feat(website): t27 world discovery -- scan GitHub for every public repository that writes .t27 and vendor it into the catalog

.github/workflows/t27-world-scan.yml

@@ -0,0 +1,95 @@
+# Scan GitHub for repositories that write .t27 specs and keep the catalog current.
+#
+# The catalog behind #/specs and the Queen map knew five repositories, each typed
+# into apps/website/scripts/sync-t27-specs.mjs by hand. gHashTag/trios (71 specs)
+# sat in the same owner's public inventory unnoticed, and
+# dmitrii-f-t27/trinity-memory belongs to another owner, so no list would have
+# found it. This runs the scan whose contract is
+# apps/website/public/t27/files/specs/catalog/discovery.t27 (owners, exclusions,
+# what qualifies), vendors what qualifies, rebuilds the shared core and the
+# atlas, runs the catalog gates and commits the data -- the way
+# signal-health-self.yml commits its numbers.
+#
+# Publishing stays with deploy-site.yml, manual on purpose: content is approved
+# before it goes out. The five founding sources are not refreshed here either;
+# they come from a local t27 checkout that carries the teaching course on a
+# branch not yet on t27 master (see sync-t27-specs.mjs), and a re-vendor from
+# GitHub alone would delete it from the site.
+name: t27 world scan
+
+on:
+  schedule:
+    - cron: '17 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    defaults:
+      run:
+        working-directory: apps/website
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: apps/website/package-lock.json
+
+      - run: npm ci
+
+      # Public reads only: owner inventories, code search, trees, blobs, tarballs,
+      # open issues. The token is the workflow's own; nothing is written to GitHub
+      # by these commands, and the reports carry no credentials.
+      - name: Scan, vendor, index, atlas
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          npm run discover -- scan --out "$RUNNER_TEMP/discovery.json"
+          npm run discover -- vendor --report "$RUNNER_TEMP/discovery.json"
+          npm run core -- index
+          # The generated catalogs pin the manifest by hash (check:agents, check:docs refuse
+          # a stale one), so they are rebuilt here exactly as prebuild rebuilds them.
+          node scripts/skills-core.mjs index
+          node scripts/agents-from-specs.mjs
+          node scripts/docs-from-specs.mjs
+          npm run atlas -- scan --discovery "$RUNNER_TEMP/discovery.json" --out "$RUNNER_TEMP/atlas-report.json"
+          npm run atlas -- build --report "$RUNNER_TEMP/atlas-report.json"
+          node -e "const r=require('$RUNNER_TEMP/discovery.json');console.log('worlds: '+r.worlds.join(', ')+'; founding: '+r.founding.length+'; code search: '+r.codeSearch.status)" >> "$GITHUB_STEP_SUMMARY"
+
+      # The same gates a PR runs on the catalog, against the tree about to be committed.
+      - name: Catalog gates
+        run: |
+          set -euo pipefail
+          npm run check:discovery
+          npm run check:shared-core
+          npm run check:spec-catalog
+          npm run check:queen-atlas
+          npm run check:queen-catalog
+          npm run check:queen-continuous
+          npm run check:queen-spec-mirrors
+          npm run check:skills-catalog
+          npm run check:crons-catalog
+          npm run check:agents
+          npm run check:tools
+          npm run check:docs
+
+      - name: Commit if the catalog changed
+        run: |
+          set -uo pipefail
+          git config user.name  't27 world scan'
+          git config user.email 'admin@t27.ai'
+          git add public/t27 public/skills public/crons public/agents public/tools public/functions public/docs qa/language-exceptions.json
+          if git diff --cached --quiet; then
+            echo "- no change" >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          N=$(node -e "const m=require('./public/t27/manifest.json');console.log(m.repos.length+' repositories, '+m.specCount+' specs')")
+          git commit -q -m "t27 worlds: refresh the catalog ($N)"
+          git push -q
+          echo "- committed: $N" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/website-checks.yml

@@ -109,6 +109,11 @@ jobs:
       # still refuse a spec whose own tests do not hold.
       - name: Viewport spec
         run: npm run check:viewport && npm run test:viewport-spec
+      # The world scan's contract (specs/catalog/discovery.t27 through the compiler),
+      # its pure decisions, and the manifest merge that must never touch a founding
+      # source. The scan itself runs against GitHub in t27-world-scan.yml.
+      - name: t27 world discovery
+        run: npm run check:discovery
 
       - name: Build
         run: npx vite build

apps/website/README.md

@@ -135,7 +135,7 @@ SPA `#/blog/<slug>` отдаёт 200 всегда и доказательств
 
 | Маршрут | Корпус | Откуда данные |
 |---|---|---|
-| `#/specs` | 760 спек `.t27` | `public/t27/`, вендорится `scripts/sync-t27-specs.mjs` |
+| `#/specs` | спеки `.t27` пяти исходных репозиториев и всех миров, найденных сканированием | `public/t27/`, вендорится `scripts/sync-t27-specs.mjs` и `scripts/discover-t27-worlds.mjs` |
 | `#/skills` | опубликованные скилы трёх репозиториев | `public/skills/`, вендорится `scripts/sync-skills.mjs` |
 | `#/crons` | всё, что запускается по расписанию | `public/crons/manifest.json`, `scripts/sync-crons.mjs` |
 | `#/clients` | память CRM владельца | ничего не вендорится — живой вызов `/mcp` |
@@ -198,9 +198,48 @@ Railway и из репозитория не читается — страниц
 инструменты плюс `crm_touch`, который меняет лишь нашу память. Отправка —
 в боте, после нажатия на карточку. Со страницы не уходит ничего.
 
+### Автосканирование репозиториев со спеками .t27
+
+Пять исходных репозиториев каталога (`t27`, `tri-net`, `trinity`, `trinity-fpga`,
+`tt-trinity-corona`) вендорятся вручную из локального checkout t27 скриптом
+`scripts/sync-t27-specs.mjs`: этот checkout несёт учебный курс (`specs/tutorial`,
+`hello_world`) на ветке, которой ещё нет на master t27, и пере-выгрузка «с GitHub»
+удалила бы курс с сайта. Всё остальное каталог находит сам.
+
+Контракт сканирования — спека `public/t27/files/specs/catalog/discovery.t27`
+(модуль `catalog_discovery`): какие владельцы GitHub сканируются (`OWNERS`), что
+исключается (приватные, форки, зеркало сборки `ghashtag.github.io`), что считается
+репозиторием на t27 (один из первых `PROBE_FILES` файлов `.t27` даёт компилятору
+не меньше `MIN_DECLARATIONS` объявлений — компилятор принимает любой текст как
+пустой модуль, поэтому «компилируется» ничего не доказывает), и пределы. Скрипт
+читает константы через вендоренный wasm, проверяет схему и прогоняет тесты спеки
+до первого обращения к GitHub.
+
+```bash
+npm run discover -- scan   --out /абсолютный/путь/NEW-discovery.json   # инвентари владельцев + code search, деревья, проба компилятором
+npm run discover -- vendor --report /абсолютный/путь/discovery.json    # тарболы миров, дедупликация по байтам, manifest.json
+npm run core -- index                                                   # shared-core.json
+node scripts/skills-core.mjs index && node scripts/agents-from-specs.mjs && node scripts/docs-from-specs.mjs  # каталоги, которые пиннят манифест по sha
+npm run atlas -- scan  --discovery /абсолютный/путь/discovery.json --out /абсолютный/путь/NEW-atlas.json
+npm run atlas -- build --report /абсолютный/путь/NEW-atlas.json          # universe-atlas.json — карта Queen
+npm run check:discovery                                                 # контракт: спека, решения, слияние манифеста
+```
+
+Файлы найденного мира лежат в `public/t27/files/<name>/` для репозиториев gHashTag
+(как у исходных пяти) и в `public/t27/files/<owner>/<name>/` для любого другого
+владельца; в манифесте такой мир помечен `discoveredAt`, и повторное сканирование
+заменяет его записи целиком, не трогая остальные. Отчёты сканирования не
+перезаписываются, в GitHub ничего не пишется, приватные репозитории не читаются.
+
+Расписание: `.github/workflows/t27-world-scan.yml` запускает эту цепочку раз в
+сутки, прогоняет гейты каталога и коммитит данные, как `signal-health-self.yml`
+коммитит свои числа. Публикация на t27.ai остаётся за `deploy-site.yml` — вручную,
+по правилу «контент утверждается до выхода».
+
 ### Проверки
 
 ```bash
+npm run check:discovery         # сканирование миров: контракт-спека, решения, слияние манифеста
 npm run check:skills-catalog    # каталог скилов: sha, id, связи, обратимость
 npm run check:crons-catalog     # каталог кронов: строки исходников перечитаны
 npm run check:clients-console   # безопасность консоли владельца

apps/website/package.json

@@ -5,6 +5,8 @@
   "type": "module",
   "scripts": {
     "atlas": "node --experimental-strip-types scripts/universe-atlas.mjs",
+  "discover": "node scripts/discover-t27-worlds.mjs",
+  "check:discovery": "node --experimental-strip-types qa/t27-world-discovery.mjs",
     "check:queen-atlas": "node --experimental-strip-types qa/queen-universe-atlas.mjs",
     "check:queen-treasury": "node --experimental-strip-types qa/queen-spec-treasury.mjs",
     "check:queen-catalog": "node --experimental-strip-types qa/queen-catalog-hive.mjs",

apps/website/public/skills/skills-core.json

@@ -1 +1 @@
-{"version":1,"provenance":{"manifestSha256":"77041c2fff42fe594a45d1df412c22df5b2c7e15befa7d191ea11fc42e041c30","specManifestSha256":"37c643f81392d9807160968671d1b559381dcd3e24a471cda1f5f7f3a61c4d8e","indexerSha256":"e7ad55414d2d48fa05cc7e2619af06bc4d3c82d6018c8a373adf3dc7402faff3"},"skillCount":26,"coverage":{"skillsBound":["t27/tri","t27/tri-pipeline","t27/wrap-up"],"skillsUnbound":["t27/measure-corpus","t27/phi-loop","t27/wave-audit","trinity/blog-post","trinity/board-sync","trinity/cloud","trinity/doctor","trinity/farm-garden","trinity/fpga-synth","trinity/god-mode","trinity/implement-issue","trinity/queen-hive-visuals","trinity/review-code","trinity/run-tests","trinity/scholar","trinity/status","trinity/tech-tree","trinity/tri","trinity/trinity-test","trinity/ux-wave","trinity/vibee-gen","trinity/vsa-verify","trinity/wave"],"skillsBroken":[],"specsWithSkill":["compiler/skill/registry.t27","specs/automation/wrapup-auto.t27","specs/pipeline/e2e_test.t27"],"specsWithoutSkill":757,"baselineUnbound":23},"skillToSpecs":{"t27/tri":["compiler/skill/registry.t27"],"t27/tri-pipeline":["specs/pipeline/e2e_test.t27"],"t27/wrap-up":["specs/automation/wrapup-auto.t27"]},"specToSkills":{"compiler/skill/registry.t27":["t27/tri"],"specs/automation/wrapup-auto.t27":["t27/wrap-up"],"specs/pipeline/e2e_test.t27":["t27/tri-pipeline"]}}
+{"version":1,"provenance":{"manifestSha256":"77041c2fff42fe594a45d1df412c22df5b2c7e15befa7d191ea11fc42e041c30","specManifestSha256":"4970a54d1cc7fc3954c66a9a11f885d7b2b4633614618f7896adb94cb3589e28","indexerSha256":"e7ad55414d2d48fa05cc7e2619af06bc4d3c82d6018c8a373adf3dc7402faff3"},"skillCount":26,"coverage":{"skillsBound":["t27/tri","t27/tri-pipeline","t27/wrap-up"],"skillsUnbound":["t27/measure-corpus","t27/phi-loop","t27/wave-audit","trinity/blog-post","trinity/board-sync","trinity/cloud","trinity/doctor","trinity/farm-garden","trinity/fpga-synth","trinity/god-mode","trinity/implement-issue","trinity/queen-hive-visuals","trinity/review-code","trinity/run-tests","trinity/scholar","trinity/status","trinity/tech-tree","trinity/tri","trinity/trinity-test","trinity/ux-wave","trinity/vibee-gen","trinity/vsa-verify","trinity/wave"],"skillsBroken":[],"specsWithSkill":["compiler/skill/registry.t27","specs/automation/wrapup-auto.t27","specs/pipeline/e2e_test.t27"],"specsWithoutSkill":853,"baselineUnbound":23},"skillToSpecs":{"t27/tri":["compiler/skill/registry.t27"],"t27/tri-pipeline":["specs/pipeline/e2e_test.t27"],"t27/wrap-up":["specs/automation/wrapup-auto.t27"]},"specToSkills":{"compiler/skill/registry.t27":["t27/tri"],"specs/automation/wrapup-auto.t27":["t27/wrap-up"],"specs/pipeline/e2e_test.t27":["t27/tri-pipeline"]}}