Make AgentSutra.dev the flagship publication

.github/workflows/ci.yml

@@ -1,9 +1,32 @@
-name: CI
+name: Legacy Runtime integrity
 on:
+  workflow_dispatch:
   push:
     branches: [main]
+    paths:
+      - "brain/**"
+      - "bot/**"
+      - "scheduler/**"
+      - "storage/**"
+      - "tests/**"
+      - "tools/**"
+      - "main.py"
+      - "config.py"
+      - "requirements.txt"
+      - ".github/workflows/ci.yml"
   pull_request:
     branches: [main]
+    paths:
+      - "brain/**"
+      - "bot/**"
+      - "scheduler/**"
+      - "storage/**"
+      - "tests/**"
+      - "tools/**"
+      - "main.py"
+      - "config.py"
+      - "requirements.txt"
+      - ".github/workflows/ci.yml"
 
 jobs:
   test:
@@ -12,11 +35,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
-          cache: 'pip'
+          python-version: "3.11"
+          cache: "pip"
       - run: pip install -r requirements.txt
-      - run: pip install pytest ruff
+      - run: pip install pytest ruff==0.16.3
       - name: Lint
-        run: ruff check .
+        run: ruff check . --select E4,E7,E9,F --exclude publication
       - name: Test
         run: python -m pytest tests/ -v -k "not docker" --tb=short

.github/workflows/publication-ci.yml

@@ -0,0 +1,85 @@
+name: AgentSutra publication CI
+
+on:
+  pull_request:
+    paths:
+      - "README.md"
+      - "publication/**"
+      - ".github/workflows/publication-ci.yml"
+  push:
+    branches: [main]
+    paths:
+      - "README.md"
+      - "publication/**"
+      - ".github/workflows/publication-ci.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: agentsutra-publication-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    working-directory: publication
+
+jobs:
+  verify:
+    name: Verify static publication
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+
+      - name: Use exact Node.js runtime
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24.19.0
+          cache: npm
+          cache-dependency-path: publication/package-lock.json
+
+      - name: Confirm runtime and install locked dependencies
+        run: |
+          npm install --global npm@11.17.0
+          node --version
+          npm --version
+          npm ci
+
+      - name: Validate source, content, privacy, and pre-launch output
+        run: npm run verify
+
+      - name: Prove the public release profile fails closed
+        run: npm run verify:public-profile
+
+      - name: Install pinned Playwright browsers
+        run: npx --no-install playwright install --with-deps chromium firefox webkit
+
+      - name: Run cross-browser and accessibility tests
+        run: npm run test:e2e
+
+      - name: Install PDF inspection tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends poppler-utils
+
+      - name: Validate deterministic social export
+        env:
+          INCLUDE_FIXTURES: "1"
+          EXPORT_MODE: "1"
+        run: npm run export:verify
+
+      - name: Rebuild clean pre-launch output
+        run: |
+          npm run build
+          npm run privacy:scan
+          npm run verify:dist
+
+      - name: Validate Cloudflare package without deploying
+        env:
+          WRANGLER_LOG_PATH: /tmp/agentsutra-wrangler.log
+        run: npm run deploy:dry-run
+
+      - name: Rehearse clean source and validated preview archives
+        run: npm run release:artifacts

CLAUDE.md

@@ -1,4 +1,9 @@
-# AgentSutra v9.0.0
+# AgentSutra Runtime v9.0.0 — frozen historical reference
+
+> **Archive notice:** The Mac mini that hosted this Runtime was reset. This code is unsupported,
+> receives no feature development and is not presented as a current operational system. The active
+> flagship is the evidence-led publication in [`publication/`](publication/). The material below is
+> retained for provenance and study only.
 
 Single-user, self-hosted AI agent. Telegram-controlled. Mac Mini M2 (16GB).
 Fixed 5-stage LangGraph pipeline: Classify → Plan → Execute → Audit → Deliver.
@@ -14,26 +19,28 @@ Full detail: cat REFERENCE.md
                                       +- retry --+ (max 3)
 
 ## File Map (abbreviated)
-| File | Purpose |
-|------|---------|
-| `main.py` | Entry point, env validation, DB init, SIGTERM handler |
-| `config.py` | All constants, paths, model names, budget caps |
-| `brain/state.py` | AgentState TypedDict — 25 fields |
-| `brain/graph.py` | LangGraph wiring, run_task(), stage tracking |
-| `brain/nodes/classifier.py` | Fast path → slow path classify |
-| `brain/nodes/planner.py` | Task prompts, RAG injection, 7 templates |
-| `brain/nodes/executor.py` | Code gen, sandbox execution, truncation detection |
-| `brain/nodes/auditor.py` | Opus adversarial review, fabrication detection |
-| `brain/nodes/deliverer.py` | Response formatting, credential filter, memory |
-| `tools/sandbox.py` | AST scanner, subprocess allowlist, Docker, Tier 1-4 |
-| `tools/deployer.py` | GitHub Pages / Vercel / Firebase deploy; _git_with_askpass() for authenticated git ops |
-| `tools/rag.py` | LanceDB, Ollama embeddings, AST chunking |
-| `tools/model_router.py` | Claude/Ollama routing by complexity + budget |
-| `tools/claude_client.py` | Anthropic API wrapper, cost tracking |
-| `storage/db.py` | SQLite WAL, 5 tables, threading.Lock |
-| `bot/handlers.py` | 19 Telegram command handlers, auth |
+
+| File                        | Purpose                                                                                |
+| --------------------------- | -------------------------------------------------------------------------------------- |
+| `main.py`                   | Entry point, env validation, DB init, SIGTERM handler                                  |
+| `config.py`                 | All constants, paths, model names, budget caps                                         |
+| `brain/state.py`            | AgentState TypedDict — 25 fields                                                       |
+| `brain/graph.py`            | LangGraph wiring, run_task(), stage tracking                                           |
+| `brain/nodes/classifier.py` | Fast path → slow path classify                                                         |
+| `brain/nodes/planner.py`    | Task prompts, RAG injection, 7 templates                                               |
+| `brain/nodes/executor.py`   | Code gen, sandbox execution, truncation detection                                      |
+| `brain/nodes/auditor.py`    | Opus adversarial review, fabrication detection                                         |
+| `brain/nodes/deliverer.py`  | Response formatting, credential filter, memory                                         |
+| `tools/sandbox.py`          | AST scanner, subprocess allowlist, Docker, Tier 1-4                                    |
+| `tools/deployer.py`         | GitHub Pages / Vercel / Firebase deploy; _git_with_askpass() for authenticated git ops |
+| `tools/rag.py`              | LanceDB, Ollama embeddings, AST chunking                                               |
+| `tools/model_router.py`     | Claude/Ollama routing by complexity + budget                                           |
+| `tools/claude_client.py`    | Anthropic API wrapper, cost tracking                                                   |
+| `storage/db.py`             | SQLite WAL, 5 tables, threading.Lock                                                   |
+| `bot/handlers.py`           | 19 Telegram command handlers, auth                                                     |
 
 ## Core Invariants
+
 1. Pipeline is FIXED at 5 stages. Never add or remove a stage.
 2. Opus ALWAYS audits. Never route audit to Sonnet or Ollama.
 3. Pipeline nodes are synchronous. No async inside nodes.
@@ -50,12 +57,16 @@ Full detail: cat REFERENCE.md
    the interpreter fallback (sandbox.py:1402), making no-scan + full execution the
    worst combination.
 
-## Active Priorities
-- v9.1: Project memory system (SQLite project_index table)
-- v9.2: Plan decomposition (structured task graph)
-- Open: Per-task cost tracking, Ollama health check, audit feedback loop
+## Historical roadmap — not active
+
+- Former v9.1 proposal: project memory system (SQLite project_index table)
+- Former v9.2 proposal: plan decomposition (structured task graph)
+- Unscheduled historical ideas: per-task cost tracking, Ollama health check, audit feedback loop
+
+These items are preserved as historical context only. The Runtime is frozen and unsupported.
 
 ## Test Gate
+
 `pytest tests/ -v -k "not docker"` must pass before AUDIT. Use `gate` alias.
 
 On a bare pyenv without the project venv, ~25 tests will fail to collect (missing
@@ -64,17 +75,20 @@ pytest-asyncio — pre-existing, confirmed via git stash round-trip. Install pro
 venv first.
 
 ## Pane Workflow
-| Pane | Model | Does | Never does |
-|------|-------|------|-----------|
-| AUDIT | Opus/high/plan | Find defects in specified files | Write code, edit files |
-| IMPL | Sonnet/high/acceptEdits | Write code, run tests | Architectural decisions, schema changes |
-| PLAN | Sonnet/low | Design decisions, task breakdowns | Write code, edit files |
-| PROMPT | Sonnet/medium | Write/audit prompts | Write application code |
+
+| Pane   | Model                   | Does                              | Never does                              |
+| ------ | ----------------------- | --------------------------------- | --------------------------------------- |
+| AUDIT  | Opus/high/plan          | Find defects in specified files   | Write code, edit files                  |
+| IMPL   | Sonnet/high/acceptEdits | Write code, run tests             | Architectural decisions, schema changes |
+| PLAN   | Sonnet/low              | Design decisions, task breakdowns | Write code, edit files                  |
+| PROMPT | Sonnet/medium           | Write/audit prompts               | Write application code                  |
 
 **Handoffs:** PLAN→IMPL: paste Section 4. IMPL→AUDIT: file list + gate pass. AUDIT→IMPL: findings verbatim, CRITICAL/HIGH only first pass.
 
 ## Session Log
+
 Append to SESSION_LOG.md. Format: `### YYYY-MM-DD — task` / `Done:` / `Decisions:` / `Next:`
 
 ## Architecture Decisions
-[PLAN outputs entries here — paste manually after each session]
+
+[PLAN outputs entries here — paste manually after each session]

CODEBASE_REFERENCE.md

@@ -1,5 +1,10 @@
 # AgentSutra — Complete Codebase Reference
 
+> **Archive notice:** The Mac mini that hosted this Runtime was reset. The Runtime is frozen,
+> unsupported and not presented as currently operating. This reference records the historical
+> codebase; operational claims require fresh verification before reuse. The active flagship is the
+> evidence-led publication in [`publication/`](publication/).
+
 Every folder, file, and configuration in the AgentSutra project — what it is, what it does, and why it was built this way.
 
 **Generated:** 2026-02-24 (v8.0.0 baseline, updated 2026-03-10 for v9.0.0)