Prepare AgentKit v0.1.0

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml,json}]
+indent_size = 2

.gitattributes

@@ -0,0 +1,12 @@
+* text=auto eol=lf
+*.sh text eol=lf
+bin/* text eol=lf
+libexec/* text eol=lf
+hooks/* text eol=lf
+*.md text eol=lf
+*.json text eol=lf
+*.jsonl text eol=lf
+*.png binary
+*.jpg binary
+*.zip binary
+*.gz binary

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+* @UtmostCreator
+/.github/ @UtmostCreator
+/install.sh @UtmostCreator
+/uninstall.sh @UtmostCreator
+/lib/exec-guard/ @UtmostCreator
+/lib/policy.sh @UtmostCreator
+/lib/secrets.sh @UtmostCreator
+/lib/log-redaction.sh @UtmostCreator

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,50 @@
+name: Bug report
+description: Report reproducible incorrect behavior
+title: "bug: "
+labels: [bug, triage]
+body:
+  - type: markdown
+    attributes:
+      value: Do not include secrets or private repository/session data.
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      placeholder: v0.1.0 or commit SHA
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      placeholder: Ubuntu 24.04, Bash 5.2
+    validations:
+      required: true
+  - type: textarea
+    id: command
+    attributes:
+      label: Command and sanitized output
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior and minimal reproduction
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I removed secrets and private data.
+          required: true
+        - label: I searched existing issues.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Usage questions and design discussion
+    url: https://github.com/UtmostCreator/agent-kit/discussions
+    about: Ask questions or discuss broad proposals.
+  - name: Security vulnerability
+    url: https://github.com/UtmostCreator/agent-kit/security/advisories/new
+    about: Report vulnerabilities privately.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,30 @@
+name: Feature request
+description: Propose a bounded improvement
+title: "feat: "
+labels: [enhancement, triage]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What repository-operation problem is not adequately solved?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed contract
+      description: Include inputs, outputs, scope, failure behavior, and safety implications.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: checkboxes
+    id: compatibility
+    attributes:
+      label: Compatibility
+      options:
+        - label: This can preserve existing command and output contracts.
+        - label: This requires a documented breaking change.

.github/copilot-instructions.md

@@ -0,0 +1,14 @@
+# Repository instructions
+
+Follow the canonical instructions in `AGENTS.md`.
+
+This is a Bash-based safety toolkit for coding-agent repository operations. Prefer existing `agent-kit` commands and shared modules over ad hoc shell logic. Preserve scope checks, execution guards, snapshots, rollback, redaction, machine-readable output, and exit-code contracts.
+
+Never commit `.ai-logs/`, session data, context packs, credentials, or local environment files. Do not bypass a safety control to make a test pass. Add tests for behavior changes and run:
+
+```bash
+./scripts/check.sh
+./scripts/check-publishable.sh
+```
+
+Report exact verification evidence and any checks that could not be run.

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 7

.github/instructions/shell.instructions.md

@@ -0,0 +1,5 @@
+---
+applyTo: "**/*.sh,bin/**,libexec/**,hooks/**"
+---
+
+Use Bash 4.4+ conventions unless the file declares another shell. Quote expansions, use arrays for argument lists, validate untrusted input, use `--` before positional paths where supported, and avoid `eval`. Use secure temporary directories and cleanup traps. Preserve stdout/stderr and exit-code contracts. Put reusable logic in `lib/` and keep command entry points thin. Add or update shell tests for every behavior change.

.github/pull_request_template.md

@@ -0,0 +1,21 @@
+## Summary
+
+<!-- What changed and why? -->
+
+## Scope
+
+<!-- Files and behavior intentionally changed; note excluded areas. -->
+
+## Verification
+
+```text
+Exact commands and results
+```
+
+## Risk
+
+- [ ] Output or schema contract changed
+- [ ] Security boundary changed
+- [ ] Installation or release behavior changed
+- [ ] Backward compatibility changed
+- [ ] Generated/session data checked and excluded

.github/workflows/ci.yml

@@ -0,0 +1,125 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  checks:
+    name: checks
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04]
+    timeout-minutes: 20
+
+    steps:
+      - name: Harden the runner (audit-only; observes egress, never blocks)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact event revision without external actions
+        env:
+          REPOSITORY: ${{ github.repository }}
+          EVENT_NAME: ${{ github.event_name }}
+          COMMIT_SHA: ${{ github.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin "https://github.com/${REPOSITORY}.git"
+          if [[ "$EVENT_NAME" == "pull_request" ]]; then
+            git fetch --no-tags --depth=1 origin "refs/pull/${PR_NUMBER}/merge"
+          else
+            git fetch --no-tags --depth=1 origin "${COMMIT_SHA}"
+          fi
+          git checkout --detach FETCH_HEAD
+
+      - name: Install validation tools
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends shellcheck jq ripgrep
+
+      - name: Validate publication boundary
+        run: ./scripts/check-publishable.sh
+
+      - name: Run lint and tests
+        run: ./scripts/check.sh
+
+  workflow-security:
+    name: workflow-security
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Harden the runner (audit-only; observes egress, never blocks)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact event revision without external actions
+        env:
+          REPOSITORY: ${{ github.repository }}
+          EVENT_NAME: ${{ github.event_name }}
+          COMMIT_SHA: ${{ github.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin "https://github.com/${REPOSITORY}.git"
+          if [[ "$EVENT_NAME" == "pull_request" ]]; then
+            git fetch --no-tags --depth=1 origin "refs/pull/${PR_NUMBER}/merge"
+          else
+            git fetch --no-tags --depth=1 origin "${COMMIT_SHA}"
+          fi
+          git checkout --detach FETCH_HEAD
+
+      - name: Install pinned actionlint + zizmor (checksum-verified)
+        run: |
+          set -euo pipefail
+          cd "$(mktemp -d)"
+          curl -fsSL -o actionlint.tar.gz \
+            "https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz"
+          echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  actionlint.tar.gz" | sha256sum -c -
+          tar xzf actionlint.tar.gz actionlint
+          sudo install -m 0755 actionlint /usr/local/bin/actionlint
+
+          curl -fsSL -o zizmor.tar.gz \
+            "https://github.com/zizmorcore/zizmor/releases/download/v1.27.0/zizmor-x86_64-unknown-linux-gnu.tar.gz"
+          echo "277f2bd8fd37cf60c42ab7afca6faa884e65440fa31e02b44bdaae60f62a358f  zizmor.tar.gz" | sha256sum -c -
+          tar xzf zizmor.tar.gz zizmor
+          sudo install -m 0755 zizmor /usr/local/bin/zizmor
+
+          actionlint -version
+          zizmor --version
+
+      - name: actionlint
+        run: actionlint -color
+
+      - name: zizmor
+        run: zizmor --strict-collection --persona=regular --min-severity=medium .
+
+  required:
+    name: required
+    if: ${{ always() }}
+    needs: [checks, workflow-security]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Confirm matrix and workflow-security success
+        env:
+          CHECKS_RESULT: ${{ needs.checks.result }}
+          WORKFLOW_SECURITY_RESULT: ${{ needs.workflow-security.result }}
+        run: |
+          set -euo pipefail
+          [[ "$CHECKS_RESULT" == "success" && "$WORKFLOW_SECURITY_RESULT" == "success" ]]

.github/workflows/release.yml

@@ -0,0 +1,89 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: write
+
+    steps:
+      - name: Harden the runner (audit-only; observes egress, never blocks)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact tag without external actions
+        env:
+          REPOSITORY: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          git init .
+          git remote add origin "https://github.com/${REPOSITORY}.git"
+          git fetch --no-tags --depth=1 origin "refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}"
+          git checkout --detach "refs/tags/${RELEASE_TAG}"
+
+      - name: Install validation tools
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends shellcheck jq ripgrep zip
+
+      - name: Validate and test
+        run: |
+          set -euo pipefail
+          ./scripts/check-publishable.sh
+          ./scripts/check.sh
+
+      - name: Build release archives
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: ./scripts/package-release.sh "${RELEASE_TAG}"
+
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          gh release create "${RELEASE_TAG}" dist/* \
+            --verify-tag \
+            --generate-notes \
+            --title "AgentKit ${RELEASE_TAG}"
+
+  attest:
+    name: attest
+    needs: release
+    runs-on: ubuntu-24.04
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
+    steps:
+      - name: Harden the runner (audit-only; observes egress, never blocks)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Download the just-published release asset
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          gh release download "${RELEASE_TAG}" --repo "${{ github.repository }}" \
+            --pattern '*.tar.gz' --dir dist
+
+      - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: 'dist/agent-kit-*.tar.gz'