# OpenOne Workflow Kit v0.1.0

The first public release turns a solo developer's product delivery and commercialization work into one tool-neutral, evidence-backed workflow.

## What is included

- **Dual-track workflow:** a delivery track from requirements to release and a commercialization track from positioning to channel review.
- **Definition-to-Done:** Completion Contracts, Definition Lint, Acceptance Oracles, and an autonomous delivery loop that stops only at verified completion or a precise blocker.
- **Seven tool adapters:** Claude Code, Codex, Cursor, GitHub Copilot, CodeBuddy, Kiro, and Trae share one workflow core while retaining tool-specific capability levels.
- **Local initialization:** scan a workspace, produce `workflow/team-profile.yaml`, copy the workflow core, and generate only the selected adapters.
- **Release evidence:** sanitized-content checks, a package manifest with SHA-256, and an installed-tarball smoke test.

## Security and privacy

- The initializer does not upload local source material.
- It does not run remote Git operations, publish packages, deploy services, write databases, or change production configuration.
- Existing target files are preserved unless the maintainer explicitly chooses the documented force/upgrade path.
- The package has no runtime dependencies. Release checks scan for private-key markers, credential assignments, and private-network URLs; an external private denylist can be supplied for repository-specific terms.

These checks reduce accidental disclosure risk but do not replace a manual review of the package contents.

## Install

Requires Node.js 18 or newer.

```bash
npm install --save-dev openone-workflow-kit@0.1.0
npx openone-workflow-init --target . --tools codex,claude,cursor --yes
```

For a one-off run without modifying `package.json`:

```bash
npx --yes --package openone-workflow-kit@0.1.0 openone-workflow-init --target . --tools codex,claude,cursor --yes
```

## Verify

Confirm the published version and generated entry points:

```bash
npm view openone-workflow-kit@0.1.0 version
node -e "for (const f of ['workflow/team-profile.yaml','workflow/core','AGENTS.md']) require('node:fs').accessSync(f); console.log('OpenOne ready')"
```

Expected output includes `0.1.0` and `OpenOne ready`.

Maintainers can reproduce the release artifact locally:

```bash
npm run check
npm run build:release
npm pack --dry-run
```

The GitHub Release attaches `openone-workflow-kit-0.1.0.tgz` and `RELEASE_MANIFEST.md`. The manifest records the reviewed source commit/tree and the tarball SHA-256; the npm Registry metadata provides the matching Git `gitHead` and tarball `dist.shasum`:

```bash
npm view openone-workflow-kit@0.1.0 version
npm view openone-workflow-kit@0.1.0 gitHead
npm view openone-workflow-kit@0.1.0 dist.shasum
```

Those values are release evidence, not a substitute for the security and installation checks above.

## Supported boundary

The workflow core is shared, but adapter behavior can be enhanced or reduced according to each tool's capabilities. This release does not claim identical automation across tools or production certification for generated application code.

See the [installation guide](https://github.com/bluecoast1379/openone-workflow-kit/blob/v0.1.0/docs/shareable-install.md), [Definition-to-Done guide](https://github.com/bluecoast1379/openone-workflow-kit/blob/v0.1.0/docs/definition-of-done.md), and [maintainer handoff](https://github.com/bluecoast1379/openone-workflow-kit/blob/v0.1.0/docs/maintainer-handoff.md) for details.