Add agent workflow binstub contract

.agents/agent-workflow.yml

@@ -0,0 +1,12 @@
+---
+base_branch: main
+follow_up_prefix: "Follow-up:"
+review_gate: AI reviewers are advisory unless they confirm a blocker; merge gate is the full `gh pr checks` list green (not --required) + all threads resolved + mergeable clean
+approval_exempt: at batch closeout, auto-merge ready low-risk PRs that pass the merge gate; keep high-risk (CI/workflow, build-config, dependency or runtime bumps, broad refactors, release) maintainer-gated
+coordination_backend: private shakacode/agent-coordination (claims/heartbeats namespaced by full repo name)
+changelog: n/a
+benchmark_labels: n/a
+merge_ledger: n/a
+ci_parity_environment: n/a — reproduce CI-only failures from the matching job in .github/workflows/**
+hosted_ci_trigger: n/a — CI runs on every PR if configured
+ci_change_detector: n/a

.agents/bin/README.md

@@ -0,0 +1,18 @@
+# Agent Workflow Scripts
+
+Standard entry points that portable agent-workflow skills call, so a skill can
+run `.agents/bin/<name>` in any repo without knowing this repo's specific
+commands. Each script is a thin, repo-owned wrapper. A script that is **absent**
+means that capability is n/a here.
+
+| Script | Purpose | This repo runs |
+| --- | --- | --- |
+| `setup` | Install dependencies and prepare the development database | `bin/setup` |
+| `validate` | Pre-push gate | `bundle exec rake` |
+| `test` | Run tests, including test database preparation | `bin/test "$@"` |
+| `lint` | Lint / format | n/a |
+| `build` | Build / type-check | n/a |
+| `docs` | Docs checks | n/a |
+| `ci-detect` | CI change detector | n/a |
+
+Non-command policy lives in [`../agent-workflow.yml`](../agent-workflow.yml).

.agents/bin/setup

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# Generated by shakacode/agent-workflows bin/push-downstream.
+# Install dependencies and prepare the development database.
+set -euo pipefail
+cd "$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+exec bin/setup "$@"

.agents/bin/test

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# Generated by shakacode/agent-workflows bin/push-downstream.
+# Run the repository test entry point, including test database preparation.
+set -euo pipefail
+cd "$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+exec bin/test "$@"

.agents/bin/validate

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# Generated by shakacode/agent-workflows bin/push-downstream.
+# Pre-push gate.
+set -euo pipefail
+cd "$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+exec bundle exec rake

AGENTS.md

@@ -430,3 +430,9 @@ Codex does not need to ask again before running `gh pr ready` under those
 conditions. If required checks are failing, review-app verification is broken,
 or blocking feedback remains unresolved, leave the pull request as draft and
 report the blocker instead.
+
+## Agent Workflow Configuration
+
+Portable shared skills resolve this repo's commands and policy through:
+- **Commands** — run `.agents/bin/<name>` (`setup`, `validate`, `test`, ...); see `.agents/bin/README.md`. A missing script means that capability is n/a here.
+- **Policy / config** — `.agents/agent-workflow.yml`.