Add a Makefile, a README and the review this branch works from

There was no onboarding doc of any kind. The Makefile covers build, test, vet,
fmt, a fmt-check gate, tidy, run, the MCP stdio mode, docker-build and the
ecosystem compose targets. The README covers what Hexis is and where it sits
between Nexus, Praxis and workspace-mcp, how to build and run it, the flag and
environment table including the new HEXIS_API_TOKEN, the API surface, and the
tests.

REVIEW-2026-07-30.md is the engineering review the preceding commits address,
kept in-tree as the rationale for them. It includes an independent
second-reviewer pass, and its "uncertainties" section has since been resolved:
the service is not reachable from the public internet (the internet-exposed
nginx config in the Maven repo is a template, not what is deployed), Nexus has
no blessing concept and none is planned, and the running image was built from
an uncommitted working tree hours before the first commit existed — which is
why the deployed binary never matched any revision.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uea55zaiWuEByEDC4UBSdd

Makefile

@@ -0,0 +1,73 @@
+
+# Hexis — capability registry + guarded execution.
+# Pure-Go build (modernc sqlite), so CGO is never required.
+
+GO          ?= go
+BIN_DIR     ?= bin
+IMAGE       ?= hexis:dev
+DATA_DIR    ?= $(HOME)/.local/share/hexis
+HTTP_ADDR   ?= localhost:9741
+
+.DEFAULT_GOAL := build
+
+.PHONY: help
+help: ## List targets
+	@grep -hE '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) | \
+		awk -F':.*?## ' '{printf "  %-14s %s\n", $$1, $$2}'
+
+.PHONY: build
+build: ## Build hexisd and hexisctl into bin/
+	CGO_ENABLED=0 $(GO) build -trimpath -o $(BIN_DIR)/hexisd ./cmd/hexisd
+	CGO_ENABLED=0 $(GO) build -trimpath -o $(BIN_DIR)/hexisctl ./cmd/hexisctl
+
+.PHONY: test
+test: ## Run the test suite
+	$(GO) test ./...
+
+.PHONY: vet
+vet: ## Run go vet
+	$(GO) vet ./...
+
+.PHONY: fmt
+fmt: ## Format all Go sources
+	$(GO) fmt ./...
+
+.PHONY: fmt-check
+fmt-check: ## Fail if any Go source is unformatted
+	@out="$$(gofmt -l .)"; \
+	if [ -n "$$out" ]; then echo "unformatted files:"; echo "$$out"; exit 1; fi
+
+.PHONY: check
+check: fmt-check vet test ## fmt-check + vet + test
+
+.PHONY: tidy
+tidy: ## Tidy go.mod/go.sum
+	$(GO) mod tidy
+
+.PHONY: run
+run: build ## Run hexisd locally (HTTP API)
+	$(BIN_DIR)/hexisd -http $(HTTP_ADDR) -data $(DATA_DIR)
+
+.PHONY: run-mcp
+run-mcp: build ## Run hexisd as an MCP stdio server
+	$(BIN_DIR)/hexisd -mcp -data $(DATA_DIR)
+
+.PHONY: clean
+clean: ## Remove build output
+	rm -rf $(BIN_DIR)
+
+.PHONY: docker-build
+docker-build: ## Build the distroless container image
+	docker build -t $(IMAGE) .
+
+# The compose file that actually runs Hexis lives with the ecosystem stack, not
+# in this repo. Override COMPOSE_DIR if yours is elsewhere.
+COMPOSE_DIR ?= ../Maven/deploy/ecosystem
+
+.PHONY: compose-up
+compose-up: ## Build + start the ecosystem stack (nexus, praxis, hexis)
+	docker compose -f $(COMPOSE_DIR)/docker-compose.yml up -d --build hexis
+
+.PHONY: compose-logs
+compose-logs: ## Tail hexis logs from the ecosystem stack
+	docker compose -f $(COMPOSE_DIR)/docker-compose.yml logs -f hexis