feat(agents): configure the repo for the mattpocock engineering skills

.claude/CLAUDE.md

@@ -328,3 +328,20 @@ fine for both: Bazel namespaces its output base by workspace path, and the modul
 content-addressed. It does mean a mount-target change is visible from other worktrees' running
 containers, which still mount the old volume at the old path — a volume's content is shared, its
 mount point is per-container.
+
+## Agent skills
+
+### Issue tracker
+
+Issues live in GitHub Issues on `Syndic/unnatural_designs`, driven via the `gh` CLI. See
+`docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+The five canonical triage roles, each label string equal to its name. See
+`docs/agents/triage-labels.md`.
+
+### Domain docs
+
+Multi-context: a root `CONTEXT-MAP.md` points at a per-context `CONTEXT.md`, one per Bazel package
+tree. See `docs/agents/domain.md`.

CONTEXT-MAP.md

@@ -0,0 +1,56 @@
+# Context Map
+
+This repo is multi-context. A context is a Bazel package tree under one of the top-level
+directories in the [README](README.md), not a directory under `src/`. See
+[`docs/agents/domain.md`](docs/agents/domain.md) for how the engineering skills consume this file.
+
+Each context owns its own `CONTEXT.md` (its glossary) and its own `docs/adr/` (decisions scoped to
+it). Repo-wide decisions live in `docs/adr/`.
+
+## Contexts
+
+- **Network infrastructure maintenance** — `tools/network_infrastructure_maintenance/`
+  _(`CONTEXT.md` not yet written)_
+
+  A home network modelled in [NetBox](https://netboxlabs.com/products/netbox/) and controlled by
+  [UniFi Network](https://unifi.ui.com/). This is the only context with a domain in the modelling
+  sense — devices, cables, IP addressing, VRFs, PoE budgets, DHCP reservations.
+
+  **Built:** `cmd/netbox_audit`, which validates the NetBox model for internal consistency. It is
+  the context's only binary.
+
+  **Planned, not built:** drift detection between NetBox's intended state and the live UniFi
+  controller, and a NetBox → UniFi sync. The tool's README describes both with their command names
+  still elided, so neither has a name yet, let alone code.
+
+  The vocabulary above describes the modelled network, not the set of tools that exist against it.
+  Treat a request for anything under "planned" as unimplemented: a redundancy check that matched a
+  request against this domain language would otherwise close a real one as already-done.
+
+- **Repo meta** — `meta/`
+  _(`CONTEXT.md` not yet written)_
+
+  The monorepo's own automation: `meta/scripts/` (pre-commit checks, changed-path classification,
+  Renovate proposal ratification and manual-job triggering, base-image pin sync) and
+  `meta/devcontainer-base/` (the shared devcontainer base image, whose README is the canonical home
+  for the container plumbing this repo and `Syndic/.dotfiles` both consume).
+
+## Relationships
+
+- **Repo meta → every other context**: build-time and CI-time only. `meta/` operates on the
+  repository as an artifact — its files, its lockfiles, its container — and shares no domain
+  language with what the code inside those contexts is about. A change in one is not expected to
+  move the vocabulary of the other.
+
+## Not yet contexts
+
+`//apps/`, `//libs/`, `//services/`, and `//infra/` are scaffolding: each carries a `BUILD.bazel`
+holding nothing but a one-line comment. Add a `CONTEXT.md` under one when it gains code, and
+register it above in the same change.
+
+## Not a context
+
+`//platforms/` does hold code — the three `platform()` definitions `.bazelrc` selects with
+`--config=linux_x86_64`, `--config=linux_arm64`, and `--config=darwin_arm64` — but it is build
+configuration rather than a domain. Three constraint tuples carry no vocabulary to model and no
+decisions to record, so it gets no `CONTEXT.md` and is not expected to grow one.

docs/agents/domain.md

@@ -0,0 +1,59 @@
+# Domain Docs
+
+How the engineering skills should consume this repo's domain documentation when exploring the
+codebase.
+
+## Before exploring, read these
+
+- **`CONTEXT-MAP.md`** at the repo root: it points at one `CONTEXT.md` per context. Read each one
+  relevant to the topic.
+- **`docs/adr/`**: system-wide architectural decisions.
+- **`<context>/docs/adr/`**: decisions scoped to a single context.
+
+If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest
+creating them upfront. The `/domain-modeling` skill (reached via `/grill-with-docs` and
+`/improve-codebase-architecture`) creates them lazily when terms or decisions actually get resolved.
+
+Note that `.claude/CLAUDE.md` is a separate artifact and is not a substitute for a `CONTEXT.md`: it
+carries cross-cutting engineering invariants (CI, devcontainer, Renovate plumbing), not the domain
+glossary.
+
+## File structure
+
+This repo is multi-context. A context is a Bazel package tree under one of the top-level
+directories documented in the README (`//apps/`, `//libs/`, `//services/`, `//tools/`, `//infra/`,
+`//meta/`, `//platforms/`), not a directory under `src/`.
+
+```
+/
+├── CONTEXT-MAP.md                                  ← points at each context's CONTEXT.md
+├── docs/adr/                                       ← system-wide decisions
+├── meta/
+│   ├── CONTEXT.md
+│   └── docs/adr/
+└── tools/network_infrastructure_maintenance/
+    ├── CONTEXT.md
+    └── docs/adr/
+```
+
+Which directories are contexts, which are scaffolding awaiting one, and which will never be one is
+recorded in `CONTEXT-MAP.md`. Add a context's `CONTEXT.md` when that context gains code, and
+register it there in the same change.
+
+Markdown docs are not Bazel targets, so adding one needs no `BUILD.bazel` edit. If a test ever reads
+one as data, add it to an `exports_files` block in that package.
+
+## Use the glossary's vocabulary
+
+When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a
+test name), use the term as defined in the relevant `CONTEXT.md`. Don't drift to synonyms the
+glossary explicitly avoids.
+
+If the concept you need isn't in the glossary yet, that's a signal: either you're inventing language
+the project doesn't use (reconsider) or there's a real gap (note it for `/domain-modeling`).
+
+## Flag ADR conflicts
+
+If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
+
+> _Contradicts ADR-0007 (event-sourced orders), but worth reopening because…_

docs/agents/issue-tracker.md

@@ -0,0 +1,50 @@
+# Issue tracker: GitHub
+
+Issues and specs for this repo live as GitHub issues. Use the `gh` CLI for all operations.
+
+## Conventions
+
+- **Create an issue**: `gh issue create --title "..." --body "..."`. Use a heredoc for multi-line bodies.
+- **Read an issue**: `gh issue view <number> --comments`, filtering comments by `jq` and also fetching labels.
+- **List issues**: `gh issue list --state open --json number,title,body,labels,comments --jq '[.[] | {number, title, body, labels: [.labels[].name], comments: [.comments[].body]}]'` with appropriate `--label` and `--state` filters.
+- **Comment on an issue**: `gh issue comment <number> --body "..."`
+- **Apply / remove labels**: `gh issue edit <number> --add-label "..."` / `--remove-label "..."`
+- **Close**: `gh issue close <number> --comment "..."`
+
+Infer the repo from `git remote -v`; `gh` does this automatically when run inside a clone. Here
+that resolves to `Syndic/unnatural_designs`.
+
+Run `gh` on the **host**, not via `devcontainer exec`: this repo's rule that all tooling runs in
+the devcontainer carves out read-side `git` and `gh` as host commands, and the host holds the
+authenticated `gh` session.
+
+## Pull requests as a triage surface
+
+**PRs as a request surface: no.** _(Set to `yes` if this repo treats external PRs as feature requests; `/triage` reads this flag.)_
+
+When set to `yes`, PRs run through the same labels and states as issues, using the `gh pr` equivalents:
+
+- **Read a PR**: `gh pr view <number> --comments` and `gh pr diff <number>` for the diff.
+- **List external PRs for triage**: `gh pr list --state open --json number,title,body,labels,author,authorAssociation,comments` then keep only `authorAssociation` of `CONTRIBUTOR`, `FIRST_TIME_CONTRIBUTOR`, or `NONE` (drop `OWNER`/`MEMBER`/`COLLABORATOR`).
+- **Comment / label / close**: `gh pr comment`, `gh pr edit --add-label`/`--remove-label`, `gh pr close`.
+
+GitHub shares one number space across issues and PRs, so a bare `#42` may be either: resolve with `gh pr view 42` and fall back to `gh issue view 42`.
+
+## When a skill says "publish to the issue tracker"
+
+Create a GitHub issue.
+
+## When a skill says "fetch the relevant ticket"
+
+Run `gh issue view <number> --comments`.
+
+## Wayfinding operations
+
+Used by `/wayfinder`. The **map** is a single issue with **child** issues as tickets.
+
+- **Map**: a single issue labelled `wayfinder:map`, holding the Notes / Decisions-so-far / Fog body. `gh issue create --label wayfinder:map`.
+- **Child ticket**: an issue linked to the map as a GitHub sub-issue (`gh api` on the sub-issues endpoint). Where sub-issues aren't enabled, add the child to a task list in the map body and put `Part of #<map>` at the top of the child body. Labels: `wayfinder:<type>` (`research`/`prototype`/`grilling`/`task`). Once claimed, the ticket is assigned to the driving dev.
+- **Blocking**: GitHub's **native issue dependencies**, the canonical, UI-visible representation. Add an edge with `gh api --method POST repos/<owner>/<repo>/issues/<child>/dependencies/blocked_by -F issue_id=<blocker-db-id>`, where `<blocker-db-id>` is the blocker's numeric **database id** (`gh api repos/<owner>/<repo>/issues/<n> --jq .id`, _not_ the `#number` or `node_id`). GitHub reports `issue_dependencies_summary.blocked_by` (open blockers only, the live gate). Where dependencies aren't available, fall back to a `Blocked by: #<n>, #<n>` line at the top of the child body. A ticket is unblocked when every blocker is closed.
+- **Frontier query**: list the map's open children (`gh issue list --state open`, scoped to the map's sub-issues / task list), drop any with an open blocker (`issue_dependencies_summary.blocked_by > 0`, or an open issue in the `Blocked by` line) or an assignee; first in map order wins.
+- **Claim**: `gh issue edit <n> --add-assignee @me`, the session's first write.
+- **Resolve**: `gh issue comment <n> --body "<answer>"`, then `gh issue close <n>`, then append a context pointer (gist + link) to the map's Decisions-so-far.

docs/agents/triage-labels.md

@@ -0,0 +1,13 @@
+# Triage Labels
+
+The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
+
+| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
+| -------------------------- | -------------------- | ---------------------------------------- |
+| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
+| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
+| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
+| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
+| `wontfix`                  | `wontfix`            | Will not be actioned                     |
+
+When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.