git-repokit 0.9.12__tar.gz → 0.10.3__tar.gz

{git_repokit-0.9.12/git_repokit.egg-info → git_repokit-0.10.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-repokit
-Version: 0.9.12
+Version: 0.10.3
 Summary: Create standardized Git repositories: language presets, licenses, GitHub setup, and a private notes vault
 Author: Dustin Darcy
 License-Expression: MIT
@@ -24,6 +24,8 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: requests>=2.25.0
 Requires-Dist: tomli>=1.1; python_version < "3.11"
+Requires-Dist: dazzle-lib>=0.8.2
+Requires-Dist: dazzle-loglib>=0.3.3
 Provides-Extra: test
 Requires-Dist: pytest>=7.0.0; extra == "test"
 Requires-Dist: python-dotenv>=1.0.0; extra == "test"
@@ -58,10 +60,10 @@ Dynamic: license-file
 A full create (the [Quick Start](#-quick-start) below) produces:
 
 - **The structure:** README, CONTRIBUTING, CHANGELOG, LICENSE, `.gitignore`, `.gitattributes`, `docs/`, `tests/`, `scripts/`, and, if you ask for them, ROADMAP, a funding file, Dependabot, a stale-issue policy and PR and release templates.
-- **The code for its language:** a Python package with `pyproject.toml` and a CLI, a CMake or Visual Studio C/C++ project, a TypeScript npm package, a Claude Code plugin, and more. Each comes with tests, a CI workflow and a VS Code debug configuration that work from the first commit. See [Languages and layers](docs/Languages-and-Layers.md).
+- **The code for its language:** a Python package with `pyproject.toml` and a CLI, a CMake or Visual Studio C/C++ project, a TypeScript npm package, a Claude Code plugin, a Paradox game mod (Crusader Kings III and others), and more. Each comes with tests, a CI workflow and a VS Code debug configuration where it has something to run, from the first commit. The project's settings name its languages, so the hooks run the right checks. See [Languages and layers](docs/Languages-and-Layers.md).
 - **A README that names the project:** the real GitHub owner, badges for the release, the Python or Node minimum and the license, install and test commands for the preset, and a License section at the end.
 - **The tooling:** [git-repokit-common](https://github.com/DazzleTools/git-repokit-common) vendored at `scripts/repokit-common/`, with git hooks that keep version numbers in step, keep private files out of public commits, and run the tests before a push.
-- **A private vault:** `private/` is its own git repository, ignored by the project, for notes, design documents and postmortems. It starts with a map, an index for an oracle session and a to-do board. See [The vault](docs/The-Vault.md).
+- **A private vault:** `private/` is its own git repository, ignored by the project, for notes, design documents, postmortems, conversations (`convos/`) and old revisions (`revisions/`); run logs go to `private/logs/`, kept on disk and never versioned. It starts with a map, an index for an oracle session and a to-do board. See [The vault](docs/The-Vault.md).
 - **The repository on GitHub** (with `--github`): created with your `gh` login and pushed. It gets the standard labels, Roadmap and Quick Notes as issues #1 and #2 (pinned), discussions and topics. See [GitHub setup](docs/GitHub-Setup.md).
 
 ## 📦 Installation
@@ -173,6 +175,9 @@ repokit create my-app --with c-cpp/msbuild --license gpl-3.0-or-later
 # A TypeScript npm package
 repokit create my-lib --language js-ts --license mpl-2.0
 
+# A Crusader Kings III mod: the mod in mod/, the repository's own files above it
+repokit create my-mod --language paradox --license mit
+
 # A one-file Python script, no packaging, given away to the public domain
 repokit create my-script --with python/script --license unlicense
 
@@ -216,6 +221,16 @@ repokit has two ways to keep private work private:
 - **`main-only` (the default):** the project folder is the repository, on `main`, and `private/` is its own nested git repository that the project ignores. One branch, no merging rules to learn.
 - **The private-branch model:** your working history lives on a local-only `private` branch in `<name>/local/`, and the public branches are git worktrees in sibling folders. You move finished work across with `repokit safe-merge`, which leaves the private content behind. This is the model repokit was first built for, and it suits projects with several release stages or several people.
 
+What the private branch carries is the **private mode** (`--private-mode`):
+
+| Mode | `private/` | Tracked on the private branch | Default for |
+|---|---|---|---|
+| `nested` | its own repository | nothing private | `main-only` |
+| `nested-branch` | its own repository, linked into every worktree | `convos/`, `revisions/`, `logs/` (run logs ignored) | a `create` with a private-branch strategy |
+| `branch` | on the private branch | `private/` too | `adopt`; otherwise opt-in, warned |
+
+The promoted folders never reach a public branch or a remote. The hooks refuse them on public branches, `safe-merge` leaves them out, and git-repokit-common's pre-push refuses a push that would add them. See [The vault](docs/The-Vault.md).
+
 | `--branch-strategy` | Public branches | Checked out in folders | Flow |
 |---|---|---|---|
 | `main-only` | main | the project folder itself | commit on main |

{git_repokit-0.9.12 → git_repokit-0.10.3}/README.md

@@ -17,10 +17,10 @@
 A full create (the [Quick Start](#-quick-start) below) produces:
 
 - **The structure:** README, CONTRIBUTING, CHANGELOG, LICENSE, `.gitignore`, `.gitattributes`, `docs/`, `tests/`, `scripts/`, and, if you ask for them, ROADMAP, a funding file, Dependabot, a stale-issue policy and PR and release templates.
-- **The code for its language:** a Python package with `pyproject.toml` and a CLI, a CMake or Visual Studio C/C++ project, a TypeScript npm package, a Claude Code plugin, and more. Each comes with tests, a CI workflow and a VS Code debug configuration that work from the first commit. See [Languages and layers](docs/Languages-and-Layers.md).
+- **The code for its language:** a Python package with `pyproject.toml` and a CLI, a CMake or Visual Studio C/C++ project, a TypeScript npm package, a Claude Code plugin, a Paradox game mod (Crusader Kings III and others), and more. Each comes with tests, a CI workflow and a VS Code debug configuration where it has something to run, from the first commit. The project's settings name its languages, so the hooks run the right checks. See [Languages and layers](docs/Languages-and-Layers.md).
 - **A README that names the project:** the real GitHub owner, badges for the release, the Python or Node minimum and the license, install and test commands for the preset, and a License section at the end.
 - **The tooling:** [git-repokit-common](https://github.com/DazzleTools/git-repokit-common) vendored at `scripts/repokit-common/`, with git hooks that keep version numbers in step, keep private files out of public commits, and run the tests before a push.
-- **A private vault:** `private/` is its own git repository, ignored by the project, for notes, design documents and postmortems. It starts with a map, an index for an oracle session and a to-do board. See [The vault](docs/The-Vault.md).
+- **A private vault:** `private/` is its own git repository, ignored by the project, for notes, design documents, postmortems, conversations (`convos/`) and old revisions (`revisions/`); run logs go to `private/logs/`, kept on disk and never versioned. It starts with a map, an index for an oracle session and a to-do board. See [The vault](docs/The-Vault.md).
 - **The repository on GitHub** (with `--github`): created with your `gh` login and pushed. It gets the standard labels, Roadmap and Quick Notes as issues #1 and #2 (pinned), discussions and topics. See [GitHub setup](docs/GitHub-Setup.md).
 
 ## 📦 Installation
@@ -132,6 +132,9 @@ repokit create my-app --with c-cpp/msbuild --license gpl-3.0-or-later
 # A TypeScript npm package
 repokit create my-lib --language js-ts --license mpl-2.0
 
+# A Crusader Kings III mod: the mod in mod/, the repository's own files above it
+repokit create my-mod --language paradox --license mit
+
 # A one-file Python script, no packaging, given away to the public domain
 repokit create my-script --with python/script --license unlicense
 
@@ -175,6 +178,16 @@ repokit has two ways to keep private work private:
 - **`main-only` (the default):** the project folder is the repository, on `main`, and `private/` is its own nested git repository that the project ignores. One branch, no merging rules to learn.
 - **The private-branch model:** your working history lives on a local-only `private` branch in `<name>/local/`, and the public branches are git worktrees in sibling folders. You move finished work across with `repokit safe-merge`, which leaves the private content behind. This is the model repokit was first built for, and it suits projects with several release stages or several people.
 
+What the private branch carries is the **private mode** (`--private-mode`):
+
+| Mode | `private/` | Tracked on the private branch | Default for |
+|---|---|---|---|
+| `nested` | its own repository | nothing private | `main-only` |
+| `nested-branch` | its own repository, linked into every worktree | `convos/`, `revisions/`, `logs/` (run logs ignored) | a `create` with a private-branch strategy |
+| `branch` | on the private branch | `private/` too | `adopt`; otherwise opt-in, warned |
+
+The promoted folders never reach a public branch or a remote. The hooks refuse them on public branches, `safe-merge` leaves them out, and git-repokit-common's pre-push refuses a push that would add them. See [The vault](docs/The-Vault.md).
+
 | `--branch-strategy` | Public branches | Checked out in folders | Flow |
 |---|---|---|---|
 | `main-only` | main | the project folder itself | commit on main |

{git_repokit-0.9.12 → git_repokit-0.10.3/git_repokit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-repokit
-Version: 0.9.12
+Version: 0.10.3
 Summary: Create standardized Git repositories: language presets, licenses, GitHub setup, and a private notes vault
 Author: Dustin Darcy
 License-Expression: MIT
@@ -24,6 +24,8 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: requests>=2.25.0
 Requires-Dist: tomli>=1.1; python_version < "3.11"
+Requires-Dist: dazzle-lib>=0.8.2
+Requires-Dist: dazzle-loglib>=0.3.3
 Provides-Extra: test
 Requires-Dist: pytest>=7.0.0; extra == "test"
 Requires-Dist: python-dotenv>=1.0.0; extra == "test"
@@ -58,10 +60,10 @@ Dynamic: license-file
 A full create (the [Quick Start](#-quick-start) below) produces:
 
 - **The structure:** README, CONTRIBUTING, CHANGELOG, LICENSE, `.gitignore`, `.gitattributes`, `docs/`, `tests/`, `scripts/`, and, if you ask for them, ROADMAP, a funding file, Dependabot, a stale-issue policy and PR and release templates.
-- **The code for its language:** a Python package with `pyproject.toml` and a CLI, a CMake or Visual Studio C/C++ project, a TypeScript npm package, a Claude Code plugin, and more. Each comes with tests, a CI workflow and a VS Code debug configuration that work from the first commit. See [Languages and layers](docs/Languages-and-Layers.md).
+- **The code for its language:** a Python package with `pyproject.toml` and a CLI, a CMake or Visual Studio C/C++ project, a TypeScript npm package, a Claude Code plugin, a Paradox game mod (Crusader Kings III and others), and more. Each comes with tests, a CI workflow and a VS Code debug configuration where it has something to run, from the first commit. The project's settings name its languages, so the hooks run the right checks. See [Languages and layers](docs/Languages-and-Layers.md).
 - **A README that names the project:** the real GitHub owner, badges for the release, the Python or Node minimum and the license, install and test commands for the preset, and a License section at the end.
 - **The tooling:** [git-repokit-common](https://github.com/DazzleTools/git-repokit-common) vendored at `scripts/repokit-common/`, with git hooks that keep version numbers in step, keep private files out of public commits, and run the tests before a push.
-- **A private vault:** `private/` is its own git repository, ignored by the project, for notes, design documents and postmortems. It starts with a map, an index for an oracle session and a to-do board. See [The vault](docs/The-Vault.md).
+- **A private vault:** `private/` is its own git repository, ignored by the project, for notes, design documents, postmortems, conversations (`convos/`) and old revisions (`revisions/`); run logs go to `private/logs/`, kept on disk and never versioned. It starts with a map, an index for an oracle session and a to-do board. See [The vault](docs/The-Vault.md).
 - **The repository on GitHub** (with `--github`): created with your `gh` login and pushed. It gets the standard labels, Roadmap and Quick Notes as issues #1 and #2 (pinned), discussions and topics. See [GitHub setup](docs/GitHub-Setup.md).
 
 ## 📦 Installation
@@ -173,6 +175,9 @@ repokit create my-app --with c-cpp/msbuild --license gpl-3.0-or-later
 # A TypeScript npm package
 repokit create my-lib --language js-ts --license mpl-2.0
 
+# A Crusader Kings III mod: the mod in mod/, the repository's own files above it
+repokit create my-mod --language paradox --license mit
+
 # A one-file Python script, no packaging, given away to the public domain
 repokit create my-script --with python/script --license unlicense
 
@@ -216,6 +221,16 @@ repokit has two ways to keep private work private:
 - **`main-only` (the default):** the project folder is the repository, on `main`, and `private/` is its own nested git repository that the project ignores. One branch, no merging rules to learn.
 - **The private-branch model:** your working history lives on a local-only `private` branch in `<name>/local/`, and the public branches are git worktrees in sibling folders. You move finished work across with `repokit safe-merge`, which leaves the private content behind. This is the model repokit was first built for, and it suits projects with several release stages or several people.
 
+What the private branch carries is the **private mode** (`--private-mode`):
+
+| Mode | `private/` | Tracked on the private branch | Default for |
+|---|---|---|---|
+| `nested` | its own repository | nothing private | `main-only` |
+| `nested-branch` | its own repository, linked into every worktree | `convos/`, `revisions/`, `logs/` (run logs ignored) | a `create` with a private-branch strategy |
+| `branch` | on the private branch | `private/` too | `adopt`; otherwise opt-in, warned |
+
+The promoted folders never reach a public branch or a remote. The hooks refuse them on public branches, `safe-merge` leaves them out, and git-repokit-common's pre-push refuses a push that would add them. See [The vault](docs/The-Vault.md).
+
 | `--branch-strategy` | Public branches | Checked out in folders | Flow |
 |---|---|---|---|
 | `main-only` | main | the project folder itself | commit on main |

{git_repokit-0.9.12 → git_repokit-0.10.3}/git_repokit.egg-info/SOURCES.txt

@@ -133,6 +133,12 @@ repokit/templates/layers/archetypes/js-ts/script/.vscode/launch.json
 repokit/templates/layers/archetypes/js-ts/script/tests/version.test.js
 repokit/templates/layers/archetypes/js-ts/ts/package.json
 repokit/templates/layers/archetypes/js-ts/ts/tsconfig.json
+repokit/templates/layers/archetypes/paradox/ck3/.repokit-common.toml
+repokit/templates/layers/archetypes/paradox/ck3/mod/descriptor.mod
+repokit/templates/layers/archetypes/paradox/clausewitz/mod/localisation/english/__RK_SNAKE___l_english.yml
+repokit/templates/layers/archetypes/paradox/descriptor-mod/mod/descriptor.mod
+repokit/templates/layers/archetypes/paradox/descriptor-mod/mod/thumbnail.png
+repokit/templates/layers/archetypes/paradox/jomini/mod/localization/english/__RK_SNAKE___l_english.yml
 repokit/templates/layers/archetypes/python/claude-plugin/.repokit-common.toml
 repokit/templates/layers/archetypes/python/claude-plugin/VERSION
 repokit/templates/layers/archetypes/python/claude-plugin/.github/workflows/ci-python.yml
@@ -168,6 +174,10 @@ repokit/templates/layers/languages/js-ts/.repokit-common.toml
 repokit/templates/layers/languages/js-ts/VERSION
 repokit/templates/layers/languages/js-ts/.github/workflows/ci-js-ts.yml
 repokit/templates/layers/languages/js-ts/.vscode/launch.json
+repokit/templates/layers/languages/paradox/.gitattributes.rkappend
+repokit/templates/layers/languages/paradox/.repokit-common.toml
+repokit/templates/layers/languages/paradox/VERSION
+repokit/templates/layers/languages/paradox/docs/modding.md
 repokit/templates/layers/languages/python/.gitignore.rkappend
 repokit/templates/layers/languages/python/.github/workflows/ci-python.yml
 repokit/templates/layers/languages/python/.vscode/launch.json
@@ -182,6 +192,7 @@ tests/test_badges.py
 tests/test_branch_strategies.py
 tests/test_cli_examples.py
 tests/test_cli_integration.py
+tests/test_common_guard.py
 tests/test_core_functionality.py
 tests/test_deployment_scenarios.py
 tests/test_directory_profiles.py
@@ -195,6 +206,7 @@ tests/test_guardrails.py
 tests/test_hermetic.py
 tests/test_hook_encoding.py
 tests/test_hook_patterns.py
+tests/test_languages_setting.py
 tests/test_layer_action_pins.py
 tests/test_layers.py
 tests/test_layers_c_cpp.py
@@ -207,9 +219,12 @@ tests/test_legacy_smoke.py
 tests/test_license_adopt.py
 tests/test_license_cli.py
 tests/test_licenses.py
+tests/test_list_templates.py
 tests/test_new_default.py
 tests/test_packaging.py
+tests/test_paradox.py
 tests/test_private_branch_create.py
+tests/test_private_modes.py
 tests/test_readme_blocks.py
 tests/test_run_tests_driver.py
 tests/test_template_parity.py

{git_repokit-0.9.12 → git_repokit-0.10.3}/git_repokit.egg-info/requires.txt

@@ -1,4 +1,6 @@
 requests>=2.25.0
+dazzle-lib>=0.8.2
+dazzle-loglib>=0.3.3
 
 [:python_version < "3.11"]
 tomli>=1.1

{git_repokit-0.9.12 → git_repokit-0.10.3}/pyproject.toml

@@ -8,7 +8,7 @@ build-backend = "setuptools.build_meta"
 # PyPI's trusted publisher is registered for this name (DazzleTools/git-repokit,
 # publish.yml, environment pypi); the command stays `repokit`
 name = "git-repokit"
-version = "0.9.12"
+version = "0.10.3"
 description = "Create standardized Git repositories: language presets, licenses, GitHub setup, and a private notes vault"
 readme = "README.md"
 license = "MIT"
@@ -37,6 +37,12 @@ dependencies = [
   "requests>=2.25.0",
   # tomllib is 3.11+; the layer engine reads TOML (layers.py falls back to tomli)
   "tomli>=1.1; python_version < '3.11'",
+  # the DazzleLib stack: dazzle_lib.continuum names how exposed private work
+  # is (defaults.EXPOSURE_CONTINUUM); pure Python, no dependencies of its own
+  "dazzle-lib>=0.8.2",
+  # logging with channels, for the verbosity work ahead; explicit now
+  # (djdarcy, 2026-11-06: "there's no reason not to")
+  "dazzle-loglib>=0.3.3",
 ]
 
 [project.urls]

git_repokit-0.10.3/repokit/__version__.py

@@ -0,0 +1,9 @@
+"""Version information for RepoKit.
+
+Set by hand beside pyproject.toml's version (repokit-common's version sync is
+off for this project); tests/test_packaging.py fails when the two differ, as
+they did at 0.10.0 and 0.10.1, whose `repokit --version` printed 0.9.12.
+"""
+
+__version__ = "0.10.3"
+__version_info__ = tuple(int(part) for part in __version__.split("."))

{git_repokit-0.9.12 → git_repokit-0.10.3}/repokit/branch_utils.py

@@ -22,6 +22,33 @@ _REPOKIT_EXCLUDE_LINES = {
 }
 
 
+def promoted_folders(repo_path: str) -> List[str]:
+    """The folders this project tracks on its private branch (0.10.3), from
+    its record: .repokit.json's private_mode and private_exposure. Empty for
+    a nested project or one with no record."""
+    import json
+    from .defaults import BRANCH_MODES
+    try:
+        with open(os.path.join(repo_path, ".repokit.json"), encoding="utf-8") as f:
+            record = json.load(f)
+    except (OSError, ValueError):
+        return []
+    mode = record.get("private_mode")
+    if mode not in BRANCH_MODES:
+        return []
+    folders = [k.strip("/") for k in record.get("private_exposure", {}) if k != "private/"]
+    return folders + (["private"] if mode == "branch" else [])
+
+
+def _without_promoted(excludes: List[str], promoted: List[str]) -> List[str]:
+    """.git/info/exclude is one file for every checkout of the repository --
+    a minimal project's branch switches and every worktree -- so an exclude
+    written for a public branch also hides the folder on the private branch,
+    where a plain `git add` must take it. The public branches keep their own
+    protection: their .gitignore and the hooks."""
+    return [p for p in excludes if p.split("/", 1)[0] not in promoted]
+
+
 def _write_excludes(exclude_file: str, excludes: List[str]) -> None:
     """Write RepoKit's branch excludes, keeping every line that is not RepoKit's.
 
@@ -94,7 +121,17 @@ class BranchContext:
             'test-runs/',
             'test_runs/',
         }))
-    
+
+        # The project's own private paths: the private-patterns its
+        # git-repokit-common settings name (written from --private-dirs at
+        # create, 0.10.2). safe-merge leaves them out of a merge into a public
+        # branch too, so a clone without hooks is not left with the hook as
+        # the only guard -- and the hook and safe-merge read one list.
+        from .common_kit import read_settings
+        project_patterns = read_settings(self.repo_path).get("private-patterns", [])
+        if isinstance(project_patterns, list):
+            self.EXCLUDE_FROM_PUBLIC.update(p for p in project_patterns if isinstance(p, str) and p)
+
     @property
     def current_branch(self) -> str:
         """Get current branch name."""
@@ -315,7 +352,8 @@ class BranchContext:
                 "test-runs/",
                 "test_runs/",
             ]
-            
+            excludes = _without_promoted(excludes, promoted_folders(self.repo_path))
+
             _write_excludes(exclude_file, excludes)
 
             print(f"✓ Set up branch excludes for public branch '{self.current_branch}'")

{git_repokit-0.9.12 → git_repokit-0.10.3}/repokit/cli.py

@@ -14,7 +14,7 @@ import subprocess
 from typing import Dict, Any, Optional
 
 from .config import ConfigManager
-from .defaults import BRANCH_STRATEGIES, DEFAULT_ADOPT_STRATEGY, PRIVATE_BRANCH_STRATEGIES
+from .defaults import BRANCH_STRATEGIES, DEFAULT_ADOPT_STRATEGY, PRIVATE_BRANCH_STRATEGIES, PRIVATE_MODES
 from .repo_manager import RepoManager
 from .template_engine import TemplateEngine
 from .directory_analyzer import (
@@ -320,22 +320,24 @@ Recipe: Microservice
 
     branch_group.add_argument(
         "--private-mode",
-        choices=["nested", "branch"],
+        choices=list(PRIVATE_MODES),
         help="How private work is kept: 'nested' makes private/ its own git repository "
-             "(linked into every worktree); 'branch' keeps it on the private branch only. "
-             "Default: nested for main-only, branch for the private-branch strategies"
+             "(linked into every worktree); 'nested-branch' keeps that, and tracks "
+             "convos/, revisions/ and logs/ on the private branch; 'branch' tracks "
+             "private/ itself on the private branch too (opt-in). Default: nested for "
+             "main-only, nested-branch for the private-branch strategies (branch for adopt)"
     )
 
     common_group = branch_group.add_mutually_exclusive_group()
     common_group.add_argument(
         "--with-common", dest="with_common", action="store_true", default=None,
         help="Vendor git-repokit-common (hooks, version sync, tools) at scripts/repokit-common/ "
-             "and install its hooks (default for main-only)"
+             "and install its hooks (the default, for every branch strategy)"
     )
     common_group.add_argument(
         "--no-common", dest="with_common", action="store_false",
-        help="Do not vendor git-repokit-common; git-repokit's own pre-commit guard is installed instead "
-             "(default for the private-branch strategies)"
+        help="Do not vendor git-repokit-common (warns); git-repokit's own basic pre-commit guard "
+             "is installed instead"
     )
 
     branch_group.add_argument(
@@ -1870,6 +1872,7 @@ def main() -> int:
         if not args.language:
             # the license catalogue, which create's --license help points to (0.9.11)
             from . import licenses as _licenses
+            print()
             print("licenses (--license; or file=PATH, or none):")
             ids = list(_licenses.known())
             for i in range(0, len(ids), 8):
@@ -1877,8 +1880,10 @@ def main() -> int:
         return 0
 
     elif args.command == "list-templates":
+        # list-templates has no --templates-dir of its own; reading
+        # args.templates_dir crashed every run (since 2025, fixed in 0.10.2)
         template_engine = TemplateEngine(
-            templates_dir=args.templates_dir, verbose=args.verbose
+            templates_dir=getattr(args, "templates_dir", None), verbose=args.verbose
         )
         templates = template_engine.list_templates()
         print("Available templates:")
@@ -2853,6 +2858,14 @@ def main() -> int:
             logger.error(str(e))
             return 1
 
+        # A private mode the strategy cannot carry (a branch mode with no
+        # private branch) is refused before anything is written (0.10.3)
+        from .repo_manager import private_mode_for
+        _mode, problem = private_mode_for(config)
+        if problem:
+            logger.error(problem)
+            return 1
+
         # The GitHub login, before any file is written: the files' URLs,
         # CODEOWNERS and FUNDING name it (0.9.6; before, they carried the
         # YOUR_GITHUB_USERNAME placeholder even with --github)

{git_repokit-0.9.12 → git_repokit-0.10.3}/repokit/common_kit.py

@@ -107,23 +107,91 @@ def install_hooks(repo_root: str) -> Optional[str]:
     return None
 
 
-def private_branch_settings(private_branch: Optional[str], private_paths: List[str]) -> Dict[str, List[str]]:
-    """Settings that make repokit-common's pre-commit guard the private-branch model.
-
-    private-patterns: the paths git-repokit's own guard protected (literal
-    prefixes; repokit-common adds them to its built-in list).
-    private-branches: only when the private branch is not one of
-    repokit-common's defaults; the setting replaces the list, so the defaults
-    are listed too.
+# Strategies whose feature branches are public: they are pushed for pull
+# requests, so private content may not be committed on them (0.10.2).
+PUBLIC_FEATURE_STRATEGIES = {"github-flow", "gitflow"}
+PUBLIC_FEATURE_PATTERNS = {"feature/*", "feat/*"}
+
+
+def private_branches(strategy: Optional[str], private_branch: Optional[str]) -> List[str]:
+    """The branches where private content may be committed, for a strategy.
+
+    repokit-common's defaults, minus the feature-branch patterns for the
+    strategies that push feature branches, plus the project's own private
+    branch when it has a name of its own. Both hooks use this one rule.
+    """
+    branches = [b for b in REPOKIT_COMMON_PRIVATE_BRANCHES
+                if not (strategy in PUBLIC_FEATURE_STRATEGIES and b in PUBLIC_FEATURE_PATTERNS)]
+    if private_branch and private_branch not in branches:
+        branches.append(private_branch)
+    return branches
+
+
+def read_settings(repo_root: str) -> Dict:
+    """The project's [tool.repokit-common] table: pyproject.toml's, else
+    .repokit-common.toml's, the order repokit-common reads them in; {} when
+    neither file has the table or a file cannot be parsed."""
+    try:
+        import tomllib
+    except ModuleNotFoundError:  # Python 3.10
+        import tomli as tomllib
+    for name in ("pyproject.toml", ".repokit-common.toml"):
+        path = os.path.join(repo_root, name)
+        if not os.path.isfile(path):
+            continue
+        try:
+            with open(path, "rb") as f:
+                data = tomllib.load(f)
+        except (OSError, ValueError):
+            continue
+        table = data.get("tool", {}).get("repokit-common")
+        if isinstance(table, dict):
+            return table
+    return {}
+
+
+def private_branch_settings(private_branch: Optional[str], private_paths: List[str],
+                            strategy: Optional[str] = None) -> Dict[str, List[str]]:
+    """Settings that make repokit-common's pre-commit guard this project.
+
+    Written for every project, single-branch ones included (0.10.2), so a
+    project that later gains a private branch is already guarded.
+    private-patterns: the paths kept off public branches (literal prefixes;
+    repokit-common adds them to its built-in list).
+    private-branches: where they may be committed, from the strategy
+    (private_branches); the setting replaces repokit-common's own list.
     """
     settings: Dict[str, List[str]] = {}
     if private_paths:
         settings["private-patterns"] = sorted(dict.fromkeys(private_paths))
-    if private_branch and private_branch not in REPOKIT_COMMON_PRIVATE_BRANCHES:
-        settings["private-branches"] = REPOKIT_COMMON_PRIVATE_BRANCHES + [private_branch]
+    settings["private-branches"] = private_branches(strategy, private_branch)
     return settings
 
 
+def languages_setting(languages: List[str], layer_folders: List[str]) -> List[str]:
+    """The `languages` value a create writes for git-repokit-common's hooks.
+
+    repokit's language names mapped to repokit-common's, in the composed
+    order (the first is primary): js-ts is "typescript" when the ts layer is
+    part of the composition, else "javascript"; python, c-cpp and paradox
+    are the same names; generic and the `any` pseudo-language add nothing.
+    Writing it, rather than leaving the hooks to detect it from the root,
+    keeps a project whose markers sit in a subfolder (a plugin in plugin/)
+    from reading as Python (design 2026-10-30__08-28-15, Addendum 2).
+    """
+    out: List[str] = []
+    for lang in languages:
+        if lang == "js-ts":
+            name = "typescript" if any(f.endswith("js-ts/ts") for f in layer_folders) else "javascript"
+        elif lang in ("python", "c-cpp", "paradox"):
+            name = lang
+        else:
+            continue
+        if name not in out:
+            out.append(name)
+    return out
+
+
 def _toml_list(values: List[str]) -> str:
     return "[" + ", ".join('"' + v.replace("\\", "\\\\").replace('"', '\\"') + '"' for v in values) + "]"
 

{git_repokit-0.9.12 → git_repokit-0.10.3}/repokit/config.py

@@ -16,6 +16,7 @@ from typing import Dict, Any, Optional, List, Union
 from .directory_profiles import DirectoryProfileManager
 from .defaults import (
     DEFAULT_PRIVATE_DIRS,
+    DEFAULT_PRIVATE_DIR_SETS,
     DEFAULT_SENSITIVE_FILES,
     DEFAULT_SENSITIVE_PATTERNS,
     BRANCH_SPECIFIC_EXCLUDES,
@@ -59,12 +60,11 @@ class ConfigManager:
             # replaces them with the chosen strategy's values
             "branches": list(BRANCH_STRATEGIES[DEFAULT_BRANCH_STRATEGY]["branches"]),
             "worktrees": list(BRANCH_STRATEGIES[DEFAULT_BRANCH_STRATEGY]["worktrees"]),
+            # convos/, revisions/ and logs/ live in private/ since 0.10.0
+            # (vault.PRIVATE_STRUCTURE), not at the project root
             "directories": [
-                "convos",
                 "docs",
-                "logs",
                 "private",
-                "revisions",
                 "scripts",
                 "tests",
             ],
@@ -680,7 +680,15 @@ class ConfigManager:
             
             if self.verbose >= 1:
                 self.logger.info(f"Resolved directory profile '{profile}' to {len(directories)} directories")
-        
+
+        elif private_set != "standard":
+            # --private-set without a profile or groups was read nowhere until
+            # 0.10.2: its folders join the protection list (added to, never
+            # replacing, any --private-dirs).
+            current = list(self.config.get("private_dirs") or DEFAULT_PRIVATE_DIRS)
+            extra = DEFAULT_PRIVATE_DIR_SETS.get(private_set, [])
+            self.config["private_dirs"] = current + [d for d in extra if d not in current]
+
         # Ensure private_dirs is always set
         if "private_dirs" not in self.config:
             self.config["private_dirs"] = DEFAULT_PRIVATE_DIRS.copy()

{git_repokit-0.9.12 → git_repokit-0.10.3}/repokit/defaults.py

@@ -6,7 +6,57 @@ This module provides centralized default values to prevent duplication
 and ensure consistency across the codebase.
 """
 
-from typing import List
+from typing import Dict, List
+
+from dazzle_lib.continuum import Continuum
+
+# How exposed a thing is: who can read it. Zero is "controlled" -- readable
+# only by people the owner chose -- and the line every private folder must
+# stay below is "shared" (a remote that could be public). Agreed with djdarcy,
+# 2026-11-01 (git-repokit's vault: notes/...__both_the-exposure-continuum.md).
+EXPOSURE_CONTINUUM = Continuum(
+    name="exposure",
+    ranks={"untracked": -2, "local": -1, "controlled": 0, "shared": 1, "public": 2},
+    invariant="who can read it",
+)
+
+# How private work is kept (--private-mode):
+#   nested         private/ is its own git repository (main-only's default)
+#   nested-branch  private/ is still its own repository, and the record
+#                  folders (PROMOTED_DIRS) are tracked on the private branch
+#                  (the private-branch strategies' default for a create)
+#   branch         private/ itself is tracked on the private branch too
+#                  (opt-in, warned; adopt's default)
+PRIVATE_MODES = ("nested", "nested-branch", "branch")
+VAULT_MODES = ("nested", "nested-branch")      # private/ is its own repository
+BRANCH_MODES = ("nested-branch", "branch")     # the private branch tracks the record folders
+
+# The record folders a private-branch project tracks at its root, on the
+# private branch only: conversations, revisions ("as easy as MOVING an old
+# file to ./revisions and it's then still git tracked"), and logs, whose run
+# output is ignored (logs/.gitignore) so chosen logs can still be committed.
+PROMOTED_DIRS = ("convos", "revisions", "logs")
+
+
+def private_dir_names(dirs) -> List[str]:
+    """Folder names from --private-dirs entries however they were written:
+    "convos/", "/revisions" and "logs" are convos, revisions and logs."""
+    return [d.strip("/") for d in dirs if d and d.strip("/")]
+
+
+def mode_exposure(promoted) -> Dict[str, str]:
+    """Where a project's private work sits on EXPOSURE_CONTINUUM, recorded in
+    .repokit.json: the vault, and each folder the mode promotes to the private
+    branch (RepoManager.promoted). Each level is checked against the
+    continuum: an unknown name raises, and none may reach "shared" -- the
+    line a private folder must stay below."""
+    ranks = {"private/": "local"}
+    ranks.update({f"{name}/": "local" for name in promoted if name != "private"})
+    for path, level in ranks.items():
+        if not EXPOSURE_CONTINUUM.is_colder(level, "shared"):
+            raise ValueError(f"{path} would be {level}: private work stays below shared")
+    return ranks
+
 
 # Default private directories that should not appear in public branches
 DEFAULT_PRIVATE_DIRS = [
@@ -180,15 +230,21 @@ def strategy_push_branches(name: str) -> List[str]:
 DEFAULT_BRANCH_STRATEGIES = {name: strategy_branch_list(name) for name in BRANCH_STRATEGIES}
 
 # Default directory profiles - centralized from directory_profiles.py
+# The text is 0.9.12's again (0.10.3). A profile entry in the private set
+# (logs, private, convos, revisions) goes to private_dirs, the protection
+# list, never to the folders created -- so this text never changed a layout.
+# Where convos/, revisions/ and logs/ are made follows the private mode:
+# inside the vault in nested, promoted to the root on the private branch in
+# nested-branch and branch (PROMOTED_DIRS).
 DEFAULT_DIRECTORY_PROFILES = {
     "minimal": ["src", "tests", "docs"],
     "standard": [
-        "src", "tests", "docs", "scripts", "config", 
+        "src", "tests", "docs", "scripts", "config",
         "logs", "private", "convos", "revisions"
     ],
     "complete": [
-        "src", "tests", "docs", "scripts", "config", "logs", 
-        "private", "convos", "revisions", "data", "examples", 
+        "src", "tests", "docs", "scripts", "config", "logs",
+        "private", "convos", "revisions", "data", "examples",
         "tools", "resources", "assets"
     ]
 }