported from Banco do Brasil/Ourocard TXT.
- OFX is not supported.
- Parsing, normalization, validation, duplicate detection, preview, and
  persistence remain separate stages.
- Real financial data and secrets must never enter Git.
- Preserve existing README and ignore-file content while making targeted updates.

## Task 1: Publish contributor and project guidance

**Files:** Create AGENTS.md, docs/product.md, docs/architecture.md,
docs/data-policy.md, docs/roadmap.md; update README.md.

**Interfaces:** Consumes the approved spec; produces linked contributor policy.

- [x] Write AGENTS.md with binding constraints, reading order, operating rules,
  local commit identity, and links to the four project documents.
- [x] Write product scope and exclusions, architecture boundaries, permitted
  Robopato access and local-data locations, and milestone acceptance criteria.
- [x] Link the documents from README and align its architecture language with
  the approved binding choices.
- [x] Check that every relative Markdown link resolves and review all documents
  against the approved spec for contradictions and unresolved policy choices.

## Task 2: Verify data exclusions and readiness

**Files:** Update .gitignore only where approved protections are missing.

**Interfaces:** Consumes data-policy locations; produces Git exclusion rules.

- [x] Exclude raw financial CSV/TXT/PDF and database dump formats, keeping
  explicitly synthetic fixture paths trackable. Preserve existing rules.
- [x] Use git check-ignore with representative paths under each local-data
  directory, secret and dump formats, and synthetic fixtures. Confirm raw data
  is ignored and synthetic fixtures remain trackable without creating real data.
- [x] Run git diff --check; verify repository-local user.name and user.email
  equal Codex and codex@localhost; inspect changed files for secrets/data.
- [x] Report the completed foundation and next application-skeleton milestone.
  Leave existing user edits and new documents available for review locally.