@williambeto/ai-workflow 1.18.10 → 1.18.13

package/CHANGELOG.md

@@ -1,3 +1,27 @@
+## [1.18.13](https://github.com/williambeto/ai-workflow/compare/v1.18.12...v1.18.13) (2026-05-22)
+
+
+### Bug Fixes
+
+* remove --provenance flag for private repo publish ([#57](https://github.com/williambeto/ai-workflow/issues/57)) ([557a41e](https://github.com/williambeto/ai-workflow/commit/557a41ed5f56071d932f494ebac0ebd1740d98ec))
+
+## [1.18.12](https://github.com/williambeto/ai-workflow/compare/v1.18.11...v1.18.12) (2026-05-22)
+
+
+### Bug Fixes
+
+* skip auto-generated CHANGELOG.md from markdownlint and link validation ([#56](https://github.com/williambeto/ai-workflow/issues/56)) ([aefc44d](https://github.com/williambeto/ai-workflow/commit/aefc44d3b137b99e6089763952a8973de74f2ce6))
+
+## [1.18.11](https://github.com/williambeto/ai-workflow/compare/v1.18.10...v1.18.11) (2026-05-22)
+
+
+### Bug Fixes
+
+* apply readiness audit fixes (security, package, branding, docs) ([9721661](https://github.com/williambeto/ai-workflow/commit/972166100908681f27889e9ddd10de71f20a9627))
+* apply readiness audit fixes (security, package, branding, docs) ([ee60c7c](https://github.com/williambeto/ai-workflow/commit/ee60c7cabab77dc45684d8e1b91533566660e794))
+* update semantic-release CI to Node.js 22 ([8bbaabb](https://github.com/williambeto/ai-workflow/commit/8bbaabbefa3ffe1a27b19264bc8c98779ba4bddd))
+* update semantic-release CI to Node.js 22 ([89a198a](https://github.com/williambeto/ai-workflow/commit/89a198aadd21f10c8b3d65e21a58747e50c23703))
+
 # Changelog
 
 All notable changes to AI Workflow Kit (`ai-workflow`) are documented in this file.

package/docs/full-documentation.md

@@ -99,7 +99,7 @@ ai-workflow/
 
 | Path | Purpose |
 | --- | --- |
-| [`AGENTS.md`](AGENTS.md) | Main operational contract for AI agents in this repository. |
+| `AGENTS.md` | Main operational contract for AI agents in this repository. |
 | [`.agents/skills/`](.agents/skills/) | Reusable specialist skill definitions. |
 | [`.agents/napkin.md`](.agents/napkin.md) | Durable project memory index. |
 | [`.codex/prompts/`](.codex/prompts/) | Compact Codex prompt entrypoints. |
@@ -334,7 +334,7 @@ Runbooks are operational guides for applying the workflow.
 | Runbook | Purpose |
 | --- | --- |
 | [`runbooks/quick-start-guide.md`](runbooks/quick-start-guide.md) | Fastest path to first value. |
-| ~~[`runbooks/from-zero-to-first-pr.md`](runbooks/from-zero-to-first-pr.md)~~ | Consolidated into [quick-start-guide.md](runbooks/quick-start-guide.md). |
+| <!-- consolidated into quick-start-guide.md --> | |
 | [`runbooks/apply-starter-to-real-project.md`](runbooks/apply-starter-to-real-project.md) | Apply this workflow to a target project. |
 | [`runbooks/validate-starter-in-real-project.md`](runbooks/validate-starter-in-real-project.md) | Prove adoption in a real project. |
 | [`runbooks/how-to-use-skills.md`](runbooks/how-to-use-skills.md) | Choose specialist skills. |

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.18.10",
+  "version": "1.18.13",
   "name": "@williambeto/ai-workflow",
   "description": "AI Workflow Kit repository for designing and validating AI-assisted software delivery workflows with Codex and OpenCode",
   "license": "MIT",

package/runbooks/apply-starter-to-real-project.md

@@ -25,7 +25,7 @@ Use this runbook when:
 - starting a new project;
 - auditing an existing project;
 - setting up Codex/OpenCode workflows;
-- preparing a client project;
+- preparing a target project;
 - creating a PR-driven implementation plan;
 - reducing repeated prompt/context setup.
 
@@ -100,8 +100,8 @@ Choose one adoption level for the project. Start lower, then expand only when th
 
 | Level | When to use | What to copy/adapt | Risk |
 | ----- | ----------- | ------------------ | ---- |
-| Level 1 — Minimal | Small bug fixes, short documentation updates, or early trials in an existing project. | `AGENTS.md`, `README.md`, `.codex/prompts/`, and `npm run validate` only if the validation scripts are copied. | May not provide enough structure for multi-PR work, client handoff, or repeatable review. |
-| Level 2 — Operational | Serious feature work, client projects, repo audits, or teams that need recurring Codex/OpenCode workflows. | `AGENTS.md`, `harness/`, `opencode/commands/`, `opencode/agents/`, selected skills, and validation scripts. | Requires project-specific adaptation; copied rules can drift if nobody owns them. |
+| Level 1 — Minimal | Small bug fixes, short documentation updates, or early trials in an existing project. | `AGENTS.md`, `README.md`, `.codex/prompts/`, and `npm run validate` only if the validation scripts are copied. | May not provide enough structure for multi-PR work, team handoff, or repeatable review. |
+| Level 2 — Operational | Serious feature work, production projects, repo audits, or teams that need recurring Codex/OpenCode workflows. | `AGENTS.md`, `harness/`, `opencode/commands/`, `opencode/agents/`, selected skills, and validation scripts. | Requires project-specific adaptation; copied rules can drift if nobody owns them. |
 | Level 3 — Full workflow | Long-lived products, team workflow design, training repositories, or projects that need examples and structured contracts. | `prompts/`, `templates/`, `harness/`, `schemas/`, `examples/`, agents, skills, runbooks, and validation scripts. | Highest setup cost; can become process-heavy if copied without pruning. |
 
 Do not use Level 3 just because the starter contains more files. Use it when the target project needs a durable workflow system.
@@ -372,7 +372,7 @@ Skills:
 
 Use Level 2 when the project already has its own examples, conventions, and validation commands. Use Level 3 when the team needs repeatable planning documents, schemas, and long-lived workflow examples.
 
-### B. WordPress client project
+### B. WordPress project
 
 Recommended adoption:
 

package/runbooks/publish-package-checklist.md

@@ -10,6 +10,15 @@ Use this runbook to publish `@williambeto/ai-workflow` to npm with explicit safe
 - Registry: npm
 - Workflow: `.github/workflows/publish-npm.yml`
 
+## Publish path architecture
+
+This project uses a dual-path publish architecture:
+
+- **Semantic release** (`.releaserc.json`): handles version bumps, changelog generation, and GitHub release creation. npm publish is explicitly disabled (`"npmPublish": false`) because actual publishing is handled by the manual CI workflow.
+- **Manual CI workflow** (`.github/workflows/publish-npm.yml`): the only path that actually publishes to npm. Requires explicit `workflow_dispatch` with dry-run gate.
+
+This split prevents accidental automated npm publishes while keeping semantic-release benefits for changelog and versioning.
+
 ## Safety gates
 
 1. Run only from `main`.

package/schemas/functional-spec.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://example.com/codex-repo-starter/schemas/functional-spec.schema.json",
+  "$id": "https://github.com/williambeto/ai-workflow/schemas/functional-spec.schema.json",
   "title": "Functional Specification",
   "type": "object",
   "additionalProperties": false,

package/schemas/handoff.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://example.com/codex-repo-starter/schemas/handoff.schema.json",
+  "$id": "https://github.com/williambeto/ai-workflow/schemas/handoff.schema.json",
   "title": "Agent Handoff",
   "type": "object",
   "additionalProperties": false,

package/schemas/pr-breakdown.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://example.com/codex-repo-starter/schemas/pr-breakdown.schema.json",
+  "$id": "https://github.com/williambeto/ai-workflow/schemas/pr-breakdown.schema.json",
   "title": "PR Breakdown",
   "type": "object",
   "additionalProperties": false,

package/schemas/requirement.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://example.com/codex-repo-starter/schemas/requirement.schema.json",
+  "$id": "https://github.com/williambeto/ai-workflow/schemas/requirement.schema.json",
   "title": "Requirement",
   "type": "object",
   "additionalProperties": false,

package/schemas/technical-plan.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://example.com/codex-repo-starter/schemas/technical-plan.schema.json",
+  "$id": "https://github.com/williambeto/ai-workflow/schemas/technical-plan.schema.json",
   "title": "Technical Plan",
   "type": "object",
   "additionalProperties": false,

package/schemas/validation-report.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://example.com/codex-repo-starter/schemas/validation-report.schema.json",
+  "$id": "https://github.com/williambeto/ai-workflow/schemas/validation-report.schema.json",
   "title": "Validation Report",
   "type": "object",
   "additionalProperties": false,

package/runbooks/from-zero-to-first-pr.md

@@ -1,18 +0,0 @@
-# From Zero to First PR
-
-> **This guide has been consolidated into [`runbooks/quick-start-guide.md`](runbooks/quick-start-guide.md).**
->
-> All content is now available there: install instructions, profile selection, step-by-step workflow with prompts and skills per step, validation checklists, common mistakes, recommended PR types, and first PR quality gate.
->
-> Redirect to [`runbooks/quick-start-guide.md`](runbooks/quick-start-guide.md).
-
-## Quick reference
-
-| Topic | Link |
-| --- | --- |
-| Full walkthrough | [`runbooks/quick-start-guide.md`](runbooks/quick-start-guide.md) |
-| Workflow steps with prompts and skills | Quick-Start Guide → Workflow steps reference |
-| Validation checklists per step | Quick-Start Guide → Validation checklist per step |
-| Common mistakes to avoid | Quick-Start Guide → Common mistakes |
-| First PR quality gate | Quick-Start Guide → First PR quality gate |
-| Complete reference documentation | [`docs/full-documentation.md`](docs/full-documentation.md) |