v2 foundation: shared contracts, app profile schema, wiring stubs

- projects: app profile columns + one app per org; project_external_git,
  deploy_targets, org_model_grants tables (migration a0f0e1d2c3b4)
- ports + fakes: RepoWorkspace, DeliveryHooks, DeployTarget, Memory,
  ModelGrants, WorkforceBootstrap; AppProfile + AppProfileRepository
- per-workstream wiring (container_org/engine/delivery), config blocks,
  empty routers, delivery worker, MCP/delivery service shells, web stubs
- admin nav derives from ADMIN_ITEMS; plan docs updated for ext4 worktrees

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

apps/api/app/interfaces/http/routers/admin_domains.py

@@ -0,0 +1,11 @@
+"""owner domain routes: /admin/domains/*.
+
+Owned by Agent 3 (see docs/plan/PLAN-v2.md §6). Registered in ``rpc_app.py`` already; give each
+route its full path (no prefix is applied here besides ``/api``).
+"""
+
+from __future__ import annotations
+
+from fastapi import APIRouter
+
+router = APIRouter(tags=["admin-domains"])

apps/api/app/interfaces/http/routers/admin_grants.py

@@ -0,0 +1,11 @@
+"""owner model grants and org policies: /admin/model-grants/*, /admin/org-policies/*.
+
+Owned by Agent 1 (see docs/plan/PLAN-v2.md §6). Registered in ``rpc_app.py`` already; give each
+route its full path (no prefix is applied here besides ``/api``).
+"""
+
+from __future__ import annotations
+
+from fastapi import APIRouter
+
+router = APIRouter(tags=["admin-grants"])

apps/api/app/interfaces/http/routers/app_setup.py

@@ -0,0 +1,11 @@
+"""org wizard, app profile, deploy-target settings: /setup/*, /organizations/{org}/app/*.
+
+Owned by Agent 1 (see docs/plan/PLAN-v2.md §6). Registered in ``rpc_app.py`` already; give each
+route its full path (no prefix is applied here besides ``/api``).
+"""
+
+from __future__ import annotations
+
+from fastapi import APIRouter
+
+router = APIRouter(tags=["app-setup"])

apps/api/app/interfaces/http/routers/delivery.py

@@ -0,0 +1,11 @@
+"""CI/CD runs, releases, production deploy: /organizations/{org}/delivery/*.
+
+Owned by Agent 3 (see docs/plan/PLAN-v2.md §6). Registered in ``rpc_app.py`` already; give each
+route its full path (no prefix is applied here besides ``/api``).
+"""
+
+from __future__ import annotations
+
+from fastapi import APIRouter
+
+router = APIRouter(tags=["delivery"])

apps/api/app/interfaces/http/routers/mcp_tokens.py

@@ -0,0 +1,11 @@
+"""MCP tokens: /organizations/{org}/mcp-tokens/*, /admin/mcp/*.
+
+Owned by Agent 1 (see docs/plan/PLAN-v2.md §6). Registered in ``rpc_app.py`` already; give each
+route its full path (no prefix is applied here besides ``/api``).
+"""
+
+from __future__ import annotations
+
+from fastapi import APIRouter
+
+router = APIRouter(tags=["mcp-tokens"])

apps/api/app/interfaces/http/routers/memory.py

@@ -0,0 +1,11 @@
+"""org memory: /organizations/{org}/memory/*.
+
+Owned by Agent 1 (see docs/plan/PLAN-v2.md §6). Registered in ``rpc_app.py`` already; give each
+route its full path (no prefix is applied here besides ``/api``).
+"""
+
+from __future__ import annotations
+
+from fastapi import APIRouter
+
+router = APIRouter(tags=["memory"])

apps/api/app/interfaces/mcp/__init__.py

@@ -0,0 +1 @@
+"""MCP gateway (owned by Agent 1)."""

apps/api/app/interfaces/mcp/server.py

@@ -0,0 +1,14 @@
+"""MCP gateway entry point (owned by Agent 1). Foundation stub."""
+
+from __future__ import annotations
+
+
+def main() -> None:
+    raise SystemExit(
+        "MCP gateway is not implemented yet "
+        "(see docs/plan/TODO-agent-1-org-platform.md, Phase 5)"
+    )
+
+
+if __name__ == "__main__":
+    main()

apps/api/app/interfaces/realtime/rpc_app.py

@@ -23,13 +23,19 @@ from app.interfaces.http.errors import register_exception_handlers
 from app.interfaces.http.request_context import RequestContextMiddleware
 from app.interfaces.http.routers import (
     admin,
+    admin_domains,
+    admin_grants,
     admin_users,
     agy,
+    app_setup,
     auth,
     billing,
+    delivery,
     health,
     invites,
     knowledge,
+    mcp_tokens,
+    memory,
     organizations,
     projects,
     sandbox,
@@ -71,6 +77,13 @@ def build_rpc_app() -> FastAPI:
     application.include_router(admin.router, prefix="/api")
     application.include_router(admin_users.router, prefix="/api")
     application.include_router(agy.router, prefix="/api")
+    # v2 routers (one workstream each; see docs/plan/PLAN-v2.md §6).
+    application.include_router(app_setup.router, prefix="/api")
+    application.include_router(memory.router, prefix="/api")
+    application.include_router(mcp_tokens.router, prefix="/api")
+    application.include_router(admin_grants.router, prefix="/api")
+    application.include_router(delivery.router, prefix="/api")
+    application.include_router(admin_domains.router, prefix="/api")
     application.include_router(realtime_router, prefix="/api")
     return application