minor

AGENT.md

@@ -13,7 +13,9 @@ You are an expert C++/CMake contributor tasked with maintaining, and expending *
 
 - The parent project owns the top-level `project(...)`, release layout, and vendor source directories.
 - Tests are enabled by the parent through `C2CORE_BUILD_TESTS`.
-- The parent is expected to provide `thirdParty/base64` and `thirdParty/donut`, or override `C2_BASE64_SOURCE_DIR` and `C2_DONUT_SOURCE_DIR`.
+- The parent is expected to provide `thirdParty/base64` as a real CMake target named `c2_base64`, and `thirdParty/donut`, or override `C2_BASE64_SOURCE_DIR` and `C2_DONUT_SOURCE_DIR`.
+- The parent is expected to provide imported targets for external dependencies used by `core`, notably `nlohmann_json::nlohmann_json` and `Libssh2::libssh2`.
+- In `C2Implant`, those external dependencies come from Conan. Other parents may provide equivalent imported targets differently.
 
 ## Platform Duality
 
@@ -25,3 +27,9 @@ You are an expert C++/CMake contributor tasked with maintaining, and expending *
 - `BeaconHttpLib` and `BeaconGithubLib` must not require `openssl::openssl` or `httplib::httplib` on Windows unless the Windows source path is explicitly changed to use them too.
 - When editing `core/beacon/CMakeLists.txt`, keep transport-specific link dependencies conditional on platform.
 - Apply the same caution to tests: if a test only covers Linux transport plumbing, guard its link dependencies with platform checks.
+
+## Dependency Rules
+
+- Link shared base64 users to `c2_base64`; do not compile `base64.cpp` directly from multiple `core` targets.
+- Link SSH users to `Libssh2::libssh2`. The parent may alias this to Conan's package target when necessary.
+- Do not make `core` depend on Conan directly. Conan is a parent-level implementation detail in `C2Implant`.