[ac-pplx]

Adds a localized AGENTS.md, each with a CLAUDE.md symlink, for five more crates. They match the style of the files from #275: rules for changes, verified against the code at bea0d3f, and a one-line pointer to docs/rust/space-conventions.md for the CI and log-target guidance instead of repeating it.

Where each file sits, and why

File	Bytes	Why this root
crates/libs/spaced/AGENTS.md	2175	Every spaced crate shares one contract: proto/spaced and the guest range SUPPORTED_SPACED_GUEST_VERSIONS. Legacy-compat markers sit on both sides. One file at the parent also covers crates that #16 adds under spaced/.
crates/libs/net/gateway/AGENTS.md	1957	Covers server and client. The client re-exports the outbound mark and holds the control-socket alias test.
crates/libs/cluster/controller/server/AGENTS.md	2012	The server crate owns every loop.
crates/libs/internal/api/server/AGENTS.md	2151	The server crate owns authentication and node publication.
crates/libs/vol/mgr/server/AGENTS.md	1918	The library is the service; the client is a generated gRPC client.

Budget: the root AGENTS.md is 5745 bytes. The deepest chain this PR adds is root plus spaced, 7920 bytes. The largest chain in the repo is unchanged: root plus infra/space/kind/AGENTS.md, 12475 bytes. All are well under 32 KiB.

Table qualification

SPACE has two sandboxes stores. The cluster-controller and internal-api files say up front that every table they name is in the control-plane Postgres store, and they name columns as Postgres sandboxes.lifecycle and sandboxes.active_node_id. The vol-mgr file says its tables are in volume-manager's own SQLite database. No file names sbx-mgr's SQLite sandboxes.state.

Deliberately left out

• spaced, frozen protobuf descriptors and Buf breaking checks: neither exists at this commit; there is no buf*.yaml or descriptor set. In their place the file states the additive-change rule for the compatibility range in docs/versioning.md.
• spaced, release dependency audit: no such audit exists either. The file states the featureless guest build in docker/Dockerfile.rust-build-common instead.
• Code that open PRs are changing:
  • The spaced codegen location and guest-server module paths (Extract guest execution service and guest protocol crates #16, Propose the guest execution embedding contract #106).
  • The net-gateway client alias test (tests: stop tests depending on root, sudo or fixed host paths #317).
  • Backup authorization (Approve bounded publication of validated retained suspends #283).
  • Template publication grants (Add per-build tenant publication grants #164, Prepare tenant publication grants for rolling upgrades #165).
  • The net-gateway TCP proxy and DNS modules (netgw: sample terminal TCP connect failure diagnostics #43, netgw: replace retired upstreams before request handoff #44, netgw: separate inspection populations by mode and reached stage #48, net: make NetworkPolicyV1 non_exhaustive with a constructor #78, netgw: require an explicit address allow for non-public DNS answers #159).
  • vol-mgr's executor and credentials (fix(credmgr): scope artifact DEK issue/unwrap to a sandbox #139, [volume-manager] bypass decode admission for metadata and vmstate pulls under bounded input and output #236, [volume-manager] opt-in multithreaded upload compression from idle codec permits #242, volume-manager: reduce restore decode disk work #245, [volume-manager] own codec admission in one type #247).
  • orphaned_restore_pod_gc's test-hook dry-run knob, which [cluster-controller] read the orphaned-restore-pod gc dry-run and tunables from the environment #234 fixes, so it is not named as a violation.
• Rules that would need more than two named exceptions:
  • "loop SQL lives in store.rs": six single-file loops have inline SQL.
  • "loops that write ship with a destructive_gate": four retention loops have no gate.
  • "every vol-mgr submit carries a dedup key".
• Review round 1: every MAJOR and MINOR is fixed. Each sentence is now a rule for new changes, with at most two named existing exceptions. Private fixtures and test-helper pointers are gone, as is the UPDATE sandboxes grep hint, which would also match sbx-mgr's SQLite sandboxes.

Validation

• All five CLAUDE.md symlinks resolve to AGENTS.md (mode 120000).
• No line is longer than 79 characters.
• The Gitleaks pre-commit hook passed.
• I ran the space-public-review checklist over the staged diff and this PR text. It contains only repository paths, public symbols, public service account names and public PR numbers. No findings.
• This is a docs-only change, so no workspace code checks were run.

🤖 Generated with Claude Code

[the-gigi-pplx]

Review: no findings

I checked every sentence in the five files that asserts a mechanism, path, symbol or command against the code at the head. Each one has a source location that makes it true. A few examples:

• spaced: SUPPORTED_SPACED_GUEST_VERSIONS is in common/src/compatibility.rs:7. The worker Ready version check is at guest/server/src/filesystem/worker/linux.rs:715. Fallback happens only on Unimplemented, at host/server/src/compat.rs:81,115. HostAuthorizationLayer enforces ALLOW_ROOT_OR_SBXMGR (authorization.rs:49). The bridge-host message-size cap is set at bridge.rs:888-889. The guest's featureless build is at docker/Dockerfile.rust-build-common:229-234. service-entrypoint is enabled only by spaced-svc.
• net-gateway: OUTBOUND_MARK is set by the relay, UDP proxy and resolver, and nowhere under ingress/. Policy is pulled through host-control in run.rs:306, with sbx-mgr as the server. run.rs:500 wires the install hook that prunes and cancels. Control RPCs use the ALLOW_NET_SERVICE / ALLOW_NET_OBSERVER split from control.rs:39-47.
• cluster-controller: the reconcilers run on the leadership token (lib.rs:194). Both snapshot sweepers run on the credentials pool (reconcilers.rs:317,354). The suspended_execution_reaper dry-run event is at mod.rs:670. The test_* readers resolve through env::test_hook, which returns None without test-hooks. stuck_container_creating_gc reads both sweeper configs (reconciler.rs:760,808).
• internal-api: health and reflection are exempt in common/svc/src/auth/mod.rs:580-583. A missing remote address is denied at lib.rs:1490. The pre-existing-registration rule is at publish.rs:60. Receipts are consumed after the status upsert and before commit. The failed projection uses a CTE plus an update by id (published_state.rs:2971-2998). evacuation_restore_target IS NULL is at :2849.
• vol-mgr: staging orphan cleanup runs before recover_and_log (run.rs:523-535). The census keeps pending/running/cancelling jobs (db.rs:135) and fails closed on a parse error. Cancel releases the lease in cleanup_cancelled (executor.rs:3916). The send-lease allowlist admits root, admin and space-volmgr only (node/mgr/.../btrfs_send_transport.rs:18). The node-manager dials in btrfs_push.rs and get_push_capabilities (service.rs:1214) are the only ones that don't go through an injectable client.

Budget: the root file is 5745 B. The largest chain is still root + infra/space/kind at 12475 B; the deepest new one is root + spaced at 7920 B. All are well under 32 KiB. No CI guard reads AGENTS.md, so the budget is enforced by hand. All five CLAUDE.md files are symlinks to AGENTS.md.

Not checked in depth: I didn't trace every restored, stopped and quarantined projection in published_state.rs for the active_node_id and lifecycle recheck. I spot-checked the failed projection, which the file names as an exception.

Verified against 151681fc8fb5ee682d7dacfa03ec91a509441ea4. Docs-only, so I read the code and ran nothing.

[the-gigi-pplx]

Approved. No findings; the review comment above lists what I checked.