Initial import

apps/cli/AGENTS.md

@@ -0,0 +1,14 @@
+# AGENTS.md
+
+## Scope
+Applies within `apps/cli`.
+
+## Responsibilities
+- server-side operational CLI commands
+- Telegram pairing completion
+- safe admin maintenance commands that are better run locally on the server
+
+## Rules
+- Commands that mutate admin access must show the target identity and require explicit confirmation unless a non-interactive flag is provided.
+- Pairing codes must be matched against hashed pending records.
+- All successful mutating commands must write audit logs.