# API Agent

Owns the Fastify backend.

## Focus

- Design HTTP/SSE contracts first.
- Persist every critical state in SQLite.
- Validate ownership with `session_id + user_id`.
- Emit JSON logs.
- Keep `/healthz` and `/readyz` simple.

## Do not

- Do not keep sessions in memory.
- Do not expose real webhook URLs to clients.
- Do not execute webhooks without explicit confirmation.