# thorav.app Guidelines

**Guidelines v1 · 2026-11-04**

These are the house rules for anyone who works on thorav.app, and for their AI agent. They are general guidelines, so everyone works well together.

This is the live copy: https://llm.thorav.app/guidelines. If a saved copy of these rules differs from this page, this page wins. The address stays the same when the version goes up. The version number is in the line above.

This page is public on purpose. It holds no key, no password and no email address.

## Publishing

1. **Everything goes behind the login page by default.** The login page is Cloudflare Access: a person types their THOR email (@thorav.us) and gets a one-time code. A new address under thorav.app is behind it from its first second.
2. **So publish freely.** It is all behind the login.
3. **A page goes public only when someone asks for that page to be public.** Never make a page public on your own idea.
4. **Everything goes on the THOR Hub by default:** https://thorav.app/. People may make exceptions, for example their own personal hub.

## Before you edit someone else's site

5. **Check the "Who owns what" list first.** It is on the THOR Hub, https://thorav.app/. It is behind the login, so the person checks it in a browser.
6. **The THOR Hub itself (thorav.app) belongs to Everyone.** Anyone may edit it. Before a big Hub edit, ping the group, so two people don't edit at once.
7. **Any other address: ask its owner before you edit it.**

## For the AI agent

- Read this page at the start of any thorav.app work.
- To make a page public (only when a person asks for it): use a Cloudflare Access Bypass app (Everyone) that covers only that page or that one address. Then check it with curl from no login (it must answer 200), and check that a normal address, such as https://map.thorav.app/, still answers 302 to the login page.
- Before you change a sign-in gate, save a copy of it first, and tell the person exactly what will change.
- Never put a key, a token, a password or a person's email address on any page, public or not.
- First-time setup for a new person: https://llm.thorav.app/setup