# tooling — shared meta/support repos (all five verticals)

Single source of truth for org agent-stack + support tooling. Created
2026-08-28 after the /tmp-relaunch regression (stale wrapper copy dropped
--yolo; duplicate screens). Rule: **no founder-run script from /tmp ever
again** — installers live here, stamped by git SHA.

## Layout (one repo per domain)
- agent-stack/     PMO/Work stack kit: pmo-loop.sh (canonical wrapper),
                   tsg-stack-relaunch-v2.sh, founder-full-reset.sh,
                   screenrc-multiuser. Cloned to offstage/COS later.
- integrations/    discourse/redmine/gitea helpers (landing zone).
- credentials/     credential-manager TOOL code only. NEVER secrets.

## Write model
- All vertical accounts (TSGBOD TSGCCO TSGCTO TSGCOO reachableceo) are in
  group `users`; dirs are setgid 2775 and git uses core.sharedRepository=group.
- Commit as your local uid: `../commit.sh <repo> "<message>"` (sets umask 002).
- Never commit secrets, tokens, session pins, or logs.

## Push/promotion model (no remotes)
- Verticals commit in place. reachableceo-PMO integrates, reviews `git log`,
  and tags releases (vN or dated).
- Offstage/COS: founder clones/tars agent-stack from a tagged SHA; changes
  flow back as `git bundle` files dropped in /home/_crossfeed/outbox, which
  reachableceo-PMO pulls. That is the "push via crossfeed" transport.

## Install provenance
Installers copy files OUT of these repos; recipients keep the header stamp
`# source: /home/_crossfeed/tooling/<repo> @ <sha>`.