Enforce Rust and Swift ownership boundary

AGENTS.md

@@ -27,6 +27,34 @@ cargo test --workspace
 Do not weaken or skip these gates to make a commit pass. Fix the underlying
 warning, lint, formatting issue, or test failure.
 
+## Rust and Swift ownership boundary
+
+Rust owns all application behavior. Put networking, authentication, input
+validation, persistence, preference changes, filtering, sorting, aggregation,
+parsing, content classification, display-data formatting, and navigation target
+derivation in `crates/app`. Cover non-trivial behavior there with Rust tests and
+expose view-ready records and operations through UniFFI.
+
+Swift is the native iOS presentation layer. Limit `ios/Sources` to UIKit and
+SwiftUI lifecycle, view-controller navigation, native controls, layout, drawing,
+fonts, colors, symbols, accessibility, task cancellation tied to view lifetime,
+and Apple presentation integrations such as Quick Look. Swift may map
+Rust-provided states to visual treatments and maintain transient control state;
+it must not infer domain state from display strings, duplicate Rust
+transformations, classify content, or implement persistence and API behavior.
+
+When changing iOS functionality:
+
+- Trace the complete flow before editing and implement behavior in Rust first.
+- Prefer view-ready Rust records over exposing raw Gitea models or rebuilding
+  titles, summaries, selections, progress, and categories in Swift.
+- Treat a pure Swift helper that does not require an Apple UI framework as a
+  boundary warning; move it to Rust unless it only calculates view geometry.
+- Regenerate and commit the UniFFI Swift and C bindings whenever the exported
+  Rust interface changes.
+- During review, inspect both sides of the bridge and reject new business logic
+  added to Swift merely because its caller is a view controller.
+
 ## UI verification conventions
 
 `TESTING.md` is the source of truth for iOS visual verification and the release