ai-kit-python 1.4.4__tar.gz → 1.4.6__tar.gz

{ai_kit_python-1.4.4 → ai_kit_python-1.4.6}/.agents/skills/project-continuity/SKILL.md

@@ -15,19 +15,20 @@ Exercise file-versus-directory native rule layouts on both probe and selected-wr
 Exercise manifest-based profile detection and project-fact drafts (version/commands into PROJECT_CONTEXT and project.json), scoped Node/Python ignore rules, the installed-project doctor report, opt-in extras (session-start, guards, CI) including key-level client settings merges, legacy whole-file migration, and hook execution, client detection markers, interactive/check onboarding, the adr/changelog helpers, and the offline router helper (route/configure with provider selection) when installer behavior changes.
 For generated client configuration, exercise private/team settings files and mode switches, owned-entry moves, project.json precedence, secret lists, ignore blocks, every scoped rule format with root modules and skipped paths, presets that turn extras off, and workflow skill copies; recheck client formats against primary docs before changing them.
 For routing, compare the implementation ladder with canonical POLICY, exercise English/Russian operation/risk regressions and override precedence, provider-review status/sources, and distinguish recommendations from executed model controls. For stack profiles, exercise manifest evidence, module scoping, and command drafting; for Filament specifically test Composer dependency/lock evidence and source/native skill lifecycle. For optional metrics, verify failure/recovery accounting, missing-value coverage, duplicate/lock/path guards, private/team journal visibility, schema 1/2 compatibility, experiment/arm/task identity, per-provider analyze output, and upgrade preservation. Exercise context snapshots and doctor warnings for new/removed modules, profile drift, and manifest changes. Exercise adapter reports plus explicit retirement of unchanged files, backups/state updates, and modified-file conflicts. Exercise opaque evaluator pair coverage without task-text persistence. Use the [evaluation protocol](../../../docs/EVALUATION.md) for separately authorized application trials; synthetic fixtures establish no savings.
-Record actual OS/runtime and unavailable checks in the implementation record; keep source visibility checks separate from client activation.
+Record runtime gaps separately from static/source checks.
 For measurement-led changes, test schema 1/2/3 compatibility, fixed A/B controls, immutable Git blobs and isolated repeated workspaces, missing/estimated telemetry, semantic-review gates, interrupted runs and idempotent private exports. Exercise resume identity checks, per-unit failure recording and configurable kit-arm agents/presets. Check that worker Git discovery cannot reach the source through parents: a ceiling at cwd itself is ineffective. Keep worker requests separate from observed execution. Exercise routing modes/pins/profiles, distinct-case quality floors, matched history, unsupported controls, immutable proposal history and explicit backed-up restore. Exercise module context scope, duplicate content, critical rules/ADRs above byte budgets and linked paths. Follow [the staged plan](../../../docs/DEVELOPMENT_PLAN.md) and [worker contract](../../../docs/BENCHMARK.md); keep native activation and real trials separate. For [optional orchestration](../../../docs/ORCHESTRATION.md), test opt-in/persistence, Codex helper conflicts/retirement, private/team/archive exclusions, bounded inputs/keys/budgets, reservations/locks, unknown billing, source-bound review and reconciliation without replay. Keep native costs separate; tests make no live calls.
 Resolve temporary fixture roots before deriving paths used by guards, assertions, or injected failures. Test equivalent path spellings; keep cleanup bound to original disposable directories. [Windows CI regression](../../../docs/WINDOWS_CI_FIX.md) records the relevant scenario.
-For reference upgrades, check the actual published tree and old paths left by overlays. Compatibility pointers link to canonical owners; never hide broken legacy links from the checker.
-Verify onboarding examples against CLI/defaults and canonical policy; distinguish installation, discovery and execution evidence. For [OpenRouter documentation](../../../README.md#working-with-openrouter), recheck primary API/cache/usage docs; distinguish shipped context manifests from proposed request assembly/runtime, prompt caching from response reuse, and observed usage from assumed savings. Root README and Docker Hub Overview have no size quota; retain scoped instruction budgets and normal link/language checks.
+For reference upgrades verify the published tree and overlay leftovers; preserve canonical links and checker coverage.
+Verify [installer flags](../../../docs/guide/INSTALLER_FLAGS.md) against argparse and selection precedence; check [Windows](../../../docs/guide/WINDOWS.md) examples and actual client activation. For [OpenRouter documentation](../../../docs/guide/OPENROUTER.md), recheck primary API/cache/usage docs; distinguish shipped context manifests from proposed request assembly/runtime, prompt caching from response reuse, and observed usage from assumed savings. README/Overview are unbounded; keep instruction budgets and link/language checks.
 For [PyPI releases](../../../docs/PYPI.md), verify metadata, VERSION, licenses, description, resources and private/path exclusions; build the wheel from sdist and smoke-install offline. Quote Twine globs; report OS gaps. A JSON 404 does not prove name eligibility. Test release/manual identity guards without uploads; preserve CI names and old tags. Published stable releases prepare PyPI artifacts; manual runs default to validation. Require exact version/tag/repository gates, owner approval and future tag coverage; agents must not approve deployments. OIDC belongs only in upload jobs consuming validated same-run artifacts. Keep setup, upload and live MCP activation separate.
 For repository administration or changes to existing required CI names, consult [repository maintenance](../../../CONTRIBUTING.md#repository-maintenance), verify live protection and emitted names, and keep required checks aligned. New local jobs establish no hosted result or required-check update. Remote changes need explicit authorization; Core governs commits/pushes.
-For every task assess [Docker image impact](../../../docs/DOCKER.md#change-impact-and-image-refresh), including packaged instructions and defaults. Follow canonical [image freshness](../../../template/ai-kit/CONTAINERS.md#image-freshness); rebuild/test affected final sources as ai-kit:dev or record why no rebuild is needed. For the image, verify actual client/daemon, pinned build inputs, VERSION/label identity, closed context, wheel resources, non-root bind permissions, read-only/offline preview and apply, preservation, conflicts, rerun and SIGTERM. Validate the Job schema; distinguish cluster/runtime coverage. Record test cache/volume ownership and size; follow canonical cleanup without shared-builder pruning. Keep image publication separate.
+Assess [Docker impact](../../../docs/DOCKER.md#change-impact-and-image-refresh) on every task, including installed guidance. Rebuild/test affected final sources as ai-kit:dev or record a descriptive-only exception. Verify client/daemon, pins, VERSION/labels, closed context, wheel resources, non-root mounts, offline/read-only preview/apply, preservation, reruns, signals and Job schema. Follow [canonical cleanup](../../../template/ai-kit/CONTAINERS.md#post-test-docker-cleanup): no threshold, zero eligible disposable resources, dedicated-builder cache, protected persistent/unrelated data and separately measured RAM/disk reclamation. Check actual backend, VHDX identity and idle maintenance scope; never infer compaction from prune. Upgrade tests must preserve adapted container rules/AGENTS through candidates. Record actual runtime gaps; publication needs its authorization.
 For [dialogue memory](../../../docs/DIALOGUE_MEMORY.md), test all supported imports, selected ChatGPT branches, omissions, untrusted roles, pending prose, explicit keyed conflicts/resolutions, source-bound review, immutable reruns, both exports and byte limits. Exercise linked/blocked paths, private/team upgrade preservation, Git/build/package exclusions and installed CLI execution. Do not infer semantic agreement from no keyed conflicts or claim live sync/upload from local export. Preserve raw sources and default project context.
 For optional upstream skills, follow [security-audit](../../../docs/SECURITY_AUDIT.md) and [Strix integration](../../../docs/STRIX.md): preserve pinned bytes/license and newline attributes, verify bounded tree coverage/digests and nested-path aliases, explicit-only metadata, absent default/preset payloads, independent persistent choices, local adaptations/conflicts, links, visibility and wheel resources. Exempt only verified external examples from authored model/language/budget checks. Keep installation separate from audits/runtime setup; report unsupported validators. For Strix, check writable copy isolation, explicit full/diff scope, budget/data destination and no implicit cloud fallback; integration tests must start no scan, model or container.
 For [Context7](../../../docs/CONTEXT7.md), check opt-in skill/registry selection, independent persistence, source/native copies, local conflicts and unchanged native MCP configuration. Keep normal skill discovery, version-aware sanitized queries and remote activation separate. Recheck client schemas/authentication against primary docs; a source revision does not pin the hosted service.
 For [Web Design](../../../docs/WEB_DESIGN.md), check whole-module default absence, multi-entry skill selection, independent persistence, created-once project documents, native copies/retirement, local conflicts and linked/blocked paths. Exercise workflow context scope, required design memory above budgets, plain HTML without assumed stack facts, private raw output/team visibility and offline wheel resources. Keep TypeUI/SkillUI setup and real browser/Laravel acceptance separate from installer evidence; adopt external guidance only within the selected stack/visual system.
-For a requested release, synchronize VERSION, root changelog, README, WIKI and maintainer context; keep kit history out of templates. Recheck CLI/version, kit, isolated archives, offline installation and prior-version upgrade preservation. Distinguish checks before/after labeling. Follow [the verified release path](../../../docs/V1_4_3.md#pypi-publication-and-read-back): preserve tags, wait for hosted build checks and report pending human approval; never approve PyPI for the owner. Git authorization follows Core. Release notes must distinguish installed guidance from external tools, live client/model setup and generated-site acceptance; verify security examples against pinned contracts.
+For a requested release, synchronize VERSION, root changelog, README, WIKI and maintainer context; keep kit history out of templates. Recheck CLI/version, kit, isolated archives, offline installation and prior-version upgrade preservation. Distinguish checks before/after labeling. Follow [the release path](../../../docs/V1_4_5.md#pypi-publication-status): preserve tags, wait for hosted build checks and report pending human approval; never approve PyPI for the owner. Git authorization follows Core. Release notes must distinguish installed guidance from external tools, live client/model setup and generated-site acceptance; verify security examples against pinned contracts.
+Keep every distribution byte-identical: `.gitattributes` pins LF (vendor bytes stay -text), Docker smoke rejects CR in packaged text, and images are built from a clean `git archive` export with AIKIT_VERSION and AIKIT_REVISION. Upgrades must treat line-ending-only differences as unchanged. Keep the PyPI build job on hash-pinned tools, twine in its own job and digest verification before upload; `tests/test_workflow_security.py` guards these properties and pinned action SHAs. Tracked root entries (CLAUDE/KIMI/MANUS) must work without local maintainer files. The project CI template validates committed files only. Keep `docker_cleanup` modes (maximum default, keep-cache) consistent across CONTAINERS, AGENTS, settings, installer and docs.
 For every Docker image release, follow the [Docker Hub checklist](../../../CONTRIBUTING.md#docker-hub-releases) and update the complete [Overview](../../../docs/DOCKER_HUB_OVERVIEW.md); synchronize version/features/examples before building and verified publication identity afterward.
-For Docker releases, follow [image verification](../../../docs/V1_4_3.md#docker-hub-143); keep local image identity distinct from a registry digest and source-bound human review distinct from automatic conversation synchronization. After explicitly authorized publication, read back the registry digest, platform and version/configuration; preserve the prepared image and record later publication-only documentation separately. Do not assign additional tags implicitly.
-Do not bootstrap the reference repository as an application or imply native/runtime checks passed from static validation.
+For Docker releases, follow [image verification](../../../docs/V1_4_6.md#verification); keep local image identity distinct from a registry digest and source-bound human review distinct from automatic conversation synchronization. After explicitly authorized publication, read back the registry digest, platform and version/configuration; preserve the prepared image and record later publication-only documentation separately. Do not assign additional tags implicitly.
+Do not bootstrap this kit as an application or infer runtime success from static checks.

{ai_kit_python-1.4.4 → ai_kit_python-1.4.6}/.gitattributes

@@ -1,3 +1,5 @@
+# Every checkout, wheel and image carries LF text, so installed-file hashes match across platforms.
+* text=auto eol=lf
 # Pinned third-party bytes must survive Windows checkout without newline conversion.
 template/ai-kit/vendor/security-audit/** -text
 template/ai-kit/vendor/strix/** -text

{ai_kit_python-1.4.4 → ai_kit_python-1.4.6}/.github/workflows/publish-pypi.yml

@@ -31,6 +31,8 @@ jobs:
       (github.event_name == 'release' && github.event.action == 'published' &&
        !github.event.release.draft && !github.event.release.prerelease)
     runs-on: ubuntu-latest
+    outputs:
+      sha256: ${{ steps.digests.outputs.sha256 }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -47,17 +49,24 @@ jobs:
         run: |
           python scripts/check_kit.py
           python -m unittest discover -s tests -v
-      - name: Install reviewed build and validation tools
-        run: |
-          python -m pip install --require-hashes -r docker/build-requirements.txt
-          python -m pip install -r docker/pypi-requirements.txt
+      # Only hash-pinned tools run in the job that produces the published files.
+      - name: Install hash-pinned build tools
+        run: python -m pip install --require-hashes -r docker/build-requirements.txt
       - name: Build source archive and wheel from that source archive
         run: python tests/build_distribution.py "${{ runner.temp }}/pypi-dist"
-      - name: Validate archives, description and installed CLI
+      - name: Validate archives and installed CLI
         run: |
           python scripts/check_distribution.py archives "${{ runner.temp }}/pypi-dist"
-          python -m twine check --strict "${{ runner.temp }}/pypi-dist/*"
           python tests/wheel_smoke.py "${{ runner.temp }}/pypi-dist"
+      - name: Record artifact digests for the upload jobs
+        id: digests
+        working-directory: ${{ runner.temp }}/pypi-dist
+        run: |
+          {
+            echo 'sha256<<AIKIT_SHA256_END'
+            sha256sum -- *
+            echo 'AIKIT_SHA256_END'
+          } >> "$GITHUB_OUTPUT"
       - name: Retain the exact validated distributions
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2, verified 2026-10-16
         with:
@@ -66,10 +75,28 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
-  testpypi:
+  # twine and its unpinned dependencies run apart from the build; upload jobs re-verify digests.
+  twine-check:
     needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: '3.13'
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2, verified 2026-10-16
+        with:
+          name: python-distributions
+          path: dist/
+      - name: Check package descriptions with twine
+        run: |
+          python -m pip install twine==7.0.0
+          python -m twine check --strict dist/*
+
+  testpypi:
+    needs: [build, twine-check]
     if: >-
-      needs.build.result == 'success' && github.event_name == 'workflow_dispatch' &&
+      needs.build.result == 'success' && needs.twine-check.result == 'success' &&
+      github.event_name == 'workflow_dispatch' &&
       inputs.destination == 'testpypi' && github.repository == 'tigusigalpa/ai-kit' &&
       startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
@@ -83,6 +110,14 @@ jobs:
         with:
           name: python-distributions
           path: dist/
+      - name: Verify artifacts match the build job digests
+        working-directory: dist
+        env:
+          EXPECTED_SHA256: ${{ needs.build.outputs.sha256 }}
+        run: |
+          printf '%s\n' "$EXPECTED_SHA256" > ../SHA256SUMS
+          test "$(ls -1 | wc -l)" -eq "$(grep -c . ../SHA256SUMS)"
+          sha256sum --check --strict ../SHA256SUMS
       - name: Upload only the validated artifacts to TestPyPI
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2, verified 2026-10-16
         with:
@@ -92,9 +127,9 @@ jobs:
           skip-existing: false
 
   pypi:
-    needs: build
+    needs: [build, twine-check]
     if: >-
-      needs.build.result == 'success' &&
+      needs.build.result == 'success' && needs.twine-check.result == 'success' &&
       (github.event_name == 'release' || inputs.destination == 'pypi') &&
       github.repository == 'tigusigalpa/ai-kit' && startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
@@ -108,6 +143,14 @@ jobs:
         with:
           name: python-distributions
           path: dist/
+      - name: Verify artifacts match the build job digests
+        working-directory: dist
+        env:
+          EXPECTED_SHA256: ${{ needs.build.outputs.sha256 }}
+        run: |
+          printf '%s\n' "$EXPECTED_SHA256" > ../SHA256SUMS
+          test "$(ls -1 | wc -l)" -eq "$(grep -c . ../SHA256SUMS)"
+          sha256sum --check --strict ../SHA256SUMS
       - name: Upload only the validated artifacts to PyPI
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2, verified 2026-10-16
         with:

{ai_kit_python-1.4.4 → ai_kit_python-1.4.6}/.gitignore

@@ -5,6 +5,7 @@
 /AGENTS.md
 /PROJECT_CONTEXT.md
 /WIKI.md
+/CLAUDE.local.md
 /ai-kit/.upstream-cache/
 /ai-kit/.metrics/
 /ai-kit/.memory/

{ai_kit_python-1.4.4 → ai_kit_python-1.4.6}/CHANGELOG.md

@@ -1,10 +1,37 @@
 # AI-KIT changelog
 
-## v1.4.4 (unreleased)
+## v1.4.6 (2026-10-30)
 
-- Added a prominent README comparison of the Docker image and Python package, with registry links, requirements, install commands and setup guides.
-- Added opt-in Codex helpers and a bounded OpenRouter text executor: explicit scope, capped-key preflight, durable reservations, private accounting, source-bound review and billing reconciliation without replay.
-- Preserved installer defaults, presets, settings, helper edits and private/team runtime exclusions; added mocked regressions, detailed [instructions](README.md#optional-orchestration), package/image preparation and [verification](docs/V1_4_4.md).
+For installed projects:
+
+- Kit text is LF in every distribution (`* text=auto eol=lf`), so Git checkouts, the PyPI wheel and the Docker image carry identical bytes. Upgrades treat line-ending-only differences as unchanged: earlier CRLF installations neither rewrite nor conflict.
+- The `--with-ci` workflow validates committed AI-KIT files with pinned actions; it no longer clones an unpinned AI-KIT or reinstalls on every push. The private-mode warning now explains that team mode keeps the files to check.
+- New `docker_cleanup` setting and `--docker-cleanup maximum|keep-cache` flag. `maximum` (default) keeps the v1.4.5 policy; `keep-cache` still removes task-owned resources but keeps the dedicated project builder cache and reclaims host RAM/disk only on request or pressure. CONTAINERS regains its full Kubernetes wording.
+- Fresh installs no longer refuse projects with linked manifests or unusual module directory names; secondary stacks (Rust, .NET, Java, Infra) fill missing commands instead of replacing pytest/npm/Go commands; `./mvnw`/`./gradlew` wrappers are no longer auto-allowed.
+- `--with-security-audit` stops installing upstream `*.test.cjs` files that host test runners collected (still verified in the manifest); remove old copies from `ai-kit/vendor/security-audit/` manually. Delegated audit prompts must mark target content as untrusted data.
+- Doctor: `--fix` previews and `--fix --apply` writes; non-UTF-8 Markdown, environment/build folders and private dialogue/design/orchestration data no longer crash, flood or leak into reports; a malformed project.json is a warning. `install --apply --check` reports a doctor failure after successful writes accurately.
+- Memory imports keep labels such as Turkish "İ" as notes instead of aborting; `context snapshot` backs up project.json and keeps non-ASCII text readable; writer locks explain recovery; atomic writes fsync.
+
+CLI, packaging and image:
+
+- The CLI handles SIGTERM as PID 1 (Kubernetes Jobs, `docker run` without `--init`); smoke tests cover both. The image label declares `MIT AND Apache-2.0` and records the source revision; images are built from a clean LF export.
+- The PyPI build job installs only hash-pinned tools (now including `build` and its Python 3.10 `tomli` dependency), records artifact SHA-256 digests, and leaves twine to a separate job; upload jobs verify the digests before publishing. A workflow-security test guards pinned actions, token scope and these steps.
+- README is a 23 KB landing page with install paths (PyPI `ai-kit-python`, the image, a checkout), visible defaults (Russian chat, owner conventions) and honest feature wording; the reference material moved to [user guides](docs/guide/README.md). README installer flag tables, defaults, persistence and command examples now live in the [flag reference](docs/guide/INSTALLER_FLAGS.md).
+- Tracked CLAUDE.md, KIMI.md and MANUS.md point to CONTRIBUTING.md and work in a clean clone; a local ignored CLAUDE.local.md can import the private AGENTS.md. The conditional document budget rises to 24000 bytes; always-loaded budgets stay 2500/3000.
+- README features the [documentation site](https://tigusigalpa.github.io/ai-kit-docs/) (command configurator, CLI installation, flag reference) in a highlighted block, badge and navigation link; the guides index, PyPI description, Docker Hub Overview, SKILL.md and the PyPI `Documentation` project URL point to it.
+- [Decision](docs/adr/0016-consistent-distributions-and-safer-defaults.md), [release record](docs/V1_4_6.md).
+
+## v1.4.5 (2026-10-30)
+
+- Require maximum disposable Docker cleanup after every build/test/debug task, without a size/age threshold; include containers, volumes, networks, unnecessary test images and dedicated-builder cache.
+- Require separate host RAM/disk reclamation, supported WSL2 settings and offline compaction; preserve persistent data, unrelated workloads and reviewed retention scope.
+- Updated installed AGENTS/docs; tested private/team upgrades and conflicts; published/verified Docker Hub and owner-approved PyPI 1.4.5, including a fresh registry installation. [Release record](docs/V1_4_5.md).
+- Added a detailed Windows README guide covering setup, inherited/stale PATH, persistent user PATH, isolated CLI, common errors and project updates.
+
+## v1.4.4 (2026-10-18)
+
+- Added opt-in Codex helpers and a bounded OpenRouter executor with capped-key preflight, reservations, private accounting, source-bound review and billing reconciliation; preserved installer defaults/edits and added tests, packaging and instructions.
+- Published and verified Docker Hub/PyPI 1.4.4, exact hosted hashes, registry installation and image behavior; refreshed README/Overview. [Complete entry and evidence](docs/V1_4_4.md).
 
 ## v1.4.3 (2026-10-16)
 
@@ -38,7 +65,7 @@
 
 - Published `tigusigalpa/ai-kit:1.4.0` to Docker Hub at the owner's request. Remote digest, linux/amd64 platform, version label and non-root entrypoint were read back and matched the prepared image; [publication record](docs/V1_4_0.md#docker-hub-publication). No `latest` tag was assigned.
 - Prepared v1.4.0 for the Docker CLI and local dialogue memory. VERSION, CLI/wheel metadata, image label and release pointers use the same version; [release checks and Docker Hub handoff](docs/V1_4_0.md). Registry publication and Git tagging remain separate.
-- Added offline `aikit memory import|merge|export`: three dialogue formats, selected ChatGPT branches, source-bound human review, explicit contradictions and ChatGPT/OpenRouter reference exports. Preserves immutable artifacts, refuses unreviewed normal exports and protects private memory across upgrades/builds. Added tests and detailed [workflow](README.md#shared-context-from-two-dialogues)/[contract](docs/DIALOGUE_MEMORY.md). Automatic sync and API execution remain separate. Archived v1.1.0 history without dropping its text.
+- Added offline `aikit memory import|merge|export`: three dialogue formats, selected ChatGPT branches, source-bound human review, explicit contradictions and ChatGPT/OpenRouter reference exports. Preserves immutable artifacts, refuses unreviewed normal exports and protects private memory across upgrades/builds. Added tests and detailed [workflow](docs/guide/DIALOGUE_MEMORY.md)/[contract](docs/DIALOGUE_MEMORY.md). Automatic sync and API execution remain separate. Archived v1.1.0 history without dropping its text.
 - Before release labeling, dialogue-memory verification passed: 336 Windows tests (329 passed/seven environment skips), 336 packaged Linux tests (334 passed/two skips), clean kit validation, offline wheel and private-package exclusion, README conflict-resolution flow and Docker smoke. [Coverage and limits](docs/DIALOGUE_MEMORY.md#verification).
 - Added standalone non-root Docker CLI, pinned build inputs, offline wheel resources, application mounts, Kubernetes preview Job, smoke tests, CI and [usage/results](docs/DOCKER.md). Earlier Docker-only Windows and packaged Linux runs passed 309 tests (307 passed/two skips each); actual image, preservation, signals, context exclusions, wheel and schema checks passed.
 - After labeling: nine CLI tests, 336 packaged Linux tests (334 passed/two Windows-only skips), clean kit validation, isolated Windows wheel/fresh-venv smoke and private-memory exclusion passed. The actual linux/amd64 image passed Docker smoke. Tracked 1.3.0 upgrades in private/team modes preserved data and pin identities, with explicit review of a local skill conflict; reruns stayed stable. [Release evidence](docs/V1_4_0.md#verification).
@@ -47,7 +74,7 @@
 
 - Prepared v1.3.0 for optional Web Design and the expanded README guide. The 304-test behavioral discovery below preceded release labeling; publication/tagging remain separate. [Release checks](docs/WEB_DESIGN.md#release-labeling).
 - After labeling: eight CLI tests, version/wheel metadata 1.3.0, clean kit checks and offline fresh-venv wheel smoke passed. The pre-label 1.2.0 upgrade preserved facts, settings, local design/skill edits, MCP configuration and both security pins; rerun stayed stable.
-- Added optional Web Design: --with-web-design installs four short skills, conditional Blade/library/tool/review guides and created-once project design documents. Added scoped context workflows, source/Claude lifecycle and preservation tests; installation remains offline. [Guide](README.md#web-design), [integration record](docs/WEB_DESIGN.md).
+- Added optional Web Design: --with-web-design installs four short skills, conditional Blade/library/tool/review guides and created-once project design documents. Added scoped context workflows, source/Claude lifecycle and preservation tests; installation remains offline. [Guide](docs/guide/WEB_DESIGN.md), [integration record](docs/WEB_DESIGN.md).
 - Removed the root README size quota and added extensive reference-to-site instructions for Laravel, Tailwind, Bootstrap, Alpine/Livewire, daisyUI, Flowbite, Flux, TypeUI and SkillUI. Existing instruction budgets remain scoped; external setup and real application checks stay separate.
 - Verified on Windows/Python 3.12.14: 304 tests (300 passed/four runtime skips), clean kit/skill checks, all-client private/team visibility, preserved tracked 1.2.0 upgrade and fresh-venv wheel smoke. Live tools/sites remain unverified. Archived v0.6.4 history without losing its text; [details](docs/WEB_DESIGN.md#verification).
 

{ai_kit_python-1.4.4 → ai_kit_python-1.4.6}/CONTRIBUTING.md

@@ -22,13 +22,13 @@ Assess [Docker impact](docs/DOCKER.md#change-impact-and-image-refresh) on every
 
 Update [DOCKER_HUB_OVERVIEW.md](docs/DOCKER_HUB_OVERVIEW.md) for every AI-KIT Docker image release, including patch releases and authorized replacements of an existing tag. Keep the complete publication copy in that file; README and the [Docker guide](docs/DOCKER.md) link to it.
 
-Before building, synchronize its version/tag, feature summary, release changes, optional modules, CLI examples and runtime/platform contract with VERSION, README and actual sources. Record only checks that ran. After an authorized push, read back the remote digest and configuration, then update publication status and the immutable pull example from that evidence. Never invent a digest or claim local preparation is publication. Keep descriptive publication receipts separate from the prepared image snapshot; do not rebuild/replace an image just to include its own digest.
+Before building, synchronize its version/tag, feature summary, release changes, optional modules, CLI examples and runtime/platform contract with VERSION, README, the [user guides](docs/guide/README.md) and actual sources. Record only checks that ran. After an authorized push, read back the remote digest and configuration, then update publication status and the immutable pull example from that evidence. Never invent a digest or claim local preparation is publication. Keep descriptive publication receipts separate from the prepared image snapshot; do not rebuild/replace an image just to include its own digest.
 
-The root README and Docker Hub Overview are user documentation without a size quota. Other document and instruction budgets remain scoped. Preparing this file does not itself publish a Docker Hub description, image or Git release; the relevant authorization still applies.
+The root README and Docker Hub Overview are user documentation without a size quota. Other documents, including the user guides, have a 24000-byte budget; the always-loaded template AGENTS (2500) and CORE (3000) budgets stay strict. Keep the README a landing page and put reference material into docs/guide. Preparing this file does not itself publish a Docker Hub description, image or Git release; the relevant authorization still applies.
 
 ## Python package releases
 
-Follow [PyPI preparation and release](docs/PYPI.md) for every package release. Synchronize VERSION, pyproject metadata, [description](docs/PYPI_DESCRIPTION.md) and README; verify license/resource inclusion and local-file exclusions in both sdist and wheel, build the wheel from sdist, run strict Twine checks and offline fresh-venv smoke. Preserve existing CI matrix/job names. Refresh the image when packaging changes affect it.
+Follow [PyPI preparation and release](docs/PYPI.md) for every package release. Synchronize VERSION, pyproject metadata, [description](docs/PYPI_DESCRIPTION.md), README and the user guides; verify license/resource inclusion and local-file exclusions in both sdist and wheel, build the wheel from sdist with the hash-pinned build tools, run strict Twine checks in a separate environment and offline fresh-venv smoke. Preserve existing CI matrix/job names. Refresh the image when packaging changes affect it.
 
 A published stable GitHub Release starts PyPI preparation; manual dispatch defaults to build-only validation. Uploads require matching VERSION/tag, the canonical repository, a configured environment/publisher and the owner's human approval. Agents must not approve or bypass a pending deployment on the owner's behalf. Keep environment reviewer protections when allowing future `v*` tags; validate canonical stable versions separately. Build tests have no OIDC permission; upload jobs consume only validated same-run artifacts. Record local, hosted and registry results separately. Preparation alone authorizes no upload, account setup or Git operation.
 

{ai_kit_python-1.4.4 → ai_kit_python-1.4.6}/Dockerfile

@@ -1,4 +1,5 @@
-# CLI runtime. Build with --build-arg AIKIT_VERSION=<VERSION file value>.
+# CLI runtime. Build from a clean LF checkout with --build-arg AIKIT_VERSION=<VERSION file value>
+# and --build-arg AIKIT_REVISION=<full source commit>.
 FROM scratch AS context-audit
 COPY . /
 
@@ -18,11 +19,13 @@ RUN python -m pip wheel . --no-index --no-deps --no-build-isolation --wheel-dir
 
 FROM python:3.13.16-slim-bookworm@sha256:a1165e272e578941b84abc79e4ab38a0305cd12803a5c4247979ac7655f4d641 AS runtime
 ARG AIKIT_VERSION
+ARG AIKIT_REVISION=unknown
 LABEL org.opencontainers.image.title="AI-KIT CLI" \
       org.opencontainers.image.description="Offline AI-KIT instructions, installer and project helpers" \
       org.opencontainers.image.source="https://github.com/tigusigalpa/ai-kit" \
-      org.opencontainers.image.licenses="MIT" \
-      org.opencontainers.image.version="${AIKIT_VERSION}"
+      org.opencontainers.image.licenses="MIT AND Apache-2.0" \
+      org.opencontainers.image.version="${AIKIT_VERSION}" \
+      org.opencontainers.image.revision="${AIKIT_REVISION}"
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     PYTHONNOUSERSITE=1 \

{ai_kit_python-1.4.4 → ai_kit_python-1.4.6}/MANIFEST.in

@@ -1,5 +1,5 @@
 include VERSION LICENSE README.md CHANGELOG.md SECURITY.md SKILL.md BOOTSTRAP_PROMPT.md CONTRIBUTING.md
-exclude AGENTS.md PROJECT_CONTEXT.md WIKI.md
+exclude AGENTS.md PROJECT_CONTEXT.md WIKI.md CLAUDE.local.md
 include .gitignore .gitattributes
 include Dockerfile .dockerignore
 include pyproject.toml Makefile MANIFEST.in

{ai_kit_python-1.4.4/ai_kit_python.egg-info → ai_kit_python-1.4.6}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: ai-kit-python
-Version: 1.4.4
+Version: 1.4.6
 Summary: Portable instructions and installer for AI coding agents: project memory, stack rules, model routing, and optional budgeted orchestration.
 Author: Igor Sazonov
 License-Expression: MIT AND Apache-2.0
 Project-URL: Homepage, https://github.com/tigusigalpa/ai-kit
-Project-URL: Documentation, https://github.com/tigusigalpa/ai-kit#readme
+Project-URL: Documentation, https://tigusigalpa.github.io/ai-kit-docs/
 Project-URL: Source, https://github.com/tigusigalpa/ai-kit
 Project-URL: Issues, https://github.com/tigusigalpa/ai-kit/issues
 Project-URL: Changelog, https://github.com/tigusigalpa/ai-kit/blob/main/CHANGELOG.md
@@ -53,10 +53,18 @@ python -m pip install ai-kit-python
 aikit --help
 ```
 
-The package name is `ai-kit-python`; the executable is `aikit`. Installing the CLI does not modify an application project until you run the installer with `--apply`.
+The package name is `ai-kit-python`; the executable is `aikit`. Never run `pip install aikit`: that is not this project's package name. Installing the CLI does not modify an application project until you run the installer with `--apply`.
 
 ## Preview, install and initialize
 
+**Defaults you should know:** chat replies default to Russian, and conventions default to the owner's opinionated Laravel conventions, including no database foreign key constraints. Authored project files are always English. For English replies and your project's own conventions, add both flags to the preview and the apply command:
+
+```sh
+aikit install /path/to/my-app --agent codex --mode private --chat-language English --conventions standard
+```
+
+Choices are saved in `ai-kit/settings.json` and reused on upgrades. See [defaults and presets](https://github.com/tigusigalpa/ai-kit/blob/main/docs/guide/INSTALL.md#choose-your-defaults).
+
 Choose an existing application folder, then preview:
 
 ```sh
@@ -77,12 +85,12 @@ Open the application in your AI client and invoke `$ai-kit-bootstrap` in Codex o
 ## Capabilities
 
 - **Project context:** verified facts, module maps, commands, decisions and continuity instructions.
-- **Client adapters:** Codex, Claude Code, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, Roo, Aider, Kimi and Manus. Actual discovery and activation depend on the client.
+- **Client adapters:** native entry files and configuration for Codex, Claude Code, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, Roo, Aider, Kimi and Manus. Documentation for Kimi and Manus is unverified, and activation in actual clients is unverified.
 - **Stack guidance:** Go, PHP, Laravel, Filament, Moodle, Python, frontend, libraries, Rust, .NET, Java and Terraform/Helm, selected from project evidence.
 - **Conservative upgrades:** existing documents, settings and local adaptations are preserved; conflicts remain reviewable.
 - **Engineering workflows:** plan, implement, test, review and document, with explicit Git authorization.
-- **Routing and measurement:** offline recommendations, context selection, metrics and benchmark scaffolding. Live execution needs a separately configured worker.
-- **Container guidance:** non-root execution, lifecycle, image freshness, mounts and Kubernetes readiness appropriate to the workload.
+- **Routing and measurement:** offline model role/effort recommendations (no savings are claimed), context selection, metrics and benchmark scaffolding. Live execution needs a separately configured worker.
+- **Container guidance:** the kit instructs agents to make new Dockerfiles and services Kubernetes-ready, keep images fresh and clean up after every Docker task. The default `maximum` mode removes all eligible disposable resources, including the dedicated builder cache, without a size threshold, and reclaims host RAM/disk; `--docker-cleanup keep-cache` keeps the dedicated project builder cache and reclaims host resources only on request or observed pressure. Persistent data and unrelated workloads remain protected; installation starts no cleanup or compaction process.
 
 ## Optional integrations
 
@@ -125,14 +133,18 @@ Package releases follow GitHub Release, automated checks and owner approval befo
 
 ## Documentation and license
 
-- [Repository and full README](https://github.com/tigusigalpa/ai-kit)
-- [Installation and upgrades](https://github.com/tigusigalpa/ai-kit#install)
-- [Web Design](https://github.com/tigusigalpa/ai-kit#web-design)
-- [Dialogue context](https://github.com/tigusigalpa/ai-kit#shared-context-from-two-dialogues)
+- [Repository and README](https://github.com/tigusigalpa/ai-kit)
+- [Documentation site with a command configurator](https://tigusigalpa.github.io/ai-kit-docs/)
+- [All guides](https://github.com/tigusigalpa/ai-kit/blob/main/docs/guide/README.md)
+- [Installation and upgrades](https://github.com/tigusigalpa/ai-kit/blob/main/docs/guide/INSTALL.md)
+- [Installer flags and options](https://github.com/tigusigalpa/ai-kit/blob/main/docs/guide/INSTALLER_FLAGS.md)
+- [Windows guide](https://github.com/tigusigalpa/ai-kit/blob/main/docs/guide/WINDOWS.md)
+- [Web Design](https://github.com/tigusigalpa/ai-kit/blob/main/docs/guide/WEB_DESIGN.md)
+- [Dialogue context](https://github.com/tigusigalpa/ai-kit/blob/main/docs/guide/DIALOGUE_MEMORY.md)
 - [Issues](https://github.com/tigusigalpa/ai-kit/issues)
 
 AI-KIT's own code and instructions are MIT licensed. Bundled Cloudflare references retain MIT; bundled Strix references retain Apache-2.0. The complete distribution declares `MIT AND Apache-2.0` and includes the corresponding license texts. External runtimes and application dependencies keep their own licenses.
 
 ## Optional orchestration (v1.4.4)
 
-Install with `--with-orchestration` to add scoped Codex helpers and disabled-by-default OpenRouter configuration. `aikit orchestrate` previews selected text tasks, executes only on explicit apply, enforces local admission and capped-key preflight, and retains private observed usage/cost, review and billing reconciliation. It never executes model output. Native helper billing is separate; real trials and savings are unverified. See the [complete guide](https://github.com/tigusigalpa/ai-kit#optional-orchestration).
+Install with `--with-orchestration` to add scoped Codex helpers and disabled-by-default OpenRouter configuration. `aikit orchestrate` previews selected text tasks, executes only on explicit apply, enforces local admission and capped-key preflight, and retains private observed usage/cost, review and billing reconciliation. It never executes model output. Native helper billing is separate; real trials and savings are unverified. See the [complete guide](https://github.com/tigusigalpa/ai-kit/blob/main/docs/guide/ORCHESTRATION.md).