Add corvid-stack template: CorvidLabs trust toolchain setup (language-agnostic)

[0xLeif]

Summary

Adds a built-in corvid-stack template that scaffolds the CorvidLabs trust toolchain — fledge + spec-sync + augur + attest — as pure config. No language scaffolding: it's the "stack setup" layer you drop onto any repo.

Until now, wiring those four tools together meant hand-copying config from the integration guide. fledge templates init <name> -t corvid-stack does it in one shot.

What it scaffolds

File	Purpose
fledge.toml	Tasks + the verify lane (the single CI gate)
.specsync/{config.toml, registry.toml, .gitignore}	spec-as-contract setup
.attest.json	Attestation policy (canonical permissive shape from CorvidLabs/attest)
.github/workflows/trust.yml	CI gate: fledge → spec-sync → augur → attest → AGENTS.md marker check
AGENTS.md	Managed trust-toolchain rules block (the BEGIN marker trust.yml greps for); CLAUDE.md is a one-line pointer
README.md	Setup + gate overview

Faithfulness

Rather than guess, the config is grounded in the real upstream sources:

• trust.yml uses the actual composite actions — CorvidLabs/spec-sync@v4, CorvidLabs/augur@v0, CorvidLabs/attest@v0 — with their documented inputs (fetch-depth: 0, notes fetch, threshold: block, policy: .attest.json).
• .attest.json matches the canonical schema dogfooded in CorvidLabs/attest.

Rendering

Files needing project variables carry a .tera extension (AGENTS.md.tera, README.md.tera, .specsync/registry.toml.tera). The workflow YAML and .attest.json are copied verbatim, so their literal ${{ }} / JSON survive Tera untouched (render = []).

Test Plan

• Scaffolded a project (fledge templates init acme-svc -t corvid-stack): all 10 files render, .tera stripped, {{ project_name }} substituted, ${{ }} preserved, marker present, no leftovers
• Scaffolded project runs fledge spec check (exit 0) and fledge lanes run verify (all 4 steps)
• Updated built-in template count test (9 → 10) + templates spec/README catalog
• cargo test, cargo clippy -- -D warnings, cargo fmt --check all pass

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces a new setup-only template, corvid-stack, which configures the CorvidLabs trust toolchain (fledge, spec-sync, augur, and attest) for language-agnostic projects. The review feedback highlights several key areas for improvement: preventing the root-level .gitignore from overwriting existing project files, correcting the min_fledge_version to ensure compatibility, resolving em-dash usage contradictions in AGENTS.md.tera, and optimizing the CI workflow by avoiding slow Homebrew installations on Ubuntu and dynamically calculating the git range for push and pull request events.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Since corvid-stack is designed as a "setup-only" layer to be dropped onto existing repositories, including a root-level .gitignore in the template is risky. The template rendering engine in fledge (src/templates.rs) overwrites existing files verbatim. If a user already has a .gitignore in their project, it will be completely overwritten and lost. Consider removing the root .gitignore from the template and instead instructing the user (e.g., in the README) to add augur.json to their existing .gitignore.

[gemini-code-assist]

The min_fledge_version is set to "1.0.0". However, according to specs/templates/context.md, the current version of fledge is around v0.15.2. If min_fledge_version is enforced, setting it to "1.0.0" will make this template incompatible with current installations of fledge. Consider lowering it to a version that actually supports the required template features (e.g., "0.15.0" or "0.1.0").

Suggested change

	min_fledge_version = "1.0.0"
	min_fledge_version = "0.15.0"

[gemini-code-assist]

The rule states Do not use em-dash characters in authored content., but the template itself uses em-dashes (—) in multiple places (e.g., lines 5, 14, 16, 19, 21, 27, and 31). To maintain consistency and adhere to the rule, please replace the em-dashes in this file with hyphens or colons, or remove/modify this rule.

[gemini-code-assist]

Since corvid-stack is a language-agnostic template, the source code might not reside in a src directory (e.g., Go projects often use the root or other directories, Python might use a package name). Consider adding a comment to remind users to update source_dirs to match their project structure.

Suggested change

	source_dirs = ["src"]
	# Update this to match your project's source directories (e.g., ["lib"], ["app"], or ["."] for root)
	source_dirs = ["src"]

[gemini-code-assist]

Using brew install on GitHub Actions ubuntu-latest runners can be extremely slow (often taking several minutes) because it may trigger a Homebrew update and potentially build from source if Linux bottles are not available. Consider using a direct binary download via curl from GitHub Releases, or caching cargo install fledge --locked to significantly speed up CI runs.

[gemini-code-assist]

Hardcoding origin/main..HEAD as the range has two issues:

1. On a push event to main, origin/main and HEAD will likely point to the same commit, resulting in an empty range.
2. On a pull_request targeting a branch other than main, it will compare against the wrong base.

Consider dynamically setting the range using GitHub Actions expressions, for example:
range: ${{ github.event_name == 'pull_request' && format('origin/{0}..HEAD', github.base_ref) || format('{0}~1..{0}', github.sha) }}

          range: ${{ github.event_name == 'pull_request' && format('origin/{0}..HEAD', github.base_ref) || format('{0}~1..{0}', github.sha) }}

[gemini-code-assist]

Hardcoding origin/main..HEAD here has the same issues as in the Augur step (empty range on push to main, incorrect base on non-main PRs). Consider using a dynamic range expression here as well.

          range: ${{ github.event_name == 'pull_request' && format('origin/{0}..HEAD', github.base_ref) || format('{0}~1..{0}', github.sha) }}

[github-actions]

❌ Corvin says...

      _
    <(;\  .oO(oh no...)
     |/(\
      \(\\
      " "\\

"I'm pecking through the errors..."

CI Summary

Check	Status
Dependency Audit	✅ Passed
Integration (3 OS)	❌ cancelled
Lint (fmt + clippy)	✅ Passed
Spec Validation	✅ Passed
Tests (3 OS)	✅ Passed

---

_{Powered by corvid-pet}

[0xLeif]

Thanks for the review. Resolved in b1ba761:

Applied

• brew install slow on ubuntu → switched to the curl-pipe prebuilt installer (install.sh), which downloads a release binary instead of building/bottling.
• Hardcoded origin/main..HEAD (augur + attest) → now dynamic: origin/<base_ref>..HEAD on PRs, <sha>~1..<sha> on push. Fixes the empty range on push-to-main and the wrong base on non-main PRs. (Safe to add ${{ }} here since trust.yml is copied verbatim, not Tera-rendered.)
• Em-dash contradiction → removed every em-dash from the template content, so it no longer breaks its own managed rule.
• source_dirs → added a comment to set it to the project's layout.

Kept, with reasoning

• min_fledge_version = "1.0.0" — the cited "~v0.15.2" is from a stale context.md; fledge is shipping 1.6.0, so a 1.0 floor is correct.
• Root .gitignore — fledge templates init only writes into a freshly created dir (it bails if the target exists), so there's no existing file to overwrite; and augur.json must be gitignored from day one per the integration guide. Added a README note to merge rather than replace when overlaying onto an existing repo.

The Integration jobs showed cancelled (not failed) on the prior run — concurrency cancel from the rapid pushes; the re-run on this push should be clean.

Superseded by updated review.

[github-actions]

❌ Corvin says...

      _
    <(;\  .oO(oh no...)
     |/(\
      \(\\
      " "\\

"Even the dumpster of code seems empty today."

CI Summary

Check	Status
Dependency Audit	✅ Passed
Integration (3 OS)	❌ cancelled
Lint (fmt + clippy)	✅ Passed
Spec Validation	✅ Passed
Tests (3 OS)	✅ Passed

---

_{Powered by corvid-pet}

Superseded by updated review.

[github-actions]

✅ Corvin says...

      _
    <(^\  .oO(Caw! ^v^)
     |/(\
      \(\\
      " "\\

"Caw! Your code sparkles like a dropped french fry."

CI Summary

Check	Status
Dependency Audit	✅ Passed
Integration (3 OS)	✅ Passed
Lint (fmt + clippy)	✅ Passed
Spec Validation	✅ Passed
Tests (3 OS)	✅ Passed

---

_{Powered by corvid-pet}