Add Universal Pad managed files

.agents/skills/pad-engineering/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: pad-engineering
+description: Universal Pad engineering orchestration — specify Work and Plans, enforce Ready/Done evidence, run verify wrappers, and hand off without chat history.
+---
+
+# Pad Engineering
+
+Use this skill for non-trivial local agentic engineering. Keep Pad's official `pad` skill for CLI/MCP mechanics. This skill overrides routing that would create Ideas or Tasks.
+
+Git owns code. CI owns verification. Pad owns intent, scope, status, dependencies, decisions, evidence, and handoffs.
+
+## Collections
+
+Use only:
+
+- `work` — Feature, Bug, Refactor, Investigation, Maintenance
+- `plans` — multi-ticket containers only
+
+Never create Ideas, Tasks, Docs-as-tickets, chores, or extra default types unless the user is explicitly asking for a document. Do not run `onboard`.
+
+Machine status values: `backlog`, `ready`, `in-progress`, `blocked`, `review`, `done`.
+Risk: `r0`, `r1`, `r2`, `r3`.
+
+Always pass `--workspace <slug>` from `.pad.toml`. Always reference items by issue ID.
+
+## Ticket body
+
+New Work items MUST start from the canonical Work template. Plans use the Plan template. Required sections must be filled before `ready`. Dependencies are Pad `blocked-by` / `blocks` links, not a prose status field.
+
+Before changing status, lint the ticket:
+
+```bash
+python3 -m pad_universal lint --ref WORK-1 --workspace <slug>
+```
+
+If the pad-universal package is not on `PYTHONPATH`, run the same linter from the pad-universal checkout. A ticket that fails the linter is not `ready` or `done`.
+
+## Lifecycle
+
+1. Specify until `ready` (playbook `specify`)
+2. Reproduce or add failing coverage when practical
+3. Implement the smallest coherent change (`implement`)
+4. `scripts/verify-fast` then `scripts/verify`
+5. Independent adversarial review for r2/r3 (`review`)
+6. Fix findings and re-verify
+7. Record evidence (`evidence`) or a handoff (`handoff`)
+
+Do not begin material implementation before the ticket is `ready`.
+
+## Routing
+
+- "new feature/bug/refactor/investigation/maintenance" → create Work with the matching `type`
+- "plan this" / multi-ticket objective → create Plan, then `decompose` into Work
+- "what's ready?" → `pad item list work --status ready --workspace <slug>`
+- Do not treat `pad project ready` as the Ready gate
+- Status changes always include `--comment` explaining why
+
+## Hard rules
+
+- Do not expand scope silently
+- Do not delete or weaken tests to pass verification
+- Do not claim checks passed when they were not run
+- Do not mark `done` without completion evidence
+- Record consequential decisions with `pad item decide`
+- Incomplete work needs a handoff a fresh agent can resume
+- Follow `PROJECT_AGENT.md` for repository invariants

.pad.toml

@@ -1 +1 @@
-workspace = "build-trilemma"
+workspace = "build-trilemma-engineering"

.pad/universal.lock.json

@@ -0,0 +1,12 @@
+{
+  "files": {
+    ".agents/skills/pad-engineering/SKILL.md": "07b6a8d2255834a6e5c97daffa14781b87977fdd2f6b74fbdab5c56086c5a4b2",
+    "AGENTS.md": "8e0e7df28f0df8d847f4981da0978c28c2c9615b0382c3bfc62c6af90a52f6b1",
+    "PROJECT_AGENT.md": "2fe79a13ae6401696119f058bb985c7e5b0fa2ad7fadf864fe151f11beacf84b",
+    "scripts/verify": "f0d9901c69d77a47f084a6cf64176e89a31f0618b8ef6d85bb984b649e0f1b31",
+    "scripts/verify-fast": "ac5cb87f802f3b4142c015643ed951327ecea8f46bb61d503afe248a35e51172"
+  },
+  "repository": "foundation-build",
+  "version": "1.0.0",
+  "workspace": "build-trilemma-engineering"
+}

AGENTS.md

@@ -1,5 +1,43 @@
-# Repository agent notes
+# Agent entry point
 
-This file is for people and coding agents working in this repository. The published site agent entrypoint is [`static/AGENTS.md`](static/AGENTS.md) (served at `/AGENTS.md`). Edit that file when changing the public agent contract.
+This repository uses the Universal Pad specification for non-trivial agentic work.
 
-Before finishing work, run `npm run check`. Fix lint, type, and test failures yourself unless a human decision is required.
+**Git** is the source of truth for code. **CI** is the source of truth for verification. **Pad** is the source of truth for intent, scope, status, dependencies, decisions, evidence, and handoffs.
+
+Read [`PROJECT_AGENT.md`](PROJECT_AGENT.md) before implementation. It holds repository-specific invariants, stack notes, and the native verification commands wrapped by `scripts/verify-fast` and `scripts/verify`.
+
+## Work
+
+Use Pad collections **Work** and **Plans** only.
+
+Work types: Feature, Bug, Refactor, Investigation, Maintenance. Plans are multi-ticket containers only.
+
+Statuses (machine values): `backlog`, `ready`, `in-progress`, `blocked`, `review`, `done`.
+
+Risk: `r0` (trivial), `r1` (normal), `r2` (consequential), `r3` (critical).
+
+Do not create Ideas, Tasks, chores, or extra default types. Do not run the Pad onboard playbook.
+
+## Lifecycle
+
+specify → test/reproduce → implement → targeted verification → full verification → adversarial review → fix findings → re-verify → CI → evidence → done
+
+Do not start material implementation until the ticket is `ready`: intended behavior, invariants, regression surface, and verification are specified.
+
+Implement the smallest coherent change. Do not silently expand scope. Put unrelated work in a new Pad ticket.
+
+## Verification
+
+Development feedback: `scripts/verify-fast`
+
+Completion gate: `scripts/verify`
+
+A ticket is not `done` while required verification is failing or unrun. Record why if a required command cannot run.
+
+## Evidence and handoffs
+
+Record decisions with `pad item decide`. Represent blockers as Pad dependencies, not prose.
+
+Incomplete work must include a handoff a fresh agent can resume without chat history.
+
+R2/R3 work needs independent adversarial review before `done`.

PROJECT_AGENT.md

@@ -0,0 +1,5 @@
+# Repository agent notes
+
+This file is for people and coding agents working in this repository. The published site agent entrypoint is [`static/AGENTS.md`](static/AGENTS.md) (served at `/AGENTS.md`). Edit that file when changing the public agent contract.
+
+Before finishing work, run `npm run check`. Fix lint, type, and test failures yourself unless a human decision is required.

scripts/verify

@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")/.."
+npm run check

scripts/verify-fast

@@ -0,0 +1,4 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")/.."
+npm run check:fast