{"owner":"apache","repo":"thrift","hasSkills":true,"hasMcp":false,"mcpConfig":null,"found":["AGENTS.md"],"skills":{"AGENTS.md":"# Apache Thrift — AI Contribution Guidelines\n\nThis file governs AI-assisted work on the Apache Thrift codebase.\nIt supplements but does **not** replace [`CONTRIBUTING.md`](CONTRIBUTING.md).\n\n---\n\n## 1. ASF Legal Compliance (Third-Party Code)\n\nApache Thrift is an [Apache Software Foundation (ASF)](https://www.apache.org/) project released under the **Apache License 2.0**.\nThe AI **must** actively enforce and monitor ASF licensing policy:\n\n- **Proactively flag conflicts**: Before introducing any dependency, snippet, or code derived from an external source, verify its license is compatible with Apache 2.0.\n  Incompatible licenses include (non-exhaustive): GPL, AGPL, SSPL, BUSL, CC-BY-NC.\n  Compatible examples: MIT, BSD-2/3, Apache 2.0, ISC, MPL 2.0 (with caveats).\n- **Category X / Category A**: Follow the [ASF Third-Party Licensing Policy](https://www.apache.org/legal/resolved.html).\n  Category A licenses may be included; Category X licenses must **never** be introduced.\n- **Update `LICENSE` and `NOTICE`**: When adding third-party code or binaries that require attribution, add the appropriate notices to `LICENSE` and/or `NOTICE` following the [ASF guide on licenses and notices](https://www.apache.org/dev/licensing-howto.html).\n  If in doubt whether an entry is required, **add it and flag it in the PR description** for committer review.\n- **Generative AI output**: The [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) applies. Be aware that AI-generated code may unintentionally reproduce copyrighted material. Flag any non-trivial generated blocks in commit messages or PR descriptions.\n\n---\n\n## 2. Issue Tracking\n\n| Type | Tracker | Notes |\n|---|---|---|\n| Significant changes | [Apache JIRA — THRIFT project](https://issues.apache.org/jira/browse/THRIFT) | Required for all non-trivial PRs |\n| Minor / quick fixes | GitHub Issues | Typos, trivial compiler warnings, etc. |\n\n**JIRA integration with GitHub**: Including a JIRA ticket identifier at the start of a PR title automatically creates a link from JIRA to the PR.\n\n- PR title format: `THRIFT-9999: Short description of the change`\n- Commit message format (required for code changes):\n  ```\n  THRIFT-9999: Short description of the change\n  Client: cpp,py,java   (comma-separated list of affected languages)\n  ```\n\nExample: [THRIFT-5929](https://issues.apache.org/jira/projects/THRIFT/issues/THRIFT-5929) → [PR #3350](https://github.com/apache/thrift/pull/3350).\n\n---\n\n## 3. Pull Request Requirements\n\nFollow [`CONTRIBUTING.md`](CONTRIBUTING.md) in full. Key points:\n\n- One commit per issue (squash before submitting).\n- All significant changes need a JIRA ticket.\n- Provide tests for every submitted change.\n- Verify coding standards: `make style`.\n- Branch name convention: use the JIRA ticket ID, e.g. `THRIFT-9999`.\n- PRs go from your fork branch → `apache:master`.\n\n---\n\n## 4. AI-Generated Contributions\n\nPer [`CONTRIBUTING.md § AI generated content`](CONTRIBUTING.md#ai-generated-content) and the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html):\n\n- **Always** label AI-assisted commits and PRs. Use one or both of:\n  ```\n  Co-Authored-By: <AI tool name and version>\n  Generated-by: <AI tool name and version>\n  ```\n  Example:\n  ```\n  THRIFT-9999: Fix connection timeout handling in Go client\n  Client: go\n\n  Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n  ```\n- Apply this label even when AI only generated a portion of the change.\n- The human author remains responsible for reviewing, testing, and standing behind all submitted code.\n\n---\n\n## 5. Language-Specific Rules (`/lib`, `/test`, `/tutorial`)\n\n- This file remains valid in all cases and must be used in addition to any additional language-specific rules.\n- If a target-language directory under `/lib/<lang>/` contains its own `CLAUDE.md` or `AGENTS.md`, those rules apply to all work in that language directory.\n- Those language-specific rules extend **by implication** to the corresponding language code under `/test/` and `/tutorial/`.\n- If `/test/` or `/tutorial/` themselves contain a `CLAUDE.md`/`AGENTS.md` for a given language, **combine** the rules: the file **closer to the code** (i.e., in the same directory) takes precedence on any conflict.\n\n---\n\n## 6. Security Work\n\nWhen assisting with security-sensitive changes (transport size limits, TLS configuration,\nauthentication, serialization bounds, or anything flagged by the project's security team):\n\n- **Never** describe the change as a security fix in public-facing text — commit messages,\n  PR titles, PR descriptions, or inline comments.  Use neutral functional language:\n  *\"add a configurable frame-size limit\"* rather than *\"fix DoS vulnerability\"*.\n  Vulnerability details travel through the private ASF channel (`security@apache.org`);\n  AI tooling must not short-circuit that process.\n- Before proposing mitigations or defaults, consult\n  [`doc/thrift-threat-model.md`](doc/thrift-threat-model.md) for the project's documented\n  attack surface, trust boundaries, and per-binding security properties.\n- External reporters and AI reviewers alike should follow the instructions in\n  [`SECURITY.md`](SECURITY.md) for responsible disclosure.\n- When asserting a security claim or identifying which component a bug affects, \n  verify reachability/exploitability empirically against the specific released version before stating it as fact.\n\n---\n\n## 7. Code Changes, Git & PR Workflow\n\n- When fixing a bug or addressing an issue, scope the change to ONLY that issue. \n  Do not touch CHANGES.md, version files, or unrelated entries unless explicitly asked.\n- Ship bug fixes as standalone pull requests by default. Do not commit directly to master \n  or mix fixes into existing/unrelated work unless told otherwise.\n- Follow a strict test-first workflow: write or update tests demonstrating the bug BEFORE applying the fix, \n  and inspect any generated code before changing it.\n\n---\n\n## 8. Quick Reference Checklist (before opening a PR)\n\n- [ ] License of any new dependency checked against [ASF Category A/X list](https://www.apache.org/legal/resolved.html)\n- [ ] `LICENSE` and/or `NOTICE` updated if third-party attribution is required\n- [ ] JIRA ticket exists (unless truly trivial)\n- [ ] PR title starts with `THRIFT-NNNN:` (if ticket exists)\n- [ ] Commit message includes affected `Client:` languages\n- [ ] Single squashed commit\n- [ ] Tests added or updated\n- [ ] `make style` passes\n- [ ] AI authorship labelled with `Co-Authored-By:` / `Generated-by:` where applicable\n- [ ] Security-sensitive changes use neutral commit/PR language (no public vulnerability details)\n- [ ] Changes touching transport limits / TLS / auth cross-checked against `doc/thrift-threat-model.md`\n"},"files":{"AGENTS.md":"# Apache Thrift — AI Contribution Guidelines\n\nThis file governs AI-assisted work on the Apache Thrift codebase.\nIt supplements but does **not** replace [`CONTRIBUTING.md`](CONTRIBUTING.md).\n\n---\n\n## 1. ASF Legal Compliance (Third-Party Code)\n\nApache Thrift is an [Apache Software Foundation (ASF)](https://www.apache.org/) project released under the **Apache License 2.0**.\nThe AI **must** actively enforce and monitor ASF licensing policy:\n\n- **Proactively flag conflicts**: Before introducing any dependency, snippet, or code derived from an external source, verify its license is compatible with Apache 2.0.\n  Incompatible licenses include (non-exhaustive): GPL, AGPL, SSPL, BUSL, CC-BY-NC.\n  Compatible examples: MIT, BSD-2/3, Apache 2.0, ISC, MPL 2.0 (with caveats).\n- **Category X / Category A**: Follow the [ASF Third-Party Licensing Policy](https://www.apache.org/legal/resolved.html).\n  Category A licenses may be included; Category X licenses must **never** be introduced.\n- **Update `LICENSE` and `NOTICE`**: When adding third-party code or binaries that require attribution, add the appropriate notices to `LICENSE` and/or `NOTICE` following the [ASF guide on licenses and notices](https://www.apache.org/dev/licensing-howto.html).\n  If in doubt whether an entry is required, **add it and flag it in the PR description** for committer review.\n- **Generative AI output**: The [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) applies. Be aware that AI-generated code may unintentionally reproduce copyrighted material. Flag any non-trivial generated blocks in commit messages or PR descriptions.\n\n---\n\n## 2. Issue Tracking\n\n| Type | Tracker | Notes |\n|---|---|---|\n| Significant changes | [Apache JIRA — THRIFT project](https://issues.apache.org/jira/browse/THRIFT) | Required for all non-trivial PRs |\n| Minor / quick fixes | GitHub Issues | Typos, trivial compiler warnings, etc. |\n\n**JIRA integration with GitHub**: Including a JIRA ticket identifier at the start of a PR title automatically creates a link from JIRA to the PR.\n\n- PR title format: `THRIFT-9999: Short description of the change`\n- Commit message format (required for code changes):\n  ```\n  THRIFT-9999: Short description of the change\n  Client: cpp,py,java   (comma-separated list of affected languages)\n  ```\n\nExample: [THRIFT-5929](https://issues.apache.org/jira/projects/THRIFT/issues/THRIFT-5929) → [PR #3350](https://github.com/apache/thrift/pull/3350).\n\n---\n\n## 3. Pull Request Requirements\n\nFollow [`CONTRIBUTING.md`](CONTRIBUTING.md) in full. Key points:\n\n- One commit per issue (squash before submitting).\n- All significant changes need a JIRA ticket.\n- Provide tests for every submitted change.\n- Verify coding standards: `make style`.\n- Branch name convention: use the JIRA ticket ID, e.g. `THRIFT-9999`.\n- PRs go from your fork branch → `apache:master`.\n\n---\n\n## 4. AI-Generated Contributions\n\nPer [`CONTRIBUTING.md § AI generated content`](CONTRIBUTING.md#ai-generated-content) and the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html):\n\n- **Always** label AI-assisted commits and PRs. Use one or both of:\n  ```\n  Co-Authored-By: <AI tool name and version>\n  Generated-by: <AI tool name and version>\n  ```\n  Example:\n  ```\n  THRIFT-9999: Fix connection timeout handling in Go client\n  Client: go\n\n  Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n  ```\n- Apply this label even when AI only generated a portion of the change.\n- The human author remains responsible for reviewing, testing, and standing behind all submitted code.\n\n---\n\n## 5. Language-Specific Rules (`/lib`, `/test`, `/tutorial`)\n\n- This file remains valid in all cases and must be used in addition to any additional language-specific rules.\n- If a target-language directory under `/lib/<lang>/` contains its own `CLAUDE.md` or `AGENTS.md`, those rules apply to all work in that language directory.\n- Those language-specific rules extend **by implication** to the corresponding language code under `/test/` and `/tutorial/`.\n- If `/test/` or `/tutorial/` themselves contain a `CLAUDE.md`/`AGENTS.md` for a given language, **combine** the rules: the file **closer to the code** (i.e., in the same directory) takes precedence on any conflict.\n\n---\n\n## 6. Security Work\n\nWhen assisting with security-sensitive changes (transport size limits, TLS configuration,\nauthentication, serialization bounds, or anything flagged by the project's security team):\n\n- **Never** describe the change as a security fix in public-facing text — commit messages,\n  PR titles, PR descriptions, or inline comments.  Use neutral functional language:\n  *\"add a configurable frame-size limit\"* rather than *\"fix DoS vulnerability\"*.\n  Vulnerability details travel through the private ASF channel (`security@apache.org`);\n  AI tooling must not short-circuit that process.\n- Before proposing mitigations or defaults, consult\n  [`doc/thrift-threat-model.md`](doc/thrift-threat-model.md) for the project's documented\n  attack surface, trust boundaries, and per-binding security properties.\n- External reporters and AI reviewers alike should follow the instructions in\n  [`SECURITY.md`](SECURITY.md) for responsible disclosure.\n- When asserting a security claim or identifying which component a bug affects, \n  verify reachability/exploitability empirically against the specific released version before stating it as fact.\n\n---\n\n## 7. Code Changes, Git & PR Workflow\n\n- When fixing a bug or addressing an issue, scope the change to ONLY that issue. \n  Do not touch CHANGES.md, version files, or unrelated entries unless explicitly asked.\n- Ship bug fixes as standalone pull requests by default. Do not commit directly to master \n  or mix fixes into existing/unrelated work unless told otherwise.\n- Follow a strict test-first workflow: write or update tests demonstrating the bug BEFORE applying the fix, \n  and inspect any generated code before changing it.\n\n---\n\n## 8. Quick Reference Checklist (before opening a PR)\n\n- [ ] License of any new dependency checked against [ASF Category A/X list](https://www.apache.org/legal/resolved.html)\n- [ ] `LICENSE` and/or `NOTICE` updated if third-party attribution is required\n- [ ] JIRA ticket exists (unless truly trivial)\n- [ ] PR title starts with `THRIFT-NNNN:` (if ticket exists)\n- [ ] Commit message includes affected `Client:` languages\n- [ ] Single squashed commit\n- [ ] Tests added or updated\n- [ ] `make style` passes\n- [ ] AI authorship labelled with `Co-Authored-By:` / `Generated-by:` where applicable\n- [ ] Security-sensitive changes use neutral commit/PR language (no public vulnerability details)\n- [ ] Changes touching transport limits / TLS / auth cross-checked against `doc/thrift-threat-model.md`\n"},"items":[{"name":"AGENTS.md","path":"AGENTS.md","title":"AGENTS.md","content":"# Apache Thrift — AI Contribution Guidelines\n\nThis file governs AI-assisted work on the Apache Thrift codebase.\nIt supplements but does **not** replace [`CONTRIBUTING.md`](CONTRIBUTING.md).\n\n---\n\n## 1. ASF Legal Compliance (Third-Party Code)\n\nApache Thrift is an [Apache Software Foundation (ASF)](https://www.apache.org/) project released under the **Apache License 2.0**.\nThe AI **must** actively enforce and monitor ASF licensing policy:\n\n- **Proactively flag conflicts**: Before introducing any dependency, snippet, or code derived from an external source, verify its license is compatible with Apache 2.0.\n  Incompatible licenses include (non-exhaustive): GPL, AGPL, SSPL, BUSL, CC-BY-NC.\n  Compatible examples: MIT, BSD-2/3, Apache 2.0, ISC, MPL 2.0 (with caveats).\n- **Category X / Category A**: Follow the [ASF Third-Party Licensing Policy](https://www.apache.org/legal/resolved.html).\n  Category A licenses may be included; Category X licenses must **never** be introduced.\n- **Update `LICENSE` and `NOTICE`**: When adding third-party code or binaries that require attribution, add the appropriate notices to `LICENSE` and/or `NOTICE` following the [ASF guide on licenses and notices](https://www.apache.org/dev/licensing-howto.html).\n  If in doubt whether an entry is required, **add it and flag it in the PR description** for committer review.\n- **Generative AI output**: The [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) applies. Be aware that AI-generated code may unintentionally reproduce copyrighted material. Flag any non-trivial generated blocks in commit messages or PR descriptions.\n\n---\n\n## 2. Issue Tracking\n\n| Type | Tracker | Notes |\n|---|---|---|\n| Significant changes | [Apache JIRA — THRIFT project](https://issues.apache.org/jira/browse/THRIFT) | Required for all non-trivial PRs |\n| Minor / quick fixes | GitHub Issues | Typos, trivial compiler warnings, etc. |\n\n**JIRA integration with GitHub**: Including a JIRA ticket identifier at the start of a PR title automatically creates a link from JIRA to the PR.\n\n- PR title format: `THRIFT-9999: Short description of the change`\n- Commit message format (required for code changes):\n  ```\n  THRIFT-9999: Short description of the change\n  Client: cpp,py,java   (comma-separated list of affected languages)\n  ```\n\nExample: [THRIFT-5929](https://issues.apache.org/jira/projects/THRIFT/issues/THRIFT-5929) → [PR #3350](https://github.com/apache/thrift/pull/3350).\n\n---\n\n## 3. Pull Request Requirements\n\nFollow [`CONTRIBUTING.md`](CONTRIBUTING.md) in full. Key points:\n\n- One commit per issue (squash before submitting).\n- All significant changes need a JIRA ticket.\n- Provide tests for every submitted change.\n- Verify coding standards: `make style`.\n- Branch name convention: use the JIRA ticket ID, e.g. `THRIFT-9999`.\n- PRs go from your fork branch → `apache:master`.\n\n---\n\n## 4. AI-Generated Contributions\n\nPer [`CONTRIBUTING.md § AI generated content`](CONTRIBUTING.md#ai-generated-content) and the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html):\n\n- **Always** label AI-assisted commits and PRs. Use one or both of:\n  ```\n  Co-Authored-By: <AI tool name and version>\n  Generated-by: <AI tool name and version>\n  ```\n  Example:\n  ```\n  THRIFT-9999: Fix connection timeout handling in Go client\n  Client: go\n\n  Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n  ```\n- Apply this label even when AI only generated a portion of the change.\n- The human author remains responsible for reviewing, testing, and standing behind all submitted code.\n\n---\n\n## 5. Language-Specific Rules (`/lib`, `/test`, `/tutorial`)\n\n- This file remains valid in all cases and must be used in addition to any additional language-specific rules.\n- If a target-language directory under `/lib/<lang>/` contains its own `CLAUDE.md` or `AGENTS.md`, those rules apply to all work in that language directory.\n- Those language-specific rules extend **by implication** to the corresponding language code under `/test/` and `/tutorial/`.\n- If `/test/` or `/tutorial/` themselves contain a `CLAUDE.md`/`AGENTS.md` for a given language, **combine** the rules: the file **closer to the code** (i.e., in the same directory) takes precedence on any conflict.\n\n---\n\n## 6. Security Work\n\nWhen assisting with security-sensitive changes (transport size limits, TLS configuration,\nauthentication, serialization bounds, or anything flagged by the project's security team):\n\n- **Never** describe the change as a security fix in public-facing text — commit messages,\n  PR titles, PR descriptions, or inline comments.  Use neutral functional language:\n  *\"add a configurable frame-size limit\"* rather than *\"fix DoS vulnerability\"*.\n  Vulnerability details travel through the private ASF channel (`security@apache.org`);\n  AI tooling must not short-circuit that process.\n- Before proposing mitigations or defaults, consult\n  [`doc/thrift-threat-model.md`](doc/thrift-threat-model.md) for the project's documented\n  attack surface, trust boundaries, and per-binding security properties.\n- External reporters and AI reviewers alike should follow the instructions in\n  [`SECURITY.md`](SECURITY.md) for responsible disclosure.\n- When asserting a security claim or identifying which component a bug affects, \n  verify reachability/exploitability empirically against the specific released version before stating it as fact.\n\n---\n\n## 7. Code Changes, Git & PR Workflow\n\n- When fixing a bug or addressing an issue, scope the change to ONLY that issue. \n  Do not touch CHANGES.md, version files, or unrelated entries unless explicitly asked.\n- Ship bug fixes as standalone pull requests by default. Do not commit directly to master \n  or mix fixes into existing/unrelated work unless told otherwise.\n- Follow a strict test-first workflow: write or update tests demonstrating the bug BEFORE applying the fix, \n  and inspect any generated code before changing it.\n\n---\n\n## 8. Quick Reference Checklist (before opening a PR)\n\n- [ ] License of any new dependency checked against [ASF Category A/X list](https://www.apache.org/legal/resolved.html)\n- [ ] `LICENSE` and/or `NOTICE` updated if third-party attribution is required\n- [ ] JIRA ticket exists (unless truly trivial)\n- [ ] PR title starts with `THRIFT-NNNN:` (if ticket exists)\n- [ ] Commit message includes affected `Client:` languages\n- [ ] Single squashed commit\n- [ ] Tests added or updated\n- [ ] `make style` passes\n- [ ] AI authorship labelled with `Co-Authored-By:` / `Generated-by:` where applicable\n- [ ] Security-sensitive changes use neutral commit/PR language (no public vulnerability details)\n- [ ] Changes touching transport limits / TLS / auth cross-checked against `doc/thrift-threat-model.md`\n","category":"root","tokens":1693}]}