Add marketing site (/site) + agent-os toolkit + Pages workflow

.github/workflows/pages.yml

@@ -0,0 +1,41 @@
+# @recall.works | .github/workflows/pages.yml | v1.0 | 2026-05-08 | deploy /site to GitHub Pages on push
+name: Deploy site to GitHub Pages
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'site/**'
+      - '.github/workflows/pages.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Pages
+        uses: actions/configure-pages@v5
+
+      - name: Upload site artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: ./site
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

agent-os/.gitignore

@@ -0,0 +1,45 @@
+# OS / editor noise
+.DS_Store
+Thumbs.db
+*.swp
+*.swo
+*~
+.vscode/
+.idea/
+
+# Local config — never commit
+config.json
+.env
+.env.*
+!.env.example
+
+# Generated state
+state/
+logs/
+*.log
+*.bak
+*.bak-*
+.spend-gate-last
+.qwen-killswitch
+.vault-killswitch
+
+# Local model state
+ollama/
+*.gguf
+
+# Local-only secrets (paranoia layer)
+*.key
+*.pem
+*-key.txt
+.vault-key.txt
+
+# Sealed backups (never commit, never search)
+*.SEALED.zip
+_sealed-*/
+
+# Build / scratch
+_scratch/
+_build/
+node_modules/
+__pycache__/
+*.pyc

agent-os/LICENSE

@@ -0,0 +1,25 @@
+MIT License
+
+Copyright (c) 2026 Steve Paltridge / Recall™
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+The "Recall" word mark is a trademark of Steve Paltridge (application
+pending). Use of the mark in derivative works or republished material should
+acknowledge the source. Use of the code is fully unrestricted under MIT.

agent-os/README.md

@@ -0,0 +1,76 @@
+<!-- @wbx-modified copilot-a3f7·MTN | 2026-05-07 | initial Recall · Agent OS public README | prev: (new) -->
+
+# Recall™ · Agent OS
+
+**A reference architecture for durable AI coding work.**
+
+When AI coding agents stay long enough to do real work, they hit three walls:
+
+1. **Statelessness** — every conversation starts cold; memory is whatever the host platform decides to keep.
+2. **Cost** — autonomous loops can burn tokens or cloud spend faster than you can intervene.
+3. **Audit** — what survives is the chat scrollback, until an opaque summarizer compacts it.
+
+Agent OS is six composable pillars and a small set of conventions that turn any AI coding agent into a contractor with a project log instead of a goldfish.
+
+> Read the whitepaper: **<https://recall.works/agent-os>**
+> _(or open `site/agent-os.html` locally — same content, no internet required)_
+
+---
+
+## What this repo contains
+
+```
+agent-os/
+├── README.md           ← you are here
+├── LICENSE             ← MIT
+├── config.example.json ← copy to config.json and edit
+├── bootstrap.ps1       ← Windows install: dirs + scheduled tasks + templates
+├── install.sh          ← cross-platform follow-up (v0.2)
+├── bin/                ← reference-implementation scripts (PowerShell, no deps)
+├── templates/          ← starter memory files (routing, audit-trail, REVIVAL)
+├── brain/              ← networked-brain container blueprint (v0.2)
+└── docs/               ← QUICKSTART + design notes
+```
+
+## Status
+
+**v0.1 · seed.** This is the initial public skeleton. The whitepaper is finished. The reference scripts work in place (running in production at the originating workstation right now). What's published here is being de-personalized — names, paths, account IDs being replaced by config knobs — one script at a time. Each script's header tells you whether it's `READY` or still has a `TODO: de-personalize` notice.
+
+Pull requests welcome. Issues welcome. The pattern is what matters; the code is one valid implementation.
+
+## Get the bits
+
+Three options, ordered by ambition:
+
+**1. Read the whitepaper, build your own.** Everything you need is at <https://recall.works/agent-os>. The pattern is the deliverable.
+
+**2. Copy a script, run it on your machine.** Every script in `bin/` is self-contained PowerShell with a parameter block at the top. No global state, no install ceremony.
+
+**3. Bootstrap the whole thing.**
+
+```powershell
+# Windows / PowerShell 7+
+git clone https://github.com/recall-works/agent-os
+cd agent-os
+cp config.example.json config.json
+# edit config.json — set workspace path, storage account, ceiling
+.\bootstrap.ps1
+```
+
+That registers the scheduled tasks, drops the memory templates into the spot your editor's memory tool reads from, and runs a self-test of the spend gate.
+
+## What's not here yet
+
+- The brain container (networked vector recall) — design notes in `brain/README.md`, full Docker image in v0.2.
+- Bash / macOS bootstrap — coming with v0.2.
+- Multi-agent coordination wedge (`claim` / `release` / `handoff`) — drops in on top of the brain layer; v0.3.
+
+## License
+
+MIT (see `LICENSE`). Use this however you want. Attribution to **Recall™** appreciated.
+
+## Why "Recall"?
+
+Because the whole architecture is built around one question: *what does the agent recall when it sits down tomorrow?* If the answer is "whatever VS Code felt like keeping," you have a problem. Recall makes the answer "exactly what you wrote down on purpose."
+
+— Steve Paltridge · <https://recall.works>

agent-os/bin/_README.md

@@ -0,0 +1,40 @@
+# Recall · Agent OS — bin/
+
+Reference implementation scripts. PowerShell 7+, no dependencies beyond what
+your platform already needs (Azure CLI for vault scripts, ollama for qwen
+scripts).
+
+Every script:
+
+- reads `config.json` from the repo root (or the path passed via `-Config`)
+- honors a kill-switch file (path defined in `config.json`)
+- can run in `-DryRun` mode where applicable
+- exits non-zero on any failure (fail-closed)
+
+| Script                       | Purpose                                                          | Status |
+|------------------------------|------------------------------------------------------------------|--------|
+| `spend-gate.ps1`             | Provider-side cost ceiling check (fail-closed)                   | READY  |
+| `vault-sync.ps1`             | Nightly snapshot of workspace + memory dir to draft container    | READY  |
+| `vault-promote.ps1`          | Weekly sweep of >N-day draft blobs into WORM vault container     | READY  |
+| `brain-snapshot.ps1`         | Weekly zip of brain state → vault + sealed local copy            | READY  |
+| `mark-touched.ps1`           | Log a folder so vault-sync picks it up next run                  | READY  |
+| `transcript-tail.ps1`        | Locate active editor transcript and emit last N KB               | READY  |
+| `qwen-rolling-summary.ps1`   | Periodic local-model summary of active session → memory dir      | READY  |
+| `qwen-coldstart.ps1`         | One-shot orientation brief from memory + newest revival doc      | READY  |
+| `latest-revival.ps1`         | Print newest revival doc, qwen-compressed if >24h old            | READY  |
+
+## Conventions
+
+- All `*.ps1` files take a `-Config <path>` parameter (default: `..\config.json`).
+- All log files land under `..\logs\` (gitignored).
+- All state files (last-call timestamps, etc.) land under `..\state\`.
+- All scripts accept `-DryRun` where it makes sense.
+
+## Adapting to your environment
+
+The originals at `c:\Dev\tools\` (in the originating workstation) had hard-coded
+paths and account names. The public versions read everything from `config.json`.
+
+If you're porting these to bash/zsh, the public-facing logic is intentionally
+small — each script under 200 lines. The PowerShell sugar is mostly
+`Invoke-RestMethod` and `azcopy` orchestration.

agent-os/bin/brain-snapshot.ps1

@@ -0,0 +1,97 @@
+# @recall.works/agent-os | brain-snapshot.ps1 | v1.0
+# Weekly zip of the brain's persistent state -> WORM vault + sealed local copy.
+# The "brain" is whatever vector store you're running (ChromaDB, Qdrant, etc.).
+# This script captures its data dir verbatim.
+#
+# Usage:  pwsh ./brain-snapshot.ps1 [-Config ../config.json] [-DryRun]
+
+[CmdletBinding()]
+param(
+    [string] $Config = (Join-Path $PSScriptRoot '..\config.json'),
+    [switch] $DryRun
+)
+
+$ErrorActionPreference = 'Stop'
+
+if (-not (Test-Path $Config)) { Write-Error "config not found: $Config"; exit 2 }
+$cfg = Get-Content $Config -Raw | ConvertFrom-Json
+$repoRoot = Split-Path $Config
+
+$kill = Join-Path $repoRoot $cfg.spendGate.killSwitchFile
+if (Test-Path $kill) { Write-Error "brain-snapshot ABORT: kill switch present"; exit 99 }
+& (Join-Path $PSScriptRoot 'spend-gate.ps1') -Config $Config -Quiet
+if ($LASTEXITCODE -ne 0 -and -not $DryRun) { Write-Error "brain-snapshot ABORT: spend-gate denied"; exit 98 }
+
+# --- inputs ---
+# By convention, brain state lives at <secondary>/brain/store or you set it explicitly.
+$brainSrc = if ($cfg.brain.stateDir) {
+    [System.Environment]::ExpandEnvironmentVariables($cfg.brain.stateDir)
+} else {
+    Join-Path ([System.Environment]::ExpandEnvironmentVariables($cfg.workspace.secondary)) 'brain\store'
+}
+if (-not (Test-Path $brainSrc)) { Write-Error "brain source not found: $brainSrc (set 'brain.stateDir' in config.json)"; exit 3 }
+
+$sealedDir = Join-Path $repoRoot 'state\sealed-brain-backups'
+if (-not (Test-Path $sealedDir)) { New-Item -ItemType Directory -Path $sealedDir -Force | Out-Null }
+
+# Sentinel files
+$donot = Join-Path $sealedDir 'DO-NOT-READ.txt'
+if (-not (Test-Path $donot)) {
+@'
+SEALED COLD-STORAGE BRAIN BACKUPS.
+
+DO NOT READ. DO NOT INDEX. DO NOT TREAT AS LIVE STATE.
+
+These zips are renamed .SEALED.zip on purpose so the agent does not
+mistake them for active brain content. Live brain is your container/
+service. Authoritative cold-copy is in the WORM vault. These local zips
+exist only as last-resort keepsake.
+
+To restore: rename .SEALED.zip -> .zip, expand to a fresh location,
+verify integrity manually before pointing services at it.
+'@ | Set-Content -Path $donot -Encoding UTF8
+}
+'*' | Set-Content -Path (Join-Path $sealedDir '.gitignore') -Encoding ASCII
+
+$ts = Get-Date -Format 'yyyy-MM-dd_HHmmss'
+$zipPath = Join-Path $sealedDir "brain-$ts.SEALED.zip"
+
+"==== brain-snapshot $ts ===="
+"src:    $brainSrc"
+"sealed: $zipPath"
+
+if ($DryRun) { "DRYRUN: would zip + upload + rotate"; exit 0 }
+
+# Stage with excludes (.venv, __pycache__, *.tmp)
+$tempStage = Join-Path $env:TEMP "brain-stage-$ts"
+New-Item -ItemType Directory -Path $tempStage | Out-Null
+$excludes = @('.venv','__pycache__','tmp','*.tmp')
+robocopy $brainSrc $tempStage /E /XD ($excludes | ForEach-Object { Join-Path $brainSrc $_ }) /NFL /NDL /NJH /NJS /NC /NS /NP | Out-Null
+if ($LASTEXITCODE -ge 8) { Write-Error "robocopy failed: $LASTEXITCODE"; Remove-Item $tempStage -Recurse -Force; exit 4 }
+
+Compress-Archive -Path "$tempStage\*" -DestinationPath $zipPath -CompressionLevel Optimal
+Remove-Item $tempStage -Recurse -Force
+
+$zipMB = [math]::Round((Get-Item $zipPath).Length / 1MB, 2)
+"sealed local: $zipPath ($zipMB MB)"
+
+# Upload to vault
+$SA      = $cfg.vault.storageAccount
+$vault   = $cfg.vault.vaultContainer
+$keyFile = Join-Path $repoRoot $cfg.vault.keyFile
+$KEY = (Get-Content $keyFile -Raw).Trim() -replace '^KEY=',''
+$expiry = (Get-Date).ToUniversalTime().AddHours(2).ToString('yyyy-MM-ddTHH:mm:ssZ')
+$sas = az storage container generate-sas --account-name $SA --account-key $KEY --name $vault `
+       --permissions rwc --expiry $expiry --https-only -o tsv
+$remote = "https://$SA.blob.core.windows.net/$vault/brain/snap-$ts/brain.zip?$sas"
+azcopy copy $zipPath $remote --log-level WARNING
+if ($LASTEXITCODE -ne 0) { Write-Error "azcopy failed: $LASTEXITCODE"; exit 5 }
+"vault uploaded: $vault/brain/snap-$ts/brain.zip"
+
+# Rotate sealed local: keep newest 2
+Get-ChildItem $sealedDir -Filter 'brain-*.SEALED.zip' |
+    Sort-Object LastWriteTime -Descending |
+    Select-Object -Skip 2 |
+    ForEach-Object { "rotating out (local): $($_.Name)"; Remove-Item $_.FullName -Force }
+
+"==== brain-snapshot complete ===="