Resync Carried Instruction Set, Config, and README Against the Hub

.github/workflows/build-release-task.yml

@@ -143,11 +143,11 @@ jobs:
         with:
           ref: ${{ needs.get-version.outputs.GitCommitId }}
 
-      # Collect assets by the `release-asset-<branch>-*` pattern so this step is target-agnostic: subset releases by
-      # deleting the target, not `enable_*: false` (a skipped `needs` job would skip this release job too). The release
-      # step guards `fail_on_unmatched_files: true`, so at least one `release-asset-*` must match; a repo that drops
-      # every file-producing target (e.g. a Docker-only repo, whose release carries only source zip + README + LICENSE)
-      # relaxes that guard.
+      # Collect assets by the `release-asset-<branch>-*` pattern so this step is target-agnostic.
+      # Subset releases by deleting the target rather than by `enable_*: false`, since a skipped `needs` job would skip this release job too.
+      # The release step guards `fail_on_unmatched_files: true`, so at least one `release-asset-*` must match.
+      # A repo that drops every file-producing target relaxes that guard.
+      # A Docker-only repo is the case, its release carrying only the source zip + README + LICENSE.
       - name: Download release asset artifacts step
         if: ${{ inputs.expect_release_assets }}
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -156,8 +156,8 @@ jobs:
           merge-multiple: true
           path: ./Publish
 
-      # The weekly publisher re-runs even with no new commits, so the version may already be released. Skip the release
-      # step when a release for this tag already exists to avoid a no-op republish.
+      # The weekly publisher re-runs even with no new commits, so the version may already be released.
+      # Skip the release step when a release for this tag already exists, to avoid a no-op republish.
       - name: Check for existing release step
         id: release-exists
         env:
@@ -179,10 +179,10 @@ jobs:
       # `target_commitish` must be set explicitly: otherwise GitHub's REST API tags the release on the default branch.
       # Pin it to `GitCommitId` so the tag is on the exact built commit, consistent with the SemVer2 tag and artifacts.
       # Skip when the release already exists, but always let a manual `workflow_dispatch` through to refresh it.
-      # Every release (any branch, any target) is a tag on the built commit plus the auto-attached source zip, README,
-      # and LICENSE; targets amend it by uploading `release-asset-*` files (binaries/packages) or pushing elsewhere
-      # (image/registry). `fail_on_unmatched_files: true` fails loudly if a promised `release-asset-*` is missing or
-      # misnamed; a no-file-target repo relaxes it (see download step).
+      # Every release, on any branch and for any target, is a tag on the built commit plus the auto-attached source zip, README, and LICENSE.
+      # Targets amend it by uploading `release-asset-*` files (binaries/packages) or by pushing elsewhere (image/registry).
+      # `fail_on_unmatched_files: true` fails loudly if a promised `release-asset-*` is missing or misnamed.
+      # A no-file-target repo relaxes it (see download step).
       - name: Create GitHub release step
         if: ${{ steps.release-exists.outputs.exists == 'false' || github.event_name == 'workflow_dispatch' }}
         uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
@@ -197,16 +197,17 @@ jobs:
             README.md
             ./Publish/*
 
-      # Surgical cleanup at the point of consumption: the release-asset-<branch>-* transfer artifacts now have durable
-      # copies on the release, so delete them by exact pattern to free the storage quota - scoped to this branch's
-      # assets, leaving diagnostics and any other artifacts. Gated to the same condition as the create step so it only
-      # deletes when a release was actually created/refreshed this run; on a skipped create (existing tag, no new
-      # commits) the fresh artifacts stay for the run, reaped by the retention-days: 1 backstop. Needs the caller to
-      # grant `actions: write` (publish-release's publish job does).
+      # Surgical cleanup at the point of consumption, since the release-asset-<branch>-* transfer artifacts now have durable copies on the release.
+      # Delete them by exact pattern to free the storage quota.
+      # The pattern is scoped to this branch's assets, leaving diagnostics and any other artifacts.
+      # It is gated to the same condition as the create step, so it only deletes when a release was actually created or refreshed this run.
+      # On a skipped create (an existing tag, no new commits) the fresh artifacts stay for the run, reaped by the retention-days: 1 backstop.
+      # It needs the caller to grant `actions: write`, which publish-release's publish job does.
       - name: Delete consumed release asset artifacts step
         if: ${{ inputs.expect_release_assets && (steps.release-exists.outputs.exists == 'false' || github.event_name == 'workflow_dispatch') }}
-        # Best-effort: the release is already published, so a listing/delete hiccup must never red the job; the
-        # retention-days: 1 backstop reaps anything missed. Deletes every matching id (a rerun can upload duplicates).
+        # Best-effort, since the release is already published, so a listing or delete hiccup must never red the job.
+        # The retention-days: 1 backstop reaps anything missed.
+        # It deletes every matching id, because a rerun can upload duplicates.
         continue-on-error: true
         env:
           GH_TOKEN: ${{ github.token }}

.markdownlint-cli2.jsonc

@@ -3,9 +3,9 @@
         // Prose paragraphs and data-heavy tables or URLs are intentionally long.
         // Reflowing at 80 columns hurts readability and churns diffs.
         "MD013": false,
-        // MD033 (inline HTML) stays enabled so native markdown wins.
+        // MD033 (inline HTML) stays enabled so native Markdown wins.
         // HTML comments, used as reference-link dividers, pass it.
-        // The details and summary elements are allowed for GitHub collapsibles, which have no markdown equivalent.
+        // The details and summary elements are allowed for GitHub collapsibles, which have no Markdown equivalent.
         // Every other element still flags.
         "MD033": { "allowed_elements": ["details", "summary"] },
         // Require fenced code blocks over the legacy 4-space-indented style.

AGENTS.md

@@ -6,6 +6,19 @@ This file is the entry point every coding agent reads first, and it holds only t
 
 Treat this file and `GOVERNANCE.md` as authoritative for cross-cutting rules, and do not restate their rules elsewhere. This project's own conventions and behavioral contracts live in [`CODESTYLE.md`](./CODESTYLE.md), **not** in [`.github/copilot-instructions.md`](./.github/copilot-instructions.md), because that file targets GitHub Copilot / VS Code specifically, while this file and `GOVERNANCE.md` are the agent-agnostic ones every coding agent is directed to read, so any rule a reviewer must honor has to live in one of those two files to be provider-independent.
 
+## Fleet Bootstrap
+
+This repository is governed by a shared template, and the canonical rules, machine-readable spec, and procedures live in `github.com/ptr727/ProjectTemplate`, the repository these rules call the hub. Fetch that repository before acting on anything about conformance, carried content, repository settings, or standing a repository up, because a carried copy here can be stale or absent and the hub is the only authority on what this repository is supposed to hold. This section is byte-locked across every repository in the fleet, so it reads identically wherever it is found, and it is the entry point whenever nothing else present says where the rules are.
+
+Route by what this repository currently holds rather than by what it is expected to hold, since the two differ exactly when this section matters most.
+
+- **No repository yet, or a local tree with no remote.** Follow the hub's `STANDUP.md` from section 0. That file is hub-only and deliberately not carried, because a repository needing it cannot be relied on to hold a current copy. Note that nothing in it creates the GitHub repository, which is an outward-facing write requiring explicit permission, so section 0A is the list handed to the maintainer before anything else starts.
+- **A repository with no carried instruction set, or a partial one.** Carry the baseline per the hub's `STANDUP.md` sections 1A and 2, which resolve what this repository is owed from its declared types and workflow model. Absent files are not drift to re-vendor, they are a baseline that never arrived, and the two are fixed differently.
+- **A repository with the instruction set, current or stale.** Follow the hub's `RESYNC.md`, which runs `AUDIT.md` end to end for the findings and then applies each one in an order that matters, since the rules govern what comes after them, a deletion must precede the re-vendor that would otherwise refresh the file, and only some findings are mechanically detectable at all. An audit that reports drift and stops is half the procedure.
+- **A repository that believes it is conformant.** Run the audit anyway and commit the report, because conformance asserted without a report is conformance nobody can check. This is the same procedure as the case above and is listed separately only because it is the one most often skipped.
+
+Three rules bound every path above. **Read the hub's `main` branch as ground truth**, since that is the promoted and gated state, and read `develop` only to detect divergence. **Reach the hub as a checkout of your own and fetch it immediately before reading it**, because a clone is whatever it last fetched rather than the branch it names, and work only in that checkout rather than in one that another task is using, per [`GOVERNANCE.md`](./GOVERNANCE.md) "Repository Boundaries and Write Safety" and "Hub-Hosted Tooling". And **the audit is read-only**: it produces a report and never edits the repository it measures, so a fix is a separate, reviewable change.
+
 ## Context and Delegation Discipline
 
 An agent session is billed on the context it carries, not the work it does. Every request re-reads the whole accumulated context, so a token added early is paid for again on every request that follows, and a long session bills its last task for every earlier one. These are cost rules. None of them licenses doing less work, skipping verification, or shipping something unreviewed.
@@ -55,21 +68,24 @@ Every rule below is a level-two section of [`GOVERNANCE.md`](./GOVERNANCE.md). R
 | --- | --- |
 | Why the rules are shaped this way | `Foundational Principles` |
 | Recording a durable lesson or updating governance | `Durable Knowledge and Self-Improvement` |
-| Any push, API mutation, comment, label, or merge | `Repository Boundaries and Write Safety` |
+| Any push, API mutation, comment, label, or merge, or which checkout the work happens in | `Repository Boundaries and Write Safety` |
 | Quoting data into a comment, commit, test, or doc | `Representative Data in Agent-Authored Text` |
-| Committing, signing, rebasing, force-pushing | `Git and Commit Rules` |
-| Branch choice, promotion, keeping branches in sync | `Branching Model` |
-| Releasing, version bumps, publishing | `Release Model` |
-| A live config repo rather than a code repo | `Operational Repositories` |
-| Onboarding a repo or running a conformance sweep | `Repository Onboarding and Conformance` (hub only, not carried) |
-| Writing a commit message or pull request title | `Pull Request Title and Commit Message Conventions` |
-| Any prose, comment, doc, or line-ending change | `Documentation Style Conventions` |
+| Committing, signing, rebasing, force-pushing | `Git and Commit Rules`, packaged as the `git-commit-conventions` Skill |
+| Branch choice, promotion, keeping branches in sync | `Branching Model`, packaged as the `operational-vs-release-workflow` Skill |
+| Releasing, version bumps, publishing | `Release Model`, packaged as the `operational-vs-release-workflow` Skill |
+| A live config repo rather than a code repo | `Operational Repositories`, packaged as the `operational-vs-release-workflow` Skill |
+| Onboarding a repo or running a conformance sweep | `Repository Onboarding and Conformance` (hub only, not carried). Standing up a new repo from a hub checkout is packaged as the `standup-a-repo` Skill, and resyncing one already stood up the same way is `resync-a-repo`, both hub-context only |
+| Running a fleet gate, the review digest, or the config script | `Hub-Hosted Tooling` |
+| Writing a commit message or pull request title | `Pull Request Title and Commit Message Conventions`, packaged as the `comment-and-doc-style` Skill |
+| Any prose, comment, doc, or line-ending change | `Documentation Style Conventions`, packaged as the `comment-and-doc-style` Skill |
 | Proving work actually happened | `Verification Discipline` |
-| Requesting, answering, or closing a review | `PR Review Etiquette` |
+| Requesting, answering, or closing a review | `PR Review Etiquette`, packaged as the `pr-review-conduct` Skill |
 | Reporting progress or asking the user something | `Communicating with the User` |
 | Editing a workflow YAML file | `Workflow YAML Conventions` |
 | Choosing an OS, runtime, or toolchain target | `Supported Development Platforms` |
 | The devcontainer | `Devcontainer` |
 | Editor settings and tasks | `Editor and Tasks` |
 | The About panel, description, or repo toggles | `Repository Details` |
 | Where a file belongs in the tree | `Repository Layout` |
+
+Some of the rules above are also packaged as Claude Code / opencode / Codex Skills, hand-authored at `.agents/skills/` in the hub (not a repo-relative link here, since that path is hub-local and not carried into every fleet repo), so they surface automatically instead of needing to be re-read every session. `scripts/` is hub-hosted and reached rather than carried, per "Hub-Hosted Tooling", so run the installer from a hub checkout: `python3 scripts/skills_install.py` (or the `.sh`/`.ps1` wrapper) once per machine, from `github.com/ptr727/ProjectTemplate`, installs them for every repo touched from that machine. `python3 scripts/skills_install.py --report`, also from a hub checkout, says whether this machine is current. A rule that keeps needing to be restated is a sign the install is missing or stale, not that the rule does not exist. Keeping a repo's own carried `.github/copilot-instructions.md` in sync with the hub, without losing that repo's own "Disproved Claims" ledger entries in the process, is `copilot-instructions-keeper`, a skill about maintaining that file rather than a rule extracted from it, since the file itself is read directly by the Copilot bot and stays fully intact everywhere it is carried. Checking, from inside this repo's own session with no operator watching, whether this repo and this machine are actually current against the hub is `fleet-conformance-check`, new content rather than a rule extracted from a section, the counterpart to `resync-a-repo` that needs no standing hub checkout or named target beyond the repo the session is already in, even though its own check fetches a hub checkout to reach `scripts/skills_install.py`. Opening a pull request against a repository outside this fleet, one the maintainer does not control, follows a different workflow entirely, new content rather than a rule extracted from a section, packaged as `upstream-contribution-workflow` and independent of the target repo's own type or workflow model.