agile-ledger-workspace

Agile-Ledger Workspace (optional orchestrator)

A layer that sits one level above the per-repo Agile-Ledger skill. The per-repo skill is unchanged and remains the default: each repository owns its self-contained Agile-Ledger/ folder. This orchestrator exists for the "install once, manage many" case — most usefully, coming back from time off and finding out, in one command, what changed across every repo and which repos are new.

It solves a specific blind spot: a repo created on the git host that nobody told you about. A local folder scan can't catch that — only asking the host can. So discovery queries GitHub via your existing gh auth, not just the filesystem.

<workspace-root>/
├── Agile-Ledger-Workspace/      # this orchestrator's only files
│   ├── Registry.md              # managed repos: path, remote, status, last-sync SHA, last-swept
│   └── Config.md                # org, clone target, filters, git_execution, setup branch
├── repo-a/  └─ Agile-Ledger/…   # per-repo ledger — the source of truth, unchanged
├── repo-b/  └─ Agile-Ledger/…
└── …

Golden safety rules (never violate)

These are stricter than the per-repo skill because this layer touches the network and the filesystem:

• Per-repo ledgers are the source of truth. The workspace holds only Registry.md and Config.md — never a backlog, sprint, or release. Each repo's Agile-Ledger/ is authoritative for itself.
• Discovery uses your existing gh auth. Run gh repo list <org> … (read-only). Never request, read, store, or handle tokens or credentials. If gh is not authenticated, say so and stop.
• Cloning downloads code → always propose and wait. List the repos that would be cloned and wait for the user's explicit confirmation before any git clone. No hands-off cloning.
• Never push, never open a PR, never merge. When git_execution is on, the orchestrator may write and commit a repo's new Agile-Ledger/ folder locally on a setup branch; the user pushes / opens the PR. When off, it only writes files and lets the user do everything.
• Reconstructed work is always a proposal, never truth. Epics/stories mined from git land only in the target repo's 📥 Inbox as Drafts, flagged 🔍 reconstructed from git — needs review. Never write acceptance criteria, estimates, or a Ready/Delivered state from inference. Never invent the "so that…". Never overwrite anything a human wrote.
• Sweeps are read-only by default. Every state-changing action (clone, bootstrap, commit, draft) is surfaced and confirmed, then performed — not assumed.
• Never delete rows from the Registry; mark them archived/gone instead.