feat: release public Hensu machine-local config

Ship v0.2.0-ready tree: peek by default, no bulk read, exec, topic guides, repo scaffolding, and origin story (EN/ES).

Author: MY-RV

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @MY-RV

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,30 @@
+name: Bug report
+description: Something broken or unexpected
+labels: ["bug"]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened?
+      description: Expected vs actual
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Reproduction
+      description: Minimal steps, a config file snippet with the values replaced, OS/arch
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: hensu --version
+    validations:
+      required: true
+  - type: markdown
+    attributes:
+      value: |
+        **Never paste real values.** Replace them, or report with `hensu get` output,
+        which is already masked. If the bug *is* that a value leaked, say so and
+        report it privately instead: see [SECURITY.md](../blob/main/SECURITY.md).

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,23 @@
+name: Feature request
+description: Something hensu should do and does not
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do?
+      description: The task, not the feature you imagined for it
+    validations:
+      required: true
+  - type: textarea
+    id: today
+    attributes:
+      label: How do you do it today?
+      description: The workaround, even if it is ugly. This is the strongest argument a request can carry.
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: What would it look like?
+      description: Optional. A command line you wish worked.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+## Summary
+
+<!-- What does this PR change, and why? -->
+
+## Checklist
+
+- [ ] Behavior change? Update [docs/contract.md](docs/contract.md) in the same PR
+- [ ] Tests cover the change (happy path + edge)
+- [ ] `godo ci` passes locally
+- [ ] No value ever reaches stdout that the reveal mode should have hidden
+- [ ] No drive-by refactors

.github/workflows/ci.yml

@@ -0,0 +1,32 @@
+name: ci
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Bootstrap godo
+        run: go install github.com/my-rv/godo/cmd/godo@v0.2.0
+      - name: CI gate (godo.yaml)
+        run: $(go env GOPATH)/bin/godo ci
+
+  # Catches a broken .goreleaser.yaml on every push, instead of at tag time
+  # when a bad config means a failed release.
+  release-config:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - uses: goreleaser/goreleaser-action@v6
+        with:
+          version: "~> v2"
+          args: check

.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+  # Signed build provenance for every published artifact.
+  id-token: write
+  attestations: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Bootstrap godo
+        run: go install github.com/my-rv/godo/cmd/godo@v0.2.0
+      - name: Verify tag tests
+        run: $(go env GOPATH)/bin/godo ci
+      - uses: goreleaser/goreleaser-action@v6
+        with:
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Optional: absent secret → tap/bucket push is skipped, not failed.
+          TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            dist/hensu_*
+            dist/checksums.txt

.gitignore

@@ -0,0 +1,8 @@
+# Local build artifacts. Anchored to the root on purpose: a bare "hensu" also
+# matches the cmd/hensu package directory, which is the shipped CLI.
+/hensu
+/dist/
+*.exe
+*.test
+*.out
+

.goreleaser.yaml

@@ -0,0 +1,98 @@
+# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
+version: 2
+
+project_name: hensu
+
+before:
+  hooks:
+    - go mod tidy
+
+builds:
+  - id: hensu
+    main: ./cmd/hensu
+    binary: hensu
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    ignore:
+      - goos: windows
+        goarch: arm64
+    ldflags:
+      - -s -w -X github.com/my-rv/hensu.Version={{.Version}}
+
+archives:
+  - id: archive
+    formats: [tar.gz]
+    format_overrides:
+      - goos: windows
+        formats: [zip]
+    name_template: >-
+      {{ .ProjectName }}_
+      {{- .Version }}_
+      {{- .Os }}_
+      {{- .Arch }}
+  - id: binary
+    formats: [binary]
+    name_template: >-
+      {{ .ProjectName }}_
+      {{- .Version }}_
+      {{- .Os }}_
+      {{- .Arch }}
+
+checksum:
+  name_template: checksums.txt
+
+# Packaging homes. Both pushes need a PAT with write access to those repos,
+# exposed to the release workflow as TAP_GITHUB_TOKEN; without it the release
+# still publishes, it just does not update the tap or the bucket.
+# Homebrew ships pre-built binaries as casks now; `brews` is deprecated and
+# makes `goreleaser check` fail. Casks are macOS-only — Linux installs go
+# through `go install` or the release binary (docs/install.md).
+homebrew_casks:
+  - name: hensu
+    ids: [archive]
+    repository:
+      owner: MY-RV
+      name: homebrew-tap
+      branch: main
+      token: "{{ .Env.TAP_GITHUB_TOKEN }}"
+    directory: Casks
+    homepage: "https://github.com/MY-RV/hensu"
+    description: "Machine-local config get/set/dump that agents can read without seeing values"
+    skip_upload: '{{ if .Env.TAP_GITHUB_TOKEN }}false{{ else }}true{{ end }}'
+    hooks:
+      post:
+        install: |
+          if system_command("/usr/bin/xattr", args: ["-h"]).exit_status == 0
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/hensu"]
+          end
+
+scoops:
+  - name: hensu
+    ids: [archive]
+    repository:
+      owner: MY-RV
+      name: scoop-bucket
+      branch: main
+      token: "{{ .Env.TAP_GITHUB_TOKEN }}"
+    homepage: "https://github.com/MY-RV/hensu"
+    description: "Machine-local config get/set/dump that agents can read without seeing values"
+    license: "Apache-2.0"
+    skip_upload: '{{ if .Env.TAP_GITHUB_TOKEN }}false{{ else }}true{{ end }}' 
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+
+release:
+  draft: false
+  prerelease: auto

CHANGELOG.md

@@ -0,0 +1,56 @@
+# Changelog
+
+## [0.2.0] — unreleased
+
+### Security
+- **`--update` verifies SHA-256 against the release `checksums.txt` before
+  replacing the running binary.** It previously installed whatever bytes the
+  download returned. A release without checksums, an asset missing from the
+  file, or a digest mismatch now aborts without touching the executable.
+
+### Changed
+- **No bulk read.** `hensu` with no command prints usage and exits 2 instead of dumping the
+  config; to see a value you name its key.
+- **JSON is the only output encoding.** The `json` and `yaml` verbs and the
+  `export KEY=value` dump are gone, along with `Store.DumpExport` / `DumpJSON` / `DumpYAML`.
+  YAML and JSON remain first-class as *file* formats, which is where they matter.
+- `update.Client.Latest` returns a `Candidate` (asset + checksums).
+- Public API is a thin facade (`pkg.go`); domain lives in `internal/store` (godo-style layout).
+- Canonical Go module layout (`cmd/hensu`, `internal/`, import `github.com/my-rv/hensu`).
+- `Store` and `FileSystem` methods take `context.Context` (cancelable lock acquire / IO checks).
+- CLI exit codes: `0` ok, `2` invalid usage, `1` runtime error.
+- File locking always uses a stable sidecar `<path>.hensu-lock` (correct with atomic rename).
+- GoReleaser + tag-triggered GitHub release workflow.
+
+### Added
+- **`peek` is the default reveal mode**, and the zero value of `Reveal`. A caller that
+  configures nothing still cannot print a secret whole: long values come back as
+  `abcd***wxyz`, short ones as `***`. Seeing a value in full is a grant — `-r trust` — and
+  grants are asked for, by a human or a model alike.
+- `-r` / `--reveal` with its own vocabulary (`peek` / `mask` / `trust`) replacing the old
+  `get` / `def` / `spy` verbs. One axis, one spelling: the strictness lattice the three verbs
+  needed is gone with them.
+- `hensu exec [--] CMD [ARGS...]` — runs a command with the config in its environment
+  (config wins over inherited values), forwards the child exit code, and skips keys that are
+  not valid environment variable names. The reveal mode is not propagated to children.
+- `read KEY` requires `-r trust`.
+- `HENSU_REVEAL` sets the mode for a session; an unparseable value is an error, never a
+  silent fallback to raw output.
+- Cross-process `Set` locking, durable atomic writes (`Sync` + dir sync).
+- Typed errors, godoc examples, fuzz tests, benchmarks, GitHub Actions CI (incl. staticcheck).
+- Apache-2.0 LICENSE, docs (contract, security, versioning, architecture, install, release).
+- `scripts/release-local.sh` for multi-arch artifacts without upload.
+- CONTRIBUTING.md.
+- CLI self-update: `--update` / `--update-check` (`internal/update`, `HENSU_RELEASES_API`).
+- `godo.yaml` dogfood scripts (`test`/`vet`/`build`/`check`/`ci`/`release-local`).
+- GoReleaser publishes bare binaries (for `--update`) in addition to archives.
+- Homebrew cask and Scoop manifest published by GoReleaser (`MY-RV/homebrew-tap`
+  under `Casks/`, `MY-RV/scoop-bucket`); skipped rather than failed when the PAT
+  is absent. Casks are macOS-only — Linux installs via `go install` or the
+  release binary.
+- Signed build provenance attestations for every released artifact.
+- `goreleaser check` in CI, so a broken release config fails on push, not at tag.
+- `SECURITY.md` (private vulnerability reporting) and `docs/agents.md`.
+
+### Notes
+- Pre-1.0: APIs may still change. Treat `v0.x` as evolving.

CONTRIBUTING.md

@@ -0,0 +1,26 @@
+# Contributing
+
+## Before a change
+
+1. Read [docs/contract.md](./docs/contract.md) — behavior changes need a contract update in the same PR.
+2. Keep the cut: thin facade + `internal/store`; CLI talks to the facade only.
+
+## Loop
+
+```bash
+godo ci
+# or
+go test -race ./...
+go build -o hensu ./cmd/hensu
+./hensu --version
+```
+
+## PR shape
+
+- One concern per PR.
+- Tests for the behavior you touch (happy path **and** the edge that failed or could fail).
+- No drive-by refactors.
+
+## Code
+
+See [docs/standards.md](./docs/dev/standards.md).