Renders the "AI context" Markdown file (ADR-0004, phase 1): a summary of layouts, fields and
script names that AI coding tools can load. Pure: no vscode, no file access, no clock.
Layout, field and script names are written by whoever can edit the database, and agents load
this file as instructions. So:
every name is written as a JSON-escaped string inside a JSON code block, never as prose;
a name is kept only when it is at most 64 characters, all from an allowlist (Unicode
letters and digits, space, and _ - . : ( )). Anything else is replaced by a placeholder,
and the replacements are counted in the header. The allowlist has no backtick, angle
bracket, quote, newline, line separator or bidi control, so a name cannot close the code
block, start a tag or fake a line;
value-list values and free-text descriptions are never included;
type names come from a fixed list, not from the server;
the connection NAME and database are the only things said about the connection. The
renderer is never given the server address, user name or credentials.
Residual risk, accepted and documented in ADR-0004: the field names a model needs in order
to build a query are subject to the same filter here, so a field with an unusual name is
listed as a placeholder; and a hostile name made only of allowlisted characters
("Ignore previous instructions") still passes, because the allowlist cannot tell meaning.
The header asks the model to treat names as data; that is a hint, not a control.
Renders the "AI context" Markdown file (ADR-0004, phase 1): a summary of layouts, fields and script names that AI coding tools can load. Pure: no vscode, no file access, no clock.
Layout, field and script names are written by whoever can edit the database, and agents load this file as instructions. So:
_ - . : ( )). Anything else is replaced by a placeholder, and the replacements are counted in the header. The allowlist has no backtick, angle bracket, quote, newline, line separator or bidi control, so a name cannot close the code block, start a tag or fake a line;Residual risk, accepted and documented in ADR-0004: the field names a model needs in order to build a query are subject to the same filter here, so a field with an unusual name is listed as a placeholder; and a hostile name made only of allowlisted characters ("Ignore previous instructions") still passes, because the allowlist cannot tell meaning. The header asks the model to treat names as data; that is a hint, not a control.