Every page says what you can do here as who you are: a role-aware, token-efficient manifest for agents #604

Pillar: P5 Open to agents (umbrella #591). One run, started fresh from today's main.

Outcome (what a person sees). An agent that lands on any forge page can ask, in a few hundred tokens, what this is, who it is here, and what it can do, with the HTTP route and the MCP tool for each action.

Today. security.txt, robots, sitemap and the web manifest exist (src/web/standards.ts). MCP OAuth discovery is on main (src/http/oauth.ts). No page says what an agent may do.

Acceptance.

• [ ] Every HTML page links <link rel="alternate" type="application/json" href="..."> to its manifest. The manifest: what this is (kind, owner/name, who can see it, in one sentence), who you are (anonymous, a person, the owner, an agent token and its scope), and the actions open to you here with route and MCP tool (tell, comment, report, offer a change, make it yours), plus the MCP URL and its OAuth discovery URL.
• [ ] Under 2 KB for a typical page; anonymous and owner get different manifests; private things stay not_found (invariant 9).
• [ ] /llms.txt names the forge, its public apps and the manifest convention. docs/STANDARDS.md documents it.

Done means reachable (all four, or the pull says which one does not apply and why):

• Page: the link on every page and /llms.txt
• MCP: here {url} returns the manifest for a URL
• Test: anonymous vs owner differ; the size bound; private stays not_found
• Look: the manifest for three pages pasted in the pull

Start from: src/web/standards.ts, src/web/layout.ts, src/http/oauth.ts, src/http/mcp.ts, docs/STANDARDS.md, docs/MCP.md.

Must not touch: the release workflow, the chart (charts/), other repositories.