feat: Implement dynamic North Star and mission config

.aider.input.history

@@ -0,0 +1,25 @@
+
+# 2026-03-27 12:22:10.097288
++You are operating on the steward repo. Do NOT edit any Python files unless explicitly stated.
++
++RECON FIRST: Before proposing any changes, read these files in order:
++1. steward/federation_relay.py
++2. steward/hooks/dharma.py  
++3. steward/hooks/moksha.py
++4. .github/workflows/steward-heartbeat.yml
++
++TASK: The NADI return path from agent-city to steward is broken.
++agent-city now writes heartbeat messages to data/federation/nadi_outbox.json
++and the agent-city heartbeat workflow copies that file to
++nadi/agent-city_to_steward.json in kimeisele/steward-federation.
++
++steward's federation_relay.py already has pull_from_hub() which reads
++nadi/*_to_steward.json files from steward-federation. Verify this is
++actually wired and being called in the DHARMA phase hook.
++
++If it is already wired correctly, report that clearly and stop.
++If it is NOT wired or has a gap, describe exactly what is missing
++before touching anything. Then fix only the gap — no rewrites.
+
+# 2026-03-27 12:22:13.452809
++a

.devcontainer/devcontainer.json

@@ -0,0 +1,28 @@
+{
+  "name": "steward-agent",
+  "image": "mcr.microsoft.com/devcontainers/python:3.12",
+  "postCreateCommand": "pip install -e '.[dev]' && pip install -e '.[providers]'",
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "ms-python.python",
+        "charliermarsh.ruff"
+      ],
+      "settings": {
+        "python.testing.pytestEnabled": true,
+        "python.testing.pytestArgs": ["tests"],
+        "[python]": {
+          "editor.defaultFormatter": "charliermarsh.ruff",
+          "editor.formatOnSave": true
+        }
+      }
+    }
+  },
+  "features": {
+    "ghcr.io/devcontainers/features/github-cli:1": {}
+  },
+  "containerEnv": {
+    "PYTHONDONTWRITEBYTECODE": "1",
+    "PYTHONUNBUFFERED": "1"
+  }
+}

.env.example

@@ -0,0 +1,7 @@
+# Steward Agent — Free-Tier API Keys
+# Copy to .env and fill in your keys.
+# All providers are FREE TIER. No paid APIs.
+
+GOOGLE_API_KEY=your-google-api-key
+MISTRAL_API_KEY=your-mistral-api-key
+GROQ_API_KEY=your-groq-api-key

.github/workflows/ci.yml

@@ -0,0 +1,67 @@
+# Steward CI — run tests + lint + security on every push and PR
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Tests (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          pip install steward-protocol[providers]
+          pip install -e ".[providers,search,api,dev]"
+
+      - name: Run tests
+        run: python -m pytest tests/ -x -q --timeout=30
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install ruff
+        run: pip install ruff
+
+      - name: Ruff check (uses pyproject.toml config)
+        run: ruff check steward/ tests/ --output-format=github
+
+      - name: Ruff format check
+        run: ruff format --check steward/ tests/
+
+  security:
+    name: Security scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install bandit
+        run: pip install bandit
+
+      - name: Bandit security scan
+        run: bandit -r steward/ -c pyproject.toml -q

.github/workflows/post-merge.yml

@@ -0,0 +1,41 @@
+# Post-Merge — trigger heartbeat so GitSense detects the merge fast.
+#
+# Without this, steward waits up to 15 minutes (cron) to notice.
+# This workflow just kicks the heartbeat with 1 cycle — GitSense
+# detects the merge via HEAD comparison, emits OP_MERGE_OCCURRED
+# to federation, and injects POST_MERGE task. All the real work
+# happens in steward's own architecture, not here.
+
+name: Post-Merge Digest
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+
+permissions:
+  actions: write
+
+jobs:
+  notify:
+    name: Trigger steward heartbeat
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.merged == true
+    timeout-minutes: 1
+
+    steps:
+      - name: Trigger heartbeat
+        env:
+          GH_TOKEN: ${{ secrets.FEDERATION_PAT || github.token }}
+        run: |
+          gh workflow run steward-heartbeat.yml \
+            --repo "${{ github.repository }}" \
+            -f cycles=1 \
+            || echo "Heartbeat trigger failed — 15min cron will catch it"
+
+      - name: Log
+        run: |
+          echo "## Post-Merge" >> $GITHUB_STEP_SUMMARY
+          echo "- **PR**: #${{ github.event.pull_request.number }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Title**: ${{ github.event.pull_request.title }}" >> $GITHUB_STEP_SUMMARY
+          echo "Triggered heartbeat — GitSense will detect merge." >> $GITHUB_STEP_SUMMARY

.github/workflows/publish-federation.yml

@@ -0,0 +1,38 @@
+name: Publish Federation Authority Feed
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/authority/**'
+      - '.well-known/agent-federation.json'
+      - 'scripts/export_authority_feed.py'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Export authority feed
+        run: python scripts/export_authority_feed.py --output-dir .authority-feed-out --repo-id steward
+
+      - name: Publish to authority-feed branch
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git checkout --orphan authority-feed-tmp
+          git rm -rf .
+          cp -r .authority-feed-out/* .
+          git add .
+          git commit -m "authority-feed: $(git rev-parse --short HEAD~0 2>/dev/null || echo 'initial')"
+          git branch -M authority-feed-tmp authority-feed
+          git push origin authority-feed --force

.github/workflows/publish.yml

@@ -0,0 +1,77 @@
+# Publish steward to PyPI on version tags (v0.15.0, v1.0.0, etc.)
+#
+# Flow: tag push → tests pass → build → publish
+#
+# Uses Trusted Publishers (OIDC) — no API tokens needed.
+# One-time setup on https://pypi.org/manage/project/steward-agent/settings/publishing/:
+#   Owner:       kimeisele
+#   Repository:  steward
+#   Workflow:    publish.yml
+#   Environment: pypi
+
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  test:
+    name: Test before publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          pip install steward-protocol[providers]
+          pip install -e ".[providers,search,api,dev]"
+
+      - name: Run tests
+        run: python -m pytest tests/ -x -q --timeout=30
+
+  build:
+    name: Build distribution
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build wheel and sdist
+        run: python -m build
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/self-heal.yml

@@ -0,0 +1,81 @@
+# Self-Healing CI — Federation Protocol
+#
+# When CI fails, notify steward API so it can diagnose and fix.
+# This is the federation play: nodes watch each other.
+#
+# Requires:
+#   - STEWARD_API_URL secret (e.g., https://steward.example.com or http://localhost:8420)
+#   - STEWARD_API_TOKEN secret (for auth)
+#   - Steward API must be running and accessible
+#
+# The workflow:
+#   1. CI fails on push to main
+#   2. This workflow triggers on workflow_run completion
+#   3. Fetches the failure log
+#   4. Sends it to steward API as a task
+#   5. Steward diagnoses and creates a fix PR
+
+name: Self-Heal
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+
+jobs:
+  diagnose:
+    name: Diagnose CI Failure
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
+
+    steps:
+      - name: Fetch failure logs
+        id: logs
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          RUN_ID=${{ github.event.workflow_run.id }}
+          echo "CI run $RUN_ID failed. Fetching logs..."
+
+          # Get failed job logs
+          LOGS=$(gh run view $RUN_ID --repo ${{ github.repository }} --log-failed 2>/dev/null | tail -100 || echo "Could not fetch logs")
+
+          # Save to file (GitHub Actions has issues with multiline env vars)
+          echo "$LOGS" > /tmp/failure_log.txt
+
+          # Get the commit that failed
+          echo "commit=${{ github.event.workflow_run.head_sha }}" >> $GITHUB_OUTPUT
+          echo "branch=${{ github.event.workflow_run.head_branch }}" >> $GITHUB_OUTPUT
+
+      - name: Notify Steward API
+        if: ${{ env.STEWARD_API_URL != '' }}
+        env:
+          STEWARD_API_URL: ${{ secrets.STEWARD_API_URL }}
+          STEWARD_API_TOKEN: ${{ secrets.STEWARD_API_TOKEN }}
+        run: |
+          FAILURE_LOG=$(cat /tmp/failure_log.txt | head -80)
+          COMMIT="${{ steps.logs.outputs.commit }}"
+          BRANCH="${{ steps.logs.outputs.branch }}"
+
+          TASK="CI failed on branch '$BRANCH' (commit $COMMIT). Diagnose the failure and suggest a fix. Failure log:\n\n$FAILURE_LOG"
+
+          # Call steward API
+          curl -s -X POST "$STEWARD_API_URL/task" \
+            -H "Authorization: Bearer $STEWARD_API_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{\"task\": $(echo "$TASK" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))')}" \
+            --max-time 120 \
+            || echo "Steward API not reachable (expected in local-only mode)"
+
+      - name: Log failure summary
+        run: |
+          echo "## CI Failure Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "- **Run ID**: ${{ github.event.workflow_run.id }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Commit**: ${{ github.event.workflow_run.head_sha }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Branch**: ${{ github.event.workflow_run.head_branch }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Failure Log (last 50 lines)" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          tail -50 /tmp/failure_log.txt >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY