feat: agent-ready CLI substrate — adapters + contracts + EcoMap

.github/workflows/autonomy-loop.yml

@@ -1,64 +1,67 @@
-name: Autonomy Loop
-
-on:
-  schedule:
-    - cron: '20 */2 * * *'
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-  issues: write
-
-# Skip on push events - only run on schedule or manual dispatch
-if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-
-jobs:
-  automerge:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Merge labeled PRs whose checks are green (Workers Builds exempt)
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -euo pipefail
-          prs=$(gh pr list -R "$REPO" --label automerge --state open --json number -q '.[].number')
-          [ -z "$prs" ] && echo 'No automerge-labeled PRs.' && exit 0
-          for pr in $prs; do
-            fails=$(gh pr checks "$pr" -R "$REPO" --json name,state \
-              -q '[.[] | select(.state=="FAILURE" or .state=="ERROR") | .name | select(startswith("Workers Builds") | not)] | length' || echo 1)
-            pending=$(gh pr checks "$pr" -R "$REPO" --json state \
-              -q '[.[] | select(.state=="PENDING" or .state=="QUEUED" or .state=="IN_PROGRESS")] | length' || echo 1)
-            if [ "$fails" = "0" ] && [ "$pending" = "0" ]; then
-              echo "Merging PR #$pr (all real checks green)"
-              gh pr merge "$pr" -R "$REPO" --squash --delete-branch || echo "PR #$pr not mergeable (conflict/protection) — next loop"
-            else
-              echo "PR #$pr skipped (non-exempt failures: $fails, pending: $pending)"
-            fi
-          done
-
-  probe:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - name: Probe live rails
-        run: |
-          set +e
-          fail=0
-          echo "## Rail status $(date -u +%Y-%m-%dT%H:%M:%SZ)"
-          curl -sf -m 15 https://bridge.a-to-mind.com/health >/dev/null && echo 'bridge /health: OK' || { echo 'bridge /health: FAIL'; fail=1; }
-          curl -sf -m 15 https://bridge.a-to-mind.com/api/stack >/dev/null && echo 'bridge /api/stack: OK' || { echo 'bridge /api/stack: FAIL'; fail=1; }
-          curl -sf -m 15 https://aether.a-to-mind.com/api/health >/dev/null && echo 'aether /api/health: OK' || echo 'aether /api/health: FAIL (known: deploy lane red, #119)'
-          if [ -f docs/run-artifacts/wix-domain.txt ]; then
-            d=$(head -n1 docs/run-artifacts/wix-domain.txt | tr -d '[:space:]')
-            body=$(curl -sf -m 15 "https://$d/_functions/health")
-            if echo "$body" | grep -q '"version":2'; then
-              echo "wix ($d): OK v2 — GitHub→Velo publish lane PROVEN"
-            else
-              echo "wix ($d): FAIL or wrong version — see #120"; fail=1
-            fi
-          else
-            echo 'wix: domain unknown — commit docs/run-artifacts/wix-domain.txt (#120 task 1)'
-          fi
-          exit $fail
+name: Autonomy Loop
+
+on:
+  schedule:
+    - cron: '20 */2 * * *'
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+jobs:
+  automerge:
+    if: >
+      github.event_name == 'schedule' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && github.ref == 'refs/heads/main')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Merge labeled PRs whose checks are green (Workers Builds exempt)
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          prs=$(gh pr list -R "$REPO" --label automerge --state open --json number -q '.[].number')
+          [ -z "$prs" ] && echo 'No automerge-labeled PRs.' && exit 0
+          for pr in $prs; do
+            fails=$(gh pr checks "$pr" -R "$REPO" --json name,state \
+              -q '[.[] | select(.state=="FAILURE" or .state=="ERROR") | .name | select(startswith("Workers Builds") | not)] | length' || echo 1)
+            pending=$(gh pr checks "$pr" -R "$REPO" --json state \
+              -q '[.[] | select(.state=="PENDING" or .state=="QUEUED" or .state=="IN_PROGRESS")] | length' || echo 1)
+            if [ "$fails" = "0" ] && [ "$pending" = "0" ]; then
+              echo "Merging PR #$pr (all real checks green)"
+              gh pr merge "$pr" -R "$REPO" --squash --delete-branch || echo "PR #$pr not mergeable (conflict/protection) — next loop"
+            else
+              echo "PR #$pr skipped (non-exempt failures: $fails, pending: $pending)"
+            fi
+          done
+
+  probe:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Probe live rails
+        run: |
+          set +e
+          fail=0
+          echo "## Rail status $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+          curl -sf -m 15 https://bridge.a-to-mind.com/health >/dev/null && echo 'bridge /health: OK' || { echo 'bridge /health: FAIL'; fail=1; }
+          curl -sf -m 15 https://bridge.a-to-mind.com/api/stack >/dev/null && echo 'bridge /api/stack: OK' || { echo 'bridge /api/stack: FAIL'; fail=1; }
+          curl -sf -m 15 https://aether.a-to-mind.com/api/health >/dev/null && echo 'aether /api/health: OK' || echo 'aether /api/health: FAIL (known: deploy lane red, #119)'
+          if [ -f docs/run-artifacts/wix-domain.txt ]; then
+            d=$(head -n1 docs/run-artifacts/wix-domain.txt | tr -d '[:space:]')
+            body=$(curl -sf -m 15 "https://$d/_functions/health")
+            if echo "$body" | grep -q '"version":2'; then
+              echo "wix ($d): OK v2 — GitHub→Velo publish lane PROVEN"
+            else
+              echo "wix ($d): FAIL or wrong version — see #120"; fail=1
+            fi
+          else
+            echo 'wix: domain unknown — commit docs/run-artifacts/wix-domain.txt (#120 task 1)'
+          fi
+          exit $fail

.github/workflows/github-watchtower.yml

@@ -1,65 +1,68 @@
-name: GitHub Watchtower
-
-on:
-  schedule:
-    - cron: '0 * * * *' # Every hour
-  workflow_dispatch: {}
-
-permissions:
-  contents: read
-  pull-requests: read
-
-# Skip on push events - only run on schedule or manual dispatch
-if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-
-jobs:
-  watch:
-    name: Monitor repo activity and open PRs
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check recent commits
-        id: commits
-        run: |
-          COMMITS=$(gh api repos/atomeam/Aether/commits --paginate -q '.[:5] | .[] | {sha, message: .commit.message[:50], author: .author.login, date: .commit.committer.date}' || echo "[]")
-          echo "$COMMITS"
-          echo "commits<<EOF" >> "$GITHUB_OUTPUT"
-          echo "$COMMITS" >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
-
-      - name: Check open PRs
-        id: prs
-        run: |
-          PRS=$(gh pr list --state open --json number,title,headRefName,createdAt,author --jq '.[] | {number, title, head: .headRefName, created: .createdAt, author: .author.login}' || echo "[]")
-          echo "$PRS"
-          echo "prs<<EOF" >> "$GITHUB_OUTPUT"
-          echo "$PRS" >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
-
-      - name: Check Issue #117 status
-        id: issue117
-        run: |
-          ISSUE=$(gh issue view 117 --json state,title,url --jq '{state, title, url}' || echo "{}")
-          echo "$ISSUE"
-          echo "issue117<<EOF" >> "$GITHUB_OUTPUT"
-          echo "$ISSUE" >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
-
-      - name: Alert on new critical PRs
-        if: contains(steps.prs.outputs.prs, 'deploy') || contains(steps.prs.outputs.prs, 'billing') || contains(steps.prs.outputs.prs, 'stripe')
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H "Content-Type: application/json" \
-            -d "{\"text\": \"👀 *GitHub Watchtower*\nCritical PRs detected:\n${{ steps.prs.outputs.prs }}\"}" || echo "Slack notification failed"
-
-      - name: Log to Notion (via bridge)
-        run: |
-          curl -sf -X POST "https://bridge.a-to-mind.com/api/github/status" \
-            -H "Content-Type: application/json" \
-            -d "{
-              \"recent_commits\": \"${{ steps.commits.outputs.commits }}\",
-              \"open_prs\": \"${{ steps.prs.outputs.prs }}\",
-              \"issue117_status\": \"${{ steps.issue117.outputs.issue117 }}\",
-              \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
-            }" 2>/dev/null || echo "Bridge endpoint not available"
+name: GitHub Watchtower
+
+on:
+  schedule:
+    - cron: '0 * * * *' # Every hour
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  watch:
+    if: >
+      github.event_name == 'schedule' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && github.ref == 'refs/heads/main')
+    name: Monitor repo activity and open PRs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check recent commits
+        id: commits
+        run: |
+          COMMITS=$(gh api repos/atomeam/Aether/commits --paginate -q '.[:5] | .[] | {sha, message: .commit.message[:50], author: .author.login, date: .commit.committer.date}' || echo "[]")
+          echo "$COMMITS"
+          echo "commits<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$COMMITS" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Check open PRs
+        id: prs
+        run: |
+          PRS=$(gh pr list --state open --json number,title,headRefName,createdAt,author --jq '.[] | {number, title, head: .headRefName, created: .createdAt, author: .author.login}' || echo "[]")
+          echo "$PRS"
+          echo "prs<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$PRS" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Check Issue #117 status
+        id: issue117
+        run: |
+          ISSUE=$(gh issue view 117 --json state,title,url --jq '{state, title, url}' || echo "{}")
+          echo "$ISSUE"
+          echo "issue117<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$ISSUE" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Alert on new critical PRs
+        if: contains(steps.prs.outputs.prs, 'deploy') || contains(steps.prs.outputs.prs, 'billing') || contains(steps.prs.outputs.prs, 'stripe')
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -s -X POST "$SLACK_WEBHOOK_URL" \
+            -H "Content-Type: application/json" \
+            -d "{\"text\": \"👀 *GitHub Watchtower*\nCritical PRs detected:\n${{ steps.prs.outputs.prs }}\"}" || echo "Slack notification failed"
+
+      - name: Log to Notion (via bridge)
+        run: |
+          curl -sf -X POST "https://bridge.a-to-mind.com/api/github/status" \
+            -H "Content-Type: application/json" \
+            -d "{
+              \"recent_commits\": \"${{ steps.commits.outputs.commits }}\",
+              \"open_prs\": \"${{ steps.prs.outputs.prs }}\",
+              \"issue117_status\": \"${{ steps.issue117.outputs.issue117 }}\",
+              \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
+            }" 2>/dev/null || echo "Bridge endpoint not available"

.github/workflows/infra-monitor.yml

@@ -1,55 +1,58 @@
-name: Infrastructure Monitor
-
-on:
-  schedule:
-    - cron: '0 * * * *' # Every hour
-  workflow_dispatch: {}
-
-# Skip on push events - only run on schedule or manual dispatch
-if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-
-jobs:
-  monitor:
-    name: Check Workers Builds and deployment status
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Workers Builds status
-        id: workers
-        run: |
-          # Workers Builds status check (requires CF_API_TOKEN)
-          if [ -n "${{ secrets.CF_API_TOKEN }}" ]; then
-            echo "Workers Builds: API token available, status check possible"
-            echo "status=checkable" >> "$GITHUB_OUTPUT"
-          else
-            echo "Workers Builds: API token missing, cannot check status"
-            echo "status=blocked" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Check recent deployments
-        id: deployments
-        run: |
-          # Check last 5 deployments via GitHub API
-          DEPLOYMENTS=$(gh api repos/atomeam/Aether/deployments --paginate -q '.[:5] | .[] | {environment, state, created_at, sha}' || echo "[]")
-          echo "$DEPLOYMENTS"
-          echo "deployments<<EOF" >> "$GITHUB_OUTPUT"
-          echo "$DEPLOYMENTS" >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
-
-      - name: Alert on deployment failures
-        if: contains(steps.deployments.outputs.deployments, 'inactive') || contains(steps.deployments.outputs.deployments, 'error')
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -s -X POST "$SLACK_WEBHOOK_URL" \
-            -H "Content-Type: application/json" \
-            -d "{\"text\": \"🚨 *Infrastructure Alert*\nRecent deployment failures detected:\n${{ steps.deployments.outputs.deployments }}\"}" || echo "Slack notification failed"
-
-      - name: Log to Notion (via bridge)
-        run: |
-          curl -sf -X POST "https://bridge.a-to-mind.com/api/infra/status" \
-            -H "Content-Type: application/json" \
-            -d "{
-              \"workers_builds_status\": \"${{ steps.workers.outputs.status }}\",
-              \"recent_deployments\": \"${{ steps.deployments.outputs.deployments }}\",
-              \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
-            }" 2>/dev/null || echo "Bridge endpoint not available"
+name: Infrastructure Monitor
+
+on:
+  schedule:
+    - cron: '0 * * * *' # Every hour
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+jobs:
+  monitor:
+    if: >
+      github.event_name == 'schedule' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && github.ref == 'refs/heads/main')
+    name: Check Workers Builds and deployment status
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Workers Builds status
+        id: workers
+        run: |
+          # Workers Builds status check (requires CF_API_TOKEN)
+          if [ -n "${{ secrets.CF_API_TOKEN }}" ]; then
+            echo "Workers Builds: API token available, status check possible"
+            echo "status=checkable" >> "$GITHUB_OUTPUT"
+          else
+            echo "Workers Builds: API token missing, cannot check status"
+            echo "status=blocked" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check recent deployments
+        id: deployments
+        run: |
+          # Check last 5 deployments via GitHub API
+          DEPLOYMENTS=$(gh api repos/atomeam/Aether/deployments --paginate -q '.[:5] | .[] | {environment, state, created_at, sha}' || echo "[]")
+          echo "$DEPLOYMENTS"
+          echo "deployments<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$DEPLOYMENTS" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Alert on deployment failures
+        if: contains(steps.deployments.outputs.deployments, 'inactive') || contains(steps.deployments.outputs.deployments, 'error')
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -s -X POST "$SLACK_WEBHOOK_URL" \
+            -H "Content-Type: application/json" \
+            -d "{\"text\": \"🚨 *Infrastructure Alert*\nRecent deployment failures detected:\n${{ steps.deployments.outputs.deployments }}\"}" || echo "Slack notification failed"
+
+      - name: Log to Notion (via bridge)
+        run: |
+          curl -sf -X POST "https://bridge.a-to-mind.com/api/infra/status" \
+            -H "Content-Type: application/json" \
+            -d "{
+              \"workers_builds_status\": \"${{ steps.workers.outputs.status }}\",
+              \"recent_deployments\": \"${{ steps.deployments.outputs.deployments }}\",
+              \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
+            }" 2>/dev/null || echo "Bridge endpoint not available"