[vitormattos]

Purpose

Introduce a reusable, language-independent institutional Skill under skills/librecode-project-bootstrap/ in the existing organization configuration repository. It supports conservative project bootstrap and non-destructive audits. It does not change repository rulesets, workflow catalog entries, production deployments, or release automation.

Evidence and institutional classification

• Examined actual governance rules and workflow distribution in this repository, and working implementations in suitecrm-mcp, akaunting-mcp, akaunting-nfse, nfse-php, profile_fields, nextcloud-docker, and selected LibreSign PRs.
• references/evidence-ledger.md links each observed convention and its limitations; institutional-standards.md distinguishes institutional requirements, recommendations, runtime-conditional controls and product specifics.
• Preserve the existing governance.config.json as source of truth. required-ci-gate remains disabled. An aggregate must genuinely observe all required checks, including failures, cancellations, missing checks, skips and revision identity, before protection can be considered.
• No universal AGPL mandate, CODEOWNERS inference or invented GitHub checks.

License policy correction (2026-11-03)

• AGPL-3.0-or-later is the default for new LibreCode-owned projects, as confirmed by the organization maintainer. It is a creation default, not a ban on deliberate, approved exceptions or a remote GitHub enforcement rule.
• The generated PHP, Python, JavaScript and Go manifests/source notices use AGPL unless --license is explicitly supplied. Existing projects are never silently relicensed by audit mode.
• Bundle the full unmodified license text from LibreCodeCoop/.github/LICENSE; its Git blob SHA is be3f7b28e564e7dd05eaf59d64adba1a4065ac0e.
• --license MIT remains a deliberately requested exception, logged as pending licensing review; unbundled alternative licenses require their canonical text and review.
• The generated REUSE manifest attributes project files without claiming the FSF license document was authored by the project owner.

Implementation

• Short SKILL.md and progressively loaded references: governance, supply chain, documentation, language-specific tool choices, contribution/review, evidence ledger.
• scripts/bootstrap.py: conservative, tested minimal CLI starters for PHP, Python, JS and Go with explicitly chosen license and no unnecessary infrastructure. More complex application types, including TypeScript services, require an engineering-driven toolchain rather than a misleading universal scaffold.
• scripts/audit_project.py: read-only local heuristics, reports UNKNOWN instead of asserting compliance from file presence.
• scripts/check_ci_results.py: offline unit-tested result evaluator only, not a real GitHub check producer or coordinator.
• Tests deliberately include rejection of unsafe overrides, unknown license content, unpinned Actions, CI failure/cancellation/unexpected skips/missing results and invalid CLI arguments.

Validation

• Skill Creator quick_validate.py and package_skill.py: pass; installable ZIP regenerated from the corrected source, not an independent source of truth.
• python3 -m unittest discover -s scripts/tests -v: 15/15 pass in isolated container (PHP, Python, JS and Go available).
• PHP CLI sample (declared runtime 8.3): syntax lint passes, positive/negative CLI assertions pass, CLI version runs, Composer JSON parses, and the license is AGPL.
• Python CLI sample (declared runtime 3.12): compileall passes, two positive/negative unittest cases pass, CLI runs, TOML parses, and the license is AGPL.
• Read-only audit: each sample 5 PASS, 0 definite FAIL, 8 UNKNOWN; NOT_CERTIFIED.
• git diff --check: pass. Signing service verified commit cryptographically and matched DCO identity.

Pending; why draft

• Reviewer confirmation of policy matrix/ownership, workflow-sync strategy and whether any new generic language workflows should join the existing catalog.
• GitHub checks on final HEAD eda7b90a6cbfe7a721e04825e8120457dade9c23 passed: Python tests (including all 15 Skill tests), actionlint, zizmor, workflow policy and DCO. This does not imply merge approval or proof of project-specific branch rulesets.
• No full Composer toolchain (PHPStan, PHP-CS-Fixer, PHPUnit dependencies), Python Ruff/mypy, external REUSE CLI or dependency vulnerability audits were executed for the minimal examples. They are expressly listed as incomplete, not green.
• Existing .github CI may not detect changes under skills/ due to path filters; decide on an appropriate genuine tests workflow, without a dummy required check.
• No merge, release, deploy or ruleset apply is authorized by this PR.

Rollback

Close the draft PR without merging, or revert the single signed feature commit after normal approval if merged later. No environment/state migration is involved.

[vitormattos]

Superseded by LibreCodeCoop/agent-skills#1. All 15 original Skill files were migrated into the public Git-backed plugin, with maintained Portuguese guidance, bilingual discovery metadata, AGPL licensing, and an independently tested CI pipeline. The new PR's latest HEAD has passing REUSE, Actionlint, Zizmor, Gitleaks, DCO/signature, tests and a real ci-required gate. Repository-scoped status protection is proposed separately in LibreCodeCoop/.github#106; the base branch protection application is awaiting protected-environment approval. Closing this draft without merge to avoid two sources of truth.