feat(autonomy): Inngest durable pipeline, budget guard, compensation registry, agent-jobs DDL

[cryptoxdog]

L9 Autonomy Upgrade — Website-Bot

This PR adds the full autonomous runtime layer described in the L9 Nuclear Architecture Brief. All additions are new files only — no existing files modified, no workflow collisions.

---

Collision audit

Existing workflow	This PR touches?
build-and-validate.yml	❌ No
deploy-to-vercel.yml	❌ No
emit-handoff.yml	❌ No
regen-lockfile.yml	❌ No
AGENTS.md	❌ No
src/pipeline/*	❌ No

---

Files added

File	Purpose
.github/workflows/agent-pipeline.yml	NEW autonomous trigger workflow — manual dispatch + weekly cron. Fires Inngest event after pre-flight gate.
src/inngest/website-pipeline.ts	Inngest createFunction wrapping all 10 pipeline stages in durable steps. Adds approval gate (waitForEvent), budget guard, and compensation registration around Vercel deploys.
src/lib/budget-guard.ts	AgentBudgetGuard — 4-move runtime cost loop: Admission → Reserve → Reconcile → Enforce.
src/lib/compensation.ts	CompensationRegistry — LIFO saga rollback for external mutations (Vercel preview, production promotion).
src/lib/schema.sql	Additive DDL: agent_jobs, budget_violations (with trigger), compensation_log.
docs/autonomy-architecture.md	ADR documenting this upgrade, approval gate semantics, budget modes, and required new secrets.

---

New secrets required

Add these to Settings → Secrets → Actions before enabling agent-pipeline.yml:

INNGEST_EVENT_KEY     — from Inngest dashboard
INNGEST_SIGNING_KEY   — from Inngest dashboard
POSTGRES_URL          — optional; enables per-run cost persistence

---

Approval gate

The Inngest workflow hibernates at step.waitForEvent('website/production.approved') for up to 24 hours before promoting to production. To approve, send:

{ "name": "website/production.approved", "data": { "jobId": "<job-id>" } }

via the Inngest dashboard or API. On timeout, the preview deployment is automatically rolled back via the compensation registry.

---

Budget modes

Pressure	Mode
< 70%	normal
70–85%	cheaper_model
85–95%	narrow_scope
95–100%	require_approval
> 100%	stop (throws BudgetExceededError)

---

Checklist

• Apply src/lib/schema.sql to Postgres: psql $POSTGRES_URL < src/lib/schema.sql
• Add INNGEST_EVENT_KEY and INNGEST_SIGNING_KEY to repo secrets
• Register websitePipeline in your Inngest serve() handler
• Install inngest package: npm install inngest
• Review docs/autonomy-architecture.md ADR

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud