Serve upload-cost estimates and shared API discovery

[JimCollinson]

Coordinated draft — for Hermes review, not merge-ready

One part of the three-repository pricing feature. Jim authorized these drafts on 11 September and explicitly deferred the dedicated clean-context review until before any merge. Production setup and release remain separately blocked.

Companion drafts: Inventory PR #2 · Developers PR #10. Review all three as one feature; no independent merge is requested. Those repositories and the shared Hermes brief require internal access.

Changes

• Add isolated GET /api/pricing: one bounded KV stream read, exact byte/hash/metadata validation, independent native/reference expiry and explicit browser-access/cache headers. Missing/invalid/native-expired data returns pricing-only503; no provider lookup or monetary recalculation on this route.
• Add one shared description/link source for root JSON and thin llms.txt, named Autonomi API, including upload-cost estimates and verified client/setup links. The directory distinguishes hosted information from local/direct network clients.
• Preserve supply URLs, bare-number responses, wallet accounting, rounding, caches, RPC fallback and the actual legacy health payload. Health's directory description is clarified; its response is unchanged.
• Add supply-preservation/new-route tests, read-only feature/PR CI and the same checks before the existing deploy step. Include minimal repo-local ADR governance and Proposed decisions; no acceptance.

Review worker/pricing.js, the limited worker/index.js delta and docs/specs/pricing-api.md first. Production wrangler.jsonc, legacy Vercel rollback files, dependencies, wallet/provider definitions and supply handlers are unchanged.

Evidence

• Exact-head CI:155 tests pass at0cc8b3c, including139 retained supply cases. Only the two owner-approved root-name assertions changed in the prior suite.
• Standard/goal/adversarial/Craft reviews passed for bounded code. Model/validator provenance is pinned to reviewed source bytes.
• Connected local proof exercised actual Wrangler/workerd/KV and the built browser with unchanged response bytes/headers. Inputs and cloud/Actions identities were simulated; no actual production availability is claimed.

Before merge / release

• Dedicated clean-context review remains required before merge, explicitly deferred by Jim—not passed or waived. See the shared brief for the blocked launch preflight and retained evidence.
• Human resolution of API ADR-0001 — Adopt Architecture Decision Records and API ADR-0002 — Serve Inventory pricing while preserving supply contracts, both Proposed.
• Actual approved PRICING_KV namespace binding and first verified publisher data. There is no dummy production binding; absent configuration currently means pricing503.
• Merging to main triggers the existing live deployment workflow. Neither a draft nor green tests authorize that action. workers.dev and the production hostname are the same Worker, not isolated staging. Preserve supply and release API → publisher/readback → website only after approval.