Release 0.3.0: AI-maintainer identity, setup completion, bundled skills

[DenWin]

Goal

Ship template version 0.3.0: least-privilege AI-maintainer identity tooling,
one-shot bootstrap completion, and the bundled agent skills — with an honest,
Keep a Changelog-formatted setup/CHANGELOG.md and a new changelog-entry
skill that maintains it.

Scope

• setup/ — New-AIMaintainerApp.ps1, Test-AIMaintainerIdentity.ps1,
  Complete-Setup.ps1, version, CHANGELOG.md, MIGRATION.md runbook;
  setup-time tests moved under setup/tests/.
• setup/optional-skills/ — bundled develop-with-tdd (+ TDD knowledge base)
  and the new changelog-entry skill.
• .config/ — asciidoctor capability check probes an actual run;
  MD024 relaxed to siblings_only; Test-PowerShellScript.ps1 StrictMode fix.
• setup/AI-Maintainer-Identity.adoc, READMEs, AGENTS.md — docs for the above.

Boundary: this is the bootstrap/setup/ layer plus its docs and the changelog;
no runtime product code exists in this template.

Risk & rollback

Low. The template ships tooling and docs, not a deployed service. setup/ is
designed to be deleted after bootstrap (Complete-Setup.ps1), and every script
fails fast rather than mutating a repo silently. Rollback: revert this branch;
nothing here runs automatically on merge.

Evidence

• pre-commit run --all-files: all hooks pass, including asciidoctor syntax validation, once Ruby is on PATH (see note). markdownlint, PSScriptAnalyzer,
  zizmor, gitleaks, and the fast/standard test lanes are green.
• setup/AI-Maintainer-Identity.adoc validated directly:
  asciidoctor -o /dev/null --failure-level WARN → no warnings/errors.
• setup/CHANGELOG.md and the changelog-entry skill files pass
  markdownlint-cli2.
• Note: on the author's machine C:\Ruby34-x64\bin was missing from PATH, so
  the local asciidoctor hook initially failed with "'ruby.exe' is not
  recognized" — an environment gap, not a content issue. With Ruby on PATH the
  hook passes; CI (which provisions Ruby) enforces it at the merge gate.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 14c8d64f40

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[DenWin]

@codex[agent] please fix the 3 comemnts you provideed

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[DenWin]

@codex[agent] retry

[chatgpt-codex-connector]

Summary

• Hardened branch protection setup so merge_queue is the only optional ruleset; failures creating required protections now return non-zero instead of allowing partial protection to pass. setup/Protect-MainBranch.ps1L197-L208
• Tightened AI maintainer identity verification to require effective repo write/push access while still rejecting admin credentials. setup/Test-AIMaintainerIdentity.ps1L47-L69 setup/Test-AIMaintainerIdentity.ps1L91-L102
• Restricted saved GitHub App private keys to the current OS user immediately after writing them, using Windows ACLs or Unix chmod 600. setup/New-AIMaintainerApp.ps1L101-L123 setup/New-AIMaintainerApp.ps1L131-L134
• Added tests covering required branch-protection failures, read-only bot credentials, and Unix private-key file mode hardening. setup/tests/Protect-MainBranch.Tests.ps1L91-L110 setup/tests/Test-AIMaintainerIdentity.Tests.ps1L23-L40 setup/tests/New-AIMaintainerApp.Tests.ps1L62-L77
• Committed the changes on the current branch with commit cd35326 and created PR metadata via the make_pr tool.

Testing

• ✅ git diff --check
• ⚠️ pre-commit run --all-files — not run because pre-commit is not installed in this environment.
• ⚠️ pwsh -NoProfile -Command "Invoke-Pester -Path setup/tests/Protect-MainBranch.Tests.ps1,setup/tests/Test-AIMaintainerIdentity.Tests.ps1,setup/tests/New-AIMaintainerApp.Tests.ps1 -Tag Fast -CI" — not run because pwsh is not installed in this environment.

View task →