Adopt persist repo practices: release, CI, .agents

[SutuSebastian]

Summary

Adopts practices audited from the sibling persist repo across three surfaces.

Release — npm trusted publishing (GitHub OIDC, no NPM_TOKEN): release.yml gets id-token: write, release environment, Node 24 + npm ≥11 for OIDC detection, pinned changesets/action; publishConfig.provenance: true; docs/packaging.md + .changeset/README.md updated.

CI / tooling — ci.yml: top-level permissions: contents: read, SHA-pinned actions/checkout + persist-credentials: false, new check-pack job (attw + publint), audit promoted to block on high/critical and wired into ci-complete; .github/dependabot.yml (npm + github-actions weekly); AGENTS.md cross-tool stub; check:pack (attw + publint), :changes scripts + scripts/run-on-changed-files.ts, sideEffects: false, packageManager, coverage threshold (0.75); prepublishOnly chains check && check:pack.

.agents/ — adopt persist's thin-rule + skill-decomposition format: slim 5 rules to priming pointers (agents-tier-system, tracer-bullets, verify-after-each-step, docs-governance, agents-first-convention), split 4 monolith skills into slim SKILL + sibling (harden-pr→WORKFLOW, docs-governance→LIFECYCLE, docs-lifecycle-sweep→WORKFLOW, pr-comment-fact-check→WORKFLOW), merge preserve-comments+concise-comments into authoring-discipline (+PROSE.md), add architecture-priming rule, add 10 new skills (agents-tier-system, ask-agents, authoring-discipline, domain-modeling, grill-with-docs, grilling, tdd, tracer-bullets, verify-after-each-step, writing-agents-config, writing-great-skills), restructure grill-me + write-a-skill + improve-codebase-architecture (+REFERENCE.md). No persist-domain leakage; all codemap-specific substance preserved.

Test plan

• bun run check:pack (attw 🟢, publint clean)
• bun run test:coverage — 1857 pass, 0.75 threshold holds
• bun run typecheck, bun run lint:ci, bun run format:check — clean
• All .cursor/rules + .cursor/skills symlinks resolve; no broken links
• No orphaned citations to deleted/slimmed rules; docs/README.md Rules 1–10 pointer preserved
• One-time GitHub setup: create release environment + npm trusted-publisher binding for @stainless-code/codemap (workflow release.yml, env release); remove NPM_TOKEN secret after first OIDC publish
• Confirm no current high/critical bun audit findings (promoted to hard gate)

[changeset-bot]

⚠️ No Changeset found

Latest commit: c89f60a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 91a72c29-4a9f-48c5-ab55-235092d43e91

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch adopt-persist-practices

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}