Promote consolidated staging history to main (no tags)

.dockerignore

@@ -0,0 +1,11 @@
+.git
+.github
+.local
+.treeseed
+dist
+node_modules
+release-assets
+artifacts
+coverage
+docs
+tests

.github/workflows/deploy-docs.yml

@@ -9,7 +9,7 @@ on:
         type: choice
         options:
           - staging
-          - prod
+          - production
       action_kind:
         required: true
         default: deploy_web
@@ -21,16 +21,13 @@ on:
       project_id:
         required: false
         type: string
-      preview_id:
-        required: false
-        type: string
 
 jobs:
   web:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-    environment: ${{ inputs.environment == 'prod' && 'production' || 'staging' }}
+    environment: ${{ inputs.environment }}
     defaults:
       run:
         working-directory: docs
@@ -40,12 +37,14 @@ jobs:
       TREESEED_CLOUDFLARE_ACCOUNT_ID: ${{ vars.TREESEED_CLOUDFLARE_ACCOUNT_ID }}
       TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME || 'treeseed-admin-docs' }}
       TREESEED_CONTENT_BUCKET_NAME: ${{ vars.TREESEED_CONTENT_BUCKET_NAME }}
+      TREESEED_TEAM_ID: treeseed
+      TREESEED_R2_ACCESS_KEY_ID: ${{ secrets.TREESEED_R2_ACCESS_KEY_ID }}
+      TREESEED_R2_SECRET_ACCESS_KEY: ${{ secrets.TREESEED_R2_SECRET_ACCESS_KEY }}
       TREESEED_CONTENT_BUCKET_BINDING: ${{ vars.TREESEED_CONTENT_BUCKET_BINDING }}
       TREESEED_PROJECT_ID: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID || 'admin' }}
       TREESEED_WORKFLOW_ACTION: ${{ inputs.action_kind }}
       TREESEED_WORKFLOW_ENVIRONMENT: ${{ inputs.environment }}
       TREESEED_WORKFLOW_PROJECT: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID || 'admin' }}
-      TREESEED_WORKFLOW_PREVIEW_ID: ${{ inputs.preview_id }}
     steps:
       - uses: actions/checkout@v4
 
@@ -69,5 +68,4 @@ jobs:
           set -euo pipefail
           EXTRA_ARGS=()
           if [[ -n "${TREESEED_WORKFLOW_PROJECT:-}" ]]; then EXTRA_ARGS+=(--project-id "${TREESEED_WORKFLOW_PROJECT}"); fi
-          if [[ -n "${TREESEED_WORKFLOW_PREVIEW_ID:-}" ]]; then EXTRA_ARGS+=(--preview-id "${TREESEED_WORKFLOW_PREVIEW_ID}"); fi
           node ./node_modules/@treeseed/sdk/scripts/tenant-workflow-action.js --action "${TREESEED_WORKFLOW_ACTION}" --environment "${TREESEED_WORKFLOW_ENVIRONMENT}" "${EXTRA_ARGS[@]}"

.github/workflows/publish.yml

@@ -1,32 +1,111 @@
-name: Publish TreeSeed Admin
-
+name: Build or Promote TreeSeed Admin Candidate
 on:
   push:
-    tags:
-      - "*.*.*"
-  workflow_dispatch:
-
+    branches: [staging, main]
+    tags: ["*.*.*"]
+    paths-ignore: ['.github/workflows/publish.yml', '.github/workflows/component-revision.yml', 'scripts/release/reissue-component.ts', 'tests/contract/package/component-revision.test.ts', 'tests/contract/package/admin-package.test.ts']
 jobs:
-  publish:
-    if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref_name, '-')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    environment: production
+  candidate-package:
+    if: github.ref == 'refs/heads/staging' || github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          registry-url: https://registry.npmjs.org
-      - run: npm run release:setup
-      - run: bash -lc 'npm run verify:local'
-      - run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-      - name: Create GitHub release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release create "${GITHUB_REF_NAME}" --generate-notes --verify-tag
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with: { node-version: 24 }
+      - run: npm ci --workspaces=false --no-audit --no-fund
+      - run: npm run verify:direct
+      - name: Build immutable Cloudflare Pages application
+        run: |
+          npm run build:pages
+          test -f .treeseed/app-dist/_worker.js/index.js
+          test -f .treeseed/app-dist/_routes.json
+          mkdir -p source-assets
+          tar --sort=name --mtime='UTC 1970-01-01' --owner=0 --group=0 --numeric-owner \
+            --create --gzip --file source-assets/admin-pages.tar.gz \
+            --directory .treeseed/app-dist .
+          tar --list --gzip --file source-assets/admin-pages.tar.gz | grep -Fx './_worker.js/index.js'
+      - run: npm pack --json --ignore-scripts --pack-destination source-assets && npm sbom --sbom-format cyclonedx > source-assets/sbom.cdx.json
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with: { name: "admin-source-${{ github.sha }}", path: source-assets/, if-no-files-found: error }
+  candidate-build:
+    if: github.ref == 'refs/heads/staging' || github.ref == 'refs/heads/main'
+    needs: candidate-package
+    environment: ${{ github.ref_name == 'main' && 'production' || 'staging' }}
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        include:
+          - { arch: amd64, platform: linux/amd64, runner: ubuntu-24.04 }
+          - { arch: arm64, platform: linux/arm64, runner: ubuntu-24.04-arm }
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        with: { username: "${{ vars.DOCKERHUB_USERNAME }}", password: "${{ secrets.DOCKERHUB_TOKEN }}" }
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
+        with: { context: ., platforms: "${{ matrix.platform }}", push: true, tags: "treeseed/admin:candidate-${{ github.sha }}-${{ matrix.arch }}", sbom: true, provenance: mode=max }
+  candidate-seal:
+    if: github.ref == 'refs/heads/staging' || github.ref == 'refs/heads/main'
+    needs: candidate-build
+    environment: ${{ github.ref_name == 'main' && 'production' || 'staging' }}
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with: { node-version: 24 }
+      - run: npm ci --ignore-scripts --workspaces=false --no-audit --no-fund
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        with: { username: "${{ vars.DOCKERHUB_USERNAME }}", password: "${{ secrets.DOCKERHUB_TOKEN }}" }
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with: { name: "admin-source-${{ github.sha }}", path: release-assets }
+      - name: Seal exact image and component assets
+        run: |
+          candidate="candidate-${GITHUB_SHA}"
+          docker buildx imagetools create -t "treeseed/admin:${candidate}" "treeseed/admin:${candidate}-amd64" "treeseed/admin:${candidate}-arm64"
+          export TREESEED_ADMIN_DIGEST="$(docker buildx imagetools inspect "treeseed/admin:${candidate}" --format '{{json .Manifest}}' | jq -r '.digest')"
+          [[ "$TREESEED_ADMIN_DIGEST" =~ ^sha256:[a-f0-9]{64}$ ]]
+          export TREESEED_RELEASE="$(node -p "require('./package.json').version")" TREESEED_SOURCE_COMMIT="$GITHUB_SHA"
+          node --import tsx scripts/create-component-release.ts
+          npm run release:custody -- seal release-assets/release-evidence-v1.json release-assets
+          npm run release:custody -- verify release-assets/release-evidence-v1.json
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with: { name: "admin-candidate-${{ github.sha }}", path: release-assets/, if-no-files-found: error, retention-days: 30 }
+  promote:
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-24.04
+    permissions: { actions: read, contents: write, id-token: write }
+    environment: ${{ contains(github.ref_name, '-') && 'staging' || 'production' }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with: { fetch-depth: 0 }
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with: { node-version: 24, registry-url: "https://registry.npmjs.org" }
+      - run: npm ci --ignore-scripts --workspaces=false --no-audit --no-fund
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
+        with: { username: "${{ vars.DOCKERHUB_USERNAME }}", password: "${{ secrets.DOCKERHUB_TOKEN }}" }
+      - name: Download exact accepted candidate
+        env: { GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}" }
+        run: |
+          if [[ "$GITHUB_REF_NAME" == *-* ]]; then candidate_branch=staging; else candidate_branch=main; fi
+          test "$(git rev-parse HEAD)" = "$(git rev-parse "origin/${candidate_branch}")"
+          run_id="$(gh run list --workflow publish.yml --branch "$candidate_branch" --commit "$GITHUB_SHA" --status success --limit 1 --json databaseId --jq '.[0].databaseId')"
+          test -n "$run_id"; gh run download "$run_id" --name "admin-candidate-${GITHUB_SHA}" --dir candidate
+          npm run release:check-tag; npm run release:custody -- verify candidate/release-evidence-v1.json
+      - id: before
+        run: echo "latest=$(npm view @treeseed/admin dist-tags.latest)" >> "$GITHUB_OUTPUT"
+      - name: Publish exact npm tarball
+        run: npm run release:publish -- "$(find candidate -maxdepth 1 -name '*.tgz' -print -quit)"
+        env: { NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}" }
+      - name: Promote exact image manifest
+        run: |
+          identity="$(node -e "const e=require('./candidate/release-evidence-v1.json'); process.stdout.write(e.artifacts.find(x=>x.kind==='oci-image').identity)")"
+          digest="${identity#*@}"; docker buildx imagetools create -t "treeseed/admin:${GITHUB_REF_NAME}" "$identity"
+          test "$(docker buildx imagetools inspect "treeseed/admin:${GITHUB_REF_NAME}" --format '{{json .Manifest}}' | jq -r '.digest')" = "$digest"
+      - name: Verify npm read-back and publish unchanged assets
+        env: { GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}", EXPECTED_LATEST: "${{ steps.before.outputs.latest }}" }
+        run: |
+          test "$(npm view @treeseed/admin dist-tags.latest)" = "$EXPECTED_LATEST"
+          flags=(); if [[ "$GITHUB_REF_NAME" == *-rc.* ]]; then flags+=(--prerelease); fi
+          gh release create "$GITHUB_REF_NAME" candidate/* --generate-notes --verify-tag "${flags[@]}"

.github/workflows/verify.yml

@@ -2,9 +2,10 @@ name: Verify
 
 on:
   push:
-    branches:
-      - '**'
+    branches: [staging, main]
+    paths-ignore: ["docs/src/content/**"]
   pull_request:
+    # Required verification must also run for ancestry-only reconciliation PRs.
   workflow_dispatch:
 
 jobs:
@@ -25,11 +26,28 @@ jobs:
 
       - name: Install dependencies
         timeout-minutes: 20
+        env:
+          TREESEED_SKIP_PACKAGE_PREPARE: "1"
         run: npm run release:setup
 
+      - name: Download exact integrated UI package
+        uses: actions/download-artifact@v4
+        with:
+          repository: treeseed-ai/ui
+          run-id: 36729378278
+          name: ui-b0c9a2bdf1eed181950c1202a24ab3d9af012833
+          github-token: ${{ github.token }}
+          path: .treeseed/ci-ui
+
+      - name: Install exact integrated UI package
+        run: npm install --ignore-scripts --no-save --package-lock=false .treeseed/ci-ui/*.tgz
+
       - name: Verify package
         run: npm run verify:direct
 
+      - name: Verify independent Cloudflare application
+        run: npm run build:pages
+
       - name: Pack verified artifact
         run: mkdir -p artifacts && npm pack --json --ignore-scripts --pack-destination artifacts
 

.gitignore

@@ -29,6 +29,7 @@ npm-debug.log*
 public/books/*.md
 public/books/*.json
 public/__treeseed/*.json
+public/favicon.svg
 .codex
 **/.ts-run-*.mjs
 .tmp-*/

AGENTS.md

@@ -0,0 +1,31 @@
+# Admin workspace guidance
+
+## CRITICAL: complete automated test coverage
+
+Every behavior, contract, state transition, failure path, and edge case must have automated unit, integration, and scene/guarantee-based acceptance coverage. This is mandatory for all projects, especially the capacity-provider and agent system. A behavior without all three layers is an unresolved delivery gap, not completed work.
+
+- Unit tests must prove exact outputs, validation, invariants, and boundary conditions. Cover valid and invalid inputs, missing/empty/malformed values, authorization denial, stale or moved refs, and every named prohibited field.
+- Integration tests must exercise the real owning components and their public boundaries: handlers, provider/kernel execution, APIs, persistence, tools, and downstream consumers. Mocks, string assertions, compilation, or call-order checks alone are not integration proof.
+- Coded scenes and guarantees must prove production-shaped end-to-end outcomes: exact governed artifacts and read-back, independent verification, actual usage, exactly-once settlement, and durable teardown. Use the project's existing native acceptance harness and respect package ownership; do not put TreeSeed-specific policy into product-neutral packages.
+- Cover duplicate and concurrent execution, idempotency, partial failure, interruption, retry, resume, cancellation, expiry, provider/tool/subprocess errors, unsafe commands, and cleanup without residue. Preserve failed observations; do not fabricate dispositions, usage, citations, receipts, or passing replays.
+- For every defect, first add a focused regression that reproduces the failure, then add or strengthen the corresponding integration and scene/guarantee cases. Fix the earliest owning contract. Retain previously covered behavior and all historical failed evidence.
+- Never weaken assertions, remove negative cases, narrow acceptance criteria, disable type checks, extend deadlines, increase allowances, or relabel failures as passes to get green results. An unexpected agent timeout is a fatal architecture defect: agents must check authoritative remaining time frequently, reserve verification/closeout time, and produce authorized continuation proposals for unfinished work before the original deadline.
+- Delivery requires passing evidence at all three layers on the exact candidate. Missing environments, credentials, skipped tests, or blocked layers remain explicitly unproven. Component passes, suite totals, line coverage, and process completion never substitute for full semantic acceptance.
+- Before EVERY acceptance run (scene or guarantee), run ALL automated unit and integration tests for every participating project on the exact candidate. Focused regressions are additional checks, not substitutes for the complete suites. Failed, skipped, missing, empty, or inconclusive prerequisite coverage blocks acceptance; never launch a live campaign first and discover prerequisite failures afterward. Run the complete suites once per participating project per acceptance invocation, before any scene begins; do not reuse a previous invocation's passing receipt or omit tests to save time. Preserve exact command, candidate, run, and result evidence in the existing Issue and Actions artifacts.
+- Keep the behavior-to-unit/integration/scene mapping and exact command, commit, run, and artifact evidence in the existing Issue body and Actions artifacts. Reproduce failures with cheap focused tests before another expensive activation or full campaign; batch known fixes, inspect failed jobs, and reuse only unchanged immutable evidence. No duplicate campaigns or new coverage side channels.
+
+## Agent configuration and handler ownership
+
+When this project defines or consumes agents, agent identity, task instructions, prompts, capabilities, permissions, parameters, and activity profiles must be governed YAML configuration. Adding or renaming an agent using existing handlers must not require provider, guest, kernel, or scheduler code changes. Do not hardcode named-role configuration in shared runtime code; shared rules must apply to any configured agent.
+
+Task-specific executable code belongs in the configured handler. Reuse existing class-based handlers and exact profile bindings; new coded functionality may require a pinned handler, but not a parallel dispatch path or duplicated policy. Test arbitrary YAML-defined agents, renamed identities, handler selection, changed prompts/parameters, denied permissions, and unknown/duplicate handlers through unit, real integration, and coded acceptance cases.
+
+Preserve the independent Admin package build and access-controlled project knowledge surfaces.
+
+## Branch and deployment boundary
+
+`main` is the only production branch and maps only to the `production` deployment environment. `staging` is the only development-integration branch and maps only to the `staging` deployment environment. Short-lived pull-request branches may validate without deploying, but they must never define another deployment environment. Do not create or use `development`, `preview`, `stable`, or any other GitHub deployment environment; preview deployments are prohibited. Release tags may promote an exact reviewed `staging` commit to `production` without creating another branch or environment. Artifact channel names must never become GitHub deployment environments.
+
+## Project library
+
+Use `trsd library show admin` and `status` before querying `treeseed-ai/admin-library`. Read root-level paths at an exact commit. Author only through governed library workspaces and reviews. Never recreate a library `src/content` tree or edit `.treeseed/data` directly.

Dockerfile

@@ -0,0 +1,17 @@
+FROM node:22-bookworm-slim AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci --ignore-scripts
+COPY . .
+ENV TREESEED_WEB_RUNTIME_TARGET=managed-node
+RUN npm run build
+RUN npm prune --omit=dev --ignore-scripts
+
+FROM node:22-bookworm-slim AS runtime
+WORKDIR /app
+ENV NODE_ENV=production HOST=0.0.0.0 PORT=4322
+COPY --from=build /app/.treeseed/app-dist ./app
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/package.json ./package.json
+EXPOSE 4322
+CMD ["node", "./app/server/entry.mjs"]