Add infrastructure/AGENTS.md and finish the README ownership map

## Problem `infrastructure/` has no `AGENTS.md`. Every other significant package in this repo has one — `surfaces/interactive_shell/`, `core/llm/`, `core/agent_harness/`, `tools/interactive_shell/` — and agents working in the repo read `AGENTS.md` by convention. `infrastructure/README.md` holds a good ownership map, but nothing points to it from the file agents actually open. Two of the three package-root modules are also missing from that map: | Module | In the README map? | | --- | --- | | `setup_state.py` | yes — "install/setup facts surfaced to agents and doctor" | | `alert_intake.py` | **no** | | `asgi_server.py` | **no** | ## Why it matters Both undocumented modules sit at the root *deliberately*, and each explains why in its own docstring: `alert_intake.py` depends only on the alert domain model so the gateway web app and the interactive shell can both host it without importing each other; `asgi_server.py` takes the app from its caller so it never depends on a web surface. That is a real architectural boundary, and right now it is visible only to someone who opens the file. The next contributor who sees two loose modules at a package root will try to "tidy" them into a subpackage and break the boundary. ## Steps 1. Read `infrastructure/README.md` end to end — it is the ownership map and you are not replacing it. 2. Read the tier rules in [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) and find the row for `infrastructure/`. Note which packages it may import and which it may not. 3. Create `infrastructure/AGENTS.md`: point at the README for ownership, and state the import borders in your own words, quoting the tier from ARCHITECTURE rather than inventing a rule. 4. Open `infrastructure/alert_intake.py` and `infrastructure/asgi_server.py`, read the module docstrings, and add one line each to the README's root-module list (next to the existing `setup_state.py` line). ## Suggested layout ``` infrastructure/ AGENTS.md <- new, ~30 lines: pointer + import borders README.md <- gains two lines in the root-module list ``` A sketch of the AGENTS file — adjust the wording, keep the shape: ```markdown ## infrastructure/ Shared runtime services outside the app surfaces and outside the agent loop. The ownership map — which subpackage owns what — is in [README.md](README.md). Read it before adding a module. ### Import borders `infrastructure/` may import: `infrastructure/` must not import: ### Rules that bite - No `common/` / `shared/` / `util/` package. Name by what it does. - Prefer leaf imports over re-export shims. - Root modules (`alert_intake.py`, `asgi_server.py`) are shared by the gateway and the interactive shell without either importing the other. Do not move them into a subpackage — that boundary is the reason they are at the root. ``` ## Expected result An agent or contributor opening `infrastructure/` finds `AGENTS.md`, learns the import borders in under a minute, and is told where the full map lives. The two root modules are documented where someone reorganising the package will see them. ## Verification Every path mentioned in either file resolves: ```bash grep -oh '`[a-z_][a-z_0-9/]*\(\.py\|\.md\)\?/\?`' \ infrastructure/AGENTS.md infrastructure/README.md \ | tr -d '`' | sort -u \ | while read -r p; do [ -e "$p" ] || [ -e "infrastructure/$p" ] || echo "BROKEN $p" done ``` Expected output: nothing. All three root modules are documented: ```bash for m in setup_state alert_intake asgi_server; do grep -q "$m" infrastructure/README.md && echo "OK $m" || echo "MISSING $m" done ``` Expected output: three `OK` lines. ## Checklist - [ ] `infrastructure/AGENTS.md` exists and is under about 40 lines - [ ] It links to `README.md` instead of restating the ownership map - [ ] Its import borders match `docs/ARCHITECTURE.md` — quoted, not paraphrased into a new rule - [ ] `alert_i