Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

These design plans and specs were gitignored, so the rationale behind
major features lived on disk but not in history. Tracking them makes the
"why" available via git and to anyone who clones the repo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Captures the dev commands (uv run + check.sh), test markers and the
90% coverage gate, naming/packaging gotchas (aai_cli vs aai-cli vs aai,
committed templates with renamed dotfiles), architecture, and the
errors-to-stderr/data-to-stdout convention so a fresh agent has the
in-repo context that previously lived only outside the repo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Track the shareable parts of .claude/ (settings, agents, skills, commands)
and add .mcp.json, narrowing .gitignore to only ignore settings.local.json.

- settings.json: format/lint-on-edit (PostToolUse ruff) and a lock/secret-file
  write guard (PreToolUse); a conservative committed permission allowlist
  (uv/ruff/mypy/pytest/pre-commit/check.sh + read-only git/gh + docs MCP) plus
  a deny block on reading .env/keys.
- agents/: security-reviewer (auth/credential/subprocess) and
  template-contract-reviewer (aai init templates + wheel packaging).
- skills/: /check (full gate) and /release-prep (version+build+smoke), user-only.
- commands/: /review-changes wires both reviewers, scoped to the diff.
- .mcp.json: GitHub remote MCP server (per-user OAuth, no token committed).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The bare http config made Claude Code attempt OAuth dynamic client
registration, which api.githubcopilot.com rejects ("does not support
dynamic client registration"). Pass a token via the Authorization
header instead, read from ${GITHUB_PAT} so no credential is committed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Resolve conflicts in pyproject.toml and scripts/check.sh: keep both the
install_script (install.sh smoke test) and install (per-template dep install)
pytest markers, and exclude all three slow marker sets from the default gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… [dev] extra

Dev deps are a PEP 735 dependency-group, not an optional extra, so
`pip install -e ".[dev]"` installed no dev deps (pip just warns the extra is
missing) and pytest was absent — `python -m pytest` failed with "No module
named pytest". Mirror the lint/test job: upgrade pip (>= 25.1 for --group) and
install with `--group dev`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The merge with main raised the minimum Python to 3.11 (install.sh +
pyproject), but the install.sh shell-logic tests still asserted the old
"Python 3.10+ is required" message — update them to 3.11. Also add the
trailing newline end-of-file-fixer wanted on the account-commands plan doc.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>