feat: add gitea agentic runtime control plane

.ralph/ralph-context.md

@@ -0,0 +1,6 @@
+# Ralph Context
+
+- Follow the approved design in `docs/superpowers/specs/2026-03-13-gitea-agentic-runtime-design.md`.
+- Execute tasks from `docs/superpowers/plans/2026-03-13-gitea-agentic-runtime-plan.md` in order.
+- Keep Gitea as the only real provider in this iteration.
+- Preserve platform-agnostic boundaries so GitHub can be added later.

.ralph/ralph-history.md

@@ -0,0 +1,101 @@
+# Ralph History
+
+## Iteration 0
+
+- Initialized worktree `feature/gitea-runtime-control-plane`
+- Wrote approved design spec and implementation plan
+- Created Ralph loop contract and task list
+- Verification: not started yet
+
+## Iteration 1
+
+- Goal: complete Task 1 package scaffold, spec loader, and sample workflow
+- Changed files:
+  - `pyproject.toml`
+  - `engine/devops_agent/__init__.py`
+  - `engine/devops_agent/cli.py`
+  - `engine/devops_agent/spec.py`
+  - `workflows/gitea-issue-delivery.md`
+  - `tests/unit/test_smoke_imports.py`
+  - `tests/unit/test_spec_loader.py`
+  - `tests/fixtures/specs/valid_workflow.md`
+  - `tests/fixtures/specs/invalid_missing_provider.md`
+  - `.gitignore`
+- Verification:
+  - `python -m pytest tests/unit/test_smoke_imports.py tests/unit/test_spec_loader.py -q`
+  - Result: `4 passed`
+- Blockers:
+  - Pytest tmp and cache facilities are unreliable in this Windows sandbox path, so tests must avoid `tmp_path` and rely on stable fixture files or repo-local paths.
+
+## Iteration 2
+
+- Goal: complete Task 2 compiler, validator, and policy enforcement
+- Changed files:
+  - `engine/devops_agent/compiler.py`
+  - `engine/devops_agent/validator.py`
+  - `engine/devops_agent/policies.py`
+  - `engine/devops_agent/spec.py`
+  - `tests/unit/test_compiler.py`
+  - `tests/unit/test_validator.py`
+  - `tests/unit/test_policies.py`
+  - `tests/fixtures/specs/no_safe_outputs_for_write.md`
+  - `tests/fixtures/specs/invalid_path_scope.md`
+- Verification:
+  - `python -m pytest tests/unit/test_smoke_imports.py tests/unit/test_spec_loader.py tests/unit/test_compiler.py tests/unit/test_validator.py tests/unit/test_policies.py -q`
+  - Result: `11 passed`
+- Blockers:
+  - PyYAML treats `on` as a boolean in default parsing, so the spec loader now normalizes that key explicitly.
+
+## Iteration 3
+
+- Goal: complete Task 3 provider layer, Gitea provider, runtime, and evidence persistence
+- Changed files:
+  - `engine/devops_agent/evidence.py`
+  - `engine/devops_agent/runtime.py`
+  - `engine/devops_agent/providers/__init__.py`
+  - `engine/devops_agent/providers/base.py`
+  - `engine/devops_agent/providers/gitea.py`
+  - `tests/unit/test_gitea_provider.py`
+  - `tests/integration/test_runtime_flow.py`
+  - `tests/fixtures/gitea/issue.json`
+  - `tests/fixtures/gitea/comment_event.json`
+- Verification:
+  - `python -m pytest tests/unit tests/integration -q`
+  - Result: `15 passed`
+- Blockers:
+  - None in code shape. Real Gitea acceptance still depends on environment credentials.
+
+## Iteration 4
+
+- Goal: complete Task 4 CLI, acceptance tests, and documentation updates
+- Changed files:
+  - `engine/devops_agent/cli.py`
+  - `tests/unit/test_cli.py`
+  - `tests/acceptance/test_gitea_acceptance.py`
+  - `README.md`
+  - `skills/gitea-issue-devops-agent/SKILL.md`
+  - `workflows/gitea-issue-delivery.lock.json`
+- Verification:
+  - `python -m pytest tests/unit tests/integration tests/acceptance -q`
+  - `python -m engine.devops_agent.cli compile workflows/gitea-issue-delivery.md --output workflows/gitea-issue-delivery.lock.json`
+  - `python -m engine.devops_agent.cli validate workflows/gitea-issue-delivery.md`
+  - Result: `18 passed, 1 skipped`
+- Blockers:
+  - Real Gitea acceptance is blocked until `GITEA_BASE_URL`, `GITEA_REPO`, `GITEA_TOKEN`, and `GITEA_ISSUE_NUMBER` are provided.
+
+## Iteration 5
+
+- Goal: complete Task 5 full verification and real Gitea acceptance handoff
+- Verification:
+  - `python -m pytest tests/unit tests/integration tests/acceptance -q`
+  - `python -m engine.devops_agent.cli compile workflows/gitea-issue-delivery.md --output workflows/gitea-issue-delivery.lock.json`
+  - `python -m engine.devops_agent.cli validate workflows/gitea-issue-delivery.md`
+  - `git diff --check`
+  - Result: `19 passed`
+- Real acceptance evidence:
+  - repo: `FunMD/document-collab`
+  - issue: `#48`
+  - comment id: `246`
+  - comment url: `http://154.39.79.147:3000/FunMD/document-collab/issues/48#issuecomment-246`
+- Blockers:
+  - None for the Gitea single-platform acceptance target.

.ralph/ralph-loop-plan.md

@@ -0,0 +1,28 @@
+# Ralph Loop Plan
+
+## Goal
+
+Integrate a Gitea-backed agentic workflow runtime into this repository so the product moves from skill-only guidance to a real execution control plane. Deliver a repo-local workflow spec format, compiler, validator, runtime, Gitea provider, safe-output policy enforcement, evidence persistence, automated tests, and one real Gitea acceptance path.
+
+## Acceptance Criteria
+
+1. `workflows/gitea-issue-delivery.md` compiles into a lock artifact.
+2. Invalid workflow specs fail validation with explicit errors.
+3. Runtime refuses undeclared write actions and records evidence for allowed ones.
+4. Automated unit and integration tests pass.
+5. Real Gitea acceptance can read the selected issue and publish an evidence comment when credentials are present.
+6. README and `skills/gitea-issue-devops-agent/SKILL.md` reflect the new runtime model.
+
+## Verification Commands
+
+- `python -m pytest tests/unit tests/integration -q`
+- `python -m pytest tests/acceptance/test_gitea_acceptance.py -q`
+- `python -m engine.devops_agent.cli compile workflows/gitea-issue-delivery.md --output workflows/gitea-issue-delivery.lock.json`
+- `python -m engine.devops_agent.cli validate workflows/gitea-issue-delivery.md`
+- `git diff --check`
+
+## Promises
+
+- completion_promise: `COMPLETE`
+- abort_promise: `ABORT`
+- max_iterations: `5`

.ralph/ralph-tasks.md

@@ -0,0 +1,7 @@
+# Ralph Tasks
+
+- [x] Task 1: Add Python package scaffold, workflow spec loader, and sample workflow
+- [x] Task 2: Add compiler, validator, and policy enforcement
+- [x] Task 3: Add provider layer, Gitea provider, runtime, and evidence persistence
+- [x] Task 4: Add CLI commands, acceptance tests, and documentation updates
+- [x] Task 5: Run full verification, compile sample workflow, and prepare manual acceptance handoff