feat: add gitea agentic runtime control plane

skills/gitea-issue-devops-agent/SKILL.md

@@ -15,11 +15,32 @@ This skill is platform-aware for Gitea, but its delivery contract must stay port
 
 - Start coding only from a selected issue, not from an unbounded issue queue, unless the user explicitly asks for triage-only queue scanning.
 - Every delivery issue must have a persisted plan before any code changes.
+- Treat workflow spec, compiled lock artifact, and evidence artifacts as executable system-of-record once the runtime is available; do not rely on prose-only guidance for enforcement.
 - External collaboration stays Git-native: issue, branch, PR, pipeline, review app, merge.
 - AI output is provisional until tests, smoke paths, and review evidence exist.
 - Engineers stay in the loop from the initial PR onward and own white-box review.
 - Keep one active issue per branch and per execution agent unless the user explicitly approves batching.
 
+## Runtime Contract (Required)
+
+When the repository contains the runtime package, use it instead of ad-hoc execution:
+
+1. Author or update the workflow spec in `workflows/*.md`.
+2. Compile before execution:
+   - `python -m engine.devops_agent.cli compile workflows/gitea-issue-delivery.md --output workflows/gitea-issue-delivery.lock.json`
+3. Validate before execution:
+   - `python -m engine.devops_agent.cli validate workflows/gitea-issue-delivery.md`
+4. Run or accept only through declared safe outputs.
+5. Persist run evidence under `.tmp/...` and treat `run-artifact.json` as execution proof.
+6. For real Gitea verification, use:
+   - `python -m engine.devops_agent.cli acceptance workflows/gitea-issue-delivery.md --base-url <url> --repo <owner/repo> --token <token> --issue-number <n> --output-dir .tmp/acceptance/gitea`
+
+Hard rules:
+
+- No undeclared write actions.
+- No execution after failed validation.
+- No claiming completion without runtime evidence.
+
 ## Mandatory Guided Start
 
 Run this interaction before any coding or issue action:
@@ -401,6 +422,15 @@ Use `jj` only under these rules:
 
 ## Script Usage
 
+### Runtime CLI
+
+- `python -m engine.devops_agent.cli compile workflows/gitea-issue-delivery.md --output workflows/gitea-issue-delivery.lock.json`
+- `python -m engine.devops_agent.cli validate workflows/gitea-issue-delivery.md`
+- `python -m engine.devops_agent.cli run workflows/gitea-issue-delivery.md --event-payload <payload.json> --output-dir .tmp/runtime-run --base-url <url> --token <token>`
+- `python -m engine.devops_agent.cli acceptance workflows/gitea-issue-delivery.md --base-url <url> --repo <owner/repo> --token <token> --issue-number <n> --output-dir .tmp/acceptance/gitea`
+
+- runtime writes `run-artifact.json` and should be used as the evidence source for status promotion and issue comments.
+
 - `scripts/issue_audit.py`: collect issues/comments/attachments, detect duplicates, score quality, detect unresolved/closed-open links, extract issue branch hints, and generate reports.
   - image intake uses three sources: markdown/html links, payload `assets/attachments` fields, and `/issues/*/assets` API endpoints.
   - if your Gitea blocks the assets endpoints, pass `--skip-asset-endpoints` and rely on payload extraction.