{"owner":"apache","repo":"thrift","hasSkills":true,"totalSkillsCount":1,"totalTokensCount":2242,"categories":["root-instruction"],"hasMcp":false,"mcpConfig":null,"found":["AGENTS.md"],"skills":{"AGENTS.md":"# Apache Thrift — AI Contribution Guidelines\n\nThis file governs AI-assisted work on the Apache Thrift codebase.\nIt supplements but does **not** replace [`CONTRIBUTING.md`](CONTRIBUTING.md).\n\n---\n\n## 1. ASF Legal Compliance (Third-Party Code)\n\nApache Thrift is an [Apache Software Foundation (ASF)](https://www.apache.org/) project released under the **Apache License 2.0**.\nThe AI **must** actively enforce and monitor ASF licensing policy:\n\n- **Proactively flag conflicts**: Before introducing any dependency, snippet, or code derived from an external source, verify its license is compatible with Apache 2.0.\n Incompatible licenses include (non-exhaustive): GPL, AGPL, SSPL, BUSL, CC-BY-NC.\n Compatible examples: MIT, BSD-2/3, Apache 2.0, ISC, MPL 2.0 (with caveats).\n- **Category X / Category A**: Follow the [ASF Third-Party Licensing Policy](https://www.apache.org/legal/resolved.html).\n Category A licenses may be included; Category X licenses must **never** be introduced.\n- **Update `LICENSE` and `NOTICE`**: When adding third-party code or binaries that require attribution, add the appropriate notices to `LICENSE` and/or `NOTICE` following the [ASF guide on licenses and notices](https://www.apache.org/dev/licensing-howto.html).\n If in doubt whether an entry is required, **add it and flag it in the PR description** for committer review.\n- **Generative AI output**: The [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) applies. Be aware that AI-generated code may unintentionally reproduce copyrighted material. Flag any non-trivial generated blocks in commit messages or PR descriptions.\n\n---\n\n## 2. Issue Tracking\n\n| Type | Tracker | Notes |\n|---|---|---|\n| Significant changes | [Apache JIRA — THRIFT project](https://issues.apache.org/jira/browse/THRIFT) | Required for all non-trivial PRs |\n| Minor / quick fixes | GitHub Issues | Typos, trivial compiler warnings, etc. |\n\n**JIRA integration with GitHub**: Including a JIRA ticket identifier at the start of a PR title automatically creates a link from JIRA to the PR.\n\n- PR title format: `THRIFT-9999: Short description of the change`\n- Commit message format (required for code changes):\n ```\n THRIFT-9999: Short description of the change\n Client: cpp,py,java (comma-separated list of affected languages)\n ```\n\nExample: [THRIFT-5929](https://issues.apache.org/jira/projects/THRIFT/issues/THRIFT-5929) → [PR #3350](https://github.com/apache/thrift/pull/3350).\n\n---\n\n## 3. Pull Request Requirements\n\nFollow [`CONTRIBUTING.md`](CONTRIBUTING.md) in full. Key points:\n\n- One commit per issue (squash before submitting).\n- All significant changes need a JIRA ticket.\n- Provide tests for every submitted change.\n- Verify coding standards: `make style`.\n- Branch name convention: use the JIRA ticket ID, e.g. `THRIFT-9999`.\n- PRs go from your fork branch → `apache:master`.\n\n---\n\n## 4. AI-Generated Contributions\n\nPer [`CONTRIBUTING.md § AI generated content`](CONTRIBUTING.md#ai-generated-content) and the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html):\n\n- **Always** label AI-assisted commits and PRs. Use one or both of:\n ```\n Co-Authored-By: \n Generated-by: \n ```\n Example:\n ```\n THRIFT-9999: Fix connection timeout handling in Go client\n Client: go\n\n Co-Authored-By: Claude Sonnet 4.6 \n ```\n- Apply this label even when AI only generated a portion of the change.\n- **Never** put tool-internal links into a commit message, PR description, JIRA comment or e-mail.\n This includes AI session and conversation URLs — `Claude-Session:`,\n `https://claude.ai/code/session_…`, `https://chatgpt.com/c/…` and any equivalent from another\n tool. Some assistants append one by default; that default does not apply to this project and\n must be overridden. The attribution line above is the whole of what belongs in a trailer block.\n Such a link is permanent once it reaches git history, means nothing to a reviewer, and may point\n at material that is not public — including work still under embargo per §6. Note that a\n force-push does not undo this: the superseded commit stays reachable by SHA.\n- The human author remains responsible for reviewing, testing, and standing behind all submitted code.\n\n---\n\n## 5. Language-Specific Rules (`/lib`, `/test`, `/tutorial`)\n\n- This file remains valid in all cases and must be used in addition to any additional language-specific rules.\n- If a target-language directory under `/lib//` contains its own `CLAUDE.md` or `AGENTS.md`, those rules apply to all work in that language directory.\n- Those language-specific rules extend **by implication** to the corresponding language code under `/test/` and `/tutorial/`.\n- If `/test/` or `/tutorial/` themselves contain a `CLAUDE.md`/`AGENTS.md` for a given language, **combine** the rules: the file **closer to the code** (i.e., in the same directory) takes precedence on any conflict.\n\n---\n\n## 6. Security Work\n\nWhen assisting with security-sensitive changes (transport size limits, TLS configuration,\nauthentication, serialization bounds, or anything flagged by the project's security team):\n\n- **Never** describe the change as a security fix in public-facing text — commit messages,\n PR titles, PR descriptions, or inline comments. Use neutral functional language:\n *\"add a configurable frame-size limit\"* rather than *\"fix DoS vulnerability\"*.\n Vulnerability details travel through the private ASF channel (`security@apache.org`);\n AI tooling must not short-circuit that process.\n- Before proposing mitigations or defaults, consult\n [`doc/thrift-threat-model.md`](doc/thrift-threat-model.md) for the project's documented\n attack surface, trust boundaries, and per-binding security properties.\n- External reporters and AI reviewers alike should follow the instructions in\n [`SECURITY.md`](SECURITY.md) for responsible disclosure.\n- When asserting a security claim or identifying which component a bug affects, \n verify reachability/exploitability empirically against the specific released version before stating it as fact.\n\n---\n\n## 7. Code Changes, Git & PR Workflow\n\n- When fixing a bug or addressing an issue, scope the change to ONLY that issue. \n Do not touch CHANGES.md, version files, or unrelated entries unless explicitly asked.\n- Ship bug fixes as standalone pull requests by default. Do not commit directly to master \n or mix fixes into existing/unrelated work unless told otherwise.\n- Follow a strict test-first workflow: write or update tests demonstrating the bug BEFORE applying the fix, \n and inspect any generated code before changing it.\n- **Prose-only changes skip CI.** A commit that only edits the text of existing documentation\n files ends its subject line with `[skip ci]`, and the PR title carries it too:\n ```\n THRIFT-9999: Clarify the TLS options in lib/cpp/README.md [skip ci]\n ```\n GitHub then runs none of the `push` and `pull_request` workflows for it, and AppVeyor skips\n the build.\n - Only the subject line works for both: AppVeyor ignores the rest of the message. A squash\n merge of several commits takes its subject from the PR title.\n - Not prose-only, so no marker: source code, comments and doc comments included; build,\n packaging and CI files; tests and test data (`compiler/cpp/test/compiler/DocTest.md` is a\n golden file, not documentation); adding, removing or renaming a file. `EXTRA_DIST` in the\n `Makefile.am` files lists documentation files by name: a removed or renamed one breaks the\n `make dist` job, and a new one needs an entry of its own, which no CI job asks for. Several\n package manifests name a README, too. When in doubt, leave the marker out.\n - The marker can skip CI for everything pushed along with it, so push a marked commit on its\n own. When a review round adds anything but prose, drop the marker as you amend.\n - GitHub also matches the marker when it is quoted. A commit that is not prose-only must not\n contain it, or GitHub's variants `[ci skip]`, `[no ci]`, `[skip actions]` and\n `[actions skip]`, anywhere in its message. A squash message built from a PR description\n picks it up from the checklist in the PR template.\n - The marker also stops the tool-internal links check (§4) from running, so check the commit\n message (`git log --format=%B`) and the PR text yourself before pushing.\n\n---\n\n## 8. Quick Reference Checklist (before opening a PR)\n\n- [ ] License of any new dependency checked against [ASF Category A/X list](https://www.apache.org/legal/resolved.html)\n- [ ] `LICENSE` and/or `NOTICE` updated if third-party attribution is required\n- [ ] JIRA ticket exists (unless truly trivial)\n- [ ] PR title starts with `THRIFT-NNNN:` (if ticket exists)\n- [ ] Commit message includes affected `Client:` languages\n- [ ] Single squashed commit\n- [ ] Prose-only change: `[skip ci]` ends the commit subject and the PR title; any other change: no such marker anywhere in the commit message\n- [ ] Tests added or updated\n- [ ] `make style` passes\n- [ ] AI authorship labelled with `Co-Authored-By:` / `Generated-by:` where applicable\n- [ ] No tool-internal or AI session URLs anywhere in the commit message or PR text\n- [ ] Security-sensitive changes use neutral commit/PR language (no public vulnerability details)\n- [ ] Changes touching transport limits / TLS / auth cross-checked against `doc/thrift-threat-model.md`\n"},"files":{"AGENTS.md":"# Apache Thrift — AI Contribution Guidelines\n\nThis file governs AI-assisted work on the Apache Thrift codebase.\nIt supplements but does **not** replace [`CONTRIBUTING.md`](CONTRIBUTING.md).\n\n---\n\n## 1. ASF Legal Compliance (Third-Party Code)\n\nApache Thrift is an [Apache Software Foundation (ASF)](https://www.apache.org/) project released under the **Apache License 2.0**.\nThe AI **must** actively enforce and monitor ASF licensing policy:\n\n- **Proactively flag conflicts**: Before introducing any dependency, snippet, or code derived from an external source, verify its license is compatible with Apache 2.0.\n Incompatible licenses include (non-exhaustive): GPL, AGPL, SSPL, BUSL, CC-BY-NC.\n Compatible examples: MIT, BSD-2/3, Apache 2.0, ISC, MPL 2.0 (with caveats).\n- **Category X / Category A**: Follow the [ASF Third-Party Licensing Policy](https://www.apache.org/legal/resolved.html).\n Category A licenses may be included; Category X licenses must **never** be introduced.\n- **Update `LICENSE` and `NOTICE`**: When adding third-party code or binaries that require attribution, add the appropriate notices to `LICENSE` and/or `NOTICE` following the [ASF guide on licenses and notices](https://www.apache.org/dev/licensing-howto.html).\n If in doubt whether an entry is required, **add it and flag it in the PR description** for committer review.\n- **Generative AI output**: The [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) applies. Be aware that AI-generated code may unintentionally reproduce copyrighted material. Flag any non-trivial generated blocks in commit messages or PR descriptions.\n\n---\n\n## 2. Issue Tracking\n\n| Type | Tracker | Notes |\n|---|---|---|\n| Significant changes | [Apache JIRA — THRIFT project](https://issues.apache.org/jira/browse/THRIFT) | Required for all non-trivial PRs |\n| Minor / quick fixes | GitHub Issues | Typos, trivial compiler warnings, etc. |\n\n**JIRA integration with GitHub**: Including a JIRA ticket identifier at the start of a PR title automatically creates a link from JIRA to the PR.\n\n- PR title format: `THRIFT-9999: Short description of the change`\n- Commit message format (required for code changes):\n ```\n THRIFT-9999: Short description of the change\n Client: cpp,py,java (comma-separated list of affected languages)\n ```\n\nExample: [THRIFT-5929](https://issues.apache.org/jira/projects/THRIFT/issues/THRIFT-5929) → [PR #3350](https://github.com/apache/thrift/pull/3350).\n\n---\n\n## 3. Pull Request Requirements\n\nFollow [`CONTRIBUTING.md`](CONTRIBUTING.md) in full. Key points:\n\n- One commit per issue (squash before submitting).\n- All significant changes need a JIRA ticket.\n- Provide tests for every submitted change.\n- Verify coding standards: `make style`.\n- Branch name convention: use the JIRA ticket ID, e.g. `THRIFT-9999`.\n- PRs go from your fork branch → `apache:master`.\n\n---\n\n## 4. AI-Generated Contributions\n\nPer [`CONTRIBUTING.md § AI generated content`](CONTRIBUTING.md#ai-generated-content) and the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html):\n\n- **Always** label AI-assisted commits and PRs. Use one or both of:\n ```\n Co-Authored-By: \n Generated-by: \n ```\n Example:\n ```\n THRIFT-9999: Fix connection timeout handling in Go client\n Client: go\n\n Co-Authored-By: Claude Sonnet 4.6 \n ```\n- Apply this label even when AI only generated a portion of the change.\n- **Never** put tool-internal links into a commit message, PR description, JIRA comment or e-mail.\n This includes AI session and conversation URLs — `Claude-Session:`,\n `https://claude.ai/code/session_…`, `https://chatgpt.com/c/…` and any equivalent from another\n tool. Some assistants append one by default; that default does not apply to this project and\n must be overridden. The attribution line above is the whole of what belongs in a trailer block.\n Such a link is permanent once it reaches git history, means nothing to a reviewer, and may point\n at material that is not public — including work still under embargo per §6. Note that a\n force-push does not undo this: the superseded commit stays reachable by SHA.\n- The human author remains responsible for reviewing, testing, and standing behind all submitted code.\n\n---\n\n## 5. Language-Specific Rules (`/lib`, `/test`, `/tutorial`)\n\n- This file remains valid in all cases and must be used in addition to any additional language-specific rules.\n- If a target-language directory under `/lib//` contains its own `CLAUDE.md` or `AGENTS.md`, those rules apply to all work in that language directory.\n- Those language-specific rules extend **by implication** to the corresponding language code under `/test/` and `/tutorial/`.\n- If `/test/` or `/tutorial/` themselves contain a `CLAUDE.md`/`AGENTS.md` for a given language, **combine** the rules: the file **closer to the code** (i.e., in the same directory) takes precedence on any conflict.\n\n---\n\n## 6. Security Work\n\nWhen assisting with security-sensitive changes (transport size limits, TLS configuration,\nauthentication, serialization bounds, or anything flagged by the project's security team):\n\n- **Never** describe the change as a security fix in public-facing text — commit messages,\n PR titles, PR descriptions, or inline comments. Use neutral functional language:\n *\"add a configurable frame-size limit\"* rather than *\"fix DoS vulnerability\"*.\n Vulnerability details travel through the private ASF channel (`security@apache.org`);\n AI tooling must not short-circuit that process.\n- Before proposing mitigations or defaults, consult\n [`doc/thrift-threat-model.md`](doc/thrift-threat-model.md) for the project's documented\n attack surface, trust boundaries, and per-binding security properties.\n- External reporters and AI reviewers alike should follow the instructions in\n [`SECURITY.md`](SECURITY.md) for responsible disclosure.\n- When asserting a security claim or identifying which component a bug affects, \n verify reachability/exploitability empirically against the specific released version before stating it as fact.\n\n---\n\n## 7. Code Changes, Git & PR Workflow\n\n- When fixing a bug or addressing an issue, scope the change to ONLY that issue. \n Do not touch CHANGES.md, version files, or unrelated entries unless explicitly asked.\n- Ship bug fixes as standalone pull requests by default. Do not commit directly to master \n or mix fixes into existing/unrelated work unless told otherwise.\n- Follow a strict test-first workflow: write or update tests demonstrating the bug BEFORE applying the fix, \n and inspect any generated code before changing it.\n- **Prose-only changes skip CI.** A commit that only edits the text of existing documentation\n files ends its subject line with `[skip ci]`, and the PR title carries it too:\n ```\n THRIFT-9999: Clarify the TLS options in lib/cpp/README.md [skip ci]\n ```\n GitHub then runs none of the `push` and `pull_request` workflows for it, and AppVeyor skips\n the build.\n - Only the subject line works for both: AppVeyor ignores the rest of the message. A squash\n merge of several commits takes its subject from the PR title.\n - Not prose-only, so no marker: source code, comments and doc comments included; build,\n packaging and CI files; tests and test data (`compiler/cpp/test/compiler/DocTest.md` is a\n golden file, not documentation); adding, removing or renaming a file. `EXTRA_DIST` in the\n `Makefile.am` files lists documentation files by name: a removed or renamed one breaks the\n `make dist` job, and a new one needs an entry of its own, which no CI job asks for. Several\n package manifests name a README, too. When in doubt, leave the marker out.\n - The marker can skip CI for everything pushed along with it, so push a marked commit on its\n own. When a review round adds anything but prose, drop the marker as you amend.\n - GitHub also matches the marker when it is quoted. A commit that is not prose-only must not\n contain it, or GitHub's variants `[ci skip]`, `[no ci]`, `[skip actions]` and\n `[actions skip]`, anywhere in its message. A squash message built from a PR description\n picks it up from the checklist in the PR template.\n - The marker also stops the tool-internal links check (§4) from running, so check the commit\n message (`git log --format=%B`) and the PR text yourself before pushing.\n\n---\n\n## 8. Quick Reference Checklist (before opening a PR)\n\n- [ ] License of any new dependency checked against [ASF Category A/X list](https://www.apache.org/legal/resolved.html)\n- [ ] `LICENSE` and/or `NOTICE` updated if third-party attribution is required\n- [ ] JIRA ticket exists (unless truly trivial)\n- [ ] PR title starts with `THRIFT-NNNN:` (if ticket exists)\n- [ ] Commit message includes affected `Client:` languages\n- [ ] Single squashed commit\n- [ ] Prose-only change: `[skip ci]` ends the commit subject and the PR title; any other change: no such marker anywhere in the commit message\n- [ ] Tests added or updated\n- [ ] `make style` passes\n- [ ] AI authorship labelled with `Co-Authored-By:` / `Generated-by:` where applicable\n- [ ] No tool-internal or AI session URLs anywhere in the commit message or PR text\n- [ ] Security-sensitive changes use neutral commit/PR language (no public vulnerability details)\n- [ ] Changes touching transport limits / TLS / auth cross-checked against `doc/thrift-threat-model.md`\n"},"items":[{"name":"AGENTS.md","path":"AGENTS.md","rawUrl":"https://raw.githubusercontent.com/apache/thrift/HEAD/AGENTS.md","title":"AI Agent Protocol & Instructions","category":"root-instruction","format":"markdown","content":"# Apache Thrift — AI Contribution Guidelines\n\nThis file governs AI-assisted work on the Apache Thrift codebase.\nIt supplements but does **not** replace [`CONTRIBUTING.md`](CONTRIBUTING.md).\n\n---\n\n## 1. ASF Legal Compliance (Third-Party Code)\n\nApache Thrift is an [Apache Software Foundation (ASF)](https://www.apache.org/) project released under the **Apache License 2.0**.\nThe AI **must** actively enforce and monitor ASF licensing policy:\n\n- **Proactively flag conflicts**: Before introducing any dependency, snippet, or code derived from an external source, verify its license is compatible with Apache 2.0.\n Incompatible licenses include (non-exhaustive): GPL, AGPL, SSPL, BUSL, CC-BY-NC.\n Compatible examples: MIT, BSD-2/3, Apache 2.0, ISC, MPL 2.0 (with caveats).\n- **Category X / Category A**: Follow the [ASF Third-Party Licensing Policy](https://www.apache.org/legal/resolved.html).\n Category A licenses may be included; Category X licenses must **never** be introduced.\n- **Update `LICENSE` and `NOTICE`**: When adding third-party code or binaries that require attribution, add the appropriate notices to `LICENSE` and/or `NOTICE` following the [ASF guide on licenses and notices](https://www.apache.org/dev/licensing-howto.html).\n If in doubt whether an entry is required, **add it and flag it in the PR description** for committer review.\n- **Generative AI output**: The [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) applies. Be aware that AI-generated code may unintentionally reproduce copyrighted material. Flag any non-trivial generated blocks in commit messages or PR descriptions.\n\n---\n\n## 2. Issue Tracking\n\n| Type | Tracker | Notes |\n|---|---|---|\n| Significant changes | [Apache JIRA — THRIFT project](https://issues.apache.org/jira/browse/THRIFT) | Required for all non-trivial PRs |\n| Minor / quick fixes | GitHub Issues | Typos, trivial compiler warnings, etc. |\n\n**JIRA integration with GitHub**: Including a JIRA ticket identifier at the start of a PR title automatically creates a link from JIRA to the PR.\n\n- PR title format: `THRIFT-9999: Short description of the change`\n- Commit message format (required for code changes):\n ```\n THRIFT-9999: Short description of the change\n Client: cpp,py,java (comma-separated list of affected languages)\n ```\n\nExample: [THRIFT-5929](https://issues.apache.org/jira/projects/THRIFT/issues/THRIFT-5929) → [PR #3350](https://github.com/apache/thrift/pull/3350).\n\n---\n\n## 3. Pull Request Requirements\n\nFollow [`CONTRIBUTING.md`](CONTRIBUTING.md) in full. Key points:\n\n- One commit per issue (squash before submitting).\n- All significant changes need a JIRA ticket.\n- Provide tests for every submitted change.\n- Verify coding standards: `make style`.\n- Branch name convention: use the JIRA ticket ID, e.g. `THRIFT-9999`.\n- PRs go from your fork branch → `apache:master`.\n\n---\n\n## 4. AI-Generated Contributions\n\nPer [`CONTRIBUTING.md § AI generated content`](CONTRIBUTING.md#ai-generated-content) and the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html):\n\n- **Always** label AI-assisted commits and PRs. Use one or both of:\n ```\n Co-Authored-By: \n Generated-by: \n ```\n Example:\n ```\n THRIFT-9999: Fix connection timeout handling in Go client\n Client: go\n\n Co-Authored-By: Claude Sonnet 4.6 \n ```\n- Apply this label even when AI only generated a portion of the change.\n- **Never** put tool-internal links into a commit message, PR description, JIRA comment or e-mail.\n This includes AI session and conversation URLs — `Claude-Session:`,\n `https://claude.ai/code/session_…`, `https://chatgpt.com/c/…` and any equivalent from another\n tool. Some assistants append one by default; that default does not apply to this project and\n must be overridden. The attribution line above is the whole of what belongs in a trailer block.\n Such a link is permanent once it reaches git history, means nothing to a reviewer, and may point\n at material that is not public — including work still under embargo per §6. Note that a\n force-push does not undo this: the superseded commit stays reachable by SHA.\n- The human author remains responsible for reviewing, testing, and standing behind all submitted code.\n\n---\n\n## 5. Language-Specific Rules (`/lib`, `/test`, `/tutorial`)\n\n- This file remains valid in all cases and must be used in addition to any additional language-specific rules.\n- If a target-language directory under `/lib//` contains its own `CLAUDE.md` or `AGENTS.md`, those rules apply to all work in that language directory.\n- Those language-specific rules extend **by implication** to the corresponding language code under `/test/` and `/tutorial/`.\n- If `/test/` or `/tutorial/` themselves contain a `CLAUDE.md`/`AGENTS.md` for a given language, **combine** the rules: the file **closer to the code** (i.e., in the same directory) takes precedence on any conflict.\n\n---\n\n## 6. Security Work\n\nWhen assisting with security-sensitive changes (transport size limits, TLS configuration,\nauthentication, serialization bounds, or anything flagged by the project's security team):\n\n- **Never** describe the change as a security fix in public-facing text — commit messages,\n PR titles, PR descriptions, or inline comments. Use neutral functional language:\n *\"add a configurable frame-size limit\"* rather than *\"fix DoS vulnerability\"*.\n Vulnerability details travel through the private ASF channel (`security@apache.org`);\n AI tooling must not short-circuit that process.\n- Before proposing mitigations or defaults, consult\n [`doc/thrift-threat-model.md`](doc/thrift-threat-model.md) for the project's documented\n attack surface, trust boundaries, and per-binding security properties.\n- External reporters and AI reviewers alike should follow the instructions in\n [`SECURITY.md`](SECURITY.md) for responsible disclosure.\n- When asserting a security claim or identifying which component a bug affects, \n verify reachability/exploitability empirically against the specific released version before stating it as fact.\n\n---\n\n## 7. Code Changes, Git & PR Workflow\n\n- When fixing a bug or addressing an issue, scope the change to ONLY that issue. \n Do not touch CHANGES.md, version files, or unrelated entries unless explicitly asked.\n- Ship bug fixes as standalone pull requests by default. Do not commit directly to master \n or mix fixes into existing/unrelated work unless told otherwise.\n- Follow a strict test-first workflow: write or update tests demonstrating the bug BEFORE applying the fix, \n and inspect any generated code before changing it.\n- **Prose-only changes skip CI.** A commit that only edits the text of existing documentation\n files ends its subject line with `[skip ci]`, and the PR title carries it too:\n ```\n THRIFT-9999: Clarify the TLS options in lib/cpp/README.md [skip ci]\n ```\n GitHub then runs none of the `push` and `pull_request` workflows for it, and AppVeyor skips\n the build.\n - Only the subject line works for both: AppVeyor ignores the rest of the message. A squash\n merge of several commits takes its subject from the PR title.\n - Not prose-only, so no marker: source code, comments and doc comments included; build,\n packaging and CI files; tests and test data (`compiler/cpp/test/compiler/DocTest.md` is a\n golden file, not documentation); adding, removing or renaming a file. `EXTRA_DIST` in the\n `Makefile.am` files lists documentation files by name: a removed or renamed one breaks the\n `make dist` job, and a new one needs an entry of its own, which no CI job asks for. Several\n package manifests name a README, too. When in doubt, leave the marker out.\n - The marker can skip CI for everything pushed along with it, so push a marked commit on its\n own. When a review round adds anything but prose, drop the marker as you amend.\n - GitHub also matches the marker when it is quoted. A commit that is not prose-only must not\n contain it, or GitHub's variants `[ci skip]`, `[no ci]`, `[skip actions]` and\n `[actions skip]`, anywhere in its message. A squash message built from a PR description\n picks it up from the checklist in the PR template.\n - The marker also stops the tool-internal links check (§4) from running, so check the commit\n message (`git log --format=%B`) and the PR text yourself before pushing.\n\n---\n\n## 8. Quick Reference Checklist (before opening a PR)\n\n- [ ] License of any new dependency checked against [ASF Category A/X list](https://www.apache.org/legal/resolved.html)\n- [ ] `LICENSE` and/or `NOTICE` updated if third-party attribution is required\n- [ ] JIRA ticket exists (unless truly trivial)\n- [ ] PR title starts with `THRIFT-NNNN:` (if ticket exists)\n- [ ] Commit message includes affected `Client:` languages\n- [ ] Single squashed commit\n- [ ] Prose-only change: `[skip ci]` ends the commit subject and the PR title; any other change: no such marker anywhere in the commit message\n- [ ] Tests added or updated\n- [ ] `make style` passes\n- [ ] AI authorship labelled with `Co-Authored-By:` / `Generated-by:` where applicable\n- [ ] No tool-internal or AI session URLs anywhere in the commit message or PR text\n- [ ] Security-sensitive changes use neutral commit/PR language (no public vulnerability details)\n- [ ] Changes touching transport limits / TLS / auth cross-checked against `doc/thrift-threat-model.md`\n","isInternal":false,"tokens":2242,"sizeBytes":9491}],"systemPromptSnippet":"\n\n# Apache Thrift — AI Contribution Guidelines\n\nThis file governs AI-assisted work on the Apache Thrift codebase.\nIt supplements but does **not** replace [`CONTRIBUTING.md`](CONTRIBUTING.md).\n\n---\n\n## 1. ASF Legal Compliance (Third-Party Code)\n\nApache Thrift is an [Apache Software Foundation (ASF)](https://www.apache.org/) project released under the **Apache License 2.0**.\nThe AI **must** actively enforce and monitor ASF licensing policy:\n\n- **Proactively flag conflicts**: Before introducing any dependency, snippet, or code derived from an external source, verify its license is compatible with Apache 2.0.\n Incompatible licenses include (non-exhaustive): GPL, AGPL, SSPL, BUSL, CC-BY-NC.\n Compatible examples: MIT, BSD-2/3, Apache 2.0, ISC, MPL 2.0 (with caveats).\n- **Category X / Category A**: Follow the [ASF Third-Party Licensing Policy](https://www.apache.org/legal/resolved.html).\n Category A licenses may be included; Category X licenses must **never** be introduced.\n- **Update `LICENSE` and `NOTICE`**: When adding third-party code or binaries that require attribution, add the appropriate notices to `LICENSE` and/or `NOTICE` following the [ASF guide on licenses and notices](https://www.apache.org/dev/licensing-howto.html).\n If in doubt whether an entry is required, **add it and flag it in the PR description** for committer review.\n- **Generative AI output**: The [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) applies. Be aware that AI-generated code may unintentionally reproduce copyrighted material. Flag any non-trivial generated blocks in commit messages or PR descriptions.\n\n---\n\n## 2. Issue Tracking\n\n| Type | Tracker | Notes |\n|---|---|---|\n| Significant changes | [Apache JIRA — THRIFT project](https://issues.apache.org/jira/browse/THRIFT) | Required for all non-trivial PRs |\n| Minor / quick fixes | GitHub Issues | Typos, trivial compiler warnings, etc. |\n\n**JIRA integration with GitHub**: Including a JIRA ticket identifier at the start of a PR title automatically creates a link from JIRA to the PR.\n\n- PR title format: `THRIFT-9999: Short description of the change`\n- Commit message format (required for code changes):\n ```\n THRIFT-9999: Short description of the change\n Client: cpp,py,java (comma-separated list of affected languages)\n ```\n\nExample: [THRIFT-5929](https://issues.apache.org/jira/projects/THRIFT/issues/THRIFT-5929) → [PR #3350](https://github.com/apache/thrift/pull/3350).\n\n---\n\n## 3. Pull Request Requirements\n\nFollow [`CONTRIBUTING.md`](CONTRIBUTING.md) in full. Key points:\n\n- One commit per issue (squash before submitting).\n- All significant changes need a JIRA ticket.\n- Provide tests for every submitted change.\n- Verify coding standards: `make style`.\n- Branch name convention: use the JIRA ticket ID, e.g. `THRIFT-9999`.\n- PRs go from your fork branch → `apache:master`.\n\n---\n\n## 4. AI-Generated Contributions\n\nPer [`CONTRIBUTING.md § AI generated content`](CONTRIBUTING.md#ai-generated-content) and the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html):\n\n- **Always** label AI-assisted commits and PRs. Use one or both of:\n ```\n Co-Authored-By: \n Generated-by: \n ```\n Example:\n ```\n THRIFT-9999: Fix connection timeout handling in Go client\n Client: go\n\n Co-Authored-By: Claude Sonnet 4.6 \n ```\n- Apply this label even when AI only generated a portion of the change.\n- **Never** put tool-internal links into a commit message, PR description, JIRA comment or e-mail.\n This includes AI session and conversation URLs — `Claude-Session:`,\n `https://claude.ai/code/session_…`, `https://chatgpt.com/c/…` and any equivalent from another\n tool. Some assistants append one by default; that default does not apply to this project and\n must be overridden. The attribution line above is the whole of what belongs in a trailer block.\n Such a link is permanent once it reaches git history, means nothing to a reviewer, and may point\n at material that is not public — including work still under embargo per §6. Note that a\n force-push does not undo this: the superseded commit stays reachable by SHA.\n- The human author remains responsible for reviewing, testing, and standing behind all submitted code.\n\n---\n\n## 5. Language-Specific Rules (`/lib`, `/test`, `/tutorial`)\n\n- This file remains valid in all cases and must be used in addition to any additional language-specific rules.\n- If a target-language directory under `/lib//` contains its own `CLAUDE.md` or `AGENTS.md`, those rules apply to all work in that language directory.\n- Those language-specific rules extend **by implication** to the corresponding language code under `/test/` and `/tutorial/`.\n- If `/test/` or `/tutorial/` themselves contain a `CLAUDE.md`/`AGENTS.md` for a given language, **combine** the rules: the file **closer to the code** (i.e., in the same directory) takes precedence on any conflict.\n\n---\n\n## 6. Security Work\n\nWhen assisting with security-sensitive changes (transport size limits, TLS configuration,\nauthentication, serialization bounds, or anything flagged by the project's security team):\n\n- **Never** describe the change as a security fix in public-facing text — commit messages,\n PR titles, PR descriptions, or inline comments. Use neutral functional language:\n *\"add a configurable frame-size limit\"* rather than *\"fix DoS vulnerability\"*.\n Vulnerability details travel through the private ASF channel (`security@apache.org`);\n AI tooling must not short-circuit that process.\n- Before proposing mitigations or defaults, consult\n [`doc/thrift-threat-model.md`](doc/thrift-threat-model.md) for the project's documented\n attack surface, trust boundaries, and per-binding security properties.\n- External reporters and AI reviewers alike should follow the instructions in\n [`SECURITY.md`](SECURITY.md) for responsible disclosure.\n- When asserting a security claim or identifying which component a bug affects, \n verify reachability/exploitability empirically against the specific released version before stating it as fact.\n\n---\n\n## 7. Code Changes, Git & PR Workflow\n\n- When fixing a bug or addressing an issue, scope the change to ONLY that issue. \n Do not touch CHANGES.md, version files, or unrelated entries unless explicitly asked.\n- Ship bug fixes as standalone pull requests by default. Do not commit directly to master \n or mix fixes into existing/unrelated work unless told otherwise.\n- Follow a strict test-first workflow: write or update tests demonstrating the bug BEFORE applying the fix, \n and inspect any generated code before changing it.\n- **Prose-only changes skip CI.** A commit that only edits the text of existing documentation\n files ends its subject line with `[skip ci]`, and the PR title carries it too:\n ```\n THRIFT-9999: Clarify the TLS options in lib/cpp/README.md [skip ci]\n ```\n GitHub then runs none of the `push` and `pull_request` workflows for it, and AppVeyor skips\n the build.\n - Only the subject line works for both: AppVeyor ignores the rest of the message. A squash\n merge of several commits takes its subject from the PR title.\n - Not prose-only, so no marker: source code, comments and doc comments included; build,\n packaging and CI files; tests and test data (`compiler/cpp/test/compiler/DocTest.md` is a\n golden file, not documentation); adding, removing or renaming a file. `EXTRA_DIST` in the\n `Makefile.am` files lists documentation files by name: a removed or renamed one breaks the\n `make dist` job, and a new one needs an entry of its own, which no CI job asks for. Several\n package manifests name a README, too. When in doubt, leave the marker out.\n - The marker can skip CI for everything pushed along with it, so push a marked commit on its\n own. When a review round adds anything but prose, drop the marker as you amend.\n - GitHub also matches the marker when it is quoted. A commit that is not prose-only must not\n contain it, or GitHub's variants `[ci skip]`, `[no ci]`, `[skip actions]` and\n `[actions skip]`, anywhere in its message. A squash message built from a PR description\n picks it up from the checklist in the PR template.\n - The marker also stops the tool-internal links check (§4) from running, so check the commit\n message (`git log --format=%B`) and the PR text yourself before pushing.\n\n---\n\n## 8. Quick Reference Checklist (before opening a PR)\n\n- [ ] License of any new dependency checked against [ASF Category A/X list](https://www.apache.org/legal/resolved.html)\n- [ ] `LICENSE` and/or `NOTICE` updated if third-party attribution is required\n- [ ] JIRA ticket exists (unless truly trivial)\n- [ ] PR title starts with `THRIFT-NNNN:` (if ticket exists)\n- [ ] Commit message includes affected `Client:` languages\n- [ ] Single squashed commit\n- [ ] Prose-only change: `[skip ci]` ends the commit subject and the PR title; any other change: no such marker anywhere in the commit message\n- [ ] Tests added or updated\n- [ ] `make style` passes\n- [ ] AI authorship labelled with `Co-Authored-By:` / `Generated-by:` where applicable\n- [ ] No tool-internal or AI session URLs anywhere in the commit message or PR text\n- [ ] Security-sensitive changes use neutral commit/PR language (no public vulnerability details)\n- [ ] Changes touching transport limits / TLS / auth cross-checked against `doc/thrift-threat-model.md`\n"}