feat: add cartridge-minter CLI and 14 new Ayo-tier cartridges

Cartridge Minter (tools/cartridge-minter/):
  Rust CLI wizard that scaffolds complete 3-layer cartridges
  (Idris2 ABI + Zig FFI + V adapter + PanLL panel harness).
  Four modes: mint, provision, configure, harness.
  22 tests, criterion benchmarks, installed as `cm` alias.

14 new cartridges (all with full ABI+FFI+ADT stacks):
  - vault-mcp: Zero-knowledge proxy to reasonably-good-token-vault
  - browser-mcp: Firefox automation via Marionette protocol
  - github-api-mcp: GitHub REST+GraphQL (replaces standalone MCP)
  - gitlab-api-mcp: GitLab API with self-hosted + push mirror support
  - slack-mcp: Slack Web API with per-method rate tiers
  - discord-mcp: Discord Bot API with bucket-based rate limits
  - telegram-mcp: Telegram Bot API with token-in-URL pattern
  - matrix-mcp: Matrix Client-Server API with configurable homeserver
  - linear-mcp: Linear GraphQL API for project management
  - notion-mcp: Notion API with versioned headers
  - jira-mcp: Atlassian Jira REST API with Basic auth
  - postgresql-mcp: PostgreSQL wire protocol with libpq stubs
  - redis-mcp: Redis RESP protocol with pipeline support
  - mongodb-mcp: MongoDB wire protocol with BSON handling

All cartridges validated: %default total, zero unsafe patterns,
SPDX PMPL-1.0-or-later, PanLL panel manifests, test+benchmark stubs.

Total cartridge count: 38 (24 existing + 14 new).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.gitignore

@@ -132,3 +132,6 @@ v.mod.lock
 # Zig global cache
 .zig-cache/
 zig-out/
+
+# Cartridge minter build artifacts
+tools/cartridge-minter/target/

.machine_readable/servers/menu.a2ml

@@ -350,3 +350,171 @@
   timestamp = "2026-03-08T00:00:00Z"
   canonical = "boj-server/.machine_readable/servers/menu.a2ml"
 @end
+
+
+@cartridge(id="vault-mcp"):
+  name       = "vault-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Secrets
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Zero-knowledge credential proxy for the reasonably-good-token-vault"
+@end
+
+
+@cartridge(id="browser-mcp"):
+  name       = "browser-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Browser
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Firefox browser automation via the Marionette protocol (TCP localhost:2828)"
+@end
+
+
+@cartridge(id="github-api-mcp"):
+  name       = "github-api-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Cloud
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "github-api-mcp cartridge"
+@end
+
+
+@cartridge(id="gitlab-api-mcp"):
+  name       = "gitlab-api-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Cloud
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "gitlab-api-mcp cartridge"
+@end
+
+
+@cartridge(id="slack-mcp"):
+  name       = "slack-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Comms
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Slack Web API and Events API cartridge — send messages, manage channels, search, react, and more"
+@end
+
+
+@cartridge(id="linear-mcp"):
+  name       = "linear-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Cloud
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "linear-mcp cartridge"
+@end
+
+
+@cartridge(id="notion-mcp"):
+  name       = "notion-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Comms
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Notion REST API cartridge — pages, databases, blocks, users, and comments via https://api.notion.com/v1/"
+@end
+
+
+@cartridge(id="jira-mcp"):
+  name       = "jira-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Cloud
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "jira-mcp cartridge"
+@end
+
+
+@cartridge(id="discord-mcp"):
+  name       = "discord-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Comms
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Discord REST API v10 cartridge — messages, channels, guilds, members, reactions, threads, search, status, file uploads"
+@end
+
+
+@cartridge(id="telegram-mcp"):
+  name       = "telegram-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Comms
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Telegram Bot API cartridge — messages, updates, chats, media, webhooks, callbacks, stickers, forwarding, pinning"
+@end
+
+
+@cartridge(id="matrix-mcp"):
+  name       = "matrix-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Comms
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Matrix Client-Server API v3 cartridge — messages, events, rooms, membership, state, sync, search, media, profiles, room creation"
+@end
+
+
+@cartridge(id="postgresql-mcp"):
+  name       = "postgresql-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Database
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "PostgreSQL database cartridge with parameterised queries, transaction support, and libpq C-ABI integration"
+@end
+
+
+@cartridge(id="redis-mcp"):
+  name       = "redis-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Database
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "Redis database cartridge with RESP protocol, pipeline support, and pub/sub"
+@end
+
+
+@cartridge(id="mongodb-mcp"):
+  name       = "mongodb-mcp"
+  version    = "0.1.0"
+  status     = Development
+  tier       = Ayo
+  domain     = Database
+  protocols  = [MCP, REST]
+  hash       = ""
+  notes      = "MongoDB database cartridge with BSON document handling, aggregation pipelines, and wire protocol integration"
+@end

cartridges/browser-mcp/README.adoc

@@ -0,0 +1,125 @@
+= browser-mcp
+Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+:spdx: PMPL-1.0-or-later
+:tier: Ayo
+:domain: Browser
+:protocols: MCP, REST
+
+== Overview
+
+Browser automation cartridge for Firefox via the **Marionette protocol**.
+Connects to Firefox's built-in remote automation endpoint on `localhost:2828`
+(enabled by launching Firefox with `--marionette` or setting
+`marionette.enabled = true` in `about:config`).
+
+Provides MCP tools for:
+
+* **Navigate** — load a URL in the current tab
+* **Click** — click an element by CSS selector
+* **Type** — type text into a form element by CSS selector
+* **Screenshot** — capture the current viewport as PNG
+* **ReadPage** — extract DOM text content
+* **FillForm** — fill multiple form fields in one operation
+* **ExecuteJS** — execute JavaScript in page context
+* **TabCreate** / **TabClose** / **TabList** — manage browser tabs
+
+Inspired by the Firefox MCP at `patallm-gallery/claude-integrations/firefox-mcp/`,
+which uses a Deno server + Firefox extension via WebSocket. This cartridge
+replaces that architecture with the standard BoJ Idris2/Zig/V-lang triple
+and connects directly to Marionette over TCP (no extension required).
+
+== Architecture
+
+[cols="1,1,2"]
+|===
+| Layer | Language | Purpose
+
+| ABI
+| Idris2
+| Formally verified browser state machine (`Closed -> Connecting -> Connected -> Navigating`) with dependent-type proofs
+
+| FFI
+| Zig
+| C-compatible implementation with thread-safe session pool, Marionette TCP protocol handling
+
+| Adapter
+| V-lang
+| REST endpoint bridge to BoJ unified adapter protocol
+|===
+
+=== Browser State Machine
+
+....
+Closed --StartConnect--> Connecting
+Connecting --ConnectSuccess--> Connected
+Connecting --ConnectFail--> Error
+Connected --BeginNavigate--> Navigating
+Connected --Disconnect--> Closed
+Connected --ConnectedError--> Error
+Navigating --EndNavigate--> Connected
+Navigating --NavigateError--> Error
+Error --ErrorRecover--> Closed
+....
+
+== Building
+
+[source,bash]
+----
+# Build FFI shared library
+cd ffi && zig build
+
+# Run FFI tests (state machine tests, no Firefox needed)
+cd ffi && zig build test
+
+# Type-check ABI
+cd abi && idris2 --check BrowserMcp.SafeBrowser
+----
+
+== Firefox Setup
+
+To enable Marionette for automation:
+
+[source,bash]
+----
+# Launch Firefox with Marionette enabled
+firefox --marionette
+
+# Or set in about:config
+# marionette.enabled = true
+# marionette.port = 2828  (default)
+----
+
+== REST Endpoints
+
+[cols="1,2,2"]
+|===
+| Method | Path | Description
+
+| POST   | `/session`                     | Open a new browser session
+| DELETE | `/session/{slot}`              | Close a session
+| GET    | `/session/{slot}/state`        | Get connection state
+| POST   | `/session/{slot}/connect`      | Connect to Firefox Marionette
+| POST   | `/session/{slot}/disconnect`   | Disconnect from Firefox
+| POST   | `/session/{slot}/navigate`     | Navigate to URL
+| POST   | `/session/{slot}/click`        | Click element by selector
+| POST   | `/session/{slot}/type`         | Type text into element
+| POST   | `/session/{slot}/screenshot`   | Capture screenshot
+| POST   | `/session/{slot}/read_page`    | Read page DOM text
+| POST   | `/session/{slot}/tab`          | Create new tab
+| DELETE | `/session/{slot}/tab/{idx}`    | Close tab by index
+| GET    | `/session/{slot}/tabs`         | List open tabs
+|===
+
+== PanLL Panel
+
+The `panels/manifest.json` defines a monitoring panel with:
+
+* Connection status badge (colour-coded by state)
+* Current URL display
+* Tab count indicator
+* Page title display
+* Screenshot thumbnail (refreshed every 30s)
+
+== Status
+
+Development — not yet ready for mounting.