[cristiangirlea]

Adds the repository's agent setup, plus a test for the one piece of behaviour it brings (the post-edit hook). No code or workflow changes.

What was added

• AGENTS.md (93 lines): layout, the exact commands tests.yml runs with the BRIDGE_TOKEN requirement, the rules by pointing to CONTRIBUTING.md and docs/testing.md, and the working rules (one purpose per branch, tested before merged, reviews are text and commits are changes, no AI attribution).
• CLAUDE.md: @AGENTS.md plus the Claude-specific lines.
• .claude/rules/php-client.md, worker.md, mcp-server.md: path-scoped rules for the three parts that differ (strict types, no mbstring and warnings as failures; stdlib-only worker path with model dependencies imported inside the ONNX functions; the tool list as a literal and BACKENDS equal to MODEL_NAMES).
• .claude/skills/check/SKILL.md: /check runs the deterministic gate's steps in order.
• .claude/hooks/repo-rules.sh and its PostToolUse wiring: after an edit, a PHP file under src/, examples/ or tests/php must declare strict types and use spaces, and a worker/ai_bridge module must not import a model dependency at module level. tests/python/test_repo_rules_hook.py covers it (nine cases: clean files, each violation, imports inside functions and look-alike names, files outside the scope, empty or malformed input, a missing file, a JSON-escaped Windows path, a relative path).
• .claude/settings.json: allows the exact compose commands CI runs and read-only git and gh; asks before gh workflow run, gh pr create, gh pr merge and the model fetcher; denies force pushes, pushes to main, gh pr merge --auto/--admin, gh release, tags, the git flags that run commands or write or read arbitrary files (grep -O, --output, diff --no-index), and reads of .env, keys and credentials. Every Bash rule has a PowerShell twin. Attribution lines are off.
• .gitignore: CLAUDE.local.md and .claude/settings.local.json. .gitattributes: hook scripts forced to LF.

Tests run

The twelve steps of the new /check skill, in order, locally on the default PHP 8.5 image (Docker 29.8.2, Compose v5.5.1), all passing on the first draft of the branch:

• --profile test config
• python-tests: 128 tests, OK
• php-tests: 101 contract checks
• php -l over src, examples, tests/php: 12 files, no syntax errors
• up -d worker frankenphp fault-worker hostile, then php-integration (134 checks including HTTP failure cases) and integration (12 concurrent jobs through the reused FrankenPHP worker, top_k, embedding, redaction, invalid and missing-job cases)
• --profile test down
• mcp-fetcher, then mcp-tests: 119 tests, OK; --profile mcp --profile mcp-fetch down

After the review fixes below, which touched only Markdown, the settings, the hook and its new test: python-tests again inside compose, 137 tests, OK (the 128 plus the nine hook cases), and the hook test suite on the host under Git Bash's sh. The --profile mcp --profile mcp-fetch --profile mcp-model config step the review added was not rerun locally; CI runs it. PHP 8.2, 8.3 and 8.4 are left to CI's matrix. The model smoke tests were not run: nothing on their paths: list changed.

Review

An independent read of the branch before this PR found five blocking items, all fixed in the one commit:

1. docker compose ... run * and up * in allow let a prompt-free command add -v, -u 0 or --entrypoint and so escape the compose sandbox, and up fetcher reached the network-enabled fetcher. Replaced by the exact commands CI runs; everything else prompts.
2. The MCP job's --profile mcp --profile mcp-fetch --profile mcp-model config step was missing from /check and AGENTS.md. Added.
3. tests/php/run.php and integration.php were described as "HTTP against fakes" and "through FrankenPHP"; run.php is offline, integration.php drives the real worker and broken peers directly, and FrankenPHP is tests/integration.py. Reworded in AGENTS.md and the PHP rule.
4. The worker rule said every limit is a Settings field in jobs.py; the body size is MAX_BODY in server.py and the field limits are MAX_* in tasks.py. Reworded.
5. AGENTS.md's summary said "never run downloaded model code outside the compose sandbox", weaker than CONTRIBUTING's "do not run downloaded model code or mount credentials into test containers". Restored.

Non-blocking findings also taken: the "read-only" git allow rules could execute or read anything through grep -O, --output and diff --no-index (denied now); the hook missed an indented or comma-list import and a lower-case drive letter (handled, with tests); a PostToolUse hook reports rather than refuses (wording fixed in CLAUDE.md and the rules); the config steps print the token (noted in the skill). Left as an issue: the push-to-main denies still miss git push origin refs/heads/main and a bare git push while on main (a push-guard hook would close that). The CI runner routing for a public repository is a separate branch already in progress.