feat(topology): master topology, runner map, agent teams (61 agents)

.claude/CLAUDE.md

@@ -504,9 +504,27 @@ Based on CodeRabbit learnings (see `.claude/learnings/ui-error-handling-review-2
 - [ ] Shared utilities extracted (no duplicate functions like `ownerFromJwt`)
 - [ ] Unused imports removed
 
+## Topology & Runner Strategy
+
+**Master topology:** `pmoves/docs/operations/TOPOLOGY.md` — single source of truth for all nodes, services, routes, and DNS.
+
+**Nodes:** Z890 (dev/GPU), 5090 (primary GPU, pending), KVM4-1 (API gateway), KVM4-2 (data/storage), KVM2 (exit proxy), Cloudflare Edge (DNS/Worker).
+
+**Agent Teams (11 teams, 62 agents):** `pmoves/configs/agent-teams.yaml` — orchestration, research, media, data, ui, automation, evolution, infra, sandbox, life, external.
+
+**CI Runners:** `self-hosted, ai-lab` (GPU), `self-hosted, cloudstartup` (staging), `self-hosted, kvm4` (production), `self-hosted, kvm2` (backup), `ubuntu-latest` (lightweight). Routing via Cloudflare Worker (`deploy/cloudflare/worker.js`).
+
+**DNS:** `pmoves.ai` zone (pending Cloudflare migration). Subdomains: api, agent, rag, tts, n8n, grafana, search, nats, minio, headscale, ci.
+
+**Quick references:**
+- `.claude/context/runner-topology.md` — condensed topology for agent context
+- `pmoves/docs/operations/WORKFLOW_RUNNER_MAP.md` — all 19 GitHub Actions workflows mapped to runners
+- `deploy/HYBRID_RUNNER_STRATEGY.md` — runner fleet documentation
+
 ## Additional References
 
 See `.claude/context/` for detailed documentation:
+- `runner-topology.md` - Condensed node/runner/team topology for agent context loading
 - `credentials-workflow.md` - Credential bootstrap, env-setup, secrets-funnel, JWT-from-Supabase flow
 - `services-catalog.md` - Complete service listing with all details
 - `submodules.md` - Complete submodules catalog (20 submodules)

.claude/context/runner-topology.md

@@ -0,0 +1,66 @@
+# Runner & Topology Context (Condensed)
+
+> Quick-reference for agents. Full details: `pmoves/docs/operations/TOPOLOGY.md`
+
+## Nodes
+
+| Node | Role | Key Services | Runner |
+|------|------|-------------|--------|
+| **Z890** | Dev + GPU (3090Ti) | All (local Docker Compose) | `self-hosted, ai-lab, gpu, cuda` |
+| **5090** | Primary GPU (pending) | Future inference | (pending) |
+| **KVM4-1** | API Gateway | TensorZero, Agent Zero, Hi-RAG, Archon, Gateway Agent | `self-hosted, vps, kvm4, production` |
+| **KVM4-2** | Data/Storage | Supabase, NATS, Qdrant, Neo4j, Meilisearch, MinIO, monitoring | `self-hosted, vps, kvm4, production` |
+| **KVM2** | Exit Node | nginx (SSL termination) | `self-hosted, vps, kvm2, backup` |
+| **Cloudflare** | Edge | DNS, CI Worker | — |
+
+## Route: Public → Services
+
+```text
+Internet → Cloudflare DNS → KVM2 (nginx/SSL) → KVM4-1 (API) or KVM4-2 (data)
+```
+
+## Route: CI/CD
+
+```text
+GitHub event → CF Worker (analyzes files) → ai-lab (GPU) / vps (Docker) / ubuntu-latest (light)
+```
+
+## Agent Teams (11 teams, 62 agents)
+
+| Team | Node Affinity | CI Runner | Count |
+|------|--------------|-----------|-------|
+| orchestration | kvm4-1, z890, 5090 | ai-lab | 6 |
+| research | kvm4-1, kvm4-2, z890 | vps | 9 |
+| media | 5090, z890 | ai-lab | 11 |
+| data | kvm4-2, z890 | vps | 9 |
+| ui | z890, 5090 | ubuntu-latest | 6 |
+| automation | kvm4-1, z890 | vps | 4 |
+| evolution | 5090, z890 | ai-lab | 4 |
+| infra | kvm4-1, kvm2 | vps | 3 |
+| sandbox | cloud | ubuntu-latest | 7 |
+| life | z890 | ubuntu-latest | 2 |
+| external | N/A (CLI) | N/A | 0 agents (7 human contributors) |
+
+## DNS Subdomains (pmoves.ai)
+
+| Subdomain | Target Node | Proxy |
+|-----------|------------|-------|
+| `api.pmoves.ai` | KVM4-1 | Yes |
+| `agent.pmoves.ai` | KVM4-1 | Yes |
+| `rag.pmoves.ai` | KVM4-1 | Yes |
+| `tts.pmoves.ai` | Z890 (via Tailscale relay) | Yes |
+| `n8n.pmoves.ai` | KVM4-1 | Yes |
+| `grafana.pmoves.ai` | KVM4-2 | Yes |
+| `search.pmoves.ai` | KVM4-2 | Yes |
+| `nats.pmoves.ai` | KVM4-2 | DNS only |
+| `minio.pmoves.ai` | KVM4-2 | DNS only |
+| `headscale.pmoves.ai` | KVM2 | DNS only |
+| `ci.pmoves.ai` | CF Worker | Yes |
+
+## Key Files
+
+- `pmoves/configs/agent-teams.yaml` — Team definitions
+- `pmoves/config/agent_registry.yaml` — Full agent registry
+- `deploy/cloudflare/worker.js` — CI routing logic
+- `deploy/scripts/deploy-vps.sh` — VPS deployment
+- `pmoves/docs/operations/WORKFLOW_RUNNER_MAP.md` — All 19 workflows mapped

deploy/cloudflare/wrangler.toml

@@ -6,7 +6,7 @@ main = "worker.js"
 compatibility_date = "2025-12-08"
 workers_dev = true
 
-# Account ID (override with CLOUDFLARE_ACCOUNT_ID env var)
+# Account ID — set via CLOUDFLARE_ACCOUNT_ID env var or wrangler login
 # account_id = "your_account_id_here"
 
 # KV Namespace for build state tracking (create via: wrangler kv:namespace create "CI_STATE")
@@ -42,10 +42,20 @@ vars = { RUNNER_DISPATCH_MODE = "cloudflare-only" }
 # - CLOUDFLARE_API_TOKEN: For deploying via Workers API
 # - DISCORD_WEBHOOK_URL: Discord notification endpoint
 
-# Routes (configure after deployment)
+# Routes — uncomment after pmoves.ai zone is active in Cloudflare
 # routes = [
-#   { pattern = "ci.pmoves.ai/webhook", zone_name = "pmoves.ai" }
+#   { pattern = "ci.pmoves.ai/webhook/*", zone_name = "pmoves.ai" },
+#   { pattern = "ci.pmoves.ai/health", zone_name = "pmoves.ai" },
+#   { pattern = "ci.pmoves.ai/status", zone_name = "pmoves.ai" },
+#   { pattern = "ci.pmoves.ai/metrics", zone_name = "pmoves.ai" }
 # ]
+#
+# Secrets to set before deploy:
+#   wrangler secret put WEBHOOK_SECRET    # GitHub webhook HMAC secret
+#   wrangler secret put GITHUB_TOKEN      # GitHub PAT for PR file fetching
+#   wrangler secret put DISCORD_WEBHOOK_URL  # Discord notification endpoint
+#
+# Deploy: cd deploy/cloudflare && npm install && npx wrangler deploy
 
 # Limits
 limits = { cpu_ms = 50 }