Establish agent-first, free-tier build and release flow

.github/ISSUE_TEMPLATE/agent-task.yml

@@ -0,0 +1,117 @@
+name: Agent implementation task
+description: Define a bounded development task for an AI coding agent
+title: "[Agent Task]: "
+labels: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Read `AGENTS.md` and `docs/AGENT_BUILD_FLOW.md` before implementation. Do not include secrets or real identity documents.
+
+  - type: textarea
+    id: objective
+    attributes:
+      label: Objective
+      description: State one measurable user or business outcome.
+      placeholder: A public contact enquiry is stored before the visitor sees a success message.
+    validations:
+      required: true
+
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: List observable conditions that prove the task is complete.
+      placeholder: |
+        - Valid submissions are persisted.
+        - Invalid input returns 400.
+        - Storage failure returns 503.
+        - Tests cover success and failure paths.
+    validations:
+      required: true
+
+  - type: textarea
+    id: scope
+    attributes:
+      label: In-scope routes, roles, and files
+      description: Identify affected user roles, routes, models, or integrations.
+    validations:
+      required: true
+
+  - type: textarea
+    id: exclusions
+    attributes:
+      label: Explicit exclusions
+      description: State what the agent must not change or activate.
+      placeholder: |
+        - No paid service activation.
+        - No production credentials.
+        - No direct commits to main.
+        - No sensitive document upload.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: data
+    attributes:
+      label: Sensitive-data level
+      options:
+        - None or public content
+        - Account or contact information
+        - Authentication or authorization
+        - Identity, financial, legal, or regulated information
+    validations:
+      required: true
+
+  - type: dropdown
+    id: billing
+    attributes:
+      label: Billing impact
+      options:
+        - None
+        - Uses an existing free or already-approved service
+        - May create metered usage
+        - Requires owner approval before implementation can finish
+    validations:
+      required: true
+
+  - type: textarea
+    id: dependencies
+    attributes:
+      label: Manual and provider dependencies
+      description: List accounts, approvals, provider decisions, or credentials the owner must supply.
+      placeholder: None, or describe the exact owner-only action.
+    validations:
+      required: true
+
+  - type: textarea
+    id: tests
+    attributes:
+      label: Required verification
+      description: Include unit, authorization, fail-closed, preview, and production checks as applicable.
+      placeholder: |
+        - pnpm run verify
+        - Vercel preview route check
+        - No external billable calls in tests
+    validations:
+      required: true
+
+  - type: textarea
+    id: rollback
+    attributes:
+      label: Rollback expectation
+      description: Explain how the change can be disabled or reverted safely.
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: guardrails
+    attributes:
+      label: Guardrails
+      options:
+        - label: I have not placed secrets, passwords, API keys, or real sensitive documents in this issue.
+          required: true
+        - label: The task does not authorize billing, legal claims, certifications, or regulated-service activation.
+          required: true
+        - label: The agent must use a branch and pull request.
+          required: true

.github/pull_request_template.md

@@ -0,0 +1,50 @@
+## Objective
+
+Closes #
+
+Describe the single measurable outcome delivered by this pull request.
+
+## Changes
+
+- 
+
+## Files and data models affected
+
+- 
+
+## Trust, security, privacy, and billing review
+
+- [ ] No secrets or real sensitive documents are included.
+- [ ] Public wording does not overstate live, verified, encrypted, certified, guaranteed, or continuous capability.
+- [ ] Authorization and validation boundaries were reviewed.
+- [ ] Missing provider configuration fails closed.
+- [ ] No paid plan, billing, or metered feature was activated.
+- [ ] Database changes include compatibility and rollback notes, or no schema change was made.
+
+## Verification
+
+- [ ] `pnpm run verify`
+- [ ] Relevant authorization and validation failures tested
+- [ ] Vercel preview checked
+- [ ] Build/runtime logs checked
+- [ ] No billable external calls made during testing
+
+Evidence:
+
+```text
+Paste concise command results or route/status checks here.
+```
+
+## Manual actions remaining
+
+State exactly what requires the business owner, provider account, legal approval, or production credential. Write `None` when no manual action remains.
+
+## Rollback
+
+Describe how to revert, disable, or fail closed safely.
+
+## Agent declaration
+
+- [ ] I read `AGENTS.md` and `docs/AGENT_BUILD_FLOW.md`.
+- [ ] This pull request stays within the linked issue scope.
+- [ ] I am not claiming completion while a required gate is failing.

.github/workflows/ci.yml

@@ -1,91 +1,51 @@
-name: CI (Tests & Validation Only - Vercel Handles Deployment)
+name: Manual Build Verification
 
 on:
-  pull_request:
-    branches: [main]
+  workflow_dispatch:
 
-jobs:
-  test:
-    name: Unit Tests
-    runs-on: ubuntu-22.04
+permissions:
+  contents: read
 
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+concurrency:
+  group: manual-build-verification-${{ github.ref }}
+  cancel-in-progress: true
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Generate Prisma client
-        run: pnpm run db:generate
-        env:
-          POSTGRES_PRISMA_URL: postgresql://ci:ci@localhost:5432/gem_ci
-          POSTGRES_URL_NON_POOLING: postgresql://ci:ci@localhost:5432/gem_ci
-
-      - name: Run unit tests
-        run: pnpm test
-        env:
-          NODE_ENV: test
-          JWT_SECRET: ci-test-secret-min-32-characters-long-placeholder
-          POSTGRES_PRISMA_URL: postgresql://ci:ci@localhost:5432/gem_ci
-          POSTGRES_URL_NON_POOLING: postgresql://ci:ci@localhost:5432/gem_ci
-
-  lint-and-build:
-    name: Lint & Build
+jobs:
+  verify:
+    name: Lint, Typecheck, Test, Build
     runs-on: ubuntu-22.04
-    needs: test
+    timeout-minutes: 30
+
+    env:
+      NODE_ENV: test
+      JWT_SECRET: ci-test-secret-min-32-characters-long-placeholder
+      POSTGRES_PRISMA_URL: postgresql://ci:ci@localhost:5432/gem_ci
+      POSTGRES_URL_NON_POOLING: postgresql://ci:ci@localhost:5432/gem_ci
+      NEXT_PUBLIC_APP_URL: https://www.gemcybersecurityassist.com
+      NEXT_PUBLIC_APP_NAME: GEM Enterprise
+      NEXT_PUBLIC_AI_DISCLOSURE_TEXT: GEM Concierge is an AI assistant. Responses are informational and require human review for sensitive decisions.
+      AUDIT_ENABLED: "true"
+      SMTP_HOST: ""
+      SMTP_PORT: "587"
+      SMTP_USER: ""
+      SMTP_PASS: ""
+      CRON_SECRET: ci-cron-secret
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
+        uses: pnpm/action-setup@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: pnpm
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Generate Prisma client
-        run: pnpm run db:generate
-        env:
-          POSTGRES_PRISMA_URL: postgresql://ci:ci@localhost:5432/gem_ci
-          POSTGRES_URL_NON_POOLING: postgresql://ci:ci@localhost:5432/gem_ci
-
-      - name: Lint
-        run: pnpm run lint
-
-      - name: Build
-        run: pnpm run build
-        env:
-          POSTGRES_PRISMA_URL: postgresql://ci:ci@localhost:5432/gem_ci
-          POSTGRES_URL_NON_POOLING: postgresql://ci:ci@localhost:5432/gem_ci
-          JWT_SECRET: ${{ secrets.JWT_SECRET || 'ci-build-secret-min-32-characters-long' }}
-          NEXT_PUBLIC_APP_URL: https://gem-enterprise.vercel.app
-          NEXT_PUBLIC_APP_NAME: GEM Enterprise
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          NEXT_PUBLIC_AI_DISCLOSURE_TEXT: ${{ secrets.NEXT_PUBLIC_AI_DISCLOSURE_TEXT || 'GEM Concierge is an AI assistant. Responses are for informational purposes only.' }}
-          AUDIT_ENABLED: 'true'
-          SMTP_HOST: ''
-          SMTP_PORT: '587'
-          SMTP_USER: ''
-          SMTP_PASS: ''
-          CRON_SECRET: ci-cron-secret
+      - name: Verify repository
+        run: pnpm run verify