Promote consolidated staging history to main (no tags)

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,2 @@
+blank_issues_enabled: false
+contact_links: []

.github/ISSUE_TEMPLATE/implementation.yml

@@ -0,0 +1,65 @@
+name: Bounded implementation
+description: Define one reviewable Platform integration outcome and its authoritative evidence.
+title: ""
+labels: []
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Issues are the plan and status authority. Update this body instead of posting
+        routine progress comments; retain detailed verification in GitHub Actions.
+  - type: textarea
+    id: objective
+    attributes:
+      label: Objective
+      description: State the concrete outcome and owning repository boundaries.
+    validations:
+      required: true
+  - type: textarea
+    id: exact-inputs
+    attributes:
+      label: Exact inputs
+      description: Record protected-branch heads, released artifacts, schemas, and dependencies.
+    validations:
+      required: true
+  - type: textarea
+    id: interfaces
+    attributes:
+      label: Interfaces and behavior
+      description: Define public commands, schemas, configuration, and failure behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance gates
+      description: List deterministic, package, integration, read-back, noop, and rollback evidence.
+    validations:
+      required: true
+  - type: textarea
+    id: dependencies
+    attributes:
+      label: Dependencies and authority
+      description: Link prerequisite Issues and identify any human or environment approval boundary.
+    validations:
+      required: true
+  - type: textarea
+    id: rollback
+    attributes:
+      label: Rollback
+      description: Identify the retained immutable state and exact recovery path.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Actions evidence
+      description: Maintain a compact table of authoritative workflow runs and artifacts.
+      value: |
+        | Gate | Run/artifact | Status |
+        |---|---|---|
+        | Focused verification | pending | pending |
+        | Release/read-back | pending | pending |
+        | Managed acceptance | pending | pending |
+    validations:
+      required: true

.github/workflows/verify.yml

@@ -15,12 +15,19 @@ concurrency:
 
 jobs:
   verify:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
-      - run: npm run verify
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with: { fetch-depth: 0 }
+      - uses: treeseed-ai/cli/.github/actions/setup-cli@0.13.0-rc.63
+        with: { version: 0.13.0-rc.63 }
+      - run: trsd platform verify . --json
+      - run: trsd platform verify . --profile core --json
+      - run: trsd platform verify . --profile control-plane --profile capacity-provider --profile treeai --json
+      - name: Verify exact project-scoped skill lock
+        run: |
+          workspace="$(mktemp -d)"
+          cd "$workspace"
+          git init --quiet
+          npx --yes skills@1.5.23 add https://github.com/treeseed-ai/skill/tree/0.1.0-rc.1 --skill treeseed --agent codex --yes --copy
+          cmp skills-lock.json "$GITHUB_WORKSPACE/skills-lock.json"

.gitignore

@@ -1,9 +1,8 @@
 node_modules/
-.treeseed/
 dist/
+.treeseed/
 /packages/
-/templates/*
-!/templates/platform-*/
+/.agents/skills/
+/.claude/skills/
+/.codex/skills/
 /.fixtures/
-/products/market/
-/services/market-api/

AGENTS.md

@@ -1,7 +1,57 @@
 # Platform workspace guidance
 
+## CRITICAL: complete automated test coverage
+
+Every behavior, contract, state transition, failure path, and edge case must have automated unit, integration, and scene/guarantee-based acceptance coverage. This is mandatory for all projects, especially the capacity-provider and agent system. A behavior without all three layers is an unresolved delivery gap, not completed work.
+
+- Unit tests must prove exact outputs, validation, invariants, and boundary conditions. Cover valid and invalid inputs, missing/empty/malformed values, authorization denial, stale or moved refs, and every named prohibited field.
+- Integration tests must exercise the real owning components and their public boundaries: handlers, provider/kernel execution, APIs, persistence, tools, and downstream consumers. Mocks, string assertions, compilation, or call-order checks alone are not integration proof.
+- Coded scenes and guarantees must prove production-shaped end-to-end outcomes: exact governed artifacts and read-back, independent verification, actual usage, exactly-once settlement, and durable teardown. Use the project's existing native acceptance harness and respect package ownership; do not put TreeSeed-specific policy into product-neutral packages.
+- Cover duplicate and concurrent execution, idempotency, partial failure, interruption, retry, resume, cancellation, expiry, provider/tool/subprocess errors, unsafe commands, and cleanup without residue. Preserve failed observations; do not fabricate dispositions, usage, citations, receipts, or passing replays.
+- For every defect, first add a focused regression that reproduces the failure, then add or strengthen the corresponding integration and scene/guarantee cases. Fix the earliest owning contract. Retain previously covered behavior and all historical failed evidence.
+- Never weaken assertions, remove negative cases, narrow acceptance criteria, disable type checks, extend deadlines, increase allowances, or relabel failures as passes to get green results. An unexpected agent timeout is a fatal architecture defect: agents must check authoritative remaining time frequently, reserve verification/closeout time, and produce authorized continuation proposals for unfinished work before the original deadline.
+- Delivery requires passing evidence at all three layers on the exact candidate. Missing environments, credentials, skipped tests, or blocked layers remain explicitly unproven. Component passes, suite totals, line coverage, and process completion never substitute for full semantic acceptance.
+- Before EVERY acceptance run (scene or guarantee), run ALL automated unit and integration tests for every participating project on the exact candidate. Focused regressions are additional checks, not substitutes for the complete suites. Failed, skipped, missing, empty, or inconclusive prerequisite coverage blocks acceptance; never launch a live campaign first and discover prerequisite failures afterward. Run the complete suites once per participating project per acceptance invocation, before any scene begins; do not reuse a previous invocation's passing receipt or omit tests to save time. Preserve exact command, candidate, run, and result evidence in the existing Issue and Actions artifacts.
+- Keep the behavior-to-unit/integration/scene mapping and exact command, commit, run, and artifact evidence in the existing Issue body and Actions artifacts. Reproduce failures with cheap focused tests before another expensive activation or full campaign; batch known fixes, inspect failed jobs, and reuse only unchanged immutable evidence. No duplicate campaigns or new coverage side channels.
+
+## Agent configuration and handler ownership
+
+When this project defines or consumes agents, agent identity, task instructions, prompts, capabilities, permissions, parameters, and activity profiles must be governed YAML configuration. Adding or renaming an agent using existing handlers must not require provider, guest, kernel, or scheduler code changes. Do not hardcode named-role configuration in shared runtime code; shared rules must apply to any configured agent.
+
+Task-specific executable code belongs in the configured handler. Reuse existing class-based handlers and exact profile bindings; new coded functionality may require a pinned handler, but not a parallel dispatch path or duplicated policy. Test arbitrary YAML-defined agents, renamed identities, handler selection, changed prompts/parameters, denied permissions, and unknown/duplicate handlers through unit, real integration, and coded acceptance cases.
+
 This is the public TreeSeed installer and integration workspace. Preserve independent package builds and route infrastructure changes through SDK reconciliation and `trsd`. Market and Market API are first-party portfolio projects governed through the same seed, reconciliation, and exact-ref custody model as the other TreeSeed repositories. Their hosted deployment remains fail-closed until the reviewed OpenTofu topology restores it.
 
+## CRITICAL: simplicity and non-duplication are mandatory
+
+Always choose the simplest complete solution. Avoid new models, schemas, storage, services, abstractions, adapters, artifacts, workflows, configuration fields, and compatibility paths unless they are strictly necessary to produce a verified requirement. One fact must have one authority, one representation, and one implementation path. Reuse existing contracts, Git state, TreeDX content, receipts, commands, and runtime boundaries instead of copying or translating them. Do not encode the same policy in profiles, prompts, handlers, assignments, providers, and API services. Delete superseded paths as part of the replacement; do not preserve speculative flexibility or backward compatibility. Before adding any concept, identify why the current simplest mechanism cannot satisfy the requirement. If that necessity cannot be demonstrated, do not add it.
+
+Optimize first for the smallest end-to-end path that works and can be verified through the supported CLI. Prefer ordinary commits, branches, exact refs, typed assignment inputs/results, and small class-based handlers over new artifact taxonomies or orchestration layers. Do not create work whose only purpose is to reconcile duplication introduced by the design itself. Complexity and duplicated effort are critical defects, not acceptable tradeoffs.
+
+## First-party repository visibility and licensing
+
+All TreeSeed repositories are public, including Team Library and Market API. First-party repositories use Apache-2.0 except API and Market API, which use AGPLv3. Preserve their exact license notices. This policy does not relicense third-party dependencies or make customer repositories public. The TreeSeed seed must declare public repository visibility; license choice is independent of visibility.
+
+## Efficient delivery is mandatory
+
+Conserve human and AI capacity by optimizing for verified outcomes rather than repeated discussion or duplicated evidence. GitHub Issues are the planning and status authority, GitHub Actions are the verification authority, and agents must not post routine issue or pull-request comments. Keep the current decision-complete contract and evidence table in the Issue body; put implementation context in commits and the pull-request description; retain detailed logs as Actions artifacts. Read only the exact context needed, batch independent reads and checks, reuse immutable receipts, inspect failed jobs rather than rerunning successful work, and batch known defects into one replacement release candidate before repeating expensive activation. Stop at real authority boundaries instead of spending quota speculating around them.
+
+Every delivery follows `Issue -> branch -> pull request -> Actions -> staging merge -> release/read-back -> Platform composition -> managed acceptance -> main/production`. Before branching, merging, or releasing, fetch and verify the exact protected-branch head. Do not create undocumented side channels for plans, progress, or acceptance.
+
+During pre-launch integration, no human approval or review is required for pull requests (including `main`), releases, deployments, infrastructure plans, reconciliation, or acceptance. Authorized agents may merge after required automated checks pass; retain pull requests, exact-ref custody, and all unrelated protections. This temporary policy is tracked in Platform #489. Before public production launch, establish a separate reviewer identity and explicitly restore required human review for PRs to `main`; verify the restored settings before promoting a public production release. Do not reintroduce human-only gates for staging or non-production work.
+
+## TypeScript source standard
+
+Use TypeScript for handwritten application, infrastructure, CLI, tooling, and test code across the integrated projects. JavaScript is generated build output, not a parallel source implementation. Keep strict type-checking enabled; do not use unchecked JavaScript or disable TypeScript checks to bypass this standard. Convert handwritten JavaScript when extending that implementation, and update its build and test entrypoints together. Keep configuration declarative. This does not authorize implementation in Platform: functional code still belongs in its owning package.
+
+## Development selection lifetime
+
+Local development selections persist until explicitly switched or stopped through `trsd`. Do not add session expiration, wall-clock watchdog shutdowns, or time-based fallback to released code. Preserve process ownership, readiness checks, explicit stop/drain behavior, and normal credential/token expiration; those are separate from development selection lifetime.
+
+## Branch and deployment boundary
+
+`main` is the only production branch and maps only to the `production` deployment environment. `staging` is the only development-integration branch and maps only to the `staging` deployment environment. Short-lived pull-request branches may validate without deploying, but they must never define another deployment environment. Do not create or use `development`, `preview`, `stable`, or any other GitHub deployment environment; preview deployments are prohibited. Release tags may promote an exact reviewed `staging` commit to `production` without creating another branch or environment. Artifact channel names must never become GitHub deployment environments.
+
 ## Project library
 
 The Platform library is `treeseed-ai/platform-library`; its TreeDX binding is authoritative. Start with `trsd library show platform` and `trsd library status platform`. Discover with `paths`, `search`, `query`, or `context`, and read a known file with `trsd library read platform <path> --ref <exact-commit>`. Use exact commits for reproducible work and protected `main` or `staging` only for deliberate moving-head inspection.

README.md

@@ -1,11 +1,37 @@
 # TreeSeed Platform
 
-Public Apache-2.0 installer and integration workspace for customer-centric TreeSeed deployments. Platform manages Admin, an optional sovereign Admin API control plane, Core, CLI, capacity providers, TreeDX, and AI services.
+TreeSeed Platform is the public, portable configuration and documentation workspace for installing, composing, developing, and releasing the TreeSeed ecosystem. It owns no application runtime or service implementation. SDK operations reconcile its declarations; `trsd` is the operator surface; the host manager owns installed services.
 
-Market is external and immutable at `https://api.treeseed.dev`. This repository cannot provision, deploy, or check out Market or Market API.
+## Start developing
 
-The active migration is tracked in [SDK-First Standards, GitHub, and Cluster Cutover Ledger](./docs/sdk-first-cutover-implementation-plan.md). The integrated single-machine and multi-node target is defined in [Cluster Architecture and Cutover](./docs/cluster-architecture-cutover.md), cross-project compatibility in [Standards-Based Independent Development](./docs/standards-dev.md), and provider-neutral GitHub Issues and pull-request synchronization in [GitHub Issues and Pull Request Integration](./docs/github-work-integration.md).
+Install a released CLI, clone this repository, and plan the desired source workset before any local API exists:
 
-## Workspace
+```text
+trsd platform verify . --json
+trsd platform workset --profile core --plan --json
+trsd platform workset --profile core --apply --yes --json
+```
 
-`trsd platform workset --plan --json` reads the authenticated live team project inventory, observes exact repository refs, and previews assignment-owned custody. `trsd platform workset --apply --yes --json` materializes that disposable custody under `packages/`, `templates/`, and `.fixtures/`. The Platform Git repository contains no portfolio manifest or project gitlinks. Paired content repositories are logical TreeDX/R2 bindings and are never software workset checkouts.
+Primary source repositories are materialized beneath `packages/<project-slug>`. Platform remains at the workspace root, knowledge libraries are never software checkouts, and `.treeseed/worksets` contains ignored exact-ref receipts. Existing checkouts are never reset, deleted, or overwritten.
+
+Install the governed TreeSeed skill at the exact release recorded in `config/skills/treeseed.lock.yaml`. Platform tracks the project lock but ignores installed skill files; skill updates are explicit lock-update pull requests.
+
+Profiles are composable:
+
+```text
+trsd platform workset --profile control-plane --apply --yes --json
+trsd platform workset --profile capacity-provider --apply --yes --json
+trsd platform workset --profile control-plane --profile treeai --apply --yes --json
+```
+
+`core` contains every first-party source project. Runtime selection is independent: any target may remain released while selected targets run live or as candidates.
+
+## Installation and production
+
+One generic Debian bootstrap installs only the manager foundation. `trsd host initialize --profile <profile>` selects the role after installation. A capacity provider needs only the control-plane URL and a prompted team registration code; approval binds its generated local identity and replaces the code with short-lived sessions.
+
+Production topology is declared under `config/topologies/` and remains fail-closed. Cloudflare hosts Admin, Railway hosts the control plane, and bare-metal providers run Agent. Market and Market API participate in development worksets but retain independent hosted-deployment authority.
+
+Staging and production use portable templates plus separately generated immutable artifact inputs. See [hosted deployment](docs/hosted-deployment.md) for state isolation, credential custody, planning, and the Ubuntu 26.04 capacity-provider fleet boundary.
+
+Current delivery work and evidence are tracked in [Platform issue #280](https://github.com/treeseed-ai/platform/issues/280). GitHub Issues are status authority and Actions are verification authority.

config/hosts/capacity-provider.yaml

@@ -0,0 +1,7 @@
+schemaVersion: treeseed.platform-host-template/v1
+id: capacity-provider
+profiles: [capacity-provider]
+integration: { id: development, digest: 'sha256:fa3879fb8ba6ca5b1736929a1947741cd4bce0ac3f6c36dca50980731ea1d9ed' }
+inputs:
+  - { name: controlPlaneUrl, required: true, sensitive: false }
+  - { name: teamRegistrationCode, required: true, sensitive: true }

config/hosts/development.yaml

@@ -0,0 +1,8 @@
+schemaVersion: treeseed.platform-host-template/v1
+id: development
+profiles: [core]
+integration: { id: development, digest: 'sha256:fa3879fb8ba6ca5b1736929a1947741cd4bce0ac3f6c36dca50980731ea1d9ed' }
+inputs:
+  - { name: hostIdentity, required: false, sensitive: false }
+  - { name: initialAdministrator, required: false, sensitive: false }
+  - { name: recoveryBundle, required: true, sensitive: true }

config/initialization/capacity-provider.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": "treeseed.host-initialization-profile/v1",
+  "id": "capacity-provider",
+  "role": "capacity-provider",
+  "runtime": { "management": "managed", "environment": "track-default" },
+  "components": ["agent"],
+  "security": { "requirement": "required" },
+  "inputs": [
+    { "name": "controlPlaneUrl", "required": true, "sensitive": false, "description": "Control-plane API HTTPS URL" },
+    { "name": "teamRegistrationCode", "required": true, "sensitive": true, "description": "Team capacity-provider registration code" }
+  ]
+}

config/initialization/control-plane.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": "treeseed.host-initialization-profile/v1",
+  "id": "control-plane",
+  "role": "control-plane",
+  "runtime": { "management": "managed", "environment": "track-default" },
+  "components": ["identity", "api", "admin", "treedx", "lab"],
+  "security": { "requirement": "optional" },
+  "inputs": []
+}