Commit + flesh out the factory-test-infra scaffold repo

[khaliqgant]

Owner task (assigned to @khaliqgant) — needs repo/permission access the GitHub App doesn't have. Part of Epic: Factory Verification & Environments (#141); stands up the data plane described in #146 and #147.

Context

agentworkforce/factory-test-infra was created but is empty. A Cloudflare-first scaffold (with BYOC-K8s guardrails) was generated this session and delivered as a tarball — it needs to be committed and then fleshed out from skeleton to a working deploy. The GitHub App can't create org repos, edit labels, or push to factory-test-infra (not in session scope), so the initial commit + permission grant are human steps.

Checklist

Commit the scaffold

• Commit the delivered scaffold to factory-test-infra on a feature branch (claude/factory-test-infra-scaffold) and open a PR. (Files: infra/, containers/, connections/, charts/byoc-base/, ci/verification-env/, .github/workflows/verify.yml, README/package.json — all carry TODO(#146)/TODO(#147) markers.)

Flesh out the skeleton (each per its issue's acceptance criteria + E2E)

• infra/ — real Cloudflare substrate: Workers for Platforms dispatch namespace(s) + per-env bindings + Cron-Trigger reaper (Stand up factory-test-infra: Cloudflare-based ephemeral verification environments (Workers for Platforms + Containers) + factory provider wiring #146).
• containers/ — Cloudflare Container defs for non-Worker deps (Postgres, mocks) (Stand up factory-test-infra: Cloudflare-based ephemeral verification environments (Workers for Platforms + Containers) + factory provider wiring #146).
• connections/ + charts/byoc-base/ — BYOC customer→cluster registry + namespace-scoped RBAC / ResourceQuota / default-deny NetworkPolicy (KubernetesEnvironmentProvider: bring-your-own EKS + managed namespaces for K8s-native customer stacks #147).
• ci/verification-env/{up,run-suite,down}.sh + verify.yml — real up → run Factory Track-C suites (EnvironmentProvider port + Cloudflare ephemeral-environment provider (Workers for Platforms + Containers); K8s/Daytona optional #142–Verification gate: provision → deploy → E2E → load → evaluate → teardown, wired into the merge gate #145) → down.

Unblock automation for next time

• Grant the GitHub App repo-creation + label-edit on the org, and/or add factory-test-infra to the working session, so future updates can be automated instead of hand-committed.
• (While you have label perms) recolor the auto-created gray factory-ready labels on relaycast and nightcto to match the green/description used elsewhere.

Notes

• Substrate decisions already baked into the scaffold: Cloudflare-first for our/CF-native stacks, bring-your-own-cluster for K8s-native customers (no cluster provisioner needed for BYOC). See Epic: Factory Verification & Environments — tiered proof (map → preview → ephemeral stack + load) for every feature #141 for the full rationale.
• Once this repo is real, the A2A connected E2E (cloud#2787) is the first workload to run on it.

[kjgbot]

The empty AgentWorkforce/factory-test-infra repository has now been initialized with a main branch and the implementation work has been moved to the repository that must own the resulting PR: AgentWorkforce/factory-test-infra#1. That issue carries factory-ready, includes the real Cloudflare E2E/guardrail acceptance criteria, and links Factory #146/#182 as the provider contract.

The local Factory scan list and checkout now include factory-test-infra. The available Factory branch is factory/146-agentworkforce-factory-80c19421 (PR #182); inspection confirms it contains the Factory-side provider/workflow and handoff contract, but not the previously described executable infra/containers/CI scaffold. The new issue states that gap explicitly so the implementer does not mistake the handoff README for completed infrastructure.