The first release, v0.1.0

.claude/CLAUDE.md

@@ -0,0 +1,5 @@
+# CLAUDE.md
+
+<!-- kit:generate .claude/CLAUDE.md -->
+@../AGENTS.md
+<!-- kit:end .claude/CLAUDE.md -->

.claude/settings.json

@@ -0,0 +1,30 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "kit context --claude"
+          }
+        ]
+      }
+    ]
+  },
+  "permissions": {
+    "deny": [
+      "Bash(git rebase *)",
+      "Bash(git worktree add *)",
+      "Bash(git checkout -b *)",
+      "Bash(git switch -c *)",
+      "Bash(git worktree remove *)",
+      "Bash(git branch -D *)",
+      "Bash(git checkout main *)",
+      "Bash(git switch main *)",
+      "Bash(git reset --hard *)",
+      "Bash(git push --force *)",
+      "Bash(git push -f *)"
+    ]
+  }
+}

.editorconfig

@@ -0,0 +1,18 @@
+# .editorconfig - see: https://editorconfig.org
+# ----------------------------------------------------------------------------------------------------------------------
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+# a trailing double space is a hard break
+[*.md]
+trim_trailing_whitespace = false
+
+# ----------------------------------------------------------------------------------------------------------------------

.gitattributes

@@ -0,0 +1,7 @@
+# .gitattributes - how git and the forge treat paths
+# ----------------------------------------------------------------------------------------------------------------------
+
+# mise writes these lock files; marked generated, the forge folds their diffs, and kit lint holds them to no template.
+/.mise/locks/** linguist-generated
+
+# ----------------------------------------------------------------------------------------------------------------------

.github/dependabot.yml

@@ -0,0 +1,18 @@
+# dependabot.yml - keeps the SHA-pinned actions in the workflows current
+# ----------------------------------------------------------------------------------------------------------------------
+#
+# Every `uses:` in .github/workflows/ is pinned to a full commit SHA with the version as a trailing comment, and a
+# SHA never advances on its own. Dependabot's github-actions ecosystem opens a pull request that moves the SHA and
+# the comment together, weekly. The tools come from mise.toml, which Dependabot does not read; `mise outdated`
+# answers for those.
+#
+# see: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+
+# ----------------------------------------------------------------------------------------------------------------------

.github/workflows/kit-ci.yml

@@ -0,0 +1,82 @@
+# kit-ci.yml - the check the kit delivers for GitHub Actions: kit ci on every pull request into the default branch
+# ----------------------------------------------------------------------------------------------------------------------
+#
+# Runs one job, CI, on each pull request into the default branch. CI is the check name a ruleset requires. The job:
+#
+#   1. puts mise on the runner, when the repository has a mise.toml (brew and docker are already on GitHub's
+#      runners)
+#   2. puts kit on PATH: the release .kit/manifest records, downloaded from its public URL, or this checkout's own
+#      bin/ when the manifest records unreleased
+#   3. installs the gate's tools with `kit toolchain install`, whichever of mise, brew, or docker manages them
+#   4. runs `kit ci`: the gate, `kit check`, `kit linked`, and `kit policy`, and reports every result
+#
+# Delivered by kit, not edited by hand. A change is a new release, then kit update. runs-on is the ci_runner value
+# under answers: in .kit/settings.yml.
+#
+# see: .kit/1st.md
+
+name: kit
+
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
+jobs:
+  CI:
+    if: github.event.pull_request.base.ref == github.event.repository.default_branch
+    runs-on: "ubuntu-latest"
+    env:
+      # mise also reads mise.ci.toml, on top of mise.toml, for the tools only a runner needs.
+      MISE_ENV: ci
+    steps:
+      - name: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          # kit policy reads every commit since the branch forked from the default branch.
+          fetch-depth: 0
+
+      - name: mise-on-path
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c  # v4.3.0
+        if: ${{ hashFiles('mise.toml', '.mise.toml') != '' }}
+        with:
+          install: false
+
+      - name: kit-on-path
+        run: |
+          set -o errexit -o nounset -o pipefail
+          if [[ ! -f .kit/manifest ]]
+          then
+            echo '::error::run kit install and commit what it writes; this repository has no .kit/manifest'
+            exit 1
+          fi
+          version=$(sed -n 's/^version //p' .kit/manifest)
+          if [[ "${version}" == unreleased && -x bin/kit ]]
+          then
+            printf '%s/bin\n' "${PWD}" >> "${GITHUB_PATH}"
+          elif [[ "${version}" == unreleased ]]
+          then
+            echo '::error::.kit/manifest says unreleased and there is no bin/kit; pin a release and run kit update'
+            exit 1
+          elif ! command -v kit >/dev/null
+          then
+            mkdir -p "${RUNNER_TEMP}/kit"
+            curl --fail --silent --location \
+              "https://github.com/empowerite/kit/releases/download/release/${version}/kit-${version}.tar.gz" \
+              | tar --extract --gzip --directory "${RUNNER_TEMP}/kit" --strip-components 1
+            printf '%s/kit/bin\n' "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
+          fi
+
+      - name: toolchain
+        run: kit toolchain install && kit toolchain path >> "${GITHUB_PATH}"
+
+      - name: kit-ci
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: kit ci
+
+# ----------------------------------------------------------------------------------------------------------------------

.github/workflows/release.yml

@@ -0,0 +1,47 @@
+# release.yml - pushing a release tag publishes the kit as a GitHub release
+# ----------------------------------------------------------------------------------------------------------------------
+#
+# Pushing a tag such as release/0.1.0 runs this workflow. It has two steps, and each step is one kit command, so
+# the same thing can be run on a laptop:
+#
+#   kit release verify    checks the tag. A release tag, release/0.1.0, must point at a commit on main. A
+#                         pre-release tag, release/0.1.0-rc.1, must point at a commit that is not on main. Any
+#                         other tag is refused.
+#   kit release publish   packs this checkout into kit-<version>.tar.gz, writes the version after release/ into
+#                         it, and publishes it as a GitHub release named by that version. A version with a
+#                         suffix is published as a pre-release.
+#
+# GitHub does not let a published release change, so a version is tagged once and never again. A release is
+# published here and nowhere else: kit release publish refuses a release tag anywhere but on the runner, so a
+# desk cannot publish one by hand. A desk may publish a pre-release. A pre-release is deleted when the branch it
+# was tagged on is deleted; see retire-pre-releases.yml.
+#
+# see: bin/kit-release.sh
+
+name: release
+
+on:
+  push:
+    tags: ['release/*']
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: verify
+        run: bin/kit release verify "${GITHUB_REF_NAME}"
+
+      - name: publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bin/kit release publish "${GITHUB_REF_NAME}"
+
+# ----------------------------------------------------------------------------------------------------------------------

.github/workflows/retire-pre-releases.yml

@@ -0,0 +1,33 @@
+# retire-pre-releases.yml - deleting a branch deletes the pre-releases that were made from it
+# ----------------------------------------------------------------------------------------------------------------------
+#
+# Deleting a branch on GitHub runs this workflow. Its one step is one kit command: kit release retire deletes
+# every pre-release, tag included, whose commit is no longer on any branch. A release is never deleted, because
+# it is on main and main is never deleted. Deleting a tag also sends a delete event, and that one is ignored.
+#
+# see: bin/kit-release.sh, .github/workflows/release.yml
+
+name: retire-pre-releases
+
+on:
+  delete:
+
+permissions:
+  contents: write
+
+jobs:
+  retire:
+    if: github.event.ref_type == 'branch'
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: retire
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bin/kit release retire
+
+# ----------------------------------------------------------------------------------------------------------------------

.gitignore

@@ -0,0 +1,9 @@
+# .gitignore - untracked files and folders
+# ----------------------------------------------------------------------------------------------------------------------
+
+# kit:generate .gitignore
+# per-issue worktrees for agents; see: .kit/1st.md
+/worktrees/
+# kit:end .gitignore
+
+# ----------------------------------------------------------------------------------------------------------------------