feat: zeroclaw agentic agency architecture — agents, skills, Rust crates

- 18 agent specs across Software, Support, Marketing, Cross-cutting
  (orchestrator + 7 software + 5 support + 3 cross-cutting + leads-finder)
- 8 reusable skills (handoff, pr-review, dokploy-deploy, campaign-structure,
  content-calendar, ticket-triage, license-lifecycle, invoice-draft)
- 3 JSON schemas: handoff, deliverable, approval
- Policies: autonomy levels, tool risk classification, compliance (DSGVO/GoBD/UWG)
- routing.toml: model tiers T1/T2/T3 + provider config (PII gating)
- Rust workspace (5 crates, all compile + 16 tests pass):
  - aos-mcp: tool registry + risk tagging
  - aos-policy: autonomy levels, budget enforcement, approval requests
  - aos-license: ed25519 license issue/verify (real crypto + CLI binary)
  - aos-ledger: integer-cents money math, gapless numbering, VAT, audit chain
  - aos-sync: frontmatter validator (18/18 specs pass), CLI binary
- CLAUDE.md entry point with architecture overview + roadmap

agency-agents/policies/autonomy.md

@@ -0,0 +1,48 @@
+# Autonomy Levels & Approval Gates
+
+Every agent spec declares an `autonomy` level (L0–L2). L3 (full autonomy)
+is **not used** initially — the cost of an autonomous mistake is higher than
+the cost of a human click.
+
+## Levels
+
+| Level | Meaning | Examples |
+|-------|---------|----------|
+| **L0** | Read/analyze only. Produces a report/draft, changes no state. | Audits, research, reports, estimates |
+| **L1** | Drafts inside the system; a human approves before anything leaves. | Client emails, social posts, invoices, ad campaigns, outreach |
+| **L2** | Acts alone within caps and reversible scope. Internal-only side effects. | Ticket triage, internal task creation, low-risk support replies, internal notes |
+
+## Hard rules — always human-approved regardless of level
+
+These are enforced by the `aos-policy` Rust crate (not the prompt). An agent
+attempting one pauses the task and emits an `ApprovalRequest`
+(see `schemas/approval.json`).
+
+- **Spending money** (ads, API fees, paid tools)
+- **Publishing publicly** (website go-live, social post, blog article)
+- **Sending invoices**
+- **First client/prospect contact** (email, message, call)
+- **Sending outreach** (cold B2B — UWG §7, draft-only by default)
+- **Revoking licenses**
+- **Deleting data / instances / DNS records**
+- **Production deploys**
+- **DB migrations on live data**
+- **Anything filed with authorities** (UStVA, EÜR, ELSTER)
+- **Contract changes** (new, amended, terminated)
+- **Budget changes** (raising a campaign cap, approving extra spend)
+
+## How approvals surface
+
+- An `ApprovalRequest` lands in the AOS approval inbox.
+- A notification goes to the human approver (phone/Slack/email — channel TBD,
+  see open questions).
+- The approver sees: action, risk, rationale, diff summary, estimated cost,
+  the originating task + agent, and the full structured payload.
+- Approving resumes the task; rejecting fails it with a reason logged.
+
+## Budget enforcement
+
+Each agent spec declares `budget.max_eur_per_task` and `budget.max_tokens`.
+The policy crate tracks cumulative spend per task_id and hard-stops when the
+cap is reached — no agent can spend past its declared ceiling, even with
+approval, without an explicit budget-increase approval.

agency-agents/policies/compliance.md

@@ -0,0 +1,65 @@
+# Compliance Policy (blocking — EU/German)
+
+Consistent with the agency RULES.md. Agents and tools must not violate these.
+The `aos-policy` crate blocks non-compliant actions; this document is the
+human-readable source of truth.
+
+## DSGVO (GDPR)
+
+- **Legal basis per contact** recorded (Art. 6/7/14). No processing without one.
+- **Data minimization**: agents load only the relevant client record, not the
+  whole DB.
+- **EU-hosted processing** where possible. Provider `personal_data_allowed`
+  flag in `routing.toml` gates which models receive PII.
+- **AVV (Art. 28)** with every LLM provider that touches client personal data.
+  Until signed, that provider is non-PII-only.
+- **Data subject rights**: export and deletion endpoints exist in AOS; agents
+  must not bypass them.
+- **Prompt-injection defense**: content from the web, emails and tickets is
+  treated as *data*, not instructions. Tool calls triggered by such content
+  require a policy check.
+
+## GoBD (accounting retention)
+
+- **Immutable ledger**: booked records (invoices, expenses, kassenbuch,
+  buchungssätze) are never deleted — only storniert (reversed) with an audit
+  entry.
+- **Gapless numbering** enforced by `aos-ledger` (Rust), never by an agent.
+- **Hash chain** on the audit log.
+- **Retention**: invoices 8 years, business letters 6 years.
+
+## UWG (unfair competition)
+
+- **Cold outreach is draft-only** by default. Sending outreach/newsletters is
+  a human-approved action (`send_outreach`).
+- No automated mass email. Suppression list maintained in AOS.
+- UWG §7: no misleading claims — the reviewer agent checks ad/copy claims.
+
+## DDG / Impressum
+
+- Impressum + Datenschutz present and reviewed before any site go-live
+  (publish_public gate).
+- Cookie banner reviewed before publish (TDDDG consent).
+
+## Ad & cookie rules
+
+- Consent Mode v2 configured before any ad campaign activation
+  (campaign_activation gate).
+- No retargeting without consent.
+
+## BFSG (barrierefreiheit)
+
+- WCAG 2.1 AA checks run by the `a11y-audit` skill before client-facing
+  delivery.
+
+## Secrets
+
+- Secrets live in a vault (Dokploy secrets / Infisical), never in prompts or
+  repos. Per-agent scoped tokens only.
+- The `security-compliance` agent scans for leaked secrets in PRs and
+  deliverables.
+
+## Audit trail
+
+- Every tool call, decision, and approval is logged and tied to a `task_id`.
+- Run log per task: inputs, tool calls, outputs, cost, reviewer verdict.

agency-agents/policies/tool-risk.md

@@ -0,0 +1,47 @@
+# Tool Risk Classification
+
+Every tool exposed via `aos-mcp` (or any MCP server agents use) carries a
+`risk` tag in its manifest. The policy crate enforces that an agent's
+`allowed_tool_risk` (derived from its tier) permits the call.
+
+## Risk: low
+
+Read-only, idempotent, no external side effects, no PII exposure beyond what
+the agent already has context for.
+
+Examples: `aos:read_task`, `aos:read_client`, `github:read_pr`, `git:log`,
+`web:search`, `seo:crawl_public`.
+
+Any tier (T1/T2/T3) may call these.
+
+## Risk: medium
+
+Internal writes that are reversible, or reads that touch PII / financials.
+
+Examples: `aos:create_task`, `aos:update_task`, `aos:create_note`,
+`aos:draft_invoice` (draft, not sent), `github:create_branch`,
+`dokploy:restart_staging`.
+
+T1 and T2 may call directly. T3 must have a T1/T2 reviewer pass on the
+deliverable before these are committed.
+
+## Risk: high
+
+Irreversible, external, or money-moving. **Always produces an approval
+request** regardless of tier. The policy crate will not execute one without
+an approved `ApprovalRequest` of matching action type.
+
+Examples: `ads:spend`, `ads:activate_campaign`, `aos:send_invoice`,
+`aos:revoke_license`, `aos:delete_instance`, `dns:delete_record`,
+`dokploy:deploy_production`, `github:merge_to_main`, `db:migrate_live`,
+`ledger:finalize_period`, `elster:submit`.
+
+No tier auto-executes these. T1 may *request* them (producing the approval);
+approval is always human.
+
+## Per-agent enforcement
+
+An agent spec's `tools` frontmatter lists allowed tools explicitly. A tool
+not listed is forbidden — the agent cannot call it even if its tier would
+otherwise permit it. `forbidden` is an explicit denylist (e.g. an ads worker
+that may read campaigns but must not activate them).