Move the decisions out of AGENTS.md into docs/decisions.md

src/auth/gate.ts

@@ -10,10 +10,14 @@ export interface Gate {
   session?: boolean; // any signed-in user, no grant to hold; anonymous is sent to /login
 }
 
+// A gate naming none of the three allows everyone. Discovery refuses one on a route or a plugin's
+// nav node, so only the header nodes `config/menu.ts`'s `groups` builds get here without a gate,
+// and failing closed would hide every section an operator grouped.
 export function allows(gate: Gate, user: User | null): boolean {
   if (gate.public === true) return true;
   if (gate.session === true) return user !== null;
-  return gate.permission == null || (user?.permissions.includes(gate.permission) ?? false);
+  if (gate.permission == null) return true;
+  return user?.permissions.includes(gate.permission) ?? false;
 }
 
 export function gatesSet(gate: Gate | null | undefined): string[] {

src/postgres.test.ts

@@ -31,9 +31,9 @@ test("init SQL gives each Ory service its own database, and leaves plugin databa
   }
 });
 
-// AGENTS.md records that the driver runs the provisioning DDL in bootstrap and nothing else. A
-// single value imported from the wrong module puts it in web's graph without changing behaviour,
-// so nothing but this would notice.
+// docs/decisions.md records that the driver runs the provisioning DDL in bootstrap and nothing
+// else. A single value imported from the wrong module puts it in web's graph without changing
+// behaviour, so nothing but this would notice.
 test("the Postgres driver reaches bootstrap only, never web's import graph", () => {
   const files = sourceFiles();
   assert.ok(files.length > 40, "walks the source tree");

src/server.ts

@@ -20,7 +20,7 @@ import { buildCredentials, storagePluginIds, type StorageCredentials } from "./p
 const config = loadConfig(); // validates the env (incl. enforced secrets) — fails loud at boot
 // The storage secret is in `config` now, so drop it from the environment before ANY plugin code
 // runs: a plugin module's top level evaluates during discovery, long before onBoot. Defence in
-// depth, not a boundary (AGENTS.md) — and only ever move this line earlier, never later.
+// depth, not a boundary (docs/decisions.md) — and only ever move this line earlier, never later.
 delete process.env["PLUGIN_DB_SECRET"];
 // App-level logger: structured, OTLP-capable when OTLP_ENDPOINT is set. The hot path clones it
 // per request for access logging + a trace span (src/http/request-tracking.ts); console-only otherwise.