project-init 0.5.0__tar.gz → 0.5.2__tar.gz

{project_init-0.5.0/plugins/project-init-lifecycle → project_init-0.5.2/.claude}/hooks/dag_workflow.py

@@ -297,6 +297,37 @@ def _strip_heredocs(cmd: str) -> str:
     return _HEREDOC_RE.sub("", cmd)
 
 
+# Free-text flag values carry arbitrary prose (commit messages, issue/PR comment
+# and release bodies, titles) that must not be scanned for command patterns — a
+# `--body` mentioning the literal "git push main" is data, not an invocation.
+_TEXT_FLAG_RE = re.compile(
+    r"""(?P<flag>--body|--message|--title|--notes|-b|-m|-t)   # known free-text flags
+        (?:=|\s+)                                             # = or whitespace separator
+        (?P<q>['"])                                           # opening quote
+        (?P<val>(?:\\.|(?!(?P=q)).)*)                         # value (escapes allowed)
+        (?P=q)                                                # matching closing quote
+    """,
+    re.VERBOSE | re.DOTALL,
+)
+
+
+def _strip_text_flag_values(cmd: str) -> str:
+    """Blank the quoted value of known free-text flags so prose can't trip the
+    pattern rules. Values containing a command substitution (``$(`` or a
+    backtick) are left intact — those ARE executed, so the rules must still see
+    them. Flag values are otherwise inert data: masking loses no real
+    enforcement (an actual ``git push origin main`` uses a positional ref, not a
+    flag value, and stays blocked)."""
+
+    def _blank(m: re.Match[str]) -> str:
+        val = m.group("val")
+        if "$(" in val or "`" in val:
+            return m.group(0)
+        return f'{m.group("flag")} ""'
+
+    return _TEXT_FLAG_RE.sub(_blank, cmd)
+
+
 def _redirect_target_exists(reason: str) -> bool:
     """Best-effort: scan the redirect message for a `.claude/scripts/<name>`
     reference and check whether the file exists. If no reference is found,
@@ -325,9 +356,10 @@ def guard(payload: dict) -> dict | None:
     if not cmd:
         return None
 
-    # Strip heredoc bodies so pattern rules don't fire on body content
-    # (e.g. `gh issue create --body "$(cat <<'EOF'\n...git push...\nEOF\n)"`)
-    cmd_scan = _strip_heredocs(cmd)
+    # Strip heredoc bodies and free-text flag values so pattern rules don't fire
+    # on prose content (e.g. `gh issue create --body "$(cat <<'EOF'\n...git
+    # push...\nEOF\n)"`, or `gh pr comment --body "...git push main..."`).
+    cmd_scan = _strip_text_flag_values(_strip_heredocs(cmd))
 
     for pattern, target, message in COMMAND_RULES:
         if not pattern.search(cmd_scan):

{project_init-0.5.0 → project_init-0.5.2}/.claude-plugin/marketplace.json

@@ -1,5 +1,6 @@
 {
   "name": "project-init",
+  "description": "Plugins extracted from the project-init scaffolder: forge-agnostic quality and safety hooks plus general skills (project-init-workflow), and GitHub issue->branch->PR->review->merge lifecycle automation (project-init-lifecycle).",
   "owner": {
     "name": "Vytautas Čepas",
     "url": "https://github.com/VytCepas"

project_init-0.5.2/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,21 @@
+<!--
+PR title must use Conventional Commits and becomes the squash-merge commit message:
+  - issue-linked work: `type(PI-N): description`  e.g. `feat(PI-42): add new overlay`
+  - no-issue minor fix: `type: description`        e.g. `fix: handle empty preset name`
+-->
+
+## What & why
+
+<!-- What does this change do, and why is it needed? -->
+
+## Related issue
+
+Closes #
+<!-- Omit this line for minor fixes without a tracking issue. -->
+
+## Checklist
+
+- [ ] `just ci` passes locally (lint + full test suite)
+- [ ] Changes under `templates/` have a matching test in `tests/<layer>/test_*.py`
+- [ ] Docs / README updated if behavior or flags changed
+- [ ] PR title follows Conventional Commits (`type(PI-N): description`, or `type: description` with no issue)

project_init-0.5.2/CITATION.cff

@@ -0,0 +1,12 @@
+cff-version: 1.2.0
+message: "If you use project-init, please cite it using these metadata."
+title: project-init
+type: software
+authors:
+  - given-names: Vytautas
+    family-names: Čepas
+    email: vyt.cepas.ve@gmail.com
+repository-code: https://github.com/VytCepas/project-init
+url: https://vytcepas.github.io/project-init/
+license: Apache-2.0
+version: 0.5.2

project_init-0.5.2/CONTRIBUTING.md

@@ -0,0 +1,64 @@
+# Contributing to project-init
+
+Thanks for your interest! **project-init** is a scaffolder that drops a `.claude/`
+agentic-development layout into other projects. Bug reports, ideas, docs fixes,
+and pull requests are all welcome.
+
+## Ways to contribute
+
+- **Ask a question or float an idea** → [GitHub Discussions](https://github.com/VytCepas/project-init/discussions).
+- **Report a bug or request a feature** → [open an Issue](https://github.com/VytCepas/project-init/issues/new/choose) using one of the templates.
+- **Send a fix or improvement** → fork, branch, and open a pull request (see below).
+
+## Development setup
+
+This repo uses [`uv`](https://docs.astral.sh/uv/) and a `justfile` as the command surface.
+
+```bash
+git clone https://github.com/VytCepas/project-init.git
+cd project-init
+just setup          # uv sync + dev deps
+just --list         # see all recipes
+```
+
+| Recipe | What it does |
+|---|---|
+| `just lint` | ruff check + format check (the gate hooks/CI enforce) |
+| `just format` | ruff format |
+| `just test` | full pytest suite (`pytest -n auto`) |
+| `just docs` | build the MkDocs site |
+| `just ci` | lint + test (run before pushing) |
+
+Tooling conventions: **uv** for everything (never `pip`/`venv`), **ruff** only
+(no black/isort/mypy), and keep dependencies minimal — `tomllib` + `argparse`
+cover most needs. The scaffolder stays small and deterministic (no LLM calls).
+
+## Making changes
+
+1. **Fork** the repo and create a branch. Types: `feat` `fix` `chore` `docs` `test`.
+   - Issue-linked work: `type/PI-<n>-slug` (e.g. `feat/PI-42-new-preset`) so the
+     CI `validate-pr` workflow can keep branch, title, and body consistent.
+   - Minor work without a tracking issue: `type/slug` (e.g. `fix/wizard-typo`).
+2. **Templates are tested by scaffolding into a temp dir** — any change under
+   `templates/` should have a matching test in the focused
+   `tests/<layer>/test_*.py` module (`unit` / `integration` / `contracts` /
+   `smoke`) for that behavior. Create a new focused file if none fits.
+3. **Run `just ci`** locally and make sure it's green.
+4. **Commit** using [Conventional Commits](https://www.conventionalcommits.org/),
+   then open a pull request. Issue-linked work uses an issue-key scope
+   (`type(PI-N): description`); no-issue work uses `type: description`.
+
+## Pull requests
+
+- Use a Conventional-Commits PR title (it becomes the squash-merge commit
+  message): `type(PI-N): description` for issue-linked work, or `type: description`
+  for a minor fix with no tracking issue.
+- Fill in the pull request template — describe *what* changed and *why*, and link
+  any related issue with `Closes #N`.
+- CI runs lint, the full test suite, a secret scan, and a wheel smoke test. All
+  checks must pass before merge.
+
+## License
+
+By contributing you agree that your contributions are licensed under the
+project's [Apache-2.0](LICENSE) license.

{project_init-0.5.0 → project_init-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: project-init
-Version: 0.5.0
+Version: 0.5.2
 Summary: Scaffolder for agentic-development infrastructure inside any project
 Project-URL: Repository, https://github.com/VytCepas/project-init
 Project-URL: Documentation, https://vytcepas.github.io/project-init/
@@ -32,9 +32,20 @@ Description-Content-Type: text/markdown
 # project-init
 
 [![CI](https://github.com/VytCepas/project-init/actions/workflows/ci.yml/badge.svg)](https://github.com/VytCepas/project-init/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/project-init)](https://pypi.org/project/project-init/)
+[![Python versions](https://img.shields.io/pypi/pyversions/project-init)](https://pypi.org/project/project-init/)
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 
 Scaffolder for agentic-development infrastructure. One command drops a `.claude/` folder into any project so Claude Code (and other agents) have memory, docs, hooks, and curated MCPs ready to go.
 
+**Who it's for** — solo devs and small teams running Claude Code seriously across multiple repos who want consistent, *enforced* agent infrastructure (CI, a git-lifecycle DAG guard, memory, curated MCPs) — not a hand-maintained `.claude/` per project.
+
+```bash
+uvx project-init .        # scaffold into the current directory
+```
+
+→ **How it compares** to other scaffolders and Claude Code plugins: [docs/positioning.md](docs/positioning.md).
+
 ## What it gives you
 
 Inside any target project:
@@ -63,6 +74,52 @@ Principles:
 - **Claude-first, portable core** — built and tested for Claude Code; other agents get instructions, not enforcement. See [Agent support tiers](#agent-support-tiers).
 - **`bun` and `uv` only** — no `npm`/`npx`/`pip`/`venv` anywhere in scaffolded projects.
 
+## Install (one-time)
+
+Two install paths — pick by how you'll invoke it:
+
+**CLI-only, from [PyPI](https://pypi.org/project/project-init/)** (ADR-011). Gives
+you the `project-init` command — no `/project-init` slash command:
+
+```bash
+uv tool install project-init   # or one-off: uvx project-init .
+```
+
+**Full setup, from git** — adds the Claude Code slash command:
+
+```bash
+curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh | bash
+```
+
+This installs [`uv`](https://docs.astral.sh/uv/) if missing, clones the repo to `~/.local/share/project-init` (override with `PROJECT_INIT_HOME=...`) **pinned to the latest tagged release**, and writes a user-level slash command at `~/.claude/commands/project-init.md`.
+
+Pin a specific version, or opt into the unreleased development head:
+
+```bash
+PROJECT_INIT_REF=v0.5.1 bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
+PROJECT_INIT_REF=main   bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
+```
+
+Direct tool install without the slash command (any pinned tag):
+
+```bash
+uv tool install git+https://github.com/VytCepas/project-init@v0.5.1
+```
+
+Distribution rationale: [ADR-008](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-008-distribution-channel.md) (git channel), [ADR-011](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-011-pypi-trusted-publishing.md) (PyPI via trusted publishing).
+
+### Platform requirements
+
+macOS, Linux, and WSL work out of the box. The scaffolded hooks and lifecycle
+scripts are bash (a single bash-3.2 portability floor, epic #359) — so on **native Windows
+(non-WSL)** you need **[Git for Windows](https://gitforwindows.org/)** (it ships
+`bash`/`sh` + coreutils), and you should run from a **Git Bash** shell. Claude
+Code then runs hooks through Git Bash automatically; the wired hooks also pin
+`"shell": "bash"` to make that explicit. Without Git for Windows, Claude Code
+falls back to PowerShell, which can't run a bash hook — so the enforcement
+hooks won't fire. PowerShell-only is not a supported target; there are no
+`.ps1` equivalents by design. (WSL remains the smoothest Windows path.)
+
 ## Agent support tiers
 
 This is **firstly a Claude Code scaffolder**. It aims to be agent-agnostic where
@@ -118,52 +175,6 @@ Two honest caveats hold across all of it:
   files.** The suite validates settings/skills/hooks/MCP and the generated
   surface configs; no GUI agent is driven live in CI.
 
-## Install (one-time)
-
-Two install paths — pick by how you'll invoke it:
-
-**CLI-only, from PyPI** (after the first published release; ADR-011). Gives
-you the `project-init` command — no `/project-init` slash command:
-
-```bash
-uv tool install project-init   # or one-off: uvx project-init .
-```
-
-**Full setup, from git** — adds the Claude Code slash command:
-
-```bash
-curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh | bash
-```
-
-This installs [`uv`](https://docs.astral.sh/uv/) if missing, clones the repo to `~/.local/share/project-init` (override with `PROJECT_INIT_HOME=...`) **pinned to the latest tagged release**, and writes a user-level slash command at `~/.claude/commands/project-init.md`.
-
-Pin a specific version, or opt into the unreleased development head:
-
-```bash
-PROJECT_INIT_REF=v0.3.0 bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
-PROJECT_INIT_REF=main   bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
-```
-
-Direct tool install without the slash command (any pinned tag):
-
-```bash
-uv tool install git+https://github.com/VytCepas/project-init@v0.3.0
-```
-
-Distribution rationale: [ADR-008](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-008-distribution-channel.md) (git channel), [ADR-011](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-011-pypi-trusted-publishing.md) (PyPI via trusted publishing).
-
-### Platform requirements
-
-macOS, Linux, and WSL work out of the box. The scaffolded hooks and lifecycle
-scripts are bash (a single bash-3.2 portability floor, epic #359) — so on **native Windows
-(non-WSL)** you need **[Git for Windows](https://gitforwindows.org/)** (it ships
-`bash`/`sh` + coreutils), and you should run from a **Git Bash** shell. Claude
-Code then runs hooks through Git Bash automatically; the wired hooks also pin
-`"shell": "bash"` to make that explicit. Without Git for Windows, Claude Code
-falls back to PowerShell, which can't run a bash hook — so the enforcement
-hooks won't fire. PowerShell-only is not a supported target; there are no
-`.ps1` equivalents by design. (WSL remains the smoothest Windows path.)
-
 ## Use
 
 ### Option 1: Inside a Claude Code session (interactive)
@@ -334,6 +345,49 @@ fields; without recorded hashes or a base, every modified file is conservatively
 treated as a conflict (`.new` sibling). Run `upgrade --apply` once and the record
 is written for next time.
 
+### Adding or removing a concern later
+
+Changed your mind about a tier you declined (or want to drop one)? `add` and
+`remove` toggle a single concern on an **already-scaffolded** project — no need to
+re-run the wizard. They reuse the upgrade engine, so the shared wiring
+(`settings.json`, `config.yaml`, CI) is re-rendered with the concern flipped.
+
+```bash
+project-init add governance --target /path/to/proj          # dry-run: report only
+project-init add governance --target /path/to/proj --apply  # land it
+project-init add memory obsidian-only --target /path --apply # memory takes a tier
+project-init remove lifecycle --target /path/to/proj --apply # drop a concern
+```
+
+Concerns: `lifecycle`, `governance`, `observability`, `multi-model`, `docs`,
+`renovate`, and `memory <stack>` (`auto` · `obsidian-only` · `obsidian-graphify` ·
+`obsidian-graphify-rag` · `none`).
+
+- **Dry-run by default** — without `--apply` it only reports what would change.
+- **`--apply` is git-guarded** — it refuses a dirty work tree (so the change lands
+  as one revertible diff); `--allow-dirty` overrides.
+- **`remove` never destroys your edits** — it deletes a concern's files only when
+  they are byte-identical to what it scaffolded; a file you edited is kept and
+  reported.
+- **Your notes are safe** — `remove memory` unwires the tier but **keeps**
+  `.claude/memory/` and `.claude/vault/` (your accumulated notes) by default. To
+  also handle that source data, opt in explicitly:
+
+  ```bash
+  project-init remove memory --target /path --apply --export ~/notes-backup  # move it out first
+  project-init remove memory --target /path --apply --purge                  # delete it (destructive)
+  ```
+
+  `--purge` and `--export` are mutually exclusive; `--purge` prints what it will
+  delete and (like all `--apply` runs) requires a clean tree, so the data is
+  recoverable from git. The same flags also clean **governance** user files.
+
+**Known limits.** `multi-model`'s CCR config lives in your global `~/.config`
+(outside the project), so `--purge` does not touch it. A memory tier *downgrade*
+done via `add memory <lower-tier>` keeps the now-unused higher-tier data in place;
+to drop it, `remove memory --purge` then `add memory <tier>` again, or delete the
+directory yourself.
+
 ## Uninstall
 
 ```bash
@@ -366,7 +420,9 @@ Run `project-init --help` and pick from `core` (vault-free), `auto` (memory file
 ## Positioning in the ecosystem
 
 Where project-init sits relative to the (fast-moving) community landscape, so
-adopters know what this tool owns and where it defers:
+adopters know what this tool owns and where it defers. For the full
+four-category comparison and the moat, see
+[docs/positioning.md](docs/positioning.md):
 
 - **What this scaffolder owns**: project infrastructure files (CI workflows,
   `.gitignore`, GitHub issue/PR templates and board automation),
@@ -404,20 +460,28 @@ adopters know what this tool owns and where it defers:
 
 ```
 project-init/
-├── pyproject.toml            # uv-managed, rich-only runtime dep, ruff-only dev
-├── install.sh                # bootstrap one-liner
-├── src/project_init/         # wizard CLI + scaffold engine
+├── pyproject.toml              # uv-managed, rich-only runtime dep, ruff-only dev
+├── install.sh                  # bootstrap one-liner
+├── src/project_init/           # wizard CLI + scaffold engine (scaffold, concerns, surfaces, mcps, …)
 ├── templates/
-│   ├── base/                 # always copied (no memory backend of its own)
-│   ├── obsidian/             # vault + agent-memory overlay; derived from memory_stack (#466)
-│   ├── graphify/             # Graphify memory overlay (implies obsidian)
-│   └── presets/              # toml preset definitions
-└── tests/                    # focused pytest modules by behavior area
+│   ├── base/                   # always copied
+│   ├── fallback/               # shared hooks/skills — rendered only with --no-plugin (ADR-010)
+│   ├── presets/                # toml preset definitions
+│   ├── obsidian/               # vault + agent-memory overlay
+│   ├── graphify/               # Graphify memory overlay (implies obsidian)
+│   ├── rag/                    # tier-3 RAG memory overlay
+│   ├── lifecycle/              # git lifecycle enforcement (+ lifecycle_fallback for --no-plugin)
+│   ├── multi_model/            # CCR model-switching overlay (--multi-model)
+│   ├── observability/          # transcript metrics overlay (--observability)
+│   ├── governance/             # AI governance overlay (--governance)
+│   ├── auto/                   # always-on emitted artifacts
+│   └── amp/ antigravity/ codex/ junie/  # per-surface wiring overlays (--agents)
+└── tests/                      # focused pytest modules by behavior area
 ```
 
 ## Status
 
-Actively developed; v0.3.0 is the first PyPI release. Track work in [GitHub Issues](https://github.com/VytCepas/project-init/issues).
+Actively developed and published to [PyPI](https://pypi.org/project/project-init/) (current release: v0.5.1). Contributions welcome — track and propose work in [GitHub Issues](https://github.com/VytCepas/project-init/issues), and use [GitHub Discussions](https://github.com/VytCepas/project-init/discussions) for questions, ideas, and feedback. Forks and pull requests are encouraged.
 
 ## License
 

{project_init-0.5.0 → project_init-0.5.2}/README.md

@@ -1,9 +1,20 @@
 # project-init
 
 [![CI](https://github.com/VytCepas/project-init/actions/workflows/ci.yml/badge.svg)](https://github.com/VytCepas/project-init/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/project-init)](https://pypi.org/project/project-init/)
+[![Python versions](https://img.shields.io/pypi/pyversions/project-init)](https://pypi.org/project/project-init/)
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 
 Scaffolder for agentic-development infrastructure. One command drops a `.claude/` folder into any project so Claude Code (and other agents) have memory, docs, hooks, and curated MCPs ready to go.
 
+**Who it's for** — solo devs and small teams running Claude Code seriously across multiple repos who want consistent, *enforced* agent infrastructure (CI, a git-lifecycle DAG guard, memory, curated MCPs) — not a hand-maintained `.claude/` per project.
+
+```bash
+uvx project-init .        # scaffold into the current directory
+```
+
+→ **How it compares** to other scaffolders and Claude Code plugins: [docs/positioning.md](docs/positioning.md).
+
 ## What it gives you
 
 Inside any target project:
@@ -32,6 +43,52 @@ Principles:
 - **Claude-first, portable core** — built and tested for Claude Code; other agents get instructions, not enforcement. See [Agent support tiers](#agent-support-tiers).
 - **`bun` and `uv` only** — no `npm`/`npx`/`pip`/`venv` anywhere in scaffolded projects.
 
+## Install (one-time)
+
+Two install paths — pick by how you'll invoke it:
+
+**CLI-only, from [PyPI](https://pypi.org/project/project-init/)** (ADR-011). Gives
+you the `project-init` command — no `/project-init` slash command:
+
+```bash
+uv tool install project-init   # or one-off: uvx project-init .
+```
+
+**Full setup, from git** — adds the Claude Code slash command:
+
+```bash
+curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh | bash
+```
+
+This installs [`uv`](https://docs.astral.sh/uv/) if missing, clones the repo to `~/.local/share/project-init` (override with `PROJECT_INIT_HOME=...`) **pinned to the latest tagged release**, and writes a user-level slash command at `~/.claude/commands/project-init.md`.
+
+Pin a specific version, or opt into the unreleased development head:
+
+```bash
+PROJECT_INIT_REF=v0.5.1 bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
+PROJECT_INIT_REF=main   bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
+```
+
+Direct tool install without the slash command (any pinned tag):
+
+```bash
+uv tool install git+https://github.com/VytCepas/project-init@v0.5.1
+```
+
+Distribution rationale: [ADR-008](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-008-distribution-channel.md) (git channel), [ADR-011](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-011-pypi-trusted-publishing.md) (PyPI via trusted publishing).
+
+### Platform requirements
+
+macOS, Linux, and WSL work out of the box. The scaffolded hooks and lifecycle
+scripts are bash (a single bash-3.2 portability floor, epic #359) — so on **native Windows
+(non-WSL)** you need **[Git for Windows](https://gitforwindows.org/)** (it ships
+`bash`/`sh` + coreutils), and you should run from a **Git Bash** shell. Claude
+Code then runs hooks through Git Bash automatically; the wired hooks also pin
+`"shell": "bash"` to make that explicit. Without Git for Windows, Claude Code
+falls back to PowerShell, which can't run a bash hook — so the enforcement
+hooks won't fire. PowerShell-only is not a supported target; there are no
+`.ps1` equivalents by design. (WSL remains the smoothest Windows path.)
+
 ## Agent support tiers
 
 This is **firstly a Claude Code scaffolder**. It aims to be agent-agnostic where
@@ -87,52 +144,6 @@ Two honest caveats hold across all of it:
   files.** The suite validates settings/skills/hooks/MCP and the generated
   surface configs; no GUI agent is driven live in CI.
 
-## Install (one-time)
-
-Two install paths — pick by how you'll invoke it:
-
-**CLI-only, from PyPI** (after the first published release; ADR-011). Gives
-you the `project-init` command — no `/project-init` slash command:
-
-```bash
-uv tool install project-init   # or one-off: uvx project-init .
-```
-
-**Full setup, from git** — adds the Claude Code slash command:
-
-```bash
-curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh | bash
-```
-
-This installs [`uv`](https://docs.astral.sh/uv/) if missing, clones the repo to `~/.local/share/project-init` (override with `PROJECT_INIT_HOME=...`) **pinned to the latest tagged release**, and writes a user-level slash command at `~/.claude/commands/project-init.md`.
-
-Pin a specific version, or opt into the unreleased development head:
-
-```bash
-PROJECT_INIT_REF=v0.3.0 bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
-PROJECT_INIT_REF=main   bash -c "$(curl -sSL https://raw.githubusercontent.com/VytCepas/project-init/main/install.sh)"
-```
-
-Direct tool install without the slash command (any pinned tag):
-
-```bash
-uv tool install git+https://github.com/VytCepas/project-init@v0.3.0
-```
-
-Distribution rationale: [ADR-008](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-008-distribution-channel.md) (git channel), [ADR-011](https://github.com/VytCepas/project-init/blob/main/docs/adr/adr-011-pypi-trusted-publishing.md) (PyPI via trusted publishing).
-
-### Platform requirements
-
-macOS, Linux, and WSL work out of the box. The scaffolded hooks and lifecycle
-scripts are bash (a single bash-3.2 portability floor, epic #359) — so on **native Windows
-(non-WSL)** you need **[Git for Windows](https://gitforwindows.org/)** (it ships
-`bash`/`sh` + coreutils), and you should run from a **Git Bash** shell. Claude
-Code then runs hooks through Git Bash automatically; the wired hooks also pin
-`"shell": "bash"` to make that explicit. Without Git for Windows, Claude Code
-falls back to PowerShell, which can't run a bash hook — so the enforcement
-hooks won't fire. PowerShell-only is not a supported target; there are no
-`.ps1` equivalents by design. (WSL remains the smoothest Windows path.)
-
 ## Use
 
 ### Option 1: Inside a Claude Code session (interactive)
@@ -303,6 +314,49 @@ fields; without recorded hashes or a base, every modified file is conservatively
 treated as a conflict (`.new` sibling). Run `upgrade --apply` once and the record
 is written for next time.
 
+### Adding or removing a concern later
+
+Changed your mind about a tier you declined (or want to drop one)? `add` and
+`remove` toggle a single concern on an **already-scaffolded** project — no need to
+re-run the wizard. They reuse the upgrade engine, so the shared wiring
+(`settings.json`, `config.yaml`, CI) is re-rendered with the concern flipped.
+
+```bash
+project-init add governance --target /path/to/proj          # dry-run: report only
+project-init add governance --target /path/to/proj --apply  # land it
+project-init add memory obsidian-only --target /path --apply # memory takes a tier
+project-init remove lifecycle --target /path/to/proj --apply # drop a concern
+```
+
+Concerns: `lifecycle`, `governance`, `observability`, `multi-model`, `docs`,
+`renovate`, and `memory <stack>` (`auto` · `obsidian-only` · `obsidian-graphify` ·
+`obsidian-graphify-rag` · `none`).
+
+- **Dry-run by default** — without `--apply` it only reports what would change.
+- **`--apply` is git-guarded** — it refuses a dirty work tree (so the change lands
+  as one revertible diff); `--allow-dirty` overrides.
+- **`remove` never destroys your edits** — it deletes a concern's files only when
+  they are byte-identical to what it scaffolded; a file you edited is kept and
+  reported.
+- **Your notes are safe** — `remove memory` unwires the tier but **keeps**
+  `.claude/memory/` and `.claude/vault/` (your accumulated notes) by default. To
+  also handle that source data, opt in explicitly:
+
+  ```bash
+  project-init remove memory --target /path --apply --export ~/notes-backup  # move it out first
+  project-init remove memory --target /path --apply --purge                  # delete it (destructive)
+  ```
+
+  `--purge` and `--export` are mutually exclusive; `--purge` prints what it will
+  delete and (like all `--apply` runs) requires a clean tree, so the data is
+  recoverable from git. The same flags also clean **governance** user files.
+
+**Known limits.** `multi-model`'s CCR config lives in your global `~/.config`
+(outside the project), so `--purge` does not touch it. A memory tier *downgrade*
+done via `add memory <lower-tier>` keeps the now-unused higher-tier data in place;
+to drop it, `remove memory --purge` then `add memory <tier>` again, or delete the
+directory yourself.
+
 ## Uninstall
 
 ```bash
@@ -335,7 +389,9 @@ Run `project-init --help` and pick from `core` (vault-free), `auto` (memory file
 ## Positioning in the ecosystem
 
 Where project-init sits relative to the (fast-moving) community landscape, so
-adopters know what this tool owns and where it defers:
+adopters know what this tool owns and where it defers. For the full
+four-category comparison and the moat, see
+[docs/positioning.md](docs/positioning.md):
 
 - **What this scaffolder owns**: project infrastructure files (CI workflows,
   `.gitignore`, GitHub issue/PR templates and board automation),
@@ -373,20 +429,28 @@ adopters know what this tool owns and where it defers:
 
 ```
 project-init/
-├── pyproject.toml            # uv-managed, rich-only runtime dep, ruff-only dev
-├── install.sh                # bootstrap one-liner
-├── src/project_init/         # wizard CLI + scaffold engine
+├── pyproject.toml              # uv-managed, rich-only runtime dep, ruff-only dev
+├── install.sh                  # bootstrap one-liner
+├── src/project_init/           # wizard CLI + scaffold engine (scaffold, concerns, surfaces, mcps, …)
 ├── templates/
-│   ├── base/                 # always copied (no memory backend of its own)
-│   ├── obsidian/             # vault + agent-memory overlay; derived from memory_stack (#466)
-│   ├── graphify/             # Graphify memory overlay (implies obsidian)
-│   └── presets/              # toml preset definitions
-└── tests/                    # focused pytest modules by behavior area
+│   ├── base/                   # always copied
+│   ├── fallback/               # shared hooks/skills — rendered only with --no-plugin (ADR-010)
+│   ├── presets/                # toml preset definitions
+│   ├── obsidian/               # vault + agent-memory overlay
+│   ├── graphify/               # Graphify memory overlay (implies obsidian)
+│   ├── rag/                    # tier-3 RAG memory overlay
+│   ├── lifecycle/              # git lifecycle enforcement (+ lifecycle_fallback for --no-plugin)
+│   ├── multi_model/            # CCR model-switching overlay (--multi-model)
+│   ├── observability/          # transcript metrics overlay (--observability)
+│   ├── governance/             # AI governance overlay (--governance)
+│   ├── auto/                   # always-on emitted artifacts
+│   └── amp/ antigravity/ codex/ junie/  # per-surface wiring overlays (--agents)
+└── tests/                      # focused pytest modules by behavior area
 ```
 
 ## Status
 
-Actively developed; v0.3.0 is the first PyPI release. Track work in [GitHub Issues](https://github.com/VytCepas/project-init/issues).
+Actively developed and published to [PyPI](https://pypi.org/project/project-init/) (current release: v0.5.1). Contributions welcome — track and propose work in [GitHub Issues](https://github.com/VytCepas/project-init/issues), and use [GitHub Discussions](https://github.com/VytCepas/project-init/discussions) for questions, ideas, and feedback. Forks and pull requests are encouraged.
 
 ## License
 

{project_init-0.5.0 → project_init-0.5.2}/docs/README.md

@@ -6,6 +6,7 @@ Architecture decisions, development guides, and references for contributors and
 
 | Path | Purpose |
 |---|---|
+| [`positioning.md`](positioning.md) | Where project-init sits in the ecosystem — comparison table + moat |
 | [`adr/`](adr/) | Architecture Decision Records — why decisions were made |
 | [`development/`](development/) | Standards, testing, template system |
 | [`guides/`](guides/) | How-to guides for users and contributors |

{project_init-0.5.0 → project_init-0.5.2}/docs/guides/org-fork-lifecycle.md

@@ -49,8 +49,9 @@ import on EMU.
 
 The fork owns its releases:
 
-1. Bump the version in `src/project_init/__init__.py` (`__version__`) and
-   `pyproject.toml`, on a branch → PR → merge.
+1. Bump the version in `src/project_init/__init__.py` (`__version__`),
+   `pyproject.toml`, and `CITATION.cff` (`version:`), on a branch → PR → merge.
+   A contract test (`test_release_engineering.py`) enforces that all three agree.
 2. Tag the release — `release.yml` triggers on a tag push:
    `git tag vX.Y.Z && git push origin vX.Y.Z`. If your org's rulesets or the
    workflow guard restrict tag pushes, create the tag via the API instead: