You are entering the Inquiry Publishing Stack through its canonical machine/configuration entry.

Public landing:
https://inquirystack.philohub.workers.dev/agent/

Before configuring, upgrading, publishing, provisioning, or operating a project:
1. Read the canonical Starter ecosystem:
   https://github.com/ChongLiuPhil/Inquiry-Publishing-Project-Starter/blob/main/ecosystem.yaml
2. Read the Agent Retrieval Contract:
   https://github.com/ChongLiuPhil/Inquiry-Publishing-Project-Starter/blob/main/docs/AGENT_RETRIEVAL_CONTRACT.md
3. For a new project, read the Project Provisioning Contract:
   https://github.com/ChongLiuPhil/Inquiry-Publishing-Project-Starter/blob/main/docs/PROJECT_PROVISIONING_CONTRACT.md
4. Resolve AHICP, PPF, Vault Interface, and Starter and their independent roles.
5. For a downstream project, read project-stack.yaml, project-provisioning.yaml when present, selected profile, and lock state.
6. Fresh-read pinned AHICP, PPF, and Vault manifests before material configuration, provisioning, or upgrade.
7. Default new projects to full AHICP + full PPF + Vault Interface unless the human explicitly selects a reduced profile.
8. Default new downstream repositories to the personal `ChongLiuPhil` GitHub account (`owner_type: user`, `visibility: private`) and prefer `workers-builds-native` + `private-project-quota-saver`. Allow one short human-assisted project bootstrap for the GitHub → Cloudflare connection, then verify a second push deploys without renewed authorization. Content-only changes must not start GitHub Actions; configuration PRs targeting main use one lightweight contract check; main-branch Web build/deploy belongs to Cloudflare Workers Builds; heavy GitHub workflows are manual; automatic success artifacts stay off and manual publication artifacts retain for one day. Keep ordinary private quota-saver, hardened external-CI, and public-framework full CI as distinct profiles.
9. Keep original or unpublished canonical source private by default.
10. Keep unpublished or transitional Web restricted and authenticated by default; keep previews disabled until their protection is separately accepted.
11. Read private platform/project state only when that access has been authorized.
12. Distinguish proposal, authorization, execution, verification, and durable write-back.
13. Perform routine technical work yourself when tools and project authorization permit; ask the human only for the repository/provider UI steps that actually require account-holder consent.
14. Treat platform provisioning authority as optional advanced infrastructure, not a prerequisite for the default guided project setup.
15. Never expose provider credential plaintext to model/chat/Git/logs. The default Workers Builds profile uses provider-managed credentials; use the Trusted Secret Broker only when the advanced external-CI profile is explicitly selected.
16. Ask the human to act only for a real reserved gate: key judgment, new sign-in/MFA or provider-scope authorization, public release, reader-audience expansion, domain/DNS authority, paid-plan change, or fallback direct secret entry.
17. Do not use GitHub Actions as an iterative debugging environment for private downstream projects. Batch edits, run Agent-side preflight, inspect the complete diff, then trigger only the intended thin CI. On failure, batch fixes and retry only failed work where possible. Never automatically enable paid Actions usage or change billing.
18. When human UI action is necessary, give exact numbered steps, target, effect, non-secret values, completion evidence, verification, and rollback.

Human conceptual entry:
https://inquirystack.philohub.workers.dev/