Skip to content

docs: add CLAUDE.md and AGENTS.md guidelines for auth0-server-python - #142

Open
rmad17 wants to merge 1 commit into
mainfrom
claude-md
Open

docs: add CLAUDE.md and AGENTS.md guidelines for auth0-server-python#142
rmad17 wants to merge 1 commit into
mainfrom
claude-md

Conversation

@rmad17

@rmad17 rmad17 commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Changes

Adds AI-agent guidance files so Claude Code, Codex CLI, Gemini CLI, and any other tool that reads AGENTS.md load this repo's actual conventions instead of inferring them. Generated by the team-sdks:generating-claude-md skill (v1.16.0).

File Lines Contents
CLAUDE.md 168 Single source of truth: persona, working principles, project overview/structure, three-tier boundaries (11 Always Do / 7 Ask First / 8 Never Do), security considerations, linked pointers to
the reference files
AGENTS.md 3 Imports @./CLAUDE.md per the agent-files spec — no duplicated content
references/code-style.md 124 .ruff.toml rule sets, naming table, good/bad method examples, dominant patterns
references/testing.md 76 pytest conventions, the @pytest.mark.asyncio requirement, mocking approach
references/commands.md 67 Exact CI invocations, single-test runs, and what deliberately doesn't exist (no typecheck, no live-test tier)
references/pitfalls.md 57 Eight repo-specific gotchas (Python 3.9 floor, MCD domain resolver, store_options threading, …)
references/git-workflow.md 55 Branch naming, PR template requirements, required checks
references/docs-update.md 50 Tracked-docs inventory, code-to-docs mapping, feature → guide map

Why references/ and not docs/. .gitignore:25 ignores docs as build
output — files placed there would not be tracked.

References

  • Generated by team-sdks:generating-claude-md v1.16.0 (Mode 1, then re-validated
    in Mode 2 with no content changes)

To review: read CLAUDE.md end to end — it should contain nothing you'd disagree
with as a maintainer — then spot-check any reference file against its source of
truth. The boundaries encode team judgment; the Ask-First list is the place to
push back.

  • This change adds unit test coverage — n/a, documentation only
  • This change adds integration test coverage — n/a, documentation only
  • This change has been tested on the latest version of the platform/language —
    lint and the full suite pass locally; CI covers 3.9/3.10/3.11/3.12

The one real effect is on AI agents working in this repo: they will follow the
documented boundaries. An incorrect boundary would misdirect an agent, which is
why the boundaries warrant a maintainer's read rather than a rubber stamp.

Checklist

@rmad17
rmad17 requested a review from a team as a code owner July 28, 2026 14:15
Comment thread references/testing.md
Two shapes coexist; match the file you're editing.

- **Module-level functions** — `test_server_client.py` and `test_dpop_auth.py`
- **Grouping classes** — `test_mfa_client.py`, `test_my_account_client.py` use `TestMfaClientConstructor`,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

test_my_account_client.py is grouped here with test_mfa_client.py as using grouping classes, but it doesn't have any Test* classes, it's 68 module-level test functions with # === banners. The two class names on the next line (TestMfaClientConstructor, TestDomainResolution) only exist in test_mfa_client.py.

Shall we move test_my_account_client.py down to the module-level-functions bullet, so test_mfa_client.py is the only grouping-class example?

|-------|---------|---------|
| `<feature>-support` | `passkey-support`, `dpop-support`, `myaccount-support` | a new capability |
| `SDK-<ticket>-<slug>` | `SDK-8833-organisations-support` | ticket-tracked work |
| `fix/<slug>` | `fix/cte-model-validators` | bug fixes |

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fix/cte-model-validators example doesn't match any branch in this repo. The only fix/ branches that ever existed are things like fix/mfa-breaking-changes. Every other example in this table (passkey-support, SDK-8833-organisations-support, feat/cte-delegation, docs/sync-2026-06-30) points at a real PR, so this one stands out.

Can we swap it for a real one, fix/mfa-breaking-changes (#104) is an actual bug-fix branch?

Comment thread references/pitfalls.md
## 4. Never construct `httpx.AsyncClient` directly

`ServerClient._get_http_client()` and `MyAccountClient._get_http_client()` merge
`self._telemetry_headers` into every request. A hand-rolled client silently drops the `Auth0-Client`

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MyAccountClient._get_http_client() merges self._headers, not self._telemetry_headers (that attribute only exists on ServerClient). It still works because ServerClient builds the MyAccount client with headers=self._telemetry_headers, so the header does get attached, but the name here doesn't match the code an agent would open to.

Comment thread references/pitfalls.md
reformatted, including `server_client.py`'s test file and `helpers.py`. Running `ruff format .`
repo-wide produces a thousand-line diff unrelated to your change. Format only what you touched.

## 3. Async tests silently pass if you forget `@pytest.mark.asyncio`

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I ran this in the repo's venv (pytest 7.4.4, pytest-asyncio 0.23.8, strict mode): an unmarked async test isn't reported as passing, it's skipped with a PytestUnhandledCoroutineWarning and shows up as s / "skipped" in the summary. testing.md already describes it correctly as skipped; it's this file and CLAUDE.md that say "passes."

The heading and the "if a new async test passes on the first run, check for the marker" tip point an agent at the wrong symptom, it'll be looking for a pass when the real signal is a skip. Can we reword both to "skipped (with a warning), never executed"?

Comment thread CLAUDE.md
### ✅ Always Do

- Run `poetry run pytest` and `poetry run ruff check .` before committing — both gate CI.
- Add tests for new functionality, and mark async tests `@pytest.mark.asyncio` (there is no `asyncio_mode = auto`; an unmarked async test never runs but reports as passing).

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same thing as the async pitfall: an unmarked async test is skipped with a warning, not "reports as passing." I confirmed it by running one in the repo's venv. Shall we bring this in line with testing.md's "collected and skipped, never runs"?

Comment thread references/docs-update.md
| Doc | What it covers | Status |
|-----|----------------|--------|
| `README.md` | Install, `ServerClient` construction, interactive login, custom token exchange, MCD, session expiry, passkeys, My Account, DPoP — each a short section that links out to `examples/` | present |
| `EXAMPLES.md` | — | **❌ missing.** This repo puts per-feature guides in `examples/*.md` instead. Add a sample to the matching `examples/` guide; only create `EXAMPLES.md` if the team decides to consolidate. |

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The red-X "❌ missing" reads like an actionable gap, even though the same cell then says the repo uses examples/*.md on purpose. Might be clearer as "not used by design" so an agent doesn't try to create EXAMPLES.md.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants