Add GET /tags, POST /todos/:id/tags, DELETE /todos/:id/tags/:tag

- GET /tags returns deduplicated sorted array of all tags across todos
- POST /todos/:id/tags attaches a tag to a todo (idempotent, ignores duplicates)
- DELETE /todos/:id/tags/:tag removes a specific tag from a todo
- Both /todos/:id/tags routes return 404 for non-existent todos

.gitea/workflows/auditor.yml

@@ -0,0 +1,47 @@
+# Drop into each agent-managed project repo as .gitea/workflows/auditor.yml.
+# Requires the project to have these Gitea Actions secrets configured:
+#   AUDITOR_SSH_KEY  — private ed25519 key whose public counterpart is in
+#                      agent@dev-01:~/.ssh/authorized_keys
+#
+# The workflow SSH's into dev-01 (192.168.1.29) and runs audit-task.sh, which
+# uses claude headless to review the PR against its linked issue's Done
+# criteria, then posts the audit as a PR comment.
+
+name: Auditor
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    container:
+      image: debian:bookworm-slim
+    steps:
+      - name: Install ssh + curl
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq openssh-client curl jq ca-certificates
+
+      - name: Audit PR via dev-01
+        env:
+          AUDITOR_KEY: ${{ secrets.AUDITOR_SSH_KEY }}
+          REPO: ${{ github.repository }}
+          PR_NUM: ${{ github.event.pull_request.number }}
+        run: |
+          set -e
+          [ -n "$AUDITOR_KEY" ] || { echo "ERROR: AUDITOR_SSH_KEY secret not set"; exit 1; }
+
+          mkdir -p ~/.ssh
+          printf '%s\n' "$AUDITOR_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+
+          # Trust dev-01's host key — collected at runtime; LAN-only path
+          ssh-keyscan -H 192.168.1.29 >> ~/.ssh/known_hosts 2>/dev/null
+
+          ssh -i ~/.ssh/id_ed25519 \
+              -o BatchMode=yes \
+              -o StrictHostKeyChecking=yes \
+              agent@192.168.1.29 \
+              "PATH=\$HOME/.local/bin:/usr/local/bin:\$PATH MAX_WALLCLOCK=10m /usr/local/bin/audit-task.sh '$REPO' '$PR_NUM'"

HELLO.md

@@ -0,0 +1,3 @@
+# Hello
+
+Greetings from the agent-coding-empire pipeline!

README.md

@@ -2,13 +2,4 @@
 
 Throwaway playground for the agent-coding-empire v0. Built end-to-end by autonomous dev agents from PM-authored issues.
 
-## Run
-
-```bash
-npm install && npm start
-```
-
-The server starts on port 3000.
-
-- `GET /todos` — returns a JSON array of todo items
-- `GET /healthz` — returns `{ "ok": true }`
+See [HELLO.md](HELLO.md) for a greeting from the pipeline.

index.js

@@ -1,22 +1,80 @@
 const express = require('express');
+const { name, version } = require('./package.json');
 
 const app = express();
 const PORT = 3000;
 
-const todos = [
-  { id: 1, title: 'Buy groceries', done: false },
-  { id: 2, title: 'Walk the dog', done: true },
-  { id: 3, title: 'Read a book', done: false },
+app.use(express.json());
+
+let todos = [
+  { id: 1, title: 'Buy groceries', done: false, tags: [] },
+  { id: 2, title: 'Walk the dog', done: true, tags: [] },
+  { id: 3, title: 'Read a book', done: false, tags: [] },
 ];
 
+let nextId = 4;
+
 app.get('/healthz', (req, res) => {
   res.json({ ok: true });
 });
 
+app.get('/version', (req, res) => {
+  res.json({ name, version });
+});
+
 app.get('/todos', (req, res) => {
+  const { tag } = req.query;
+  if (tag !== undefined) {
+    return res.json(todos.filter(t => t.tags.includes(tag)));
+  }
   res.json(todos);
 });
 
+app.post('/todos', (req, res) => {
+  const { title, tags } = req.body;
+  const todo = { id: nextId++, title, done: false, tags: Array.isArray(tags) ? tags : [] };
+  todos.push(todo);
+  res.status(201).json(todo);
+});
+
+app.delete('/todos/:id', (req, res) => {
+  const id = parseInt(req.params.id, 10);
+  const index = todos.findIndex(t => t.id === id);
+  if (index === -1) {
+    return res.status(404).end();
+  }
+  todos.splice(index, 1);
+  res.status(204).end();
+});
+
+app.get('/tags', (req, res) => {
+  const tags = [...new Set(todos.flatMap(t => t.tags))].sort();
+  res.json(tags);
+});
+
+app.post('/todos/:id/tags', (req, res) => {
+  const id = parseInt(req.params.id, 10);
+  const todo = todos.find(t => t.id === id);
+  if (!todo) {
+    return res.status(404).end();
+  }
+  const { tag } = req.body;
+  if (!todo.tags.includes(tag)) {
+    todo.tags.push(tag);
+  }
+  res.json(todo);
+});
+
+app.delete('/todos/:id/tags/:tag', (req, res) => {
+  const id = parseInt(req.params.id, 10);
+  const todo = todos.find(t => t.id === id);
+  if (!todo) {
+    return res.status(404).end();
+  }
+  todo.tags = todo.tags.filter(t => t !== req.params.tag);
+  res.status(204).end();
+});
+
 app.listen(PORT, () => {
   console.log(`Server listening on http://localhost:${PORT}`);
 });