feat(pilot): installable workspace pilot (spec 006 T001–T009)

.github/workflows/check.yml

@@ -5,11 +5,32 @@ permissions:
 jobs:
   bootstrap:
     runs-on: ubuntu-24.04
+    timeout-minutes: 35
     steps:
       # pull_request checks GitHub's ordinary synthetic merge into main.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
+      # Native tool installers only; no product runtime, containers or activation.
+      # SHAs resolved from the official repositories' tag API on 2026-10-14.
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.14.8'
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version: '1.27.2'
+          cache: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: '26.11.1'
+          package-manager-cache: false
+      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1
+        with:
+          version-type: strict
+          otp-version: '29.1.1'
+          elixir-version: '1.20.4'
+          install-hex: false
+          install-rebar: false
       - name: Validate explicit repository acceptance
         run: python3 -I -B scripts/check_ci.py

.gitignore

@@ -12,3 +12,7 @@ __pycache__/
 .codex/auth.json
 .codex/sessions/
 WORKFLOW.local.md
+
+# Local Go scaffold executables (build acceptance normally targets a temp dir).
+/apps/host_agent/workharbor-agent
+/apps/whr/whr

.tool-versions

@@ -0,0 +1,5 @@
+erlang 29.1.1
+elixir 1.20.4-otp-29
+golang 1.27.2
+nodejs 26.11.1
+python 3.14.8

Makefile

@@ -1,8 +1,11 @@
 PYTHON ?= python3
-.PHONY: check check-raw test
+.PHONY: check check-raw check-apps test
 check:
 	$(PYTHON) -I -B scripts/check_ci.py
 
+check-apps:
+	$(PYTHON) -I -B scripts/check_ci.py --applications-only
+
 check-raw:
 	$(PYTHON) scripts/check_repo.py
 	$(PYTHON) -m unittest discover -s tests -v

README.md

@@ -36,7 +36,9 @@ make check
 
 The bundle must be supplied separately; it is not required for the GitHub clone.
 
-Requires Git, Make, Python 3.11+ and Bash. On macOS the built-in Python may need a
+Requires Git, Make, Bash, native C build tools and the exact versions in
+`.tool-versions` (Python, Go, Node, Elixir and Erlang). The application check fetches
+locked dependencies and pinned build tools; see the [harness](docs/development/harness.md). On macOS the built-in Python may need a
 newer installation. Open Codex in this repository; generated `$speckit-*` skills
 live under `.agents/skills/`. Read [AGENTS.md](AGENTS.md), the
 [constitution](.specify/memory/constitution.md) and [documentation index](docs/index.md).

apps/api_client/doc.go

@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: EUPL-1.2
+
+// Package apiclient reserves the shared owner API client boundary for whr and the
+// host agent. Transport and authentication are not implemented yet.
+package apiclient

apps/api_client/go.mod

@@ -0,0 +1,3 @@
+module github.com/wstein/workharbor-nxt/apps/api_client
+
+go 1.27.2