mopac-pmo/tooling-draft/README.md

tooling — shared meta/support repos (all five verticals)

Single source of truth for org agent-stack + support tooling. Created 2026-08-28 after the /tmp-relaunch regression (stale wrapper copy dropped --yolo; duplicate screens). Rule: no founder-run script from /tmp ever again — installers live here, stamped by git SHA.

Layout (one repo per domain)

• agent-stack/ PMO/Work stack kit: pmo-loop.sh (canonical wrapper), tsg-stack-relaunch-v2.sh, founder-full-reset.sh, screenrc-multiuser. Cloned to offstage/COS later.
• integrations/ discourse/redmine/gitea helpers (landing zone).
• credentials/ credential-manager TOOL code only. NEVER secrets.

Write model

• All vertical accounts (TSGBOD TSGCCO TSGCTO TSGCOO reachableceo) are in group users; dirs are setgid 2775 and git uses core.sharedRepository=group.
• Commit as your local uid: ../commit.sh <repo> "<message>" (sets umask 002).
• Never commit secrets, tokens, session pins, or logs.

Push/promotion model (no remotes)

• Verticals commit in place. reachableceo-PMO integrates, reviews git log, and tags releases (vN or dated).
• Offstage/COS: founder clones/tars agent-stack from a tagged SHA; changes flow back as git bundle files dropped in /home/_crossfeed/outbox, which reachableceo-PMO pulls. That is the "push via crossfeed" transport.

Install provenance

Installers copy files OUT of these repos; recipients keep the header stamp # source: /home/_crossfeed/tooling/<repo> @ <sha>.