vycari-pepper 0.1.0__tar.gz

vycari_pepper-0.1.0/.claude/guidelines/coding.md

@@ -0,0 +1,16 @@
+# Coding guidelines
+
+- Python 3.13+. Format with `ruff format`, lint with `ruff check` (the rule set is `ALL` minus the
+  documented ignores in `pyproject.toml`), type-check with `ty check src/pepper_cli/`.
+- Do not add new lint ignores to make a change pass. Fix the code, or justify a narrowly scoped
+  ignore in the PR description.
+- Bearer tokens and PATs are wrapped in `SecretStr` (`secret.py`) at the boundary and are never
+  logged, printed, or put in an exception message.
+- Wire models mirror the server's `/api/v1` response shapes. Each mirrored model carries a
+  `# MIRROR:` comment naming the server model it follows. Keep models tolerant: ignore unknown
+  fields and unknown stream frame types rather than failing.
+- Formatted output goes through `render.py` and its rich consoles. Bare `print` is allowed in
+  `cli.py` only, for plain lines meant for pipes (a created id, `whoami` fields) and argv errors
+  on stderr; the `T201` ignore in `pyproject.toml` is scoped to that one file, so a `print`
+  anywhere else fails lint.
+- Keep the CLI dependency-light. A new runtime dependency needs a reason in the PR.

vycari_pepper-0.1.0/.claude/guidelines/invariants.md

@@ -0,0 +1,13 @@
+# Invariants
+
+1. **Tokens stay secret.** A PAT or session token is never logged, echoed, or included in an error
+   message or in rendered output. The credentials file is written with owner-only permissions.
+2. **The CLI follows the server contract, not the reverse.** The server's `/api/v1` is additive-only
+   for supported clients. The CLI must keep working against a server that adds fields, endpoints, or
+   stream frame types it does not know about.
+3. **`# MIRROR:` comments stay accurate.** When a mirrored model changes, update the comment and the
+   model together.
+4. **Exit codes and stdout are an interface.** Scripts and agents parse the output; changing the
+   shape of `--json` output or an exit code is a breaking change and needs a deliberate PR.
+5. **The bundled agent skill matches the CLI.** `src/pepper_cli/data/agent-skill/SKILL.md`
+   documents the commands; change both together.

vycari_pepper-0.1.0/.claude/guidelines/testing.md

@@ -0,0 +1,11 @@
+# Testing guidelines
+
+- Run `uv run pytest`. The suite must pass with no network: HTTP is mocked with `pytest-httpx`.
+- Coverage is a ratchet. `coverage.floor` in `.claude/maintainerd.json` may be raised, never
+  lowered to make a change pass. CI fails when measured line coverage is below it.
+- A behaviour change comes with a test that fails without it. Prefer asserting on rendered output
+  and request shape over asserting on internals.
+- Tests use obviously fake credentials and identities (for example `pat_supersecret`,
+  `alice@example.com`). Never put a real token, address, or hostname in a fixture.
+- Tests never read or write the real credentials file; use the temporary-directory fixtures in
+  `tests/conftest.py`.

vycari_pepper-0.1.0/.claude/maintainerd/coverage-adapt.sh

@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+#
+# coverage-adapt.sh — normalize a coverage tool's native JSON into the maintainerd
+# coverage summary contract:
+#
+#     {"metric": "lines", "percent": <float>}
+#
+# Canonical source: maintainerd, plugins/core/scripts/coverage-adapt.sh
+# A consuming repo carries a copy at .claude/maintainerd/coverage-adapt.sh so CI can run
+# it without the plugin installed. Re-copy it when maintainerd-core updates.
+#
+#   coverage-adapt.sh                                  # auto-detect the one input and its format
+#   coverage-adapt.sh --tool pytest-cov                # force the pytest-cov (coverage.py) shape
+#   coverage-adapt.sh --tool istanbul --input coverage/coverage-summary.json
+#   coverage-adapt.sh --output build/coverage-summary.json
+#
+# Line coverage only. Branch coverage is deliberately not gated: it is noisier, moves for
+# reasons unrelated to test quality, and a ratchet on it ratchets on noise.
+#
+# Requires: bash 3.2+, jq.
+#
+# Exits non-zero — and writes nothing — on anything it cannot read with certainty. A
+# coverage gate that guesses a number is worse than one that stops.
+
+set -euo pipefail
+# Float parsing and printing must not follow the runner's locale: a comma decimal
+# separator turns 87.4 into 87 in awk, and the gate silently moves.
+export LC_ALL=C
+
+usage() {
+  cat >&2 <<'USAGE'
+usage: coverage-adapt.sh [--tool auto|pytest-cov|istanbul] [--input FILE] [--output FILE]
+
+  --tool    input format. Default "auto": detect from the JSON's shape.
+              pytest-cov  coverage.py / pytest-cov `--cov-report=json`  (.totals.percent_covered)
+              istanbul    vitest / jest / nyc `json-summary`            (.total.lines.pct)
+  --input   the tool's native JSON. Default: whichever ONE of coverage-summary.json,
+            coverage.json, coverage/coverage-summary.json holds a measurement. Two or more
+            is an error, not a ranking: one of them is a previous run's number. This
+            script's own normalized output does not count as a rival measurement.
+  --output  where to write the normalized summary. Default: coverage-summary.json
+USAGE
+}
+
+tool=auto
+input=""
+output="coverage-summary.json"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --tool)   [ $# -ge 2 ] || { echo "coverage-adapt: --tool needs a value" >&2; exit 2; }; tool="$2"; shift 2 ;;
+    --input)  [ $# -ge 2 ] || { echo "coverage-adapt: --input needs a value" >&2; exit 2; }; input="$2"; shift 2 ;;
+    --output) [ $# -ge 2 ] || { echo "coverage-adapt: --output needs a value" >&2; exit 2; }; output="$2"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "coverage-adapt: unknown argument: $1" >&2; usage; exit 2 ;;
+  esac
+done
+
+case "$tool" in
+  auto|pytest-cov|istanbul) ;;
+  *) echo "coverage-adapt: unknown --tool '$tool' (auto|pytest-cov|istanbul)" >&2; exit 2 ;;
+esac
+
+command -v jq >/dev/null 2>&1 || {
+  echo "coverage-adapt: jq is not installed — the summary cannot be read" >&2; exit 2; }
+
+# Discovery refuses to choose between two *measurements* rather than ranking them: a repo
+# whose tool writes coverage.json while an unrelated coverage-summary.json is still lying
+# around has two plausible inputs, and either ranking silently gates the current commit on
+# a previous run's number — the one failure this whole gate exists to prevent.
+#
+# The adapter's own earlier output is the exception, and not a special case so much as the
+# absence of one: an already-normalized file sitting at the output path is this script's
+# work, not a rival measurement, so a native input beside it simply wins. That keeps the
+# step re-runnable, which matters because CI steps get retried.
+if [ -z "$input" ]; then
+  found=""
+  own_output=""
+  count=0
+  for candidate in coverage-summary.json coverage.json coverage/coverage-summary.json; do
+    [ -f "$candidate" ] || continue
+    if [ "$candidate" = "$output" ] && jq -e \
+        'type == "object" and .metric == "lines" and (.percent | type == "number")' \
+        "$candidate" >/dev/null 2>&1; then
+      own_output="$candidate"
+      continue
+    fi
+    found="${found:+$found, }$candidate"
+    input="$candidate"
+    count=$((count + 1))
+  done
+
+  if [ "$count" -gt 1 ]; then
+    echo "coverage-adapt: more than one coverage JSON is present ($found)." >&2
+    echo "  One of them is probably left over from an earlier run, and gating on the wrong" >&2
+    echo "  one would check this commit against a previous commit's number. Pass --input to" >&2
+    echo "  name the file this run wrote, or delete the stale one before the coverage step." >&2
+    exit 1
+  fi
+  # Nothing but our own output: the re-run no-op.
+  if [ "$count" -eq 0 ] && [ -n "$own_output" ]; then input="$own_output"; fi
+fi
+
+if [ -z "$input" ] || [ ! -f "$input" ]; then
+  echo "coverage-adapt: no coverage JSON found${input:+ at $input}." >&2
+  echo "  Run the repo's commands.coverage first, or pass --input." >&2
+  exit 1
+fi
+
+# `type == "object"` rather than a bare parse check: every shape below indexes the top
+# level, and indexing an array or a string is a jq *error*, which would surface as a raw
+# jq message rather than as this one.
+jq -e 'type == "object"' "$input" >/dev/null 2>&1 || {
+  echo "coverage-adapt: $input is not a valid JSON object — refusing to guess a percentage." >&2
+  exit 1; }
+
+# Each supported shape, as the jq path to its line-coverage percentage. The normalized
+# shape is included so re-running the adapter on its own output is a no-op rather than an
+# error: CI steps get re-run, and a step that only works once is a step that breaks.
+percent=""
+detected=""
+try_shape() {
+  local name="$1" filter="$2" value
+  value="$(jq -r "$filter // empty" "$input" 2>/dev/null || true)"
+  if [ -n "$value" ]; then detected="$name"; percent="$value"; return 0; fi
+  return 1
+}
+
+case "$tool" in
+  pytest-cov) try_shape pytest-cov 'select(.totals.percent_covered | type == "number") | .totals.percent_covered' || true ;;
+  istanbul)   try_shape istanbul   'select(.total.lines.pct     | type == "number") | .total.lines.pct'             || true ;;
+  auto)
+    try_shape normalized 'select(.metric == "lines" and (.percent | type == "number")) | .percent' \
+      || try_shape pytest-cov 'select(.totals.percent_covered | type == "number") | .totals.percent_covered' \
+      || try_shape istanbul   'select(.total.lines.pct | type == "number") | .total.lines.pct' \
+      || true
+    ;;
+esac
+
+if [ -z "$percent" ]; then
+  echo "coverage-adapt: $input has no line-coverage percentage in the ${tool} shape." >&2
+  echo "  Expected .totals.percent_covered (pytest-cov) or .total.lines.pct (istanbul)," >&2
+  echo "  as a number. istanbul writes \"Unknown\" when it measured no lines at all." >&2
+  exit 1
+fi
+
+# 0-100 is the only range a percentage can be in. Anything else means the shape matched
+# something that is not a percentage (a count, a ratio) and the gate would be nonsense.
+awk -v p="$percent" 'BEGIN { exit !(p + 0 >= 0 && p + 0 <= 100) }' || {
+  echo "coverage-adapt: $input yielded percent=$percent, which is not in 0-100." >&2; exit 1; }
+
+outdir="$(dirname "$output")"
+[ -d "$outdir" ] || mkdir -p "$outdir"
+
+# The temp file is created beside the output, not in TMPDIR: mv is only atomic within one
+# filesystem, and on CI runners TMPDIR is regularly on another. A reader — the gate, the
+# artifact upload — must never see a half-written summary.
+tmp="$(mktemp "$outdir/.coverage-summary.XXXXXX")"
+trap 'rm -f "$tmp"' EXIT
+# Written through jq so the output is valid JSON with a real number, whatever the input's
+# formatting. `-n` plus --argjson keeps the value numeric rather than a quoted string.
+jq -n --argjson percent "$percent" '{metric: "lines", percent: $percent}' > "$tmp"
+# mktemp creates the file 0600; the summary is uploaded as an artifact and read by the
+# gate, so give it the ordinary readable mode a generated file would have.
+chmod 644 "$tmp"
+mv "$tmp" "$output"
+trap - EXIT
+
+echo "coverage-adapt: $input ($detected) -> $output  lines ${percent}%"

vycari_pepper-0.1.0/.claude/maintainerd/coverage-check.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+#
+# coverage-check.sh — the coverage ratchet gate.
+#
+# Reads the normalized summary (`{"metric": "lines", "percent": <float>}`, produced by
+# coverage-adapt.sh) and the repo's `coverage.floor` from .claude/maintainerd.json, and
+# fails when the measured percentage is below the floor. Equal passes: the floor is the
+# lowest acceptable value, not a value to beat.
+#
+# Canonical source: maintainerd, plugins/core/scripts/coverage-check.sh
+# A consuming repo carries a copy at .claude/maintainerd/coverage-check.sh so CI can run
+# it without the plugin installed. Re-copy it when maintainerd-core updates.
+#
+#   coverage-check.sh
+#   coverage-check.sh --summary build/coverage-summary.json
+#   coverage-check.sh --floor 80        # override the config, for a local what-if
+#
+# There are no tool-specific threshold flags anywhere in the pipeline: the gate is this
+# one shell step in every repo, and the number it reads lives in one tracked file, so
+# lowering it is a reviewable diff rather than an invisible edit to a workflow.
+#
+# The workflow uploads the summary as an artifact named `coverage`; `doctor` reads that
+# artifact from the latest default-branch run. See the workflow snippet in the plugin's
+# references/config-schema.md.
+#
+# Requires: bash 3.2+, jq.
+#
+# Fails closed. A missing summary, malformed JSON, or an absent floor is an error, never
+# a pass — every one of those states is indistinguishable from "the tests did not run",
+# and a gate that waves those through is a gate that has never once fired.
+
+set -euo pipefail
+export LC_ALL=C
+
+usage() {
+  cat >&2 <<'USAGE'
+usage: coverage-check.sh [--summary FILE] [--config FILE] [--floor N]
+
+  --summary  normalized coverage summary. Default: coverage-summary.json
+  --config   repo config holding coverage.floor. Default: .claude/maintainerd.json
+  --floor    use this floor instead of the one in the config (an integer, 0-100)
+USAGE
+}
+
+summary="coverage-summary.json"
+config=".claude/maintainerd.json"
+floor=""
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --summary) [ $# -ge 2 ] || { echo "coverage-check: --summary needs a value" >&2; exit 2; }; summary="$2"; shift 2 ;;
+    --config)  [ $# -ge 2 ] || { echo "coverage-check: --config needs a value" >&2; exit 2; }; config="$2"; shift 2 ;;
+    --floor)   [ $# -ge 2 ] || { echo "coverage-check: --floor needs a value" >&2; exit 2; }; floor="$2"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "coverage-check: unknown argument: $1" >&2; usage; exit 2 ;;
+  esac
+done
+
+command -v jq >/dev/null 2>&1 || {
+  echo "coverage-check: jq is not installed — the summary cannot be read" >&2; exit 2; }
+
+# GitHub Actions renders `::error::` as an annotation on the job. Elsewhere it is just a
+# line of text, so this costs nothing off CI.
+fail() {
+  if [ -n "${GITHUB_ACTIONS:-}" ]; then printf '::error::%s\n' "$1" >&2; else printf '%s\n' "$1" >&2; fi
+  shift
+  for line in "$@"; do printf '  %s\n' "$line" >&2; done
+  exit 1
+}
+
+# ── The floor ────────────────────────────────────────────────────────────────
+if [ -z "$floor" ]; then
+  [ -f "$config" ] || fail "coverage-check: no $config — the floor lives there." \
+    "Run /bootstrap in this repo, then /bootstrap --adopt to measure and record the floor."
+  jq -e 'type == "object"' "$config" >/dev/null 2>&1 \
+    || fail "coverage-check: $config is not a valid JSON object."
+  floor="$(jq -r 'if (.coverage | type) == "object" then (.coverage.floor // empty) else empty end' "$config")"
+  [ -n "$floor" ] || fail "coverage-check: $config has no coverage.floor — this repo has not adopted the ratchet." \
+    "Run /bootstrap --adopt to measure the default branch and record coverage.floor," \
+    "or drop this step from the workflow if the repo is exempt from coverage."
+fi
+
+case "$floor" in
+  ''|*[!0-9]*) fail "coverage-check: coverage.floor is '$floor'; it must be a whole number of percent." ;;
+esac
+[ "$floor" -le 100 ] || fail "coverage-check: coverage.floor is $floor, which is above 100%."
+
+# ── The measurement ──────────────────────────────────────────────────────────
+[ -f "$summary" ] || fail "coverage-check: $summary does not exist." \
+  "The repo's commands.coverage must leave a summary there, normalized by coverage-adapt.sh." \
+  "Failing closed: a missing summary is indistinguishable from a suite that never ran."
+
+# `type == "object"`, not a bare parse check: indexing an array or a bare string with
+# .metric is a jq error, and it would surface as a raw jq message instead of a finding.
+jq -e 'type == "object"' "$summary" >/dev/null 2>&1 \
+  || fail "coverage-check: $summary is not a JSON object — it may be truncated or the wrong file." \
+  "Failing closed rather than reading a percentage out of it."
+
+metric="$(jq -r '.metric // empty' "$summary")"
+[ "$metric" = "lines" ] || fail "coverage-check: $summary reports metric '${metric:-<absent>}', expected 'lines'." \
+  "Run coverage-adapt.sh over the tool's native output first; the gate reads only the normalized shape."
+
+percent="$(jq -r 'select(.percent | type == "number") | .percent // empty' "$summary")"
+[ -n "$percent" ] || fail "coverage-check: $summary has no numeric .percent." \
+  "Run coverage-adapt.sh over the tool's native output first."
+
+awk -v p="$percent" 'BEGIN { exit !(p + 0 >= 0 && p + 0 <= 100) }' \
+  || fail "coverage-check: $summary reports percent=$percent, which is not in 0-100."
+
+# ── The gate ─────────────────────────────────────────────────────────────────
+# awk, not bash arithmetic: the percentage is a float and bash 3.2 has integers only.
+# Truncating it here would let a real regression from 85.0 to 84.9 read as no change.
+if awk -v p="$percent" -v f="$floor" 'BEGIN { exit !(p + 0 < f + 0) }'; then
+  fail "coverage-check: line coverage ${percent}% is below the floor of ${floor}%." \
+    "The floor is a ratchet: it may rise, never fall. Add tests for what this change" \
+    "left uncovered rather than lowering coverage.floor in $config."
+fi
+
+printf 'coverage-check: line coverage %s%% (floor %s%%) — OK\n' "$percent" "$floor"

vycari_pepper-0.1.0/.claude/maintainerd.json

@@ -0,0 +1,86 @@
+{
+  "repo": "Vycari/pepper-cli",
+  "defaultBranch": "main",
+  "language": "python",
+  "commands": {
+    "format": "uv run ruff format --check",
+    "lint": "uv run ruff check",
+    "build": null,
+    "test": "uv run pytest",
+    "coverage": "uv run pytest --cov --cov-report=json:coverage-summary.json",
+    "typecheck": "uv run ty check src/pepper_cli/"
+  },
+  "coverage": {
+    "floor": 88
+  },
+  "paths": {
+    "source": "src/pepper_cli/",
+    "tests": "tests/",
+    "designDocs": [],
+    "productDocs": [
+      "README.md",
+      "CLAUDE.md"
+    ],
+    "changelogDir": null,
+    "researchRadarDir": null,
+    "prTemplate": ".github/PULL_REQUEST_TEMPLATE.md",
+    "skillsDir": ".claude/skills/"
+  },
+  "guidelines": {
+    "coding": ".claude/guidelines/coding.md",
+    "testing": ".claude/guidelines/testing.md",
+    "invariants": ".claude/guidelines/invariants.md"
+  },
+  "labels": {
+    "architecture": "architecture",
+    "testQuality": "test-quality",
+    "security": "security",
+    "dependencies": "dependencies",
+    "automated": "automated"
+  },
+  "dailyUpdate": {
+    "subSkills": [
+      "audit-product-docs"
+    ],
+    "branchPrefix": "daily-update-",
+    "commitSubject": "chore(daily): {date} daily update"
+  },
+  "autoDev": {
+    "enabled": false,
+    "branchPrefix": "auto/issue-",
+    "marker": "<!-- auto-dev -->",
+    "stateLabels": {
+      "needsInfo": "auto:needs-info",
+      "planned": "auto:planned",
+      "ready": "auto:ready",
+      "inProgress": "auto:in-progress",
+      "parked": "auto:parked",
+      "skip": "auto:skip"
+    },
+    "excludedLabels": [
+      "epic",
+      "question",
+      "wontfix",
+      "duplicate",
+      "invalid"
+    ],
+    "openPrsAsDraft": false,
+    "prLabel": "auto:pr",
+    "fallbackReviewMinutes": 60,
+    "maxPrsInFlight": 1,
+    "orphanReclaimMinutes": 90
+  },
+  "createPr": {
+    "requireIssueForDeferredWork": true
+  },
+  "review": {
+    "bots": [
+      "greptile-apps[bot]"
+    ],
+    "approvalThreshold": "5/5",
+    "responderTier": "capable",
+    "impasseRounds": 2,
+    "sameFileRoundCap": 3
+  },
+  "release": null
+}

vycari_pepper-0.1.0/.claude/settings.json

@@ -0,0 +1,22 @@
+{
+  "extraKnownMarketplaces": {
+    "maintainerd": {
+      "source": {
+        "source": "github",
+        "repo": "Vycari/maintainerd"
+      }
+    },
+    "vycari": {
+      "source": {
+        "source": "github",
+        "repo": "Vycari/vycari"
+      }
+    }
+  },
+  "enabledPlugins": {
+    "maintainerd-core@maintainerd": true,
+    "repo-ops@maintainerd": true,
+    "audits@maintainerd": true,
+    "vycari-ops@vycari": true
+  }
+}

vycari_pepper-0.1.0/.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# Every path in this repo is owned by the maintainer. The repo profile
+# (Vycari/vycari, plugins/vycari-ops/references/repo-profile.json) owns this
+# line's contents — it is the one file whose text the standard pins.
+* @allenhutchison

vycari_pepper-0.1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,60 @@
+<!--
+Two audiences, one template, and this file is the canonical copy of both: a repo's
+`.github/PULL_REQUEST_TEMPLATE.md` is this file with its checklist block filled in. Change the
+shape here, in `plugins/vycari-ops/references/pr-template.md`, not in a repo.
+
+Everything above `## AI reviewer` is for a human who is busy and reading across many workstreams.
+Everything below it is for the Greptile reviewer and for future Claude sessions reading this PR as
+history. Write each for its own reader: don't pad the human half with detail, and don't thin the AI
+half because a human might skim it. State gaps and trade-offs plainly — a description that admits
+its own limitations is the one a reviewer trusts. No marketing language, no emoji.
+
+Closing keywords are a live footgun. GitHub matches `close`/`fix`/`resolve` next to an issue number
+ANYWHERE in the body and ignores negation — the sentence "does not close #123" closes #123 on merge
+(that has wrongly closed issues before). For a partial fix write `Refs #123`, and keep the
+keyword away from the number: "this does not finish #123".
+-->
+
+## Human overview
+
+<!-- 2–4 sentences, glanceable: what changed and why, for a reviewer working across many streams.
+Link the issue (`Fixes #N` / `Refs #N`). No implementation detail — that is the AI section's job. -->
+
+### Human required (optional)
+
+<!-- Only when a person must do or decide something: a merge-order constraint, a settings / secrets
+/ prod / branch-protection step, a product decision. One line each, imperative. Drop the whole
+section when it is empty. -->
+
+- [ ]
+
+## AI reviewer
+
+<!-- For Greptile and for future Claude sessions; assume no human reads this. As dense as is useful.
+Cover what applies and drop what doesn't:
+
+- what the diff does, by subsystem
+- invariants touched, and why they still hold
+- alternatives rejected, and why
+- failure posture: what breaks if this is wrong, and what it takes with it
+- migration notes: ordering, backfill, rollback
+- where to look hardest — the subtle bug this nearly shipped, the "simplification" a later PR would
+  apply without understanding
+- verification: exact commands and their actual results, not what should pass; say what was skipped
+  and why
+- deferred work, each with an issue link (a follow-up that lives only in a PR dies with the PR)
+-->
+
+### Checklist (repo-specific)
+
+<!-- REPO-SPECIFIC SLOT — the only part of this template a repo owns. Fill it with that repo's own
+gates (its format / lint / typecheck / test commands, migration and coverage rules, doc surfaces
+that must move with the code). Tick only what actually ran; mark an inapplicable box `[ ]` with a
+one-line reason. An N/A with a reason is fine, a silently ticked box is not. -->
+
+- [ ] `uv run ruff format --check` and `uv run ruff check` clean (no new lint ignores)
+- [ ] `uv run ty check src/pepper_cli/` clean
+- [ ] `uv run pytest` passes; coverage floor in `.claude/maintainerd.json` not lowered
+- [ ] Server-contract changes: `/api/v1` usage stays additive-only, `# MIRROR:` comments updated, unknown fields and frames still tolerated
+- [ ] No token or credential is logged, printed, or put in a fixture
+- [ ] README and the bundled `SKILL.md` updated if commands or output changed

vycari_pepper-0.1.0/.github/dependabot.yml

@@ -0,0 +1,35 @@
+version: 2
+
+# Ecosystems come from the repo profile (Vycari/vycari,
+# plugins/vycari-ops/references/repo-profile.json -> languages.python-service.dependabot),
+# minus `docker`: this repo has no Dockerfile.
+#
+# `uv`, not `pip`: this repo's dependency truth is uv.lock, and the pip ecosystem does not
+# regenerate it.
+updates:
+  # Python dependencies (pyproject.toml + uv.lock).
+  #
+  # Patch and minor are batched into one PR each; majors are deliberately ungrouped so each
+  # arrives as its own revertable PR. Batching matters because every bump regenerates uv.lock,
+  # and separate lock regenerations conflict with each other in the merge queue.
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      python-patch:
+        update-types: ["patch"]
+      python-minor:
+        update-types: ["minor"]
+
+  # GitHub Actions used in .github/workflows. Grouped across update types: an Actions bump that
+  # breaks fails loudly in CI rather than subtly at runtime, so the batch is cheap to bisect.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns: ["*"]

vycari_pepper-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,99 @@
+name: CI
+
+# Format, lint, type-check and test the CLI; lint the markdown. Everything here needs no
+# network access to a Pepper server: the tests mock the HTTP layer.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  # Required by the merge queue, and load-bearing: the queue holds a PR until its required
+  # checks report against the *speculative merge* it builds, so a required workflow that never
+  # runs on `merge_group` leaves every entry pending forever. There is deliberately no `paths:`
+  # filter anywhere in this file — `merge_group` does not support one, and a required workflow
+  # that path-filters itself out of a queue run has the same effect.
+  merge_group:
+
+concurrency:
+  # `github.ref` is the queue's own ref for a merge_group run
+  # (`refs/heads/gh-readonly-queue/main/pr-N-<sha>`), unique per entry, so cancel-in-progress
+  # cannot cancel a sibling entry's checks out from under it — a cancelled check is an eviction
+  # from the queue.
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+# Least-privilege default: the jobs here only read the checkout.
+permissions:
+  contents: read
+
+jobs:
+  # The repo profile's `python-service` required checks are `ci` and `docs`. Required checks are
+  # named per JOB, not per workflow, so these job keys are exactly the check-run names branch
+  # protection must list.
+  ci:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          enable-cache: true
+          python-version: "3.13"
+
+      # --frozen: fail rather than silently resolving a different dependency set than uv.lock
+      # records. --extra dev pulls pytest, pytest-httpx, pytest-cov, ruff and ty.
+      - name: Install dependencies
+        run: uv sync --frozen --extra dev
+
+      - name: Format check (ruff format)
+        run: uv run --no-sync ruff format --check
+
+      - name: Lint (ruff check)
+        run: uv run --no-sync ruff check
+
+      - name: Type check (ty)
+        run: uv run --no-sync ty check src/pepper_cli/
+
+      # `commands.coverage` from .claude/maintainerd.json. Running the suite under coverage is
+      # also how the suite runs at all — there is no separate test step, so a test failure fails
+      # here rather than being masked by the gate below.
+      - name: Test and measure coverage
+        run: uv run --no-sync pytest --cov --cov-report=json:coverage-summary.json
+
+      # coverage.py's JSON is not the summary contract; the adapter rewrites it to
+      # {"metric": "lines", "percent": N}. Vendored under .claude/maintainerd/ so CI runs it
+      # without the plugin installed.
+      - name: Normalize the coverage summary
+        run: .claude/maintainerd/coverage-adapt.sh --tool pytest-cov
+
+      # Before the gate, so a regression still publishes the number that proves it. The artifact
+      # name is load-bearing: the maintainerd doctor looks for exactly this.
+      - name: Upload the coverage summary
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: coverage
+          path: coverage-summary.json
+          if-no-files-found: error
+          retention-days: 30
+
+      # The ratchet. Reads coverage.floor from .claude/maintainerd.json — one number, in a
+      # tracked file, so lowering it is a reviewable diff.
+      - name: Coverage ratchet
+        run: .claude/maintainerd/coverage-check.sh
+
+  # Markdown lint over the whole tree. Config, and the reason each rule is off, are in
+  # .markdownlint-cli2.jsonc.
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Lint markdown
+        run: npx --yes markdownlint-cli2@0.18.1