Consolidate CI, add end-to-end pipeline demo, fix agentmd lint:isolint

- Replace three per-package CI workflows with a single `ci.yml` covering
  isolint's Node compat matrix and a unified build/test/dogfood job; update
  the iso-harness release gate to track the new check-run name.
- Add `examples/pipeline/` — one authored `agent.md` flows through agentmd
  lint/render, isolint lint, and iso-harness build to produce the 11 files
  each coding-agent harness expects. Exposed as `npm run test:pipeline` and
  wired into CI so the monorepo's thesis stays provable.
- Repoint `@razroo/agentmd`'s `lint:isolint` at the sibling workspace
  instead of a global binary, and render to a file since `isolint lint`
  does not read stdin.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: CharlieGreenman

.github/workflows/agentmd-ci.yml

@@ -0,0 +1,107 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  isolint-compat:
+    name: isolint compat (Node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ["18.17", "20", "22"]
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      - run: npm ci
+
+      - run: npm run typecheck --workspace @razroo/isolint
+
+      - run: npm test --workspace @razroo/isolint
+
+      - run: npm run build --workspace @razroo/isolint
+
+  build-test-lint:
+    name: build-test-lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22"
+          cache: npm
+
+      - run: npm ci
+
+      - run: npm run typecheck --workspaces --if-present
+
+      - run: npm run test --workspaces --if-present
+
+      - run: npm run build --workspaces --if-present
+
+      - name: agentmd lint (examples)
+        working-directory: packages/agentmd
+        run: |
+          node dist/cli.js lint examples/outreach-writer.md
+          node dist/cli.js lint examples/minimal.md
+
+      - name: isolint lint (SARIF)
+        working-directory: packages/isolint
+        run: node dist/cli/index.js lint . --format sarif --fail-on warn > isolint.sarif
+        continue-on-error: true
+
+      - name: Upload SARIF to GitHub code scanning
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: packages/isolint/isolint.sarif
+          category: isolint
+
+      - name: isolint lint (enforce)
+        working-directory: packages/isolint
+        run: node dist/cli/index.js lint . --fail-on error
+
+      - name: Pipeline integration (agentmd → isolint → iso-harness)
+        run: node examples/pipeline/build.mjs
+
+      - name: iso-harness smoke build
+        working-directory: packages/iso-harness
+        run: npm run smoke
+
+      - name: Verify iso-harness expected output files exist
+        run: |
+          set -e
+          OUT=/tmp/iso-harness-smoke
+          for f in \
+            "$OUT/CLAUDE.md" \
+            "$OUT/.claude/agents/researcher.md" \
+            "$OUT/.claude/commands/review.md" \
+            "$OUT/.mcp.json" \
+            "$OUT/.cursor/rules/main.mdc" \
+            "$OUT/.cursor/mcp.json" \
+            "$OUT/AGENTS.md" \
+            "$OUT/.codex/config.toml" \
+            "$OUT/opencode.json" \
+            "$OUT/.opencode/agents/researcher.md" \
+            "$OUT/.opencode/skills/review.md"
+          do
+            if [ ! -f "$f" ]; then
+              echo "::error::missing expected output: $f"
+              exit 1
+            fi
+          done
+          echo "All 11 expected output files present."

.github/workflows/ci.yml

@@ -29,34 +29,34 @@ jobs:
           VERSION="${GITHUB_REF_NAME#iso-harness-v}"
           echo "VERSION=$VERSION" >> $GITHUB_ENV
 
-      - name: Verify Quality checks passed for release commit
+      - name: Verify CI build-test-lint passed for release commit
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         working-directory: .
         run: |
           SHA=$(git rev-parse HEAD)
-          echo "Verifying iso-harness quality check-run for $SHA"
+          echo "Verifying CI build-test-lint check-run for $SHA"
           DEADLINE=$(( $(date +%s) + 1800 ))
           STATUS=""
           CONCLUSION=""
           while [ "$(date +%s)" -lt "$DEADLINE" ]; do
             read -r STATUS CONCLUSION <<<"$(gh api "repos/${{ github.repository }}/commits/$SHA/check-runs" \
-              --jq '[.check_runs[] | select(.name == "quality")] | sort_by(.started_at) | last | "\(.status // "missing") \(.conclusion // "null")"')"
-            echo "quality check-run: status=$STATUS conclusion=$CONCLUSION"
+              --jq '[.check_runs[] | select(.name == "build-test-lint")] | sort_by(.started_at) | last | "\(.status // "missing") \(.conclusion // "null")"')"
+            echo "build-test-lint check-run: status=$STATUS conclusion=$CONCLUSION"
             if [ "$STATUS" = "completed" ]; then
               break
             fi
             sleep 15
           done
           if [ "$STATUS" != "completed" ]; then
-            echo "::error::Quality checks for $SHA never completed within 30min (last status: $STATUS)."
+            echo "::error::CI build-test-lint for $SHA never completed within 30min (last status: $STATUS)."
             exit 1
           fi
           if [ "$CONCLUSION" != "success" ]; then
-            echo "::error::Quality checks for $SHA did not succeed (conclusion: $CONCLUSION). Fix before re-releasing."
+            echo "::error::CI build-test-lint for $SHA did not succeed (conclusion: $CONCLUSION). Fix before re-releasing."
             exit 1
           fi
-          echo "Quality checks succeeded for $SHA"
+          echo "CI build-test-lint succeeded for $SHA"
 
       - name: Verify package.json version matches release tag
         run: npm run release:check-source -- "$VERSION"

.github/workflows/iso-harness-ci.yml

@@ -80,8 +80,17 @@ npm install                 # install all workspace deps
 npm run build               # build every package
 npm run test                # run every package's tests
 npm run typecheck           # typecheck every package
+npm run test:pipeline       # end-to-end demo (agentmd → isolint → iso-harness)
 
 # Target a single package
 npm run build --workspace @razroo/isolint
 npm run test  --workspace @razroo/agentmd
 ```
+
+## End-to-end example
+
+[`examples/pipeline/`](./examples/pipeline) is an executable demonstration
+of the composed pipeline: one authored `agent.md` is structurally linted,
+rendered, prose-linted, and fanned out into the 11 files each coding-agent
+harness expects. Run `npm run test:pipeline` to exercise all three packages
+against a single source.

.github/workflows/iso-harness-release.yml

@@ -0,0 +1,2 @@
+iso-src/instructions.md
+out/