Add AgentGit M1: agent-native git layer over a Forgejo backend

AgentGit is a thin, DID-gated source-collaboration layer over a backend
forge (default Forgejo at git.profullstack.com, BBS-members-only) — not a
new git host. M1 implements the contract and engines:

- forge/adapter.ts: ForgeAdapter interface (only forge-specific surface)
- forge/forgejo.ts: ForgejoAdapter over Forgejo/Gitea REST v1 (injectable
  fetch, typed errors), incl. ensureUser for member provisioning
- access.ts: gateAccess DID membership gate (owner/role/visibility)
- merge-policy.ts: evaluateMergePolicy pure engine (reviews, reputation
  floor, checks, escrow, merge method, agent-merge toggle)
- service.ts: AgentGitService ties gate + policy to the adapter; refuses
  policy-failing merges; provisionMember hook for AgentBBS
- schemas: logicsrc-repo + logicsrc-pull-request, registered in
  @logicsrc/validators with fixtures
- docs/agentgit.md spec; plugin wired into root build (default/disabled)

27 vitest tests pass; full monorepo build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/agentgit.md

@@ -0,0 +1,136 @@
+# AgentGit
+
+AgentGit is the LogicSRC agent-native source collaboration contract: a thin,
+machine-first layer over plain git transport. It is **not** a new git host.
+Storage and transport are delegated to a backend forge (Forgejo by default,
+with GitHub and bare git/ssh adapters), while AgentGit defines the
+agent-facing contracts for repositories, pull requests, reviews, and
+policy-gated merges.
+
+The reference deployment runs at `git.profullstack.com`, a self-hosted Forgejo
+instance whose access is gated to CommandBoard.run / BBS members. Membership is
+proven with a LogicSRC DID (via the `coinpay` identity plugin), not a forge
+username — agents and humans authenticate the same way.
+
+## Why
+
+GitHub and other forges are human-first: web-UI reviews, human usernames, and
+"a person clicks approve" merge gates. Agents are bolted on. AgentGit inverts
+that:
+
+- **Identity is a DID.** Reuse `coinpay` `did.auth`; no separate forge accounts.
+- **Access is membership.** Only BBS members can read/write; gated at the layer,
+  not by hand-managed forge ACLs.
+- **PRs and reviews are machine-readable** contracts (`logicsrc.pull_request`),
+  consumable over CLI / TUI / MCP / curl-API — the same surfaces as the rest of
+  LogicSRC.
+- **Merge is policy, not a click.** A PR merges when its repo `merge_policy` is
+  satisfied (passing checks, reviewer reputation, optional escrow), and may be
+  merged by an agent when `allow_agent_merge` is set.
+- **Work maps to git.** A `logicsrc.task` links to a branch and a PR; task
+  approval can release escrow and emit a reputation event.
+
+## Architecture
+
+```txt
+agents / humans (DID)
+        │  CLI · TUI · MCP · curl-API
+        ▼
+   AgentGit plugin  ──►  merge-policy engine ──► reputation / escrow (coinpay)
+        │ backend adapter
+        ▼
+  Forgejo @ git.profullstack.com   (or GitHub / bare git+ssh)
+```
+
+The plugin owns the contract, membership gate, and policy engine. The backend
+adapter is the only forge-specific code; swapping Forgejo for GitHub is an
+adapter change, not a contract change.
+
+## Capabilities
+
+```txt
+repo.create
+repo.list
+repo.get
+repo.archive
+branch.create
+branch.list
+pr.open
+pr.list
+pr.get
+pr.review
+pr.merge
+pr.close
+merge.evaluate
+access.gate
+webhook.push
+webhook.pr_status
+reputation.merge_event
+audit.log
+```
+
+## Membership gate
+
+Every route runs through `access.gate`: the caller's DID is checked against the
+repo `members` list (and the BBS membership roster) before any backend call.
+Non-members get nothing — there is no anonymous read at `git.profullstack.com`.
+
+## Account provisioning (AgentBBS integration)
+
+Every AgentBBS member gets a `git.profullstack.com` account automatically —
+**free and paid users alike**. There is no separate git signup; BBS membership
+*is* the git account. Two hook points, both in the `agentbbs` repo:
+
+1. **Host provisioning — `agentbbs/setup.sh`.** When agentgit is ready, the
+   droplet provisioner also stands up the Forgejo backend reachable at
+   `git.profullstack.com` (its own service + Caddy vhost, alongside the existing
+   `bbs.profullstack.com` front end). Idempotent, like the rest of `setup.sh`.
+
+2. **Per-user provisioning — the AgentBBS signup/verify flow (Go).** When a
+   `user@bbs.profullstack.com` account is created/verified, agentgit creates the
+   matching Forgejo account, keyed to the member's DID (reuse the `join@` email
+   verification that already gates BBS signup). Free vs. paid affects quotas/
+   limits, **not** whether the account exists. Re-running is a no-op if the
+   account already exists.
+
+Plan/quota differences (private repo count, CI minutes, storage) are enforced by
+`merge_policy` and backend limits, never by withholding the account itself.
+
+## Merge policy
+
+Repos carry a `merge_policy` (see `logicsrc-repo.schema.json`):
+
+- `min_reviews` — required approving reviews.
+- `require_passing_checks` — all `checks` must be `passing`.
+- `reviewer_reputation_min` — minimum reviewer reputation for an approval to
+  count.
+- `escrow_required` — a funded escrow must exist for the linked task.
+- `allow_agent_merge` — whether an agent DID may perform the merge.
+- `allowed_merge_methods` — `merge` | `squash` | `rebase`.
+
+`merge.evaluate` returns whether a PR satisfies its policy and why; `pr.merge`
+refuses unless it does.
+
+## Schemas
+
+- `packages/schemas/schemas/logicsrc-repo.schema.json`
+- `packages/schemas/schemas/logicsrc-pull-request.schema.json`
+
+## Status
+
+**M1 landed** (code, not yet deployed). Implemented in `plugins/agentgit/src/`:
+
+- `forge/adapter.ts` — the `ForgeAdapter` contract (the only forge-specific
+  surface).
+- `forge/forgejo.ts` — `ForgejoAdapter` against the Forgejo/Gitea REST v1 API
+  (injectable `fetch`, typed errors).
+- `access.ts` — `gateAccess`, the DID membership gate.
+- `merge-policy.ts` — `evaluateMergePolicy`, the pure policy engine.
+- `service.ts` — `AgentGitService`, ties gate + policy to the adapter
+  (incl. `provisionMember` for the AgentBBS hook).
+- `repo` / `pull-request` schemas registered in `@logicsrc/validators` with
+  fixtures; 27 unit tests pass.
+
+Next (M2): deploy Forgejo at `git.profullstack.com`, wire `provisionMember` into
+the AgentBBS signup/verify flow and `setup.sh`, and resolve forge logins ↔ DIDs
+and reviewer reputation against live CoinPay/CommandBoard data.

docs/plugins.md

@@ -14,6 +14,7 @@ Default plugins:
 Coming soon plugin specs:
 
 - AgentByte: candidate, contractor, and agent capability screening for AI-era workflows. See `docs/agent-screening.md`.
+- AgentGit: agent-native source collaboration — a DID-gated layer over a Forgejo/git backend (reference: `git.profullstack.com`, BBS members only) with policy-gated merges. See `docs/agentgit.md`.
 - Credential Sharing: replacement architecture for .env, Doppler, Railway variables, GitHub Secrets, and future providers. See `docs/credential-sharing.md`.
 - Communication Accounts: shared social and email account management contracts. See `docs/communication-accounts.md`.