feat(autonomy): Inngest durable pipeline, budget guard, compensation registry, agent-jobs DDL

.github/workflows/agent-pipeline.yml

@@ -0,0 +1,117 @@
+# agent-pipeline.yml
+# NEW workflow — does NOT replace or conflict with:
+#   build-and-validate.yml, deploy-to-vercel.yml, emit-handoff.yml, regen-lockfile.yml
+# Triggered manually or on schedule; runs pre-flight gates then fires the Inngest event.
+
+name: Agent Pipeline (Autonomous)
+
+on:
+  schedule:
+    - cron: '0 9 * * 1'   # Weekly Monday 09:00 UTC — off-peak
+  workflow_dispatch:
+    inputs:
+      spec_path:
+        description: 'Path to domain spec file (relative to repo root)'
+        required: false
+        default: 'inputs/domain-spec.yaml'
+      cost_cap_usd:
+        description: 'Hard cost cap for this run (USD)'
+        required: false
+        default: '1.00'
+      dry_run:
+        description: 'Dry run — validate and plan only, no deploy'
+        required: false
+        default: 'false'
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+jobs:
+  preflight:
+    name: Pre-flight gates
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check
+        run: npm run typecheck
+
+      - name: Launch-env gate (fail-closed)
+        run: |
+          if [ -f scripts/verify-launch-env.mjs ]; then
+            node scripts/verify-launch-env.mjs --ci
+          else
+            echo "verify-launch-env.mjs not present — skipping"
+          fi
+        env:
+          # Secrets injected for gate validation only — no model calls at this stage
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          PERPLEXITY_API_KEY: ${{ secrets.PERPLEXITY_API_KEY }}
+          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
+
+  run-agent:
+    name: Run autonomous pipeline via Inngest
+    needs: preflight
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      INNGEST_EVENT_KEY: ${{ secrets.INNGEST_EVENT_KEY }}
+      INNGEST_SIGNING_KEY: ${{ secrets.INNGEST_SIGNING_KEY }}
+      OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+      PERPLEXITY_API_KEY: ${{ secrets.PERPLEXITY_API_KEY }}
+      VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
+      POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
+      COST_CAP_USD: ${{ inputs.cost_cap_usd || '1.00' }}
+      SPEC_PATH: ${{ inputs.spec_path || 'inputs/domain-spec.yaml' }}
+      DRY_RUN: ${{ inputs.dry_run || 'false' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Restore pipeline cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/website-bot
+          key: website-bot-pipeline-${{ github.run_id }}
+          restore-keys: website-bot-pipeline-
+
+      - name: Fire Inngest pipeline event
+        run: node -e "
+          const { Inngest } = require('inngest');
+          const client = new Inngest({ id: 'website-bot', eventKey: process.env.INNGEST_EVENT_KEY });
+          client.send({
+            name: 'website/pipeline.requested',
+            data: {
+              specPath: process.env.SPEC_PATH,
+              costCapUsd: parseFloat(process.env.COST_CAP_USD),
+              dryRun: process.env.DRY_RUN === 'true',
+              runId: '${{ github.run_id }}',
+              triggeredBy: '${{ github.actor }}',
+            }
+          }).then(() => console.log('Event sent')).catch(e => { console.error(e); process.exit(1); });
+        "
+
+      - name: Upload run artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: agent-pipeline-${{ github.run_id }}
+          path: outputs/
+          if-no-files-found: ignore

docs/autonomy-architecture.md

@@ -0,0 +1,93 @@
+# ADR: L9 Autonomy Upgrade — Website-Bot
+
+**Status:** Proposed  
+**Date:** 2026-07-15  
+**Author:** L9 Architecture (via Perplexity deep-research brief)
+
+## Context
+
+Website-Bot is a deterministic, staged site-generation pipeline targeting Astro + Vercel.  
+The existing stage orchestrator (`src/pipeline/`) runs one-shot without durable checkpointing,  
+which means a mid-run failure requires a full restart and any external mutations (Vercel deploys) have no registered rollback path.
+
+## Decision
+
+Wrap the existing 10-stage pipeline in an **Inngest durable function** (`src/inngest/website-pipeline.ts`).
+
+### What changes
+
+| File | Change |
+|------|--------|
+| `.github/workflows/agent-pipeline.yml` | **NEW** — autonomous trigger; fires Inngest event after pre-flight gate. Does NOT replace `build-and-validate.yml`, `deploy-to-vercel.yml`, `emit-handoff.yml`, or `regen-lockfile.yml`. |
+| `src/inngest/website-pipeline.ts` | **NEW** — Inngest function wrapping all stages with durable steps, approval gate, budget guard, and compensation. |
+| `src/lib/budget-guard.ts` | **NEW** — `AgentBudgetGuard` class (admission → reserve → reconcile → enforce). |
+| `src/lib/compensation.ts` | **NEW** — `CompensationRegistry` saga/rollback abstraction. |
+| `src/lib/schema.sql` | **NEW** — `agent_jobs`, `budget_violations`, `compensation_log` DDL. |
+
+### What does NOT change
+
+- Existing pipeline stage modules in `src/pipeline/`
+- Existing workflows: `build-and-validate.yml`, `deploy-to-vercel.yml`, `emit-handoff.yml`, `regen-lockfile.yml`
+- `AGENTS.md` locked decisions (Astro, Vercel, npm, @quantum-l9/llm-router)
+- `.env.example` or `config/launch-env.required.yaml`
+
+## Implementation status (2026-07-20)
+
+The original proposal above assumed `VercelDeploy.deployPreview()` / `.promoteToProduction()` /
+`.rollback()` methods and a `step.waitForEvent('website/production.approved')` human-approval
+gate between a preview deploy and a production promotion. **`VercelDeployStage` does not have
+that API** — it performs a single direct `target: 'production'` deploy with no preview/promote
+split and no rollback endpoint. Implementing the preview → approve → promote → rollback flow is
+tracked as a follow-up (it would also move `VercelDeployStage` onto the "preview-first only"
+deployment posture already locked in `AGENTS.md`, which it does not currently follow either).
+
+What is implemented in `src/inngest/website-pipeline.ts` today:
+
+- The existing 10-stage `PipelineRunner` run wrapped as one durable Inngest step (not split
+  per-stage — `PipelineRunner` owns a single SQLite `BuildDB` connection for the whole run, so
+  splitting it across step boundaries would leave that connection spanning Inngest replays).
+- `AgentBudgetGuard` admission/reserve/reconcile/enforce around the run, with compensation
+  triggered on `BudgetExceededError` / `AdmissionRejectedError`.
+- A `CompensationRegistry` entry registered before the run so a failure can report the
+  deployment for manual rollback (VercelDeployStage has no automated rollback to call yet).
+- A `website/pipeline.completed` Inngest event emitted on success (in addition to, not instead
+  of, `HandoffEmitterStage`'s existing `contracts/website_factory_integration.yaml` write and
+  optional SEO-Bot registration POST).
+
+## Approval gate semantics (not yet implemented)
+
+The human-approval gate described in the original proposal — hibernating at
+`step.waitForEvent('website/production.approved')` for up to 24 hours, with compensation on
+timeout — requires the preview/promote split above and is **not present** in the current
+`website-pipeline.ts`. Do not assume this gate exists until it ships.
+
+## Budget control
+
+`COST_CAP_USD` is injected as an env var from the GitHub Actions `workflow_dispatch` input (default: `1.00`).  
+The `AgentBudgetGuard` enforces four modes as spend accumulates:
+
+| Pressure | Mode |
+|----------|------|
+| < 70% | `normal` |
+| 70–85% | `cheaper_model` |
+| 85–95% | `narrow_scope` |
+| 95–100% | `require_approval` |
+| > 100% | `stop` (throws `BudgetExceededError`) |
+
+## Required secrets (new)
+
+```
+INNGEST_EVENT_KEY    — from Inngest dashboard (signing key for event dispatch)
+INNGEST_SIGNING_KEY  — from Inngest dashboard (request signature verification)
+POSTGRES_URL         — optional; if set, persists job cost to agent_jobs table
+```
+
+## Consequences
+
+- A crash retries the whole `run-pipeline` step (i.e. the whole 10-stage run) via Inngest's
+  built-in step retry — not just the failing stage — because the stages share one `BuildDB`
+  connection and `BuildContext` for the duration of the run.
+- On budget exhaustion, the registered compensation action logs the deployment for manual
+  rollback; there is no automated Vercel rollback yet (see "Implementation status" above).
+- Budget spend is visible per-run in Postgres (when `POSTGRES_URL` is set) and in the Inngest
+  dashboard.