Decide whether the secure base of create-project.sh is sound enough to build the host integration on: configuration, credential handling, logging, prompts and tests.
Decide whether the script creates the Gitea repository and, if GitHub is chosen, the GitHub repository under the correct owners, and configures the Gitea to GitHub push mirror reliably, including when something fails halfway.
Decide whether the project is ready to release: the local project is scaffolded with the framework, the documentation is complete and an end-to-end review found no credential, ownership or mirror-direction defect.
Decide whether the project details can be preset in config.env without weakening the safety questions: a detail that is set there is not asked, an invalid one stops the run, and the confirmations stay interactive.
Decide whether the script can ask for a credential that .env does not provide and create the new project's own .env, without exposing a token: asked without echo, written only after a yes, owner-only, ignored by git, never replacing an existing file, and never shown in any output.
Decide whether the project's license can be set in config.env without weakening the existing behaviour: a license that is set applies with or without GitHub, none means no license, an absent key gives AGPL-3.0 only when GitHub is chosen and the project is public, and a license the Gitea server does not offer stops the run before anything is created.
Decide whether a new project holds the whole framework, including the qc checklists that the framework keeps in its own submodule, and whether a Maintainer can start the script from the folder where the project is to be created, through a global command, with the README saying exactly how.
Decide whether the files the framework installs into a new project, .claude, .agents and AGENTS.md, stay out of that project's git history. The skills in .claude and .agents are copies made by the framework's installer, and AGENTS.md is copied from a framework template. Git should not list them as untracked or offer them to a commit. They are excluded the way the project's .env already is: in .git/info/exclude, which belongs to the clone, is never committed and changes no tracked file.