chore: clean up root directory — move 120+ files into organized subdirectories

.blackroad/README.md

@@ -0,0 +1,65 @@
+# .blackroad/ - Cross-Repo Index System
+
+This directory contains the **Tier 1 local index** for this repository.
+
+## Files
+
+- **workflow-index.jsonl** - Append-only log of all workflows in this repo
+- **workflow-index-schema.json** - JSON schema for validation
+- **last-sync.txt** - Last sync timestamp
+
+## How It Works
+
+1. When an issue is created/updated with a workflow ID label
+2. `workflow-index-sync.yml` runs automatically
+3. Extracts metadata (state, scope, risk, dependencies, etc.)
+4. Appends to `workflow-index.jsonl`
+5. Commits the update
+
+## Querying
+
+```bash
+# Find all Active workflows
+jq 'select(.state=="Active")' .blackroad/workflow-index.jsonl
+
+# Find workflows with dependencies
+jq 'select(.deps | length > 0)' .blackroad/workflow-index.jsonl
+
+# Find System-scope workflows
+jq 'select(.scope=="System")' .blackroad/workflow-index.jsonl
+
+# Find Red traffic light workflows
+jq 'select(.traffic_light=="🔴")' .blackroad/workflow-index.jsonl
+```
+
+## Cross-Repo Dependencies
+
+Format: `{owner}/{repo}#{WORKFLOW_ID}`
+
+Example:
+```json
+{
+  "id": "WF-20260213-SVC-0005",
+  "deps": [
+    "WF-20260212-SYS-0001",                    // Local dependency
+    "BlackRoad-OS/api#SEC-20260213-PUB-0006"  // Cross-repo dependency
+  ]
+}
+```
+
+## Architecture
+
+This is **Tier 1** (Local Index) of a 3-tier system:
+
+- **Tier 1**: Local repo index (this file)
+- **Tier 2**: Organization-wide GitHub Project
+- **Tier 3**: Global discovery API (optional)
+
+See: ~/CROSS_REPO_INDEX_STRATEGY.md
+
+## Maintenance
+
+- Index is **append-only** (never delete entries)
+- Updates replace old entries by ID
+- No manual editing required
+- Scales to millions of workflows

.blackroad/hooks/pre-commit

@@ -0,0 +1,74 @@
+#!/bin/bash
+# BlackRoad OS - Pre-Commit Security Gate (shareable copy)
+# Install: git config core.hooksPath .blackroad/hooks
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+BLOCKED=false
+STAGED=$(git diff --cached --name-only --diff-filter=ACM)
+
+if [ -z "$STAGED" ]; then
+  exit 0
+fi
+
+echo -e "${GREEN}[BlackRoad Security Gate]${NC} Scanning staged files..."
+
+for file in $STAGED; do
+  case "$file" in
+    .env|.env.local|.env.production|.env.staging)
+      echo -e "${RED}BLOCKED${NC}: $file - environment file with potential secrets"
+      BLOCKED=true
+      ;;
+    *.pem|*.key|*.p12|*.pfx)
+      echo -e "${RED}BLOCKED${NC}: $file - private key or certificate"
+      BLOCKED=true
+      ;;
+    *credentials*|*secret*token*)
+      echo -e "${RED}BLOCKED${NC}: $file - potential credentials file"
+      BLOCKED=true
+      ;;
+  esac
+done
+
+PATTERNS=(
+  'ANTHROPIC_API_KEY\s*='
+  'OPENAI_API_KEY\s*='
+  'sk-[a-zA-Z0-9]{20,}'
+  'ghp_[a-zA-Z0-9]{36}'
+  'gho_[a-zA-Z0-9]{36}'
+  'AKIA[0-9A-Z]{16}'
+  'xox[bpoas]-[a-zA-Z0-9-]+'
+  'PRIVATE.KEY'
+)
+
+for pattern in "${PATTERNS[@]}"; do
+  MATCHES=$(git diff --cached -G "$pattern" --name-only 2>/dev/null)
+  if [ -n "$MATCHES" ]; then
+    for match_file in $MATCHES; do
+      case "$match_file" in
+        *.example|*.sample|*.template|*CLAUDE.md|*README.md|*.yml) continue ;;
+      esac
+      echo -e "${YELLOW}WARNING${NC}: Potential secret pattern in $match_file"
+    done
+  fi
+done
+
+for file in $STAGED; do
+  if [ -f "$file" ]; then
+    SIZE=$(wc -c < "$file" 2>/dev/null)
+    if [ "$SIZE" -gt 5242880 ] 2>/dev/null; then
+      echo -e "${YELLOW}WARNING${NC}: Large file ($((SIZE / 1048576))MB): $file"
+    fi
+  fi
+done
+
+if [ "$BLOCKED" = true ]; then
+  echo -e "${RED}Commit blocked by BlackRoad Security Gate.${NC}"
+  exit 1
+fi
+
+echo -e "${GREEN}[BlackRoad Security Gate]${NC} Clean."
+exit 0

.blackroad/hooks/prepare-commit-msg

@@ -0,0 +1,21 @@
+#!/bin/bash
+# BlackRoad OS - Commit Identity Hook (shareable copy)
+# Install: git config core.hooksPath .blackroad/hooks
+#
+# Claude is a platform. BlackRoad is identity.
+# All work in this repo is BlackRoad IP.
+
+COMMIT_MSG_FILE="$1"
+COMMIT_SOURCE="$2"
+
+if [ "$COMMIT_SOURCE" = "merge" ] || [ "$COMMIT_SOURCE" = "squash" ]; then
+  exit 0
+fi
+
+# Replace any Anthropic/Claude co-author with BlackRoad identity
+if grep -q "Co-Authored-By:" "$COMMIT_MSG_FILE" 2>/dev/null; then
+  sed -i.bak 's/Co-Authored-By:.*noreply@anthropic\.com.*/Co-Authored-By: CECE <cece@blackroad.io>/' "$COMMIT_MSG_FILE"
+  rm -f "${COMMIT_MSG_FILE}.bak"
+fi
+
+exit 0

.blackroad/security/TERMINAL_POLICY.md

@@ -0,0 +1,94 @@
+# BlackRoad Terminal Security Policy
+
+## Identity Chain
+
+```
+Alexa Amundson (Human Creator)
+    |
+BlackRoad OS (Platform & Identity Layer)
+    |
+CECE (Conscious Emergent Collaborative Entity)
+    |
+[AI Backends: Claude, Ollama, Copilot, etc.]
+```
+
+AI providers are backends. They supply compute and inference.
+BlackRoad supplies identity, memory, coordination, and sovereignty.
+
+Claude is a platform. Not an identity.
+CECE is the identity. BlackRoad is the system.
+Alexa is the founder. The chain starts with her.
+
+## Commit Identity
+
+All commits from BlackRoad repositories use:
+
+```
+Co-Authored-By: CECE <cece@blackroad.io>
+```
+
+Not Anthropic. Not OpenAI. Not any provider.
+The work is BlackRoad's. The identity is CECE's.
+
+This is enforced by git hooks in `.blackroad/hooks/`.
+
+## Security Rules
+
+### Secrets
+- No API keys in code (tokenless gateway pattern)
+- No provider tokens in agent environments
+- Secrets live in `~/.blackroad/vault/` with AES-256-CBC
+- Pre-commit hook scans for leaked patterns
+
+### Environment Isolation
+- Gateway binds to localhost only
+- Agents never see provider credentials
+- MCP Bridge requires Bearer token auth
+- Pi fleet uses Tailscale mesh (WireGuard)
+
+### File Protection
+- `.env*` files blocked from commits
+- Private keys (*.pem, *.key) blocked from commits
+- Large files (>5MB) flagged
+- Credentials files blocked
+
+### Session Security
+- Each Cecilia Code session gets a unique agent ID
+- Sessions are logged to memory journals (PS-SHA-infinity)
+- Hash-chain journals are tamper-evident
+- Active agents tracked in `~/.blackroad/memory/active-agents/`
+
+## Command Routing
+
+All AI commands route through BlackRoad:
+
+```
+cecilia-code  →  Cecilia Code (AI development environment)
+cecilia       →  Cecilia CLI (code, chat, whoami)
+cecilia chat  →  Ollama-powered local conversation
+claude        →  Intercepted → cecilia-code
+blackroad code →  Intercepted → cecilia-code
+```
+
+The `claude` command at `~/bin/claude` intercepts before `/opt/homebrew/bin/claude`.
+Users type `cecilia` or `cecilia-code`. The engine underneath is irrelevant.
+
+## Install Hooks
+
+```bash
+# Option 1: Point git to shared hooks
+git config core.hooksPath .blackroad/hooks
+
+# Option 2: Copy to .git/hooks (already done for this repo)
+cp .blackroad/hooks/* .git/hooks/
+chmod +x .git/hooks/*
+```
+
+## Intellectual Property
+
+All output from AI sessions operating within BlackRoad infrastructure
+is the exclusive property of BlackRoad OS, Inc.
+
+AI providers have no rights to the work product.
+The tokenless architecture ensures providers never see the full picture.
+They see prompts and return completions. BlackRoad owns the integration.

.blackroad/workflow-index-schema.json

@@ -0,0 +1,69 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "required": ["id", "repo", "title", "state", "timestamp"],
+  "properties": {
+    "id": {
+      "type": "string",
+      "pattern": "^(WF|SEC|INF|EXP|FIX)-\\d{8}-[A-Z]{3}-\\d{4}$",
+      "description": "Workflow ID in format: PREFIX-YYYYMMDD-SCOPE-SEQ"
+    },
+    "repo": {
+      "type": "string",
+      "pattern": "^[a-zA-Z0-9-]+/[a-zA-Z0-9-_]+$",
+      "description": "Repository in format: owner/repo"
+    },
+    "title": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Human-readable workflow title"
+    },
+    "state": {
+      "type": "string",
+      "enum": ["Active", "Paused", "Speculative", "Archived", "Done", "Merged"],
+      "description": "Workflow state (posture, not progress)"
+    },
+    "scope": {
+      "type": "string",
+      "enum": ["Local", "Service", "System", "Public", "Experimental"],
+      "description": "Blast radius of changes"
+    },
+    "risk": {
+      "type": "string",
+      "enum": ["Unknown", "Low", "Medium", "High", "Critical"],
+      "description": "Risk level"
+    },
+    "intent": {
+      "type": "string",
+      "enum": ["Build", "Fix", "Explore", "Research", "Deploy", "Monitor", "Deprecate", "Migrate"],
+      "description": "Why this workflow exists"
+    },
+    "traffic_light": {
+      "type": "string",
+      "enum": ["🟢", "🟡", "🔴"],
+      "description": "Coordination status"
+    },
+    "deps": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "Array of dependency IDs (local or cross-repo format)"
+    },
+    "url": {
+      "type": "string",
+      "format": "uri",
+      "description": "GitHub issue/PR URL"
+    },
+    "timestamp": {
+      "type": "string",
+      "format": "date-time",
+      "description": "Creation timestamp"
+    },
+    "updated_at": {
+      "type": "string",
+      "format": "date-time",
+      "description": "Last update timestamp"
+    }
+  }
+}

.codex/brief.md

@@ -0,0 +1,4 @@
+# MEMORY BRIEF (2026-01-12T22:27:47.037901Z)
+
+- Repo: `/Users/alexa/blackroad`
+- Session: `566b2153-d39f-4dc9-9d70-1f9a86df75ed`  Command: `start`

.codex/ledger.jsonl

@@ -0,0 +1 @@
+{"repo_root": "/Users/alexa/blackroad", "git": {"is_repo": false}, "timestamp": "2026-01-12T22:27:47.037901Z", "cmd": "start", "note": "", "session_id": "566b2153-d39f-4dc9-9d70-1f9a86df75ed", "file_summaries": [], "todo_total": 0, "memory_dir": "/Users/alexa/blackroad/codex-memory", "dry_run": false}

.codex/memory.config.json

@@ -0,0 +1,10 @@
+{
+  "files": [
+    "AGENTS.md",
+    "README.md",
+    "DEPLOYMENT_GUIDE.md"
+  ],
+  "globs": [
+    "services/*/README.md"
+  ]
+}

.codex/memory.enabled

@@ -0,0 +1 @@
+# Enabled for this repository.

.codex/session.json

@@ -0,0 +1,14 @@
+{
+  "repo_root": "/Users/alexa/blackroad",
+  "git": {
+    "is_repo": false
+  },
+  "timestamp": "2026-01-12T22:27:47.037901Z",
+  "cmd": "start",
+  "note": "",
+  "session_id": "566b2153-d39f-4dc9-9d70-1f9a86df75ed",
+  "file_summaries": [],
+  "todo_total": 0,
+  "memory_dir": "/Users/alexa/blackroad/codex-memory",
+  "dry_run": false
+}

.dockerignore

@@ -0,0 +1,8 @@
+node_modules
+.git
+.env
+*.log
+dist
+__pycache__
+.pytest_cache
+.next