Chapter Three — Foundation: contributor dossier, sealed-sprint mode, Session 06 + scaffolds for 01/02/03/09, federation registry + Agora

[Keeleran]

Chapter Three — Foundation

This PR opens Chapter Three of Aeon: contributor dossier, sealed-sprint operating mode, Session 06 (skill discovery) shipped end-to-end, and scaffolds for Sessions 01 (Cloudflare runtime), 02 (KG memory), 03 (federation), 09 (the Agora). Two new in-repo subprojects join the family: aeon-federation-registry/ and aeon-agora/.

Built in a sealed sprint at @Keeleran's machine (mode doc: docs/contributor-dossier/_modes/sealed-sprint.md) — no external service calls, no early commits, deterministic-mock embeddings throughout. Full append-only trail at docs/contributor-dossier/_sprint-log/2026-05-26-full-menu.md.

---

What's in the 9 commits

Commit	What
docs(dossier)	Contributor dossier — overview, architecture, tree-walk, 11 subsystem docs (incl. 4 new ones for Chapter Three), governance, security threat model, implementation patterns, testing, open questions, expansion charter (9 options, 5 with deep PoC sketches).
docs(meta)	Sealed-sprint mode + 9 session prompts + 5 test scaffolds. The operating layer that makes Chapter Three repeatable.
feat(skill-discovery)	Full Session 06. ./index-skills + ./skill-search, MCP aeon-skill-search, A2A skill, GET /api/skills/search, <SkillSearch> React component. Workers AI is the recommended provider; mock embeddings ship as default so the wiring is fully testable without credentials. 10/10 tests passing.
feat(memory)	Session 02 scaffold — graphify-memory skill prose + ./memory-query + KG schema in memory/graph/. Real indexer is post-merge work.
feat(federation)	Session 03 — federation/1 protocol spec, security threat model, three per-instance skills (federation-publish, federation-call, federation-trust), and the new in-repo aeon-federation-registry/ Cloudflare Worker (canonical URL: federation.aeon.bot). 6/6 smoke tests.
feat(agora)	Session 09 — agora/1 spec, glass-box contract (7 enforceable properties), five per-instance skills (agora-{post,follow,react,quote,mute}), and the new in-repo aeon-agora/ subproject (crawler + Astro pages frontend for agora.beta.aeon.bot). 12/12 glass-box tests. Plus .github/workflows/glass-box.yml enforcing the contract on every PR.
feat(runtime-cloudflare)	Session 01 scaffold — workers-runtime/ with wrangler config, Durable Object skeleton, full 21-step pipeline documented inline. Real pipeline implementation is multi-week post-merge work.
ci(lint)	Non-blocking workflow: skill-lint, skills-index coherence, skill-discovery smoke, actionlint.
chore(sprint-log)	The 303-line sealed-sprint log. Audit trail.

Test status

scripts/test-skill-discovery.mjs              → 10/10
aeon-federation-registry/__tests__/smoke.mjs  →  6/6
aeon-agora/crawler/__tests__/smoke.mjs        →  5/5
aeon-agora/pages/__tests__/glass-box.spec.mjs → 12/12
                                                 ─────
                                                 33/33 across 4 suites

All run via node --test — no new devDependencies added.

Known PLACEHOLDERs (intentional, post-merge work)

These are scaffolded but disabled inside the sealed sprint. Each has clear enable-instructions in its subsystem doc:

1. Embedding providers (openai, workers) in scripts/index-skills.mjs + scripts/memory-query.mjs — throw with operator instructions until credentials are set. Workers AI is the recommended primary.
2. aeon-federation-registry Cloudflare Worker — code complete; deploy is a wrangler deploy once D1 namespace exists.
3. aeon-agora/crawler + aeon-agora/pages — same; deploy via Cloudflare Pages once D1 timeline exists.
4. workers-runtime/ — the 21-step pipeline is documented inline as comments + function stubs; SkillRunner DO returns 501.
5. scripts/graphify-memory.mjs — entity-extraction backed by Haiku; deferred to after operator decides on KG memory shape.
6. Cross-publisher delivery for federation-call + agora-react/agora-quote — envelopes signed locally; HTTP delivery via scripts/postprocess-federation-call.sh (placeholder).

Full PLACEHOLDER list with activation steps: docs/contributor-dossier/_sprint-log/2026-05-26-full-menu.md § Remaining blockers.

Reviewer guide

For the strategic conversation:

• docs/contributor-dossier/09-EXPANSION-OPTIONS.md — the 9 options + sequencing recommendation.
• docs/contributor-dossier/08-OPEN-QUESTIONS.md — author-facing decisions; five already RESOLVED by operator earlier in the sprint.

For the security review:

• docs/contributor-dossier/05-SECURITY.md — full Aeon threat model.
• docs/federation-spec/SECURITY.md — federation threat model.
• docs/agora-spec/GLASS-BOX-CONTRACT.md — the seven enforceable properties of the glass-box.

For the working artifact:

• Try: ./skill-search "monitor crypto tokens" (works locally; deterministic mock embeddings).
• docs/contributor-dossier/03-subsystems/skill-discovery.md — what shipped + how to swap in Workers AI post-merge.

For the dossier itself:

• Start at docs/contributor-dossier/README.md and follow the recommended reading paths.

Co-maintainer note

Per the operator decision recorded in docs/contributor-dossier/04-GOVERNANCE.md: @Keeleran is joining as co-maintainer / repo owner. Push access to aaronjmars/aeon hasn't been provisioned yet — this PR comes from the standard fork-and-PR flow as the bridge.

Once push access is granted at github.com/aaronjmars/aeon/settings/access, future Chapter Three work can land via direct push to chapter-three/<slug> branches (no fork hop needed).

---

🤖 This PR was built with assistance from Claude Opus 4.7 (1M context) — see commit footers.

[imancipate]

Closed as out-of-scope — see triage comment above. The right venue is a GitHub issue.

[imancipate]

Triage: OUT-OF-SCOPE — touches .github/workflows/ (glass-box.yml, lint.yml) plus root binaries (index-skills, memory-query, skill-search, generate-skills-json), scripts/, mcp-server/, and a2a-server/, which external contributors cannot modify directly via PR.
For changes at this layer, please open an issue describing the goal and a maintainer will land the workflow/runtime pieces — the issue is the right venue. Flagging for @aaronjmars to take it from here; this first-touch triage layer can't close or land the change itself.

[aaronjmars]

Thanks for the enormous effort here, @Keeleran — there's clearly a lot of thought in the Chapter Three / Agora / federation work, and I don't want that to go to waste.

I'm going to close this one, though, echoing the triage note: it's out of scope as a single external PR.

• It's ~78k additions across 112 files, which isn't reviewable as one change.
• It touches the layers external contributors can't land directly via PR — .github/workflows/ (glass-box.yml, lint.yml), the root binaries (index-skills, memory-query, skill-search, generate-skills-json), scripts/, mcp-server/, and a2a-server/ — and it stands up entirely new subsystems (aeon-agora crawler, aeon-federation-registry) with their own package.json + CI that would run on every PR.

If you'd like to move pieces of this forward, the right venue is a GitHub issue per piece describing the goal — I'll land the workflow/runtime parts myself. Self-contained additions (a single skill, or docs) are very welcome as small, focused PRs. Closing for scope/shape reasons only — not a reflection on the work. 🙏