guild-cli 0.10.4__tar.gz → 0.11.0__tar.gz

{guild_cli-0.10.4 → guild_cli-0.11.0}/.claude/skills/guild/scripts/configure-repo.sh

@@ -43,6 +43,27 @@ command -v gh >/dev/null 2>&1 || { echo "configure-repo: 'gh' not on PATH" >&2;
 
 say() { if $apply; then echo "  ✓ $1"; else echo "  would: $1"; fi; }
 
+# Run a gh write that GitHub gates behind a paid plan for PRIVATE repos
+# (environments, rulesets). The ✓/⚠ line is printed only AFTER the call returns,
+# so the log never claims success before the attempt. On that specific 403 —
+# "Upgrade to GitHub Pro or make this repository public" — warn (to stderr) and
+# continue so a private `guild create` still succeeds on free-tier accounts; any
+# other failure stays fatal (output re-emitted to stderr, and the non-zero
+# return trips `set -e` in the caller).
+pro_gated_apply() {
+    what="$1"; shift
+    if out="$("$@" 2>&1)"; then
+        echo "  ✓ $what"
+        return 0
+    fi
+    if printf '%s\n' "$out" | grep -qiE 'Upgrade to GitHub Pro|make this repository public'; then
+        echo "  ⚠ skipped $what — requires GitHub Pro/Team for private repos (apply after upgrade or when the repo is public)" >&2
+        return 0
+    fi
+    printf '%s\n' "$out" >&2
+    return 1
+}
+
 echo "── configure-repo: $repo $([ "$apply" = true ] && echo '(--apply)' || echo '(dry-run)') ──"
 
 # 1. auto-delete-on-merge ---------------------------------------------------
@@ -53,9 +74,10 @@ fi
 
 # 2. environments -----------------------------------------------------------
 for env in "${ENVIRONMENTS[@]}"; do
-    say "ensure environment '$env'"
     if $apply; then
-        gh api -X PUT "repos/$repo/environments/$env" >/dev/null
+        pro_gated_apply "environment '$env'" gh api -X PUT "repos/$repo/environments/$env"
+    else
+        say "ensure environment '$env'"
     fi
 done
 
@@ -65,8 +87,8 @@ if ! $apply; then
 elif gh api "repos/$repo/rulesets" --jq '.[].name' 2>/dev/null | grep -Fxq "$RULESET_NAME"; then
     echo "  • ruleset '$RULESET_NAME' already present — skipping"
 else
-    echo "  ✓ create ruleset '$RULESET_NAME' (deletion + non_fast_forward + pull_request)"
-    gh api -X POST "repos/$repo/rulesets" --input - >/dev/null <<JSON
+    pro_gated_apply "ruleset '$RULESET_NAME' (deletion + non_fast_forward + pull_request)" \
+        gh api -X POST "repos/$repo/rulesets" --input - <<JSON
 {
   "name": "$RULESET_NAME",
   "target": "branch",

{guild_cli-0.10.4 → guild_cli-0.11.0}/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to this project will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/). This project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.11.0] - 2026-06-10
+
+### Added
+
+- **`guild create` now defaults to a PRIVATE repo, with `--public` to opt out.**
+  The `culture-agent-template` is itself private, so new siblings are created
+  private by default; pass `--public` for siblings meant to be open. The flag
+  flips the `gh repo create` visibility from `--private` to `--public`, and the
+  resolved visibility is surfaced in the dry-run render (`visibility :
+  private`/`public`) and the `--json` payload (`"private"`). **Behavioral change:**
+  a bare `guild create` previously produced a public repo and now produces a
+  private one.
+- **`configure-repo.sh` tolerates the GitHub Pro/Team gate on private repos.**
+  Environments and branch-protection rulesets return a 403 (`Upgrade to GitHub
+  Pro or make this repository public`) for private repos on free-tier accounts.
+  The new `pro_gated_apply` helper warns-and-continues on exactly that 403 (any
+  other failure stays fatal), so provisioning a private sibling completes cleanly
+  instead of aborting after the repo + genesis already exist. Branch protection
+  is simply not applied until the repo is upgraded to a paid plan or made public.
+  The skip warning is written to **stderr** and `guild create` re-emits it as a
+  diagnostic (stdout stays clean for `--json`), so the skip is never swallowed by
+  the provisioning runner; the `✓`/`⚠` status line is printed only *after* the
+  call returns, never optimistically before it.
+- **Registered `agent-lifecycle` in the skills ledger** as a downstream consumer
+  of the canonical kit. `agent-lifecycle` is a new (private) sibling chartered by
+  `culture` (guildmaster#61): a harness- and transport-agnostic agent runtime
+  extracted from `cultureagent`.
+
+### Changed
+
+### Fixed
+
 ## [0.10.4] - 2026-06-07
 
 ### Changed

{guild_cli-0.10.4 → guild_cli-0.11.0}/CLAUDE.md

@@ -108,7 +108,7 @@ two live broadcasters.
 
 **Provisioning verb — `guild create` (template-instantiate a new sibling).**
 
-- `guild create --agent OWNER/REPO --desc TEXT [--backend claude|acp] [--workspace-root DIR] [--template agentculture/culture-agent-template] [--command NAME] [--pkg NAME] [--dist NAME] [--apply] [--json]` — provision a brand-new AgentCulture sibling by instantiating the GitHub template, renaming identifiers throughout the clone, writing a self-init CLAUDE.md seed, configuring the GitHub repo (branch protection, environments, SONAR_TOKEN placeholder), pushing the genesis commit, and registering the agent in `docs/skill-sources.md`. Dry-run by default; `--apply` executes. The transform is **pure** (unit-testable against a fixture dir; no network): `culture_agent_template` → pkg (underscore form, e.g. `my_agent`), `culture-agent-template` → repo token (hyphen form, e.g. `my-agent`). **The repo token is the repo/agent identity only** — it always drives the README heading, `culture.yaml` suffix, CLAUDE.md seed, and repo URL. The **command**, **import package**, and **dist** are each independently retargetable and default to the repo token (or, for `--pkg`, the underscore form of `--command`); with no overrides the output is byte-identical to a plain rename. `--command NAME` sets the **console-command (binary) name** (default: the repo token) and retargets **only** the `[project.scripts]` entry-point key — e.g. `--command reachy` for repo `reachy-mini-cli` ships the command as `reachy`. `--pkg NAME` sets the **importable Python package** (default: the underscore form of `--command`, so command and import package stay in lock-step like `guild`/`guild`); pass it only to decouple the two. `--dist NAME` sets the **PyPI distribution name** (default: the repo token); pass e.g. `--dist jetson-cli` to publish as `jetson-cli` while keeping the command and import package as the repo token (`jetson`) — this retargets only `[project].name`, the `importlib.metadata` lookup, and the TestPyPI install pin, matching the `guild-cli`/`guild` convention without a manual post-create edit. (Renaming the dist or command does **not** register a Trusted Publisher — that needs a matching Trusted Publisher registered for the project name on PyPI/TestPyPI; `guild create` configures the GitHub side only.) The CLAUDE.md seed is a `/init`-style bootstrap placeholder — run `/init` in the new repo after provisioning to expand it into a full runtime prompt. Implementation: `guild/scaffold/instantiate.py` (pure transform: `_resolve_identifiers` + `_retarget_command` / `_retarget_dist`), `guild/cli/_commands/create.py` (CLI), `guild/cli/_commands/_provision_template.py` (injectable-runner executor), `.claude/skills/guild/scripts/create.sh` (thin wrapper).
+- `guild create --agent OWNER/REPO --desc TEXT [--backend claude|acp] [--workspace-root DIR] [--template agentculture/culture-agent-template] [--command NAME] [--pkg NAME] [--dist NAME] [--public] [--apply] [--json]` — provision a brand-new AgentCulture sibling by instantiating the GitHub template, renaming identifiers throughout the clone, writing a self-init CLAUDE.md seed, configuring the GitHub repo (branch protection, environments, SONAR_TOKEN placeholder), pushing the genesis commit, and registering the agent in `docs/skill-sources.md`. Dry-run by default; `--apply` executes. **New repos are private by default** (the `culture-agent-template` is itself private); pass `--public` to create an open sibling. Branch-protection rulesets (and environments) are GitHub Pro/Team-gated for private repos on free-tier accounts, so `configure-repo.sh` warns-and-skips the gated `gh` calls (any other failure stays fatal) and applies the rest — a private create still completes; re-run `configure-repo.sh` after a Pro upgrade or after going public to add the ruleset. The transform is **pure** (unit-testable against a fixture dir; no network): `culture_agent_template` → pkg (underscore form, e.g. `my_agent`), `culture-agent-template` → repo token (hyphen form, e.g. `my-agent`). **The repo token is the repo/agent identity only** — it always drives the README heading, `culture.yaml` suffix, CLAUDE.md seed, and repo URL. The **command**, **import package**, and **dist** are each independently retargetable and default to the repo token (or, for `--pkg`, the underscore form of `--command`); with no overrides the output is byte-identical to a plain rename. `--command NAME` sets the **console-command (binary) name** (default: the repo token) and retargets **only** the `[project.scripts]` entry-point key — e.g. `--command reachy` for repo `reachy-mini-cli` ships the command as `reachy`. `--pkg NAME` sets the **importable Python package** (default: the underscore form of `--command`, so command and import package stay in lock-step like `guild`/`guild`); pass it only to decouple the two. `--dist NAME` sets the **PyPI distribution name** (default: the repo token); pass e.g. `--dist jetson-cli` to publish as `jetson-cli` while keeping the command and import package as the repo token (`jetson`) — this retargets only `[project].name`, the `importlib.metadata` lookup, and the TestPyPI install pin, matching the `guild-cli`/`guild` convention without a manual post-create edit. (Renaming the dist or command does **not** register a Trusted Publisher — that needs a matching Trusted Publisher registered for the project name on PyPI/TestPyPI; `guild create` configures the GitHub side only.) The CLAUDE.md seed is a `/init`-style bootstrap placeholder — run `/init` in the new repo after provisioning to expand it into a full runtime prompt. Implementation: `guild/scaffold/instantiate.py` (pure transform: `_resolve_identifiers` + `_retarget_command` / `_retarget_dist`), `guild/cli/_commands/create.py` (CLI), `guild/cli/_commands/_provision_template.py` (injectable-runner executor), `.claude/skills/guild/scripts/create.sh` (thin wrapper).
 
 **Inventory verbs — `overview` & `show` (the read-only surfaces).** guildmaster
 owns the mesh's *inventory* surfaces per

{guild_cli-0.10.4 → guild_cli-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: guild-cli
-Version: 0.10.4
+Version: 0.11.0
 Summary: guildmaster — an agent and CLI that manages skills for the AgentCulture mesh.
 Project-URL: Homepage, https://github.com/agentculture/guildmaster
 Project-URL: Issues, https://github.com/agentculture/guildmaster/issues

{guild_cli-0.10.4 → guild_cli-0.11.0}/docs/skill-sources.md

@@ -32,14 +32,14 @@ current by `guild overview --scope mesh`.
 
 | Skill | Upstream | Downstream copies (known) | Notes |
 |-------|----------|---------------------------|-------|
-| `agent-config` | `guildmaster` (`.claude/skills/agent-config/`) | `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli` | Inventory variant backing `guild show` ([#12](https://github.com/agentculture/guildmaster/issues/12)); `show.sh` + `data/backend-fingerprints.yaml` vendored verbatim from steward, SKILL.md reframed from alignment-judgment to inventory + `type: command` added. **Forked from steward:** steward retains its own alignment-focused `agent-config` variant; the inventory variant is guildmaster's to supply. |
-| `cicd` | `guildmaster` (`.claude/skills/cicd/`) — layered on `devex pr` (in `agentculture/devex`) | `afi-cli`, `devex` (adapted-thin delegate — owns `devex pr`; see [devex#53](https://github.com/agentculture/devex/pull/53)), `agtag`, `antoine`, `appsec`, `auntiepypi`, `cfafi` (still named `pr-review`), `code-lens-cli`, `culture` (still named `pr-review`), `devague`, `katvan`, `lecodeur`, `lepenseur`, `seer-cli`, `telek`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `grant` (still named `pr-review`), `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli` | Thin delegate to `devex pr` for lint / open / read / reply / delta, plus guildmaster's `status` (SonarCloud quality gate + hotspots + unresolved-thread tally) and `await` (composes `devex pr read --wait` with `status`, non-zero exit on Sonar ERROR / unresolved threads) extensions. **Inverted case:** devex, as the `devex pr` upstream, vendors the skill adapted-thin — a `workflow.sh`-only pure delegate ([devex#53](https://github.com/agentculture/devex/pull/53)). Renamed from `pr-review` in steward 0.7.0; downstream copies may keep the old name on their own cadence. |
-| `communicate` | `guildmaster` (`.claude/skills/communicate/`) | `afi-cli`, `devex` (identifier-only — vendored steward 0.11.0; scripts current as of 0.18.0), `agtag`, `antoine`, `appsec`, `auntiepypi`, `code-lens-cli`, `culture` (still named `coordinate`), `devague`, `katvan`, `lecodeur`, `lepenseur`, `seer-cli`, `telek`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli` | Cross-repo + mesh communication: file issues / hand off briefs to sibling-repo agents (auto-signed), comment on existing issues, fetch issues to inline state into briefs, and send live messages to Culture mesh channels (unsigned — nick is the speaker). Renamed from `coordinate` in steward 0.8.0; absorbed `gh-issues` (as `fetch-issues.sh`) in 0.9.1. Issue I/O backed by `agtag` (>=0.1) since steward 0.11.0 — signature resolves from local `culture.yaml` (override via `--as`). |
-| `doc-test-alignment` | `guildmaster` (`.claude/skills/doc-test-alignment/`) | `devague`, `lecodeur`, `lepenseur`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli` | Stub; real implementation TBD. `scripts/check.sh` exits not-yet-implemented today. |
-| `pypi-maintainer` | `guildmaster` (`.claude/skills/pypi-maintainer/`) | `agtag`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli` | Switches a PyPI package install between pypi / test-pypi / local. Generalised from the original culture-specific `change-package`. |
-| `run-tests` | `guildmaster` (`.claude/skills/run-tests/`) | `agtag`, `antoine`, `appsec`, `code-lens-cli`, `culture`, `culture-sonar-cli`, `devague`, `lecodeur`, `lepenseur`, `seer-cli`, `grant`, `telek`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli` | Coverage source resolves from `[tool.coverage.run]` in `pyproject.toml`, so the script is portable across siblings without modification. |
-| `sonarclaude` | `guildmaster` (`.claude/skills/sonarclaude/`) | `antoine`, `appsec`, `code-lens-cli`, `devague`, `lecodeur`, `lepenseur`, `seer-cli`, `telek`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli` | SonarCloud API client. Project key resolves from `$SONAR_PROJECT` or `--project KEY`. |
-| `version-bump` | `guildmaster` (`.claude/skills/version-bump/`) | `afi-cli`, `agtag`, `antoine`, `appsec`, `auntiepypi`, `cfafi`, `code-lens-cli`, `culture`, `devague`, `lecodeur`, `lepenseur`, `seer-cli`, `grant`, `telek`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli` | Pure Python, prepends a Keep-a-Changelog entry; no per-repo customization needed. |
+| `agent-config` | `guildmaster` (`.claude/skills/agent-config/`) | `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli`, `agent-lifecycle` | Inventory variant backing `guild show` ([#12](https://github.com/agentculture/guildmaster/issues/12)); `show.sh` + `data/backend-fingerprints.yaml` vendored verbatim from steward, SKILL.md reframed from alignment-judgment to inventory + `type: command` added. **Forked from steward:** steward retains its own alignment-focused `agent-config` variant; the inventory variant is guildmaster's to supply. |
+| `cicd` | `guildmaster` (`.claude/skills/cicd/`) — layered on `devex pr` (in `agentculture/devex`) | `afi-cli`, `devex` (adapted-thin delegate — owns `devex pr`; see [devex#53](https://github.com/agentculture/devex/pull/53)), `agtag`, `antoine`, `appsec`, `auntiepypi`, `cfafi` (still named `pr-review`), `code-lens-cli`, `culture` (still named `pr-review`), `devague`, `katvan`, `lecodeur`, `lepenseur`, `seer-cli`, `telek`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `grant` (still named `pr-review`), `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli`, `agent-lifecycle` | Thin delegate to `devex pr` for lint / open / read / reply / delta, plus guildmaster's `status` (SonarCloud quality gate + hotspots + unresolved-thread tally) and `await` (composes `devex pr read --wait` with `status`, non-zero exit on Sonar ERROR / unresolved threads) extensions. **Inverted case:** devex, as the `devex pr` upstream, vendors the skill adapted-thin — a `workflow.sh`-only pure delegate ([devex#53](https://github.com/agentculture/devex/pull/53)). Renamed from `pr-review` in steward 0.7.0; downstream copies may keep the old name on their own cadence. |
+| `communicate` | `guildmaster` (`.claude/skills/communicate/`) | `afi-cli`, `devex` (identifier-only — vendored steward 0.11.0; scripts current as of 0.18.0), `agtag`, `antoine`, `appsec`, `auntiepypi`, `code-lens-cli`, `culture` (still named `coordinate`), `devague`, `katvan`, `lecodeur`, `lepenseur`, `seer-cli`, `telek`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli`, `agent-lifecycle` | Cross-repo + mesh communication: file issues / hand off briefs to sibling-repo agents (auto-signed), comment on existing issues, fetch issues to inline state into briefs, and send live messages to Culture mesh channels (unsigned — nick is the speaker). Renamed from `coordinate` in steward 0.8.0; absorbed `gh-issues` (as `fetch-issues.sh`) in 0.9.1. Issue I/O backed by `agtag` (>=0.1) since steward 0.11.0 — signature resolves from local `culture.yaml` (override via `--as`). |
+| `doc-test-alignment` | `guildmaster` (`.claude/skills/doc-test-alignment/`) | `devague`, `lecodeur`, `lepenseur`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli`, `agent-lifecycle` | Stub; real implementation TBD. `scripts/check.sh` exits not-yet-implemented today. |
+| `pypi-maintainer` | `guildmaster` (`.claude/skills/pypi-maintainer/`) | `agtag`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli`, `agent-lifecycle` | Switches a PyPI package install between pypi / test-pypi / local. Generalised from the original culture-specific `change-package`. |
+| `run-tests` | `guildmaster` (`.claude/skills/run-tests/`) | `agtag`, `antoine`, `appsec`, `code-lens-cli`, `culture`, `culture-sonar-cli`, `devague`, `lecodeur`, `lepenseur`, `seer-cli`, `grant`, `telek`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli`, `agent-lifecycle` | Coverage source resolves from `[tool.coverage.run]` in `pyproject.toml`, so the script is portable across siblings without modification. |
+| `sonarclaude` | `guildmaster` (`.claude/skills/sonarclaude/`) | `antoine`, `appsec`, `code-lens-cli`, `devague`, `lecodeur`, `lepenseur`, `seer-cli`, `telek`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli`, `agent-lifecycle` | SonarCloud API client. Project key resolves from `$SONAR_PROJECT` or `--project KEY`. |
+| `version-bump` | `guildmaster` (`.claude/skills/version-bump/`) | `afi-cli`, `agtag`, `antoine`, `appsec`, `auntiepypi`, `cfafi`, `code-lens-cli`, `culture`, `devague`, `lecodeur`, `lepenseur`, `seer-cli`, `grant`, `telek`, `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli`, `agent-lifecycle` | Pure Python, prepends a Keep-a-Changelog entry; no per-repo customization needed. |
 
 > **How the downstream column is maintained.** The "Downstream copies (known)"
 > entries are kept in sync with guildmaster's own drift detector:
@@ -86,9 +86,9 @@ harmless on `claude-code`. This is the only divergence from upstream.
 
 | Skill | Origin | Downstream copies (known) | Notes |
 |-------|--------|---------------------------|-------|
-| `think` | `devague` (`agentculture/devague`, `../devague/.claude/skills/think/`) | — (broadcast pending), `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli` | Operator for the **idea→spec** leg (announcement frame → capture/classify claims → interrogate with honesty conditions → park open vagueness → `export` once the frame converges). Renamed from `devague` in devague 0.4.0. **Divergence:** `type: command` added. Runtime dep: `uv tool install devague`. |
-| `spec-to-plan` | `devague` (`agentculture/devague`, `../devague/.claude/skills/spec-to-plan/`) | — (broadcast pending), `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli` | Operator for the **spec→plan** leg (`devague plan ...`): seed from a converged frame, cover every coverage target with acceptance-gated, acyclically-ordered tasks, park unknowns as risks, `export` once the plan converges. New in devague 0.4.0. **Divergence:** `type: command` added. Runtime dep: `uv tool install devague`. |
-| `assign-to-workforce` | `devague` (`agentculture/devague`, `../devague/.claude/skills/assign-to-workforce/`) | — (broadcast pending), `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli` | Operator for the **implementation** leg: reads `devague plan waves` (read-only) and fans out independent tasks to one agent per task per wave in isolated git worktrees, with main-agent TDD-gated merges. Three human gates: spec / split plan / final PR. The CLI stays non-orchestrating ([devague#20](https://github.com/agentculture/devague/issues/20)). New in devague 0.10.0. **Divergence:** `type: command` added. Runtime deps: `uv tool install devague`, `git worktree`, the vendored `cicd` skill (for gate-3 `devex pr open`). |
+| `think` | `devague` (`agentculture/devague`, `../devague/.claude/skills/think/`) | — (broadcast pending), `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli`, `agent-lifecycle` | Operator for the **idea→spec** leg (announcement frame → capture/classify claims → interrogate with honesty conditions → park open vagueness → `export` once the frame converges). Renamed from `devague` in devague 0.4.0. **Divergence:** `type: command` added. Runtime dep: `uv tool install devague`. |
+| `spec-to-plan` | `devague` (`agentculture/devague`, `../devague/.claude/skills/spec-to-plan/`) | — (broadcast pending), `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli`, `agent-lifecycle` | Operator for the **spec→plan** leg (`devague plan ...`): seed from a converged frame, cover every coverage target with acceptance-gated, acyclically-ordered tasks, park unknowns as risks, `export` once the plan converges. New in devague 0.4.0. **Divergence:** `type: command` added. Runtime dep: `uv tool install devague`. |
+| `assign-to-workforce` | `devague` (`agentculture/devague`, `../devague/.claude/skills/assign-to-workforce/`) | — (broadcast pending), `agenda`, `dominion-breaker`, `colleague`, `jetson`, `reachy-mini-cli`, `jetson-ai-lab-cli`, `dgx-spark-cli`, `unsloth-cli`, `discord-bot-cli`, `arxivist`, `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli`, `agent-lifecycle` | Operator for the **implementation** leg: reads `devague plan waves` (read-only) and fans out independent tasks to one agent per task per wave in isolated git worktrees, with main-agent TDD-gated merges. Three human gates: spec / split plan / final PR. The CLI stays non-orchestrating ([devague#20](https://github.com/agentculture/devague/issues/20)). New in devague 0.10.0. **Divergence:** `type: command` added. Runtime deps: `uv tool install devague`, `git worktree`, the vendored `cicd` skill (for gate-3 `devex pr open`). |
 
 Downstream is empty by design: these are still being introduced to the mesh.
 `guild teach --new --skill <name> --to <repos>` frames them as *new* skills to
@@ -136,7 +136,7 @@ the CLI, the wrapper exits with a clear install hint rather than crashing.
 
 | Skill | Origin | Downstream copies (known) | Notes |
 |-------|--------|---------------------------|-------|
-| `outsource` | `colleague` (`agentculture/colleague`, `../colleague/.claude/skills/outsource/`) | — (broadcast pending; [`culture-agent-template#8`](https://github.com/agentculture/culture-agent-template/issues/8) proposes adding it to the clone template), `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli` | First-party colleague skill: hand a scoped task to a *different* engine/mind. Verbs `explore` / `review` / `write`. **Divergence:** Provenance paragraph reframed for re-broadcast (above); `type: command` already present upstream. Runtime dep: `uv tool install colleague-cli` + a reachable engine. |
+| `outsource` | `colleague` (`agentculture/colleague`, `../colleague/.claude/skills/outsource/`) | — (broadcast pending; [`culture-agent-template#8`](https://github.com/agentculture/culture-agent-template/issues/8) proposes adding it to the clone template), `rtx-spark-cli`, `reachy-mini-mcp`, `tensor-cli`, `climate-cli`, `eidetic-cli`, `prove-cli`, `reduce-cli`, `refactor-cli`, `rollout-cli`, `coherence-cli`, `agent-lifecycle` | First-party colleague skill: hand a scoped task to a *different* engine/mind. Verbs `explore` / `review` / `write`. **Divergence:** Provenance paragraph reframed for re-broadcast (above); `type: command` already present upstream. Runtime dep: `uv tool install colleague-cli` + a reachable engine. |
 
 Downstream is empty by design — guildmaster is the first holder outside
 colleague. `guild teach --new --skill outsource --to <repos>` frames it as a

{guild_cli-0.10.4 → guild_cli-0.11.0}/guild/cli/_commands/_provision_template.py

@@ -16,7 +16,7 @@ Sequence (``--apply``)
 1. ``gh repo view <agent>``                          (preflight: repo must NOT exist)
 2. ``gh repo create <agent>``                        (template instantiation)
    ``  --template <template>``
-   ``  --public``
+   ``  --private`` / ``--public``                     (visibility; --private by default)
    ``  --description <desc>``
 3. ``git clone https://github.com/<agent>.git <clone_dest>``
 4. transform_clone(<clone_dest>, bare, desc, backend) (pure, local, no runner)
@@ -244,6 +244,7 @@ def apply(
     dist: str | None = None,
     command: str | None = None,
     pkg: str | None = None,
+    public: bool = False,
     poll_attempts: int = 30,
     poll_delay: float = 2.0,
 ) -> dict:
@@ -277,6 +278,10 @@ def apply(
     pkg:
         Importable package name. ``None`` defaults to the underscore form of the
         effective command (see ``transform_clone``).
+    public:
+        Repo visibility. ``False`` (default) creates a ``--private`` repo, matching
+        the (private) ``culture-agent-template``; ``True`` creates a ``--public``
+        repo for siblings that are meant to be open.
     poll_attempts / poll_delay:
         ``gh repo create --template`` copies the template content
         **asynchronously**; cloning immediately yields an empty repo. After
@@ -304,6 +309,7 @@ def apply(
     preflight(agent, clone_dest, runner=runner)
 
     # Step 2 — create the repo from the template.
+    visibility = "--public" if public else "--private"
     create = runner(
         [
             "gh",
@@ -312,7 +318,7 @@ def apply(
             agent,
             "--template",
             template,
-            "--public",
+            visibility,
             "--description",
             desc,
         ]
@@ -352,13 +358,20 @@ def apply(
 
     # Step 8 — configure-repo.sh LAST: its "Protect main" ruleset requires PRs,
     # so applying it before the genesis push would get that push rejected.
+    configure_output = ""
     configure_script = guildmaster_root / CONFIGURE_REPO_SCRIPT
     if configure_script.is_file():
         cfg = runner([_BASH, str(configure_script), agent, "--apply"])
         _check(cfg, f"configure-repo.sh {agent} failed", EXIT_ENV_ERROR)
+        # configure-repo.sh writes its Pro-gate skip warnings (and any other
+        # diagnostics) to stderr. The runner captures them, so surface them to
+        # the caller — otherwise a private create that silently skipped
+        # environments/rulesets is reported as fully configured.
+        configure_output = (cfg.stderr or "").strip()
 
     return {
         "repo": agent,
         "clone_dest": str(clone_dest),
         "pushed": True,
+        "configure_output": configure_output,
     }

{guild_cli-0.10.4 → guild_cli-0.11.0}/guild/cli/_commands/create.py

@@ -16,7 +16,7 @@ Usage
                  [--backend claude|acp] [--workspace-root DIR]
                  [--template agentculture/culture-agent-template]
                  [--command NAME] [--pkg NAME] [--dist NAME]
-                 [--apply] [--json]
+                 [--public] [--apply] [--json]
 """
 
 from __future__ import annotations
@@ -31,7 +31,7 @@ from pathlib import Path
 from guild.cli._commands import _broadcast
 from guild.cli._commands import _provision_template as _provision
 from guild.cli._errors import EXIT_USER_ERROR, GuildError
-from guild.cli._output import emit_result
+from guild.cli._output import emit_diagnostic, emit_result
 from guild.cli._repo import repo_root
 from guild.scaffold.instantiate import transform_plan as _transform_plan
 from guild.skills import ledger as _ledger
@@ -128,6 +128,15 @@ def register(sub: argparse._SubParsersAction) -> None:
             "[project].name, the importlib.metadata lookup, and the TestPyPI pin."
         ),
     )
+    parser.add_argument(
+        "--public",
+        action="store_true",
+        help=(
+            "Create the GitHub repo public. The default is PRIVATE — the "
+            "culture-agent-template is itself private, so siblings are created "
+            "private unless you opt into public with this flag."
+        ),
+    )
     parser.add_argument(
         "--apply",
         action="store_true",
@@ -238,6 +247,7 @@ def _handle(args: argparse.Namespace) -> None:
             "agent": agent,
             "backend": args.backend,
             "template": args.template,
+            "private": not args.public,
             "clone_dest": str(clone_dest),
             "plan": plan,
             "ledger_diff": ledger_diff,
@@ -257,8 +267,16 @@ def _handle(args: argparse.Namespace) -> None:
         dist=args.dist,
         command=args.command_name,
         pkg=args.pkg,
+        public=args.public,
     )
 
+    # Surface configure-repo.sh diagnostics (e.g. Pro-gated environment/ruleset
+    # skips for private repos) on stderr, so they aren't swallowed by the runner
+    # and stdout stays clean for --json consumers.
+    configure_output = apply_result.get("configure_output")
+    if configure_output:
+        emit_diagnostic(configure_output)
+
     # Register in the ledger idempotently.
     ledger_written = new_ledger != ledger_text
     if ledger_written:
@@ -272,6 +290,7 @@ def _handle(args: argparse.Namespace) -> None:
         "repo": apply_result["repo"],
         "clone_dest": apply_result["clone_dest"],
         "pushed": apply_result["pushed"],
+        "private": not args.public,
         "command": plan["command"],
         "pkg": plan["pkg"],
         "dist": plan["dist"],
@@ -293,6 +312,7 @@ def _render_dry_run(result: dict) -> str:
         f"  template   : {result['template']}",
         f"  agent      : {result['agent']}",
         f"  backend    : {result['backend']}",
+        f"  visibility : {'private' if result.get('private') else 'public'}",
         f"  clone dest : {result['clone_dest']}",
         f"  repo token : {plan['repo_token']}  (identity: README, culture.yaml, seed, URL)",
         f"  command    : {plan['command']}",

{guild_cli-0.10.4 → guild_cli-0.11.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "guild-cli"
-version = "0.10.4"
+version = "0.11.0"
 description = "guildmaster — an agent and CLI that manages skills for the AgentCulture mesh."
 readme = "README.md"
 license = "Apache-2.0"

{guild_cli-0.10.4 → guild_cli-0.11.0}/tests/test_cli_create.py

@@ -317,10 +317,13 @@ def test_create_dry_run_explicit_owner_not_prefixed(tmp_path, monkeypatch, capsy
 class _FakeRunner:
     """Records every command issued, returns configurable per-command results."""
 
-    def __init__(self, *, repo_exists: bool = False, auth_ok: bool = True):
+    def __init__(
+        self, *, repo_exists: bool = False, auth_ok: bool = True, configure_stderr: str = ""
+    ):
         self.calls: list[tuple[list[str], dict]] = []
         self._repo_exists = repo_exists
         self._auth_ok = auth_ok
+        self._configure_stderr = configure_stderr
 
     def __call__(self, cmd: list[str], *, cwd: str | None = None) -> RunResult:
         self.calls.append((list(cmd), {"cwd": cwd}))
@@ -375,7 +378,7 @@ class _FakeRunner:
 
         # configure-repo.sh
         if "configure-repo.sh" in " ".join(str(a) for a in argv):
-            return RunResult(returncode=0)
+            return RunResult(returncode=0, stderr=self._configure_stderr)
 
         # git -C ... add / commit / push
         if argv[:1] == ["git"] and "-C" in argv:
@@ -440,6 +443,145 @@ def test_create_apply_full_command_sequence(tmp_path, monkeypatch, capsys):
     assert poll_idx < clone_idx, f"populate-poll must precede clone; got {issued}"
 
 
+def _create_argv(workspace: Path, *extra: str) -> list[str]:
+    """Shared argv for the visibility apply tests."""
+    return [
+        "create",
+        "--agent",
+        "newsib",
+        "--desc",
+        "A new sibling.",
+        "--workspace-root",
+        str(workspace),
+        *extra,
+        "--apply",
+    ]
+
+
+def _gh_repo_create_cmd(runner: "_FakeRunner") -> list[str]:
+    """Return the argv list of the single ``gh repo create`` call."""
+    return next(
+        cmd
+        for cmd, _ in runner.calls
+        if cmd[:3] == ["gh", "repo", "create"] and "--template" in cmd
+    )
+
+
+def test_create_apply_defaults_to_private(tmp_path, monkeypatch):
+    """Without --public, the repo is created --private (the new default)."""
+    root = _seed(tmp_path)
+    workspace = tmp_path / "ws"
+    workspace.mkdir()
+    monkeypatch.chdir(root)
+
+    runner = _FakeRunner()
+    import guild.cli._commands._provision_template as _prov
+
+    monkeypatch.setattr(_prov, "default_runner", runner)
+
+    rc = main(_create_argv(workspace))
+    assert rc == 0
+
+    create_cmd = _gh_repo_create_cmd(runner)
+    assert "--private" in create_cmd
+    assert "--public" not in create_cmd
+
+
+def test_create_apply_public_flag(tmp_path, monkeypatch):
+    """--public creates the repo --public (and never --private)."""
+    root = _seed(tmp_path)
+    workspace = tmp_path / "ws"
+    workspace.mkdir()
+    monkeypatch.chdir(root)
+
+    runner = _FakeRunner()
+    import guild.cli._commands._provision_template as _prov
+
+    monkeypatch.setattr(_prov, "default_runner", runner)
+
+    rc = main(_create_argv(workspace, "--public"))
+    assert rc == 0
+
+    create_cmd = _gh_repo_create_cmd(runner)
+    assert "--public" in create_cmd
+    assert "--private" not in create_cmd
+
+
+def test_create_dry_run_reports_visibility(tmp_path, monkeypatch, capsys):
+    """The dry-run render surfaces the chosen visibility (private default / public opt-in)."""
+    root = _seed(tmp_path)
+    monkeypatch.chdir(root)
+    monkeypatch.setattr(subprocess, "run", _never_called)
+    monkeypatch.setattr(socket, "getaddrinfo", _never_called)
+
+    assert main(["create", "--agent", "newsib", "--desc", "X"]) == 0
+    assert "visibility : private" in capsys.readouterr().out
+
+    assert main(["create", "--agent", "newsib", "--desc", "X", "--public"]) == 0
+    assert "visibility : public" in capsys.readouterr().out
+
+
+def test_create_apply_public_json_payload(tmp_path, monkeypatch, capsys):
+    """The --json apply payload reports visibility: --public ⇒ private False."""
+    root = _seed(tmp_path)
+    workspace = tmp_path / "ws"
+    workspace.mkdir()
+    monkeypatch.chdir(root)
+
+    runner = _FakeRunner()
+    import guild.cli._commands._provision_template as _prov
+
+    monkeypatch.setattr(_prov, "default_runner", runner)
+
+    rc = main(_create_argv(workspace, "--public", "--json"))
+    assert rc == 0
+
+    payload = json.loads(capsys.readouterr().out)
+    assert payload["private"] is False
+
+
+def test_create_apply_surfaces_configure_warnings_on_stderr(tmp_path, monkeypatch, capsys):
+    """configure-repo.sh Pro-gate skip warnings reach the operator's stderr, and
+    stdout stays pure JSON under --json (the runner must not swallow them)."""
+    root = _seed(tmp_path)
+    workspace = tmp_path / "ws"
+    workspace.mkdir()
+    monkeypatch.chdir(root)
+
+    warning = "  ⚠ skipped ruleset 'Protect main' — requires GitHub Pro/Team for private repos"
+    runner = _FakeRunner(configure_stderr=warning + "\n")
+    import guild.cli._commands._provision_template as _prov
+
+    monkeypatch.setattr(_prov, "default_runner", runner)
+
+    rc = main(_create_argv(workspace, "--json"))
+    assert rc == 0
+
+    captured = capsys.readouterr()
+    # stdout is still valid JSON (the warning did NOT leak onto it).
+    payload = json.loads(captured.out)
+    assert payload["applied"] is True
+    # the skip warning is surfaced as a diagnostic on stderr.
+    assert "skipped ruleset 'Protect main'" in captured.err
+
+
+def test_create_apply_no_configure_warnings_keeps_stderr_quiet(tmp_path, monkeypatch, capsys):
+    """A clean configure-repo run (no Pro-gate skips) emits nothing extra to stderr."""
+    root = _seed(tmp_path)
+    workspace = tmp_path / "ws"
+    workspace.mkdir()
+    monkeypatch.chdir(root)
+
+    runner = _FakeRunner()  # no configure_stderr
+    import guild.cli._commands._provision_template as _prov
+
+    monkeypatch.setattr(_prov, "default_runner", runner)
+
+    rc = main(_create_argv(workspace, "--json"))
+    assert rc == 0
+    assert capsys.readouterr().err == ""
+
+
 def test_wait_for_template_polls_until_populated():
     """The repo is empty (409) for a few polls, then the template lands."""
     import guild.cli._commands._provision_template as _prov

{guild_cli-0.10.4 → guild_cli-0.11.0}/uv.lock

@@ -179,7 +179,7 @@ wheels = [
 
 [[package]]
 name = "guild-cli"
-version = "0.10.4"
+version = "0.11.0"
 source = { editable = "." }
 dependencies = [
     { name = "pyyaml" },