repo: AGENTS.md, SECURITY.md, ignore pycache

.gitignore

@@ -1,4 +1,5 @@
 build/
+__pycache__/
 *.o
 *.err
 *.elf

AGENTS.md

@@ -0,0 +1,39 @@
+# AGENTS.md — orbisRPC contributor notes
+
+Beta Discord Rich Presence daemon for jailbroken PS4. Testers install the
+`.elf` from Discord; no PKG ships yet. README is the tester entry point,
+`docs/` is the deep end (index at `docs/README.md`).
+
+## Never break
+
+- `orbisrpc/` is the PS4 payload. Host-test every change:
+  `make -C tests test`, `make -C tests asan`,
+  `ORBISRPC_STRICT_SECRETS=1 python3 tests/e2e_consumer.py`.
+- Never link `libkernel.so` (or any app-world `.so`). Daemon-world only:
+  `libkernel_web.sprx`, `libSceLibcInternal.sprx`, `libSceNet.sprx`, plus
+  `libSceSystemService.sprx` for foreground detection. CI gates this; a
+  violation dies before `main()` with no log line.
+- The SDK must be built from git, never the release ZIP (CRT firmware
+  gate; see `docs/research/sdk-13.52.md`).
+- `discord_build_activity()` arg order is `(state, name, details,
+  asset_idle, asset_playing, ...)` — every param is `const char*`, so a
+  mis-order compiles. Assert values, not arity (see `test_activity_assets`).
+
+## Secrets
+
+- Never commit a Discord user token or webhook URL. CI enforces this with
+  `ORBISRPC_STRICT_SECRETS=1`. The Discord notify webhook lives only in
+  the `DISCORD_WEBHOOK_URL` repo secret. See `SECURITY.md`.
+
+## Conventions
+
+- Tests link the vendored sqlite amalgamation, not system sqlite, with a
+  test-only VFS shim (`tests/test_utils.c`) — stock `xFullPathname` fails
+  silent-CANTOPEN on some CI runners.
+- Docs: tester flow in `README.md`, reference in `docs/`
+  (`TROUBLESHOOTING.md`, `CONFIG.md`, `BUILDING.md`), hardware research in
+  `docs/research/`. Keep them in sync with behavior changes.
+- Don't tell testers to use Payload Guest for orbisRPC; autorun via
+  `/data/payloads` is not recommended on test builds.
+- License is undecided (MIT vs GPL). Don't add GPL code or a LICENSE
+  file until the owners pick.

SECURITY.md

@@ -0,0 +1,25 @@
+# Security
+
+## Discord user tokens
+
+The daemon connects to Discord's gateway as you, using your user session
+token. That string grants **full account access**:
+
+- Never share `config.json`. Never paste a token in Discord, logs, or issues.
+- Never commit a token. CI scans shipped files for token-shaped strings
+  and fails the build (`ORBISRPC_STRICT_SECRETS=1`).
+- Token stopped working (close `4004`)? It died on Discord's side
+  (password change / logout-all). Paste a fresh one; no reinstall needed.
+- Token-based presence violates Discord's ToS. No bans for non-spam
+  presence use are known, but the risk is yours.
+
+## Webhook
+
+Commit notifications post via the `DISCORD_WEBHOOK_URL` repo secret
+(Settings → Secrets → Actions). The URL itself is a secret: never commit
+it, and regenerate it in Discord if it ever leaks.
+
+## Reporting
+
+Found a vulnerability? Report it in the Discord server, not in a public
+issue. See the README for the invite.