Export Public — generate & publish the downstream public repos
shared-config is the private upstream source of truth. Every public repo is
downstream, generated, and never hand-edited. This skill drives
scripts/export-public.py, which reads export/MANIFEST.json (one entry per
public artifact) and keeps the generated trees honest.
Only origin: authored units are publishable. imported-*, forked, and
uncertain units must never leak (see library/LICENSE_AUDIT.md); the drift
gate enforces this mechanically.
The one-way rule
Public repos are a generated projection, not a fork. You never edit a public
repo by hand. Improvements a user contributes upstream (a PR against the public
repo) come back into shared-config via /intake, stamped
origin: community-contributed, and are re-projected on the next --sync. Editing
the public repo directly is always wrong — the next sync overwrites it.
Modes
python3 scripts/export-public.py --check # CI drift gate (the point)
python3 scripts/export-public.py --sync # regenerate vendored exports from source
python3 scripts/export-public.py --publish <name> # print push plan (dry-run)
python3 scripts/export-public.py --publish <name> --force # actually push
--check — for every artifact, recompute what the export SHOULD contain
from the manifest + current private sources and diff against the on-disk tree.
Fails listing each stale / missing / extra unit, any file that still contains a
forbid token, and any shipped unit that is not origin: authored. This is the
cross-repo drift gate; it runs in CI (.github/workflows/lint.yml).--sync — rebuild each vendored export from source, applying scrub
rules (rename map + lifecycle-skill token replacement → "your workflow's
equivalent"), then run that export's own tests. It refuses to leave a broken
export (restore + exit 1) and is idempotent (running twice = no diff). A
converged tree is left untouched, so a concurrently-restructured export is not
clobbered.--publish <artifact> — print the exact git commands (clone / rsync /
commit / push) that would publish one artifact to its target_repo. Dry-run by
default; --force executes. Never invents credentials — it uses your existing
git auth.
The manifest
export/MANIFEST.json (_comment documents the full schema) declares each
artifact and its kind:
- vendored (
casper) — assembled from named private skills, hooks
groups, and docs; scrub rename/replace applied on copy.
- standalone (
refute-action, verdict-viewer, …) — the export tree is
the source; --check only verifies it (forbid tokens, no non-authored units).
- collection (
public_collection) — ships all origin: authored skills
- agents (the awesome-style collection a companion agent materializes).
Typical flows
- CI / pre-PR:
--check. If it flags drift, --sync to converge, review the
diff, commit.
- Adding an authored skill to casper: add its name to the
casper
artifact's source.skills in the manifest, --sync, --check.
- Publishing:
--publish casper (read the plan), then --publish casper --force once you're sure. Publishing is irreversible — confirm first.
Judgment weave (see /judgment)
- "Sanitized" is a claim: the
forbid scan is mechanical, but before a
--force publish run /refute — grep the export for project names, keys,
and internal paths as if hunting for a leak. A green --check is necessary,
not sufficient, for putting code on the public internet.
1---2name: export-public3description: Drive the public export layer — the machinery that turns this private repo into the downstream public repos (casper, refute-action, the awesome-style skills collection, …). Use when asked to "export public skills", "publish my skills", "check public export drift", "sync the public repos", "make the free repo", or "update the public skills repo".4---56# Export Public — generate & publish the downstream public repos78`shared-config` is the **private upstream source of truth**. Every public repo is9**downstream, generated, and never hand-edited**. This skill drives10`scripts/export-public.py`, which reads `export/MANIFEST.json` (one entry per11public artifact) and keeps the generated trees honest.1213Only `origin: authored` units are publishable. `imported-*`, `forked`, and14`uncertain` units must never leak (see `library/LICENSE_AUDIT.md`); the drift15gate enforces this mechanically.1617## The one-way rule1819Public repos are a **generated projection**, not a fork. You never edit a public20repo by hand. Improvements a user contributes upstream (a PR against the public21repo) come **back into shared-config via `/intake`**, stamped22`origin: community-contributed`, and are re-projected on the next `--sync`. Editing23the public repo directly is always wrong — the next sync overwrites it.2425## Modes2627```bash28python3 scripts/export-public.py --check # CI drift gate (the point)29python3 scripts/export-public.py --sync # regenerate vendored exports from source30python3 scripts/export-public.py --publish <name> # print push plan (dry-run)31python3 scripts/export-public.py --publish <name> --force # actually push32```3334- **`--check`** — for every artifact, recompute what the export SHOULD contain35 from the manifest + current private sources and diff against the on-disk tree.36 Fails listing each stale / missing / extra unit, any file that still contains a37 `forbid` token, and any shipped unit that is not `origin: authored`. This is the38 cross-repo drift gate; it runs in CI (`.github/workflows/lint.yml`).39- **`--sync`** — rebuild each **vendored** export from source, applying scrub40 rules (rename map + lifecycle-skill token replacement → "your workflow's41 equivalent"), then run that export's own tests. It **refuses to leave a broken42 export** (restore + exit 1) and is **idempotent** (running twice = no diff). A43 converged tree is left untouched, so a concurrently-restructured export is not44 clobbered.45- **`--publish <artifact>`** — print the exact git commands (clone / rsync /46 commit / push) that would publish one artifact to its `target_repo`. Dry-run by47 default; `--force` executes. Never invents credentials — it uses your existing48 git auth.4950## The manifest5152`export/MANIFEST.json` (`_comment` documents the full schema) declares each53artifact and its kind:5455- **vendored** (`casper`) — assembled from named private `skills`, `hooks`56 groups, and `docs`; scrub `rename`/`replace` applied on copy.57- **standalone** (`refute-action`, `verdict-viewer`, …) — the export tree *is*58 the source; `--check` only verifies it (forbid tokens, no non-authored units).59- **collection** (`public_collection`) — ships **all** `origin: authored` skills60 + agents (the awesome-style collection a companion agent materializes).6162## Typical flows6364- **CI / pre-PR:** `--check`. If it flags drift, `--sync` to converge, review the65 diff, commit.66- **Adding an authored skill to casper:** add its name to the `casper`67 artifact's `source.skills` in the manifest, `--sync`, `--check`.68- **Publishing:** `--publish casper` (read the plan), then `--publish casper69 --force` once you're sure. Publishing is irreversible — confirm first.7071## Judgment weave (see /judgment)7273- **"Sanitized" is a claim:** the `forbid` scan is mechanical, but before a74 `--force` publish run **`/refute`** — grep the export for project names, keys,75 and internal paths as if hunting for a leak. A green `--check` is necessary,76 not sufficient, for putting code on the public internet.
ronniepinnell