chore(harness): make repository agent-ready

Add concise routed context, task-aware agent roles, focused skills, and structured learning promotion.\n\nUnify local development and workspace tooling, add layered test and E2E verification, harden MCP authentication, and gate deployment behind verification and explicit production promotion.

.github/workflows/deploy-supabase.yml

@@ -1,7 +1,13 @@
 name: Deploy Supabase to Production
 
 on:
-  workflow_dispatch:
+  workflow_dispatch:
+    inputs:
+      deploy_production:
+        description: Promote the verified change to production after non-production
+        required: false
+        type: boolean
+        default: false
   push:
     branches:
       - master
@@ -10,23 +16,34 @@ on:
       - 'terraform/**'
       - '.github/workflows/deploy-supabase.yml'
 
-jobs:
-  deploy-database:
+jobs:
+  quality:
+    name: Verify deployable source
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run verify:fast
+      - run: npm run build
+
+  deploy-database:
     name: Deploy Migrations & Functions
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest
+    needs: quality
+    environment: ${{ matrix.environment }}
     strategy:
-      max-parallel: 1
-      matrix:
-        environment:
-          - name: non-prod
-            project_ref: itbzhrvlgvdmzbnhzhyx
-          - name: prod
-            project_ref: ckjcrkjpmhqhiucifukx
+      max-parallel: 1
+      matrix:
+        environment: ${{ fromJSON(github.event_name == 'workflow_dispatch' && inputs.deploy_production && '["non-prod","prod"]' || '["non-prod"]') }}
 
     env:
       SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
-      SUPABASE_PROJECT_REF: ${{ matrix.environment.project_ref }}
-      ENVIRONMENT_NAME: ${{ matrix.environment.name }}
+      SUPABASE_PROJECT_REF: ${{ matrix.environment == 'prod' && 'ckjcrkjpmhqhiucifukx' || 'itbzhrvlgvdmzbnhzhyx' }}
+      ENVIRONMENT_NAME: ${{ matrix.environment }}
 
     steps:
       - name: Checkout repository
@@ -37,13 +54,13 @@ jobs:
         with:
           version: latest
 
-      - name: Link to ${{ matrix.environment.name }} Project
+      - name: Link to ${{ matrix.environment }} Project
         run: supabase link --project-ref $SUPABASE_PROJECT_REF --workdir apps
 
-      - name: Apply Database Migrations (${{ matrix.environment.name }})
+      - name: Apply Database Migrations (${{ matrix.environment }})
         run: supabase db push --workdir apps --include-all
 
-      - name: Sync Edge Function Secrets (${{ matrix.environment.name }})
+      - name: Sync Edge Function Secrets (${{ matrix.environment }})
         env:
           # Add secrets from GitHub Secrets
           REVENUECAT_WEBHOOK_SECRET: ${{ secrets.REVENUECAT_WEBHOOK_SECRET }}
@@ -72,7 +89,7 @@ jobs:
             echo "No secrets to sync"
           fi
 
-      - name: Deploy Edge Functions (${{ matrix.environment.name }})
+      - name: Deploy Edge Functions (${{ matrix.environment }})
         run: |
           # Deploy all edge functions (excluding _shared directory)
           for dir in apps/supabase/functions/*/; do
@@ -88,7 +105,7 @@ jobs:
             supabase functions deploy "$function_name" --no-verify-jwt --project-ref $SUPABASE_PROJECT_REF --workdir apps
           done
 
-      - name: Remove Deleted Functions (${{ matrix.environment.name }})
+      - name: Remove Deleted Functions (${{ matrix.environment }})
         run: |
           # Get list of functions deployed on Supabase (skip header lines, extract slug column)
           deployed=$(supabase functions list --project-ref $SUPABASE_PROJECT_REF | grep -E '^[a-z]' | awk '{print $1}')
@@ -108,9 +125,10 @@ jobs:
             fi
           done
 
-  deploy-infrastructure:
+  deploy-infrastructure:
     name: Deploy Infrastructure (Terraform)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest
+    needs: quality
 
     env:
       TF_VAR_supabase_access_token: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
@@ -146,18 +164,22 @@ jobs:
         run: terraform apply -auto-approve tfplan
 
       # Production Environment
-      - name: Terraform Init (Prod)
+      - name: Terraform Init (Prod)
+        if: github.event_name == 'workflow_dispatch' && inputs.deploy_production
         working-directory: terraform/environments/prod
         run: terraform init
 
-      - name: Terraform Validate (Prod)
+      - name: Terraform Validate (Prod)
+        if: github.event_name == 'workflow_dispatch' && inputs.deploy_production
         working-directory: terraform/environments/prod
         run: terraform validate
 
-      - name: Terraform Plan (Prod)
+      - name: Terraform Plan (Prod)
+        if: github.event_name == 'workflow_dispatch' && inputs.deploy_production
         working-directory: terraform/environments/prod
         run: terraform plan -out=tfplan
 
-      - name: Terraform Apply (Prod)
+      - name: Terraform Apply (Prod)
+        if: github.event_name == 'workflow_dispatch' && inputs.deploy_production
         working-directory: terraform/environments/prod
         run: terraform apply -auto-approve tfplan

.github/workflows/verify.yml

@@ -0,0 +1,78 @@
+name: Verify
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+concurrency:
+  group: verify-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  static:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run learn:check
+      - run: npm run verify:fast
+      - run: npm run build
+
+  full-stack:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - uses: denoland/setup-deno@v2
+        with:
+          deno-version: v2.x
+      - run: npm ci
+      - run: npx playwright install --with-deps chromium
+      - name: Start local Supabase
+        env:
+          GOOGLE_CLIENT_ID: local
+          GOOGLE_CLIENT_SECRET: local
+          APPLE_CLIENT_ID: local
+          APPLE_CLIENT_SECRET: local
+        run: npx supabase start --workdir apps
+      - name: Reset and seed
+        run: |
+          npx supabase db reset --workdir apps
+          scripts/with-local-supabase-env.sh tests node scripts/seed-e2e.mjs
+      - name: Start application services
+        run: |
+          npx supabase functions serve --workdir apps > /tmp/sauci-functions.log 2>&1 &
+          scripts/with-local-supabase-env.sh web npm run dev -w @sauci/web -- --port 3000 > /tmp/sauci-web.log 2>&1 &
+          scripts/with-local-supabase-env.sh admin npm run dev -w @sauci/admin -- --host 127.0.0.1 --port 3001 > /tmp/sauci-admin.log 2>&1 &
+          scripts/with-local-supabase-env.sh mcp npm run dev -w sauci-mcp-server > /tmp/sauci-mcp.log 2>&1 &
+      - name: Wait for services
+        run: |
+          for url in http://127.0.0.1:3000 http://127.0.0.1:3001/login http://127.0.0.1:3002/health; do
+            for attempt in $(seq 1 60); do
+              curl --fail --silent "$url" >/dev/null && break
+              sleep 2
+            done
+            curl --fail --silent "$url" >/dev/null
+          done
+      - run: npm run test:supabase
+      - run: npm run verify:e2e
+      - name: Upload E2E proof
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: e2e-proof
+          path: |
+            e2e/test-results
+            e2e/playwright-report
+            /tmp/sauci-*.log
+          if-no-files-found: ignore
+          retention-days: 14