Wave 1: harden, test & CI-gate the Cloudflare Worker (production-grade roadmap)

.github/workflows/boj-build.yml

@@ -13,7 +13,7 @@ jobs:
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |
           # Send a secure trigger to boj-server to build this repository
-          curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
+          curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\"}"
         continue-on-error: true
 permissions:
   contents: read

.github/workflows/worker-ci.yml

@@ -0,0 +1,53 @@
+# SPDX-License-Identifier: MPL-2.0
+# Worker CI — lint, format, test and bundle the Cloudflare Worker.
+# This is the gate that actually exercises the deliverable (the read API).
+name: Worker CI
+
+on:
+  pull_request:
+    branches: ['**']
+    paths:
+      - 'worker/**'
+      - '.github/workflows/worker-ci.yml'
+  push:
+    branches: [main, master]
+    paths:
+      - 'worker/**'
+      - '.github/workflows/worker-ci.yml'
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    working-directory: worker
+
+jobs:
+  build-test:
+    name: Lint, format, test, bundle
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup Node.js
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: worker/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint (eslint)
+        run: npm run lint
+
+      - name: Format check (prettier)
+        run: npm run format:check
+
+      - name: Unit + contract tests (vitest)
+        run: npm test
+
+      - name: Bundle check (wrangler dry-run)
+        run: npx wrangler deploy --dry-run

.github/workflows/worker-deploy.yml

@@ -0,0 +1,76 @@
+# SPDX-License-Identifier: MPL-2.0
+# Worker Deploy — push the Cloudflare Worker to staging on merge to main, and
+# to production via manual dispatch (gated by the "production" GitHub Environment).
+#
+# Required repository secret: CLOUDFLARE_API_TOKEN (Workers Scripts:Edit).
+# Optional: CLOUDFLARE_ACCOUNT_ID (if the token spans multiple accounts).
+# Until CLOUDFLARE_API_TOKEN is set, the deploy step is skipped (workflow stays green).
+name: Worker Deploy
+
+on:
+  push:
+    branches: [main, master]
+    paths:
+      - 'worker/**'
+      - '.github/workflows/worker-deploy.yml'
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Target environment
+        type: choice
+        options:
+          - staging
+          - production
+        default: staging
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    working-directory: worker
+
+jobs:
+  deploy:
+    name: Deploy
+    runs-on: ubuntu-latest
+    # Manual dispatch picks the env (production requires approval if the
+    # "production" GitHub Environment has protection rules); push → staging.
+    environment: ${{ github.event_name == 'workflow_dispatch' && inputs.environment || 'staging' }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup Node.js
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: worker/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Test before deploy
+        run: npm test
+
+      - name: Check deploy credentials
+        id: gate
+        run: echo "have_token=${{ secrets.CLOUDFLARE_API_TOKEN != '' }}" >> "$GITHUB_OUTPUT"
+
+      - name: Deploy (wrangler)
+        if: steps.gate.outputs.have_token == 'true'
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          TARGET_ENV: ${{ github.event_name == 'workflow_dispatch' && inputs.environment || 'staging' }}
+        run: |
+          if [ "$TARGET_ENV" = "production" ]; then
+            npx wrangler deploy
+          else
+            npx wrangler deploy --env staging
+          fi
+
+      - name: Skipped (no credentials)
+        if: steps.gate.outputs.have_token != 'true'
+        run: echo "::notice::CLOUDFLARE_API_TOKEN not set — skipping deploy. Add the secret to enable automated deploys."

.machine_readable/6a2/STATE.a2ml

@@ -6,13 +6,13 @@
 [metadata]
 project = "gv-clade-index"
 version = "0.1.0"
-last-updated = "2026-03-16"
+last-updated = "2026-06-20"
 status = "active"
 
 [project-context]
 name = "gv-clade-index"
 purpose = "VeriSimDB-backed clade taxonomy and central registry for the hyperpolymath ecosystem (200+ repos)"
-completion-percentage = 10
+completion-percentage = 18
 
 [position]
 phase = "implementation"
@@ -23,7 +23,7 @@ milestones = [
   { name = "Phase 0: Clade taxonomy, repo seed, VQL schema, queries", completion = 100 },
   { name = "Phase 1: Deploy CLADE.a2ml to all 200 repos", completion = 0 },
   { name = "Phase 2: VeriSimDB instance on VPS, ingest data", completion = 0 },
-  { name = "Phase 3: Cloudflare Worker API endpoints", completion = 0 },
+  { name = "Phase 3: Cloudflare Worker API endpoints", completion = 60 },
   { name = "Phase 4: ReScript/WASM portal on github.io", completion = 0 },
   { name = "Phase 5: LLM query endpoint", completion = 0 },
   { name = "Phase 6: Bot write endpoints + TODO octads", completion = 0 },
@@ -32,11 +32,15 @@ milestones = [
 ]
 
 [blockers-and-issues]
-# None at Phase 0
+blockers = [
+  "Phase 3 deploy: CLOUDFLARE_API_TOKEN repo secret required to enable automated Worker deploys",
+  "Phase 3 live data + Phases 5-8: VeriSimDB instance (Phase 2) not yet stood up on a VPS",
+]
 
 [critical-next-actions]
 actions = [
-  "Deploy CLADE.a2ml to all 200 repos (batch script)",
-  "Stand up VeriSimDB instance on Verpex VPS",
+  "Add CLOUDFLARE_API_TOKEN secret to enable Worker auto-deploy to staging/production",
+  "Stand up VeriSimDB instance on Verpex VPS (Phase 2) so the Worker reads live data",
+  "Deploy CLADE.a2ml to all 200 repos (sync/deploy-clade-a2ml.sh)",
   "Write sync/ingest tooling in Rust",
 ]

.well-known/groove/manifest.json

@@ -0,0 +1,31 @@
+{
+  "groove_version": "1.0.0",
+  "service_id": "gv-clade-index",
+  "name": "Hyperpolymath Clade Registry API",
+  "description": "Read-only API and central registry — the map of the hyperpolymath ecosystem (12 clades, 200+ repos).",
+  "clade": "gv",
+  "repository": "https://github.com/hyperpolymath/gv-clade-index",
+  "license": "MPL-2.0",
+  "maintainer": "hyperpolymath",
+  "protocol": "https",
+  "api": {
+    "base_path": "/v1",
+    "health": "/v1/health",
+    "readiness": "/v1/ready",
+    "endpoints": [
+      { "method": "GET", "path": "/v1/dashboard", "description": "Ecosystem overview with clade stats" },
+      { "method": "GET", "path": "/v1/clades", "description": "List all 12 clades" },
+      { "method": "GET", "path": "/v1/clade/:code", "description": "Single clade with member repos" },
+      { "method": "GET", "path": "/v1/repo/:name", "description": "Single repo detail" },
+      { "method": "GET", "path": "/v1/repos", "description": "All repos (params: clade, page, limit)" },
+      { "method": "GET", "path": "/v1/search", "description": "Full-text search across repos" },
+      { "method": "GET", "path": "/v1/llm", "description": "Structured output for LLM consumption" },
+      { "method": "GET", "path": "/v1/query/language", "description": "Query repos by language keyword" },
+      { "method": "GET", "path": "/v1/query/tag", "description": "Query repos by tag" }
+    ]
+  },
+  "auth": {
+    "public_read": true,
+    "tiers": ["public-read", "llm-key", "bot-jwt", "contributor-oauth"]
+  }
+}

sync/deploy-clade-a2ml.sh

@@ -9,15 +9,23 @@
 
 set -uo pipefail
 
-REPOS_DIR="/var$REPOS_DIR"
+# REPOS_DIR is the directory that contains all hyperpolymath repo clones,
+# including gv-clade-index itself. Defaults to the parent of this checkout
+# (repos checked out as siblings); override by exporting REPOS_DIR.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPOS_DIR="${REPOS_DIR:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
 SEED_FILE="$REPOS_DIR/gv-clade-index/verisim/seed/repos.a2ml"
 DRY_RUN="${1:-}"
+
+if [[ ! -d "$REPOS_DIR" ]]; then
+    echo "ERROR: REPOS_DIR '$REPOS_DIR' is not a directory." >&2
+    echo "Export REPOS_DIR to the folder containing your repo clones." >&2
+    exit 1
+fi
 COMMIT_MSG="feat: add CLADE.a2ml — clade taxonomy declaration
 
 Part of gv-clade-index Phase 1: every repo declares its identity,
-primary clade, and forge mappings for the VeriSimDB central registry.
-
-Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>"
+primary clade, and forge mappings for the VeriSimDB central registry."
 
 SUCCESS=0
 SKIPPED=0

sync/parse-repos.sh

@@ -2,7 +2,9 @@
 # SPDX-License-Identifier: MPL-2.0
 # Parse repos.a2ml and emit TSV: name\tprimary\tsecondary\tlineage\tparent\tdescription
 
-SEED_FILE="${1:-/var$REPOS_DIR/gv-clade-index/verisim/seed/repos.a2ml}"
+# Default to this repo's seed file (script lives in sync/, seed in verisim/seed/).
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SEED_FILE="${1:-$SCRIPT_DIR/../verisim/seed/repos.a2ml}"
 
 awk '
 BEGIN { FS="=" }

worker/.gitignore

@@ -0,0 +1,7 @@
+# Node toolchain (dev-only; not part of the deployed Worker)
+node_modules/
+# Wrangler local dev / Miniflare state
+.wrangler/
+# Test coverage
+coverage/
+*.log

worker/.prettierignore

@@ -0,0 +1,5 @@
+node_modules/
+.wrangler/
+coverage/
+data/
+package-lock.json

worker/.prettierrc.json

@@ -0,0 +1,5 @@
+{
+  "singleQuote": true,
+  "printWidth": 100,
+  "trailingComma": "all"
+}