GENESIS: windy-git DNA Strand Master Plan v0.1.0

Stake in the ground for Windy Git — the version, permission and provenance
plane over Windy Cloud, and an agent-native code and model host.

Captures the 2026-08-11 vision session as nine locked decisions (D-1..D-9),
thirteen invariants (I-1..I-13), and thirteen strands (G0..G12) with atomic
codons and per-codon acceptance criteria.

Grounded in measurement, not estimate:
  - 61 repos = 11 GB working trees, 0.63 GB git objects
  - Veron 1: 24 cores / 251 GB / 978 GB free / load 1.52 / $0
  - Kit 0: 4 vCPU / load 7.62 — disqualified on four independent grounds
  - Windy Cloud storage confirmed to have ZERO sharing/permission/versioning

Every warning in the plan is a lesson a sibling cell already paid for in
production, cited to its source in the 2026-08-09 audits.

Apex windygit.com purchased 2026-08-11, zone 9d8637dc, active.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

AGENTS.md

@@ -0,0 +1,39 @@
+# AGENTS.md — windy-git
+
+Read this before touching anything. Then read `DNA_STRAND_MASTER_PLAN.md`, which is the source of truth.
+
+## Current state
+
+**GENESIS.** No code. No `make dev` yet — building it is codon **G0.8**.
+
+The next work is Strand **G0** (cell substrate), then **G1** (Veron 1 host + Cloudflare Tunnel), then **G2** (Gitea, stock and branded), then **G3** (identity), then **G4** (storage). G0–G4 are sequential. G5–G12 are concurrent once G4 lands.
+
+## The rules that will get you reverted if you break them
+
+1. **Do not fork Gitea.** (D-2 / I-1.) Our code calls Gitea's REST API from our own service. Any patch to Gitea source goes in `patches/` as a numbered rebasable diff with a one-line justification, and `make check` fails past **3** files without an ADR.
+2. **Never say "a Git."** (D-9 / I-9.) Git is not a countable noun. A moment in time is a *commit*; user-facing, it is a *version* or *save point*. `make check` greps for violations.
+3. **Never touch Kit 0.** (D-4 / §7.8.) Not in v0, not in v1. Only Grant may overturn a never.
+4. **No Stripe. No prices. No checkout.** (I-11.) This cell emits usage events; the Windy Cloud kernel owns the ladder.
+5. **Never claim live while a provider is mock.** (I-8.) Every seam fails closed. `/health/full` reports what it can prove and nothing more.
+6. **`repo_type` exists from migration 001.** (I-7.) Never inferred, never defaulted at read time, never retrofitted.
+7. **Git objects on local disk, heavy bytes on R2. Never the reverse.** (I-3.)
+8. **`/version` must be honest.** (I-12.) The commit sha is baked at image build; a runtime `COMMIT_SHA` env var is **ignored with a warning**. Nine of twelve sibling services cannot name their own commit — we will not be the tenth.
+9. **Every invariant has a named test.** Cite the invariant in the test file header.
+10. **An unverifiable codon is not done.** Every codon in the plan has an acceptance criterion. Finished-looking code without its acceptance test is not finished.
+
+## House conventions
+
+- Python 3.12 · FastAPI · pydantic-settings · Postgres schema `windgit` · own alembic, every migration with a tested downgrade.
+- `make check` = `ruff` + `mypy` + `pytest` + membrane-drift + capabilities-drift + `/version` honesty + vocabulary audit. **The local gate IS the merge gate.**
+- Errors are 4-field repair pointers: `{code, speak, machine_cause, remediation_tool}`. No exceptions, including validation errors.
+- Every tool response carries `state_proof` + `next_actions`.
+- Telemetry `actor_type` comes from the enum `{human, agent, system}`. **`'service'` is not legal** — it 422s and silently drops the whole batch. A sibling service is losing telemetry to exactly this today.
+- Runner labels are explicit and pinned. **`ubuntu-latest` is banned** — all four `windy-registry` workflows use it and every run fails.
+
+## Membrane
+
+Calls out, calls in, and events are **enumerated in invariant I-2** and mirrored in `docs/MEMBRANE.v1.md`. Adding a call means editing I-2 first, then the doc, then the code. Not the other way round.
+
+## What needs Grant
+
+See §7 of the plan. Short version: opening to any non-Grant user · any pricing · advancing off the GitHub mirror · marketing provenance before the upstream integrity fix lands · a hard fork of Gitea · the marketing site · enabling `repo_type=model` in production · anything involving Kit 0.