feat: zeroclaw agentic agency architecture — agents, skills, Rust crates

- 18 agent specs across Software, Support, Marketing, Cross-cutting
  (orchestrator + 7 software + 5 support + 3 cross-cutting + leads-finder)
- 8 reusable skills (handoff, pr-review, dokploy-deploy, campaign-structure,
  content-calendar, ticket-triage, license-lifecycle, invoice-draft)
- 3 JSON schemas: handoff, deliverable, approval
- Policies: autonomy levels, tool risk classification, compliance (DSGVO/GoBD/UWG)
- routing.toml: model tiers T1/T2/T3 + provider config (PII gating)
- Rust workspace (5 crates, all compile + 16 tests pass):
  - aos-mcp: tool registry + risk tagging
  - aos-policy: autonomy levels, budget enforcement, approval requests
  - aos-license: ed25519 license issue/verify (real crypto + CLI binary)
  - aos-ledger: integer-cents money math, gapless numbering, VAT, audit chain
  - aos-sync: frontmatter validator (18/18 specs pass), CLI binary
- CLAUDE.md entry point with architecture overview + roadmap

agency-agents/crates/aos-mcp/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "aos-mcp"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+serde.workspace = true
+serde_json.workspace = true
+anyhow.workspace = true
+thiserror.workspace = true
+
+[lib]
+path = "src/lib.rs"

agency-agents/crates/aos-mcp/src/lib.rs

@@ -0,0 +1,13 @@
+// aos-mcp — MCP server exposing Agency OS (tasks, clients, leads, licenses,
+// invoices, content) to every runtime (Claude Code, Claude Desktop, Hermes).
+//
+// Built on the Rust MCP SDK (`rmcp`). This crate is the single gateway agents
+// use to read/write AOS — no agent keeps private state, and every tool call
+// is logged + risk-classified for the policy crate to gate on.
+//
+// TODO: integrate `rmcp` once the SDK stabilizes. The tool registry + risk
+// tagging is defined here so the policy crate can consume it immediately.
+
+pub mod tools;
+
+pub use tools::{Risk, ToolSpec};

agency-agents/crates/aos-mcp/src/tools.rs

@@ -0,0 +1,40 @@
+//! Tool registry + risk classification.
+//!
+//! Every tool exposed to agents carries a `Risk` tag. The `aos-policy` crate
+//! enforces that an agent's tier (and autonomy level) permits the call. See
+//! `policies/tool-risk.md` for the human-readable classification.
+
+use serde::{Deserialize, Serialize};
+
+/// Risk classification for an MCP tool. Drives approval gating.
+///
+/// - `Low`: read-only, idempotent, no external side effects. Any tier.
+/// - `Medium`: internal reversible writes, or reads touching PII/financials.
+///   T1/T2 direct; T3 needs a reviewer pass.
+/// - `High`: irreversible, external, or money-moving. **Always** produces an
+///   `ApprovalRequest` regardless of tier. Never auto-executed.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Risk {
+    Low,
+    Medium,
+    High,
+}
+
+/// Specification of a tool exposed via the MCP server.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ToolSpec {
+    /// Dotted name, e.g. `aos-mcp:read_task`, `ads:spend`.
+    pub name: String,
+    pub risk: Risk,
+    pub description: String,
+}
+
+/// Returns the registered tool specs.
+///
+/// TODO: populate from a manifest file or a proc-macro inventory. For now
+/// this is an empty registry — the structure is what the policy crate
+/// consumes.
+pub fn list_tools() -> Vec<ToolSpec> {
+    Vec::new()
+}