openone-workflow-kit 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,21 @@
+# Changelog
+
+All notable changes to OpenOne Workflow Kit are documented here. The project follows [Semantic Versioning](https://semver.org/).
+
+## [0.1.0] - 2026-07-19
+
+### Added
+
+- Tool-neutral workflow core for a solo developer's delivery and commercialization tracks.
+- Completion Contract, Definition Lint, Acceptance Oracle, and `/交付至完成` workflow.
+- Adapters for Claude Code, Codex, Cursor, GitHub Copilot, CodeBuddy, Kiro, and Trae.
+- Local workspace scanner, generated team profile, release-safety boundaries, and sanitized-content checker.
+- Cross-platform release packaging with an installed-tarball smoke test.
+- GitHub Actions coverage for Ubuntu on Node.js 18/20/22, Windows on Node.js 20, and macOS on Node.js 20.
+
+### Security
+
+- The initializer reads and writes only local workspace files; it does not upload source material or perform remote Git, publishing, deployment, database, or production-configuration writes.
+- Release checks scan for common credential assignments, private-key markers, and private-network URLs; maintainers can add an external private denylist.
+
+[0.1.0]: https://github.com/bluecoast1379/openone-workflow-kit/releases/tag/v0.1.0

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,25 @@
+# 行为准则
+
+## 基本标准
+
+参与者应保持专业、尊重和聚焦问题本身。讨论工作流、工具限制、风险边界和实现方案时，请给出可验证依据，避免人身攻击、骚扰、歧视或泄露他人隐私。
+
+鼓励的行为：
+
+- 清楚描述问题、复现步骤和影响范围；
+- 尊重不同团队的工具差异和流程约束；
+- 在公开材料中使用脱敏、合成示例；
+- 对安全、隐私和远程操作保持谨慎。
+
+不接受的行为：
+
+- 发布他人的私有信息、凭证、日志或业务数据；
+- 用攻击性语言针对个人或群体；
+- 故意引导 agent 绕过安全闸门；
+- 在公共渠道要求他人提供敏感资料。
+
+## 执行
+
+维护者可以编辑、隐藏或关闭违反准则的 issue、PR 或讨论。严重或重复违反时，维护者可以限制参与。
+
+报告行为问题时，请只提供维护者判断所需的最小上下文。除非已约定私有报告渠道，不要包含私有或敏感数据。

package/CONTRIBUTING.md

@@ -0,0 +1,51 @@
+# 贡献说明
+
+感谢改进 Agent Workflow Starter Kit。本项目坚持三个原则：workflow core 保持通用、本地优先、工具无关。
+
+## 提交 PR 前
+
+先运行：
+
+```bash
+npm run check
+npm run build:release
+```
+
+再检查本地发布清单：
+
+```bash
+cat dist/RELEASE_MANIFEST.md
+```
+
+## 隐私规则
+
+请不要贡献以下内容：
+
+- 私有公司名称或内部项目名称；
+- 私有工作区里的真实仓库名；
+- 客户、员工、学员、患者、账号、支付或运营记录；
+- 生产 URL、内部域名、日志、SQL 导出、截图、凭证、token 或私钥；
+- 可以追溯到真实组织的事故细节。
+
+示例必须是合成的、可替换的。如果规则来自私有事件，请抽象机制并移除可识别事实后再提交。
+
+## 修改范围
+
+- 工具无关行为放在 `workflow/core/`。
+- 团队特化配置示例放在 `examples/`。
+- 工具特定行为放在 adapter 或初始化器生成逻辑里。
+- adapter 必须保持薄入口，不能削弱 core 硬闸门。
+- 远程 Git、创建分支、push、包发布、部署和数据库写入必须保持人工执行。
+
+## PR 检查清单
+
+- 修改是通用的，不绑定任何私有组织。
+- `npm run check` 通过。
+- `npm run build:release` 通过。
+- 新增或修改的示例都是合成数据。
+- 生成文件布局变化时，文档说明迁移或兼容影响。
+- 除非维护者明确要求提交发布产物，否则不要提交生成的 `dist/` 文件。
+
+## 提交历史
+
+公开发布前，维护者应检查 commit message 和变更文件是否包含私有引用。如果私有数据进入尚未发布的历史，应在 push 前改写历史；如果泄露的是敏感凭证，应轮换对应密钥。

package/INIT.md

@@ -0,0 +1,81 @@
+# 初始化指南
+
+本文说明个人开发者拿到 OpenOne Workflow Kit 路径、Git 地址或发布包后，如何在自己的项目或工作区初始化工作流。
+
+## 推荐流程
+
+1. 把 starter kit 放在目标产品仓库之外。
+2. 打开目标产品工作区根目录。
+3. 从目标根目录运行初始化器。
+4. 检查生成的 `workflow/team-profile.yaml`。
+5. 如果存在 `workflow/INITIALIZATION_QUESTIONS.md`，补齐缺失资料。
+6. 如需调整工具列表，重新运行初始化器。
+
+## 本地路径安装
+
+```bash
+cd /path/to/target-workspace
+node /path/to/openone-workflow-kit/bin/init-workspace.cjs --target . --tools codex,claude,cursor
+```
+
+Shell wrapper：
+
+```bash
+cd /path/to/target-workspace
+/path/to/openone-workflow-kit/install.sh . --tools codex,claude,cursor
+```
+
+## package bin 安装
+
+如果 starter kit 已作为本地 package 安装：
+
+```bash
+cd /path/to/target-workspace
+openone-workflow-init --target . --tools codex,claude,cursor
+```
+
+## 非交互安装
+
+在 agent 驱动或 CI-like 初始化中，终端无法回答问题时使用：
+
+```bash
+openone-workflow-init --target . --tools codex,claude,cursor --yes
+```
+
+缺失资料会记录到 `workflow/INITIALIZATION_QUESTIONS.md`。
+
+## 升级已有工作区
+
+```bash
+openone-workflow-init --target . --tools codex,claude,cursor --upgrade
+```
+
+如果已有文件会被覆盖，初始化器默认写出 `.agent-workflow-new` 文件；只有显式传入 `--force` 才会覆盖。
+
+## 安全边界
+
+初始化器不会：
+
+- 执行远程 Git 命令；
+- push 代码；
+- 触发构建或部署；
+- 执行数据库写入；
+- 修改生产配置。
+
+生成后的个人工作流允许 agent 在范围明确且工作树已检查后执行本地分支命名、创建、commit、tag 和本地 merge。远程 push、release、部署和生产配置写入需要用户明确授权。
+
+## 工具别名
+
+初始化器接受 `trea` 作为 `trae` 的别名，并写入 `.trae/instructions.md`。
+
+## 接收方验收
+
+正式用于需求交付前，请先确认：
+
+- 已检查 `workflow/team-profile.yaml`；
+- 如存在 `workflow/INITIALIZATION_QUESTIONS.md`，已补齐待补资料；
+- 选中的工具 adapter 已生成；
+- 已有文件没有被意外覆盖；
+- 初始化期间没有发生远程 Git、push、部署、数据库或生产配置动作。
+
+完整验收清单见 `docs/maintainer-handoff.md`。

package/LICENSE

@@ -0,0 +1,201 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction,
+and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by
+the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all
+other entities that control, are controlled by, or are under common
+control with that entity. For the purposes of this definition,
+"control" means (i) the power, direct or indirect, to cause the
+direction or management of such entity, whether by contract or
+otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity
+exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation
+source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical
+transformation or translation of a Source form, including but
+not limited to compiled object code, generated documentation,
+and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or
+Object form, made available under the License, as indicated by a
+copyright notice that is included in or attached to the work
+(an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object
+form, that is based on (or derived from) the Work and for which the
+editorial revisions, annotations, elaborations, or other modifications
+represent, as a whole, an original work of authorship. For the purposes
+of this License, Derivative Works shall not include works that remain
+separable from, or merely link (or bind by name) to the interfaces of,
+the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the
+original version of the Work and any modifications or additions
+to that Work or Derivative Works thereof, that is intentionally
+submitted to Licensor for inclusion in the Work by the copyright owner
+or by an individual or Legal Entity authorized to submit on behalf of
+the copyright owner. For the purposes of this definition, "submitted"
+means any form of electronic, verbal, or written communication sent
+to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems,
+and issue tracking systems that are managed by, or on behalf of, the
+Licensor for the purpose of discussing and improving the Work, but
+excluding communication that is conspicuously marked or otherwise
+designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity
+on behalf of whom a Contribution has been received by Licensor and
+subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+copyright license to reproduce, prepare Derivative Works of,
+publicly display, publicly perform, sublicense, and distribute the
+Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+(except as stated in this section) patent license to make, have made,
+use, offer to sell, sell, import, and otherwise transfer the Work,
+where such license applies only to those patent claims licensable
+by such Contributor that are necessarily infringed by their
+Contribution(s) alone or by combination of their Contribution(s)
+with the Work to which such Contribution(s) was submitted. If You
+institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Work
+or a Contribution incorporated within the Work constitutes direct
+or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate
+as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+Work or Derivative Works thereof in any medium, with or without
+modifications, and in Source or Object form, provided that You
+meet the following conditions:
+
+(a) You must give any other recipients of the Work or
+Derivative Works a copy of this License; and
+
+(b) You must cause any modified files to carry prominent notices
+stating that You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works
+that You distribute, all copyright, patent, trademark, and
+attribution notices from the Source form of the Work, excluding
+those notices that do not pertain to any part of the Derivative
+Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its
+distribution, then any Derivative Works that You distribute must
+include a readable copy of the attribution notices contained
+within such NOTICE file, excluding those notices that do not
+pertain to any part of the Derivative Works, in at least one
+of the following places: within a NOTICE text file distributed
+as part of the Derivative Works; within the Source form or
+documentation, if provided along with the Derivative Works; or,
+within a display generated by the Derivative Works, if and
+wherever such third-party notices normally appear. The contents
+of the NOTICE file are for informational purposes only and
+do not modify the License. You may add Your own attribution
+notices within Derivative Works that You distribute, alongside
+or as an addendum to the NOTICE text from the Work, provided
+that such additional attribution notices cannot be construed
+as modifying the License.
+
+You may add Your own copyright statement to Your modifications and
+may provide additional or different license terms and conditions
+for use, reproduction, or distribution of Your modifications, or
+for any such Derivative Works as a whole, provided Your use,
+reproduction, and distribution of the Work otherwise complies with
+the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+any Contribution intentionally submitted for inclusion in the Work
+by You to the Licensor shall be under the terms and conditions of
+this License, without any additional terms or conditions.
+Notwithstanding the above, nothing herein shall supersede or modify
+the terms of any separate license agreement you may have executed
+with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+names, trademarks, service marks, or product names of the Licensor,
+except as required for reasonable and customary use in describing the
+origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+agreed to in writing, Licensor provides the Work (and each
+Contributor provides its Contributions) on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+implied, including, without limitation, any warranties or conditions
+of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any
+risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+whether in tort (including negligence), contract, or otherwise,
+unless required by applicable law (such as deliberate and grossly
+negligent acts) or agreed to in writing, shall any Contributor be
+liable to You for damages, including any direct, indirect, special,
+incidental, or consequential damages of any character arising as a
+result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill,
+work stoppage, computer failure or malfunction, or any and all
+other commercial damages or losses), even if such Contributor
+has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+the Work or Derivative Works thereof, You may choose to offer,
+and charge a fee for, acceptance of support, warranty, indemnity,
+or other liability obligations and/or rights consistent with this
+License. However, in accepting such obligations, You may act only
+on Your own behalf and on Your sole responsibility, not on behalf
+of any other Contributor, and only if You agree to indemnify,
+defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason
+of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following
+boilerplate notice, with the fields enclosed by brackets "[]"
+replaced with your own identifying information. (Do not include
+the brackets!)  The text should be enclosed in the appropriate
+comment syntax for the file format. We also recommend that a
+file or class name and description of purpose be included on the
+same "printed page" as the copyright notice for easier
+identification within third-party archives.
+
+Copyright 2026 Agent Workflow Starter Kit contributors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/NOTICE

@@ -0,0 +1,6 @@
+Agent Workflow Starter Kit
+
+Copyright 2026 Agent Workflow Starter Kit contributors
+
+This product includes software and documentation developed for a
+tool-agnostic agent workflow starter kit.

package/README.md

@@ -0,0 +1,195 @@
+# OpenOne Workflow Kit
+
+[![CI](https://img.shields.io/github/actions/workflow/status/bluecoast1379/openone-workflow-kit/check.yml?branch=main&label=CI)](https://github.com/bluecoast1379/openone-workflow-kit/actions/workflows/check.yml)
+[![npm](https://img.shields.io/npm/v/openone-workflow-kit?label=npm)](https://www.npmjs.com/package/openone-workflow-kit)
+[![Node.js](https://img.shields.io/badge/Node.js-%3E%3D18-339933)](./package.json)
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](./LICENSE)
+
+![OpenOne Workflow Kit：独立开发者的研发与商业化双轨工作流](./docs/assets/hero.svg)
+
+面向独立开发者的工具无关 agent 工作流：把产品研发和商业化放进同一个可验证闭环。核心不是更长的 prompt，而是把“什么叫完成”编译成可冻结的《完成合同》：**blocking 验收 Oracle 全部 PASS，才能宣布完成。**
+
+- **研发轨**：需求 → 完成合同 → 实现/审查/测试 → 发布 → 复盘。
+- **商业化轨**：定位 → 商业模式/PMF/ICP → 渠道/预算 → 策略复盘。
+- **本地优先**：只读本地上下文并生成工作流文件；不上传资料，不自动 push、发布、部署或写生产数据。
+
+## 如何选择
+
+| 项目 | 服务对象 | 选它的理由 |
+| --- | --- | --- |
+| [open-workflow-kit](https://github.com/bluecoast1379/open-workflow-kit) | AI Coding 团队 | 需要完成合同、证据账本和跨工具交付治理 |
+| [business-agent](https://github.com/bluecoast1379/business-agent) | 企业业务 Agent | 需要从业务规划、网关脚手架到评测与运行边界 |
+| **openone-workflow-kit（本项目）** | **独立开发者** | **需要个人研发 + 商业化双轨，同时控制流程税** |
+
+## 30 秒 Quick Demo
+
+前置条件：Node.js 18+；首次下载时间不计入 30 秒。在一个空目录中执行：
+
+```bash
+mkdir openone-demo && cd openone-demo
+npx --yes --package openone-workflow-kit@0.1.0 openone-workflow-init --target . --tools codex,cursor --yes
+node -e "for (const f of ['workflow/team-profile.yaml','AGENTS.md']) require('node:fs').accessSync(f); console.log('OpenOne ready')"
+```
+
+预期结果：终端输出 `OpenOne ready`，并生成 `workflow/team-profile.yaml`、`workflow/core/`、`AGENTS.md` 与所选工具 adapter。如果 npm 网络不可用，参考 [Git 或本地 tarball 安装](./docs/shareable-install.md)。
+
+![OpenOne Workflow Kit 30 秒体验：创建目录、运行 v0.1.0、验证产物](./docs/assets/quick-demo.svg)
+
+## 架构：一套 Core，两条轨道
+
+![OpenOne Workflow Kit 双轨架构：上下文、定义、执行、验证与复盘共享治理闸门](./docs/assets/architecture.svg)
+
+1. `workflow/team-profile.yaml` 记录本地事实与路径；`specs/` 记录已发布行为真相。
+2. `workflow/core/` 提供工具无关的阶段、完成合同、闸门、模板和 Oracle 能力。
+3. `workflow/adapters/` 为 Claude、Codex、Cursor、Copilot、CodeBuddy、Kiro 和 Trae 生成薄入口；共享 core，但不承诺工具体验完全相同。
+
+深入阅读：[定义完成指南](./docs/definition-of-done.md) · [双轨工作流设计](./docs/dual-track-workflow.md) · [v0.1.0 Release Notes](./docs/releases/v0.1.0.md)
+
+## 一键初始化
+
+从 npm 的不可变版本运行（Node.js 18+）：
+
+```bash
+npx --yes --package openone-workflow-kit@0.1.0 openone-workflow-init --target . --tools codex,claude,cursor --yes
+```
+
+从源码 checkout 本地运行：
+
+```bash
+node /path/to/openone-workflow-kit/bin/init-workspace.cjs --target .
+```
+
+也可以使用 shell wrapper：
+
+```bash
+/path/to/openone-workflow-kit/install.sh . --tools codex,claude,cursor
+```
+
+如果你拿到的是 Git 地址或本地 tarball，见 [可分享安装方式](./docs/shareable-install.md)。该文档也说明了如何先验证 Registry 中的 `0.1.0` 再安装，避免把尚未发布的版本当作可用事实。
+
+常用参数：
+
+```bash
+# 指定工具入口
+node /path/to/openone-workflow-kit/bin/init-workspace.cjs --target . --tools codex,claude,cursor
+
+# GitHub 包安装方式
+npx --yes --package "git+https://github.com/bluecoast1379/openone-workflow-kit.git#v0.1.0" openone-workflow-init --target . --tools codex,claude,cursor
+
+# 工具名支持 trea 别名，会自动归一为 trae
+node /path/to/openone-workflow-kit/bin/init-workspace.cjs --target . --tools codex,trea,codebuddy
+
+# 非交互模式，缺失资料会写入 workflow/INITIALIZATION_QUESTIONS.md
+node /path/to/openone-workflow-kit/bin/init-workspace.cjs --target . --yes
+
+# 只查看会生成什么，不写文件
+node /path/to/openone-workflow-kit/bin/init-workspace.cjs --target . --dry-run
+```
+
+## 初始化器会做什么
+
+1. 扫描目标工作区本地文件和目录，识别代码仓库、技术栈线索、项目资料、UI 规范、前后端规范和测试规范。
+2. 生成 `workflow/team-profile.yaml`，只记录本地路径、工具选择、技术栈和缺失项，不上传任何资料。
+3. 如果必要资料缺失：
+   - 交互式终端：逐项提问。
+   - 非交互模式：生成 `workflow/INITIALIZATION_QUESTIONS.md`。
+4. 生成跨工具入口：
+   - Codex: `AGENTS.md`、`.codex/prompts/`
+   - Claude Code: `CLAUDE.md`、`.claude/commands/`
+   - Cursor: `.cursor/rules/` 和 `.cursor/commands/`
+   - Copilot: `.github/copilot-instructions.md`
+   - CodeBuddy / Kiro / Trae: 各自 `instructions.md`
+5. 初始化器本身不执行远程 Git、push、构建部署或数据库写入。生成后的个人工作流允许 agent 在范围明确且工作树干净时执行本地分支命名、创建、commit、tag 和本地 merge；远程 push、release、部署和生产配置写入需要用户明确授权。
+
+## 隐私与脱敏边界
+
+本 kit 自身不应包含任何真实客户字段、内部系统地址、真实 URL 或凭证。对外分发前运行：
+
+```bash
+node openone-workflow-kit/bin/check-sanitized.cjs
+```
+
+个人项目的业务介绍、项目资料、代码、UI 文件、前后端规范和测试规范只在本地被引用；初始化器不把这些资料发送到外部服务。
+
+## 生成后的工作方式
+
+初始化完成后，个人项目按 `AGENTS.md` 和 `workflow/core/commands/` 推进。
+
+研发轨（每个需求一轮；`/new-feature` 时按 S/M/L 分级，S 档压缩为 定义完成→实现→验证 三步）：
+
+1. `/new-feature`（S/M/L 复杂度分级）
+2. `/01-需求讨论`（存量行为先读 `specs/`）
+3. `/澄清`（按需：≤5 问消融歧义，答案写回文档）
+4. `/02-产品文档`
+5. `/02B-UI设计`（含体验预算）
+6. `/03-技术架构`（含数据流/状态机草案、规范提取到 `workflow/standards/`）
+7. `/06-测试用例`（风险驱动，Oracle-ready）
+8. `/定义完成`（把 01-06 编译成完成合同：数据流、失败路径、质量预算、验收 Oracle、术语表、影响边界；Definition Lint 通过并经用户确认后冻结）
+9. `/一致性检查`（实现前只读交叉检查）
+10. `/交付至完成`（在合同范围内自主循环 实现→验证→修复→复验 直到 blocking Oracle 全绿或精确阻塞），或手动 `/04-代码实现`、`/04A`、`/04B` → `/05-代码审查` → `/07-测试执行`
+11. `/08-发布准备`（发布准入 = blocking Oracle 全 PASS）
+12. `/09-发布执行`
+13. `/10-复盘总结`（行为增量回写 `specs/` living specs）
+
+商业化轨（每个产品一份基线 + 周期复盘）：
+
+1. `/new-product`
+2. `/B1-业务定位`（可用 `/B1-B8-商业化准备` 一次性串联 B1 到 B8）
+3. `/B2-商业模式`
+4. `/B3-PMF与客户画像`
+5. `/B4-场景与购买旅程`
+6. `/B5-渠道漏斗映射`
+7. `/B6-营销获客策略`
+8. `/B7-营销预算`
+9. `/B8-渠道执行策略`
+10. `/B9-策略复盘`（周期执行：建议周检视指标、月度策略复盘、季度定位校准）
+
+两轨衔接：`/01`、`/02` 读取定位、ICP 与场景基线；`/08`、`/09` 对照 B5/B8 准备发布营销材料和分发清单；`/10` 的增长信号回流 `/B9`；B8 的营销工程需求（landing、SEO 页面、埋点）通过 `/new-feature` 进入研发轨。
+
+业务代码修改必须先通过功能分支闸门、阶段闸门和并行开发隔离检查；M/L 档需求还必须有已冻结且 Definition Lint 通过的完成合同（S 档为迷你合同）。涉及 UI 或前端的功能必须先完成 `/02B-UI设计`，或记录用户明确授权的范围有限设计豁免。文档分析和初始化不等于授权实现代码。商业化轨只产出文档和清单：对外发布、投放、cold outreach 必须由用户明确授权或自行执行，市场结论必须做证据分级、不得编造数据。
+
+完成合同可用内置校验器检查结构：
+
+```bash
+node openone-workflow-kit/bin/check-contract.cjs features/<feature>/00-完成合同.md
+```
+
+初始化器还会在目标工作区生成 `workflow/constitution.md`（跨需求不可协商原则）、`workflow/standards/`（个人规范层）和 `specs/`（已实现行为的 living specs）。
+
+个人版迁移了 gstack 指南中的独立开发者发布经验：`main` / `prod` 双分支、本地集成、语义化 tag、扩展/CLI/桌面应用发布清单、发布后文档和复盘。agent 可以执行本地 git 分支、commit、tag、merge；远程 push、GitHub release、商店提交、部署和生产配置写入需要用户明确授权。
+
+## 维护建议
+
+- 通用规则只改 `workflow/core`。
+- 个人项目特化配置只改 `workflow/team-profile.yaml`。
+- 工具入口由初始化器或 adapter 生成，不把业务规则硬编码到单个工具里。
+- 对外发布前先跑脱敏检查，再由人工复核许可证、示例和文档。
+
+## 开源协作
+
+- 贡献说明见 [CONTRIBUTING.md](./CONTRIBUTING.md)。
+- 安全报告说明见 [SECURITY.md](./SECURITY.md)。
+- 行为准则见 [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md)。
+- GitHub issue 和 PR 模板位于 `.github/`。
+
+## 本地验证
+
+```bash
+cd /path/to/openone-workflow-kit
+npm run check
+```
+
+该命令会执行脚本语法检查、starter kit 脱敏检查和临时目录 smoke test。
+
+## 本地打包
+
+```bash
+cd /path/to/openone-workflow-kit
+npm run build:release
+```
+
+该命令会在 `dist/` 下生成本地 tarball 和 `RELEASE_MANIFEST.md`。它不创建远程仓库、不 push、不打 tag、不执行 npm publish。
+
+远程发布步骤见 [手动发布指南](./docs/manual-publish.md)。维护本 kit 自身时，push、tag、npm publish 仍应由维护者明确授权。
+
+维护者发布、接收方验收和支持边界见 [维护者交接](./docs/maintainer-handoff.md)。

package/SECURITY.md

@@ -0,0 +1,39 @@
+# 安全策略
+
+## 支持版本
+
+公开项目默认支持最新发布版本。安全修复优先进入默认分支，再由维护者手动发布。
+
+## 报告漏洞
+
+不要在公开 issue 中提交密钥、凭证、私有 URL、客户数据、私有源码、日志、数据库导出或生产配置。
+
+请通过仓库维护者指定的私有渠道报告安全问题，并只提供定位问题所需的最小上下文。
+
+## 范围
+
+本项目关注：
+
+- 初始化器写入了不应写入的私有内容；
+- 脱敏检查遗漏明显敏感模式；
+- 生成的 adapter 削弱了 workflow 硬闸门；
+- 文档引导用户执行不安全的自动远程操作。
+
+不在范围内：
+
+- 用户手动改坏生成文件后的误用；
+- 目标团队自己的业务代码缺陷；
+- 目标团队工具或插件本身的漏洞；
+- 未经授权上传到 issue、PR 或讨论区的私有数据。
+
+## 脱敏检查
+
+发布或分享前必须运行：
+
+```bash
+npm run check
+npm run build:release
+node bin/check-sanitized.cjs --extra-banned <private-denylist-file>
+```
+
+`private-denylist-file` 必须放在 starter kit 外部，不要提交到仓库。