# Agent instructions

You are operating against Clanker Test.

## Prefer these files

1. `/llms.txt` — index
2. `/openapi.json` — public HTTP contract
3. `/guides/public-api.md` and `/guides/agents.md`
4. MCP tool `read_validation_kit` before writing tests

## Call paths

- Humans use the website. The website calls `@clanker-test/services` in-process. Do not scrape the UI for an HTTP contract.
- Agents and other HTTP clients use the public API origin (`:3200` local, `api.qa.clankertest.net`, `api.clankertest.com`).
- Every signed-in website action has a `/v1` equivalent that runs the same Effect services and permission checks.

## Auth

Create a hashed user API key on the website (Security settings). Send it on `/v1`:

```
Authorization: Bearer ctk_…
```

or `X-API-Key: ctk_…`.

Google OAuth and email/password stay website-only. Agent MCP uses a separate OAuth access token against `{API_URL}/agent/mcp`. Do not send API keys to MCP, and do not send agent `atk_` tokens to `/v1`.

## Do not

- Call the website origin for `/v1`, MCP, token, or register.
- Cache a packaged validation kit. Read it from MCP or `POST /agent/v1/validation-kit:read`.
- Sign in on `/v1/auth`. That surface does not exist.