[MIGRATION] META-240 — extract producer and DataHub shim into workspacejson/cli

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.4/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": ["@workspacejson/cli"]
+}

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20, 22]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: pnpm
+
+      - run: pnpm install --no-frozen-lockfile
+
+      - name: Architecture and clean-room guards
+        run: pnpm run check:architecture
+
+      - name: Architecture guard red tests
+        run: node scripts/check-architecture.test.mjs
+
+      - name: Typecheck all packages
+        run: pnpm -r typecheck
+
+      - name: Build all packages
+        run: pnpm -r build
+
+      - name: Run tests
+        run: pnpm -r test
+
+      - name: Verify package tarballs
+        run: pnpm run release:verify-packs
+
+      # This repository owns and exports agents-audit only. @workspacejson/spec
+      # and @workspacejson/rules are consumed as released dependencies and are
+      # verified by workspacejson/standard, not here.
+      - name: Validate package exports
+        run: node -e "import('agents-audit')"
+
+      - name: Run agents-audit on this repo
+        run: node packages/agents-audit/dist/cli.js scan . --fail-on error

.github/workflows/release.yml

@@ -0,0 +1,62 @@
+name: Release (DISABLED — non-authoritative)
+
+# ---------------------------------------------------------------------------
+# PUBLISHING FROM THIS REPOSITORY IS DISABLED.
+#
+# `workspace-json/agents-audit` remains the sole publisher of `agents-audit`
+# until the coordinated authority cutover in META-243. This workflow exists so
+# that the release path is reviewable now and can be enabled deliberately later
+# — it is NOT a working publisher:
+#
+#   * it has no `on:` trigger that can fire (manual dispatch is commented out),
+#   * it holds no npm credential and requests no publish permission,
+#   * the publish step is absent, not merely conditional,
+#   * this repository has no NPM_TOKEN secret configured.
+#
+# Enabling it is META-243's job and requires, in order: standard/CLI parity
+# complete, old workflow disabled, old token revoked, then a least-privilege
+# token granted here for `agents-audit` only.
+#
+# `@workspacejson/cli` must NOT be added to this workflow. It is `private: true`
+# and its identity is undecided until META-236.
+# ---------------------------------------------------------------------------
+
+on:
+  # Intentionally left with no enabled trigger. Do not add `workflow_dispatch`
+  # or `push` here as a convenience — that is the authority transfer itself.
+  workflow_call:
+    inputs:
+      dry_run:
+        description: Verification only. This workflow cannot publish.
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  verify-only:
+    name: Verify release candidate (cannot publish)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --no-frozen-lockfile
+      - run: pnpm run check:architecture
+      - run: pnpm -r typecheck
+      - run: pnpm -r build
+      - run: pnpm -r test
+      - run: pnpm run release:verify-packs
+
+      - name: Confirm this workflow is non-authoritative
+        run: |
+          echo "Release candidate verified. Publishing is intentionally not performed here."
+          echo "Publish authority for agents-audit remains with workspace-json/agents-audit until META-243."
+          exit 0

AGENTS.md

@@ -0,0 +1,8 @@
+# Workspace Notes
+
+- This repository holds two distinct CLI packages. `./packages/agents-audit/` is the published `agents-audit` package and contains the real workspace.json generator (`./packages/agents-audit/src/generate.ts`). `./packages/cli/` is the private `@workspacejson/cli` DataHub/dbt join shim and is not the generator.
+- Keep package entry points aligned with `./packages/agents-audit/src/index.ts` and `./packages/cli/src/index.ts`.
+- Review changes against `./packages/agents-audit/src/cli.ts` before release.
+- `@workspacejson/spec` and `@workspacejson/rules` are consumed as released packages from `workspacejson/standard`; never vendor, copy or workspace-link them here.
+- Keep workspace metadata in `./CHANGELOG.md` and `./README.md` current.
+- Workspace layout is defined in `./pnpm-workspace.yaml`; repository boundaries are defined in `./OWNERSHIP.md` and enforced by `./scripts/check-architecture.mjs`.

CHANGELOG.md

@@ -0,0 +1,36 @@
+# Changelog — `workspacejson/cli`
+
+This file records **repository-level** history for the CLI repository. Package
+release notes live with their packages:
+
+* [`packages/agents-audit/CHANGELOG.md`](./packages/agents-audit/CHANGELOG.md) — `agents-audit`
+
+## [Unreleased]
+
+### Changed
+
+- Repository created by history-preserving extraction from
+  `workspace-json/agents-audit@e47eb1b8556c4f361db9a78190a2f36b400756e8`
+  (META-240). No package was renamed, no public command changed, and no package
+  was published as part of the move.
+- `@workspacejson/spec` and `@workspacejson/rules` dependencies changed from
+  `workspace:*` to the registry-backed pin `0.4.4`. This reproduces the exact
+  dependency bytes that `pnpm pack` already wrote into the published
+  `agents-audit@0.4.4` tarball, so packed output is unchanged.
+- `repository` and `bugs` metadata repointed from `workspace-json/agents-audit`
+  to `workspacejson/cli`.
+- Release workflow landed **non-authoritative**: it cannot publish and holds no
+  npm credential. `workspace-json/agents-audit` remains the sole publisher of
+  `agents-audit` until META-243.
+
+## Historical release family
+
+Releases through `0.4.4` were produced from the `workspace-json/agents-audit`
+monorepo as a fixed group of `@workspacejson/spec`, `@workspacejson/rules` and
+`agents-audit`, tagged `v0.4.x` in that repository. Those tags remain valid
+provenance for the pre-migration history and are **not** re-created here; per
+META-243 this repository will use package-scoped tags such as
+`agents-audit-v0.4.5`.
+
+Historical monorepo changelog:
+<https://github.com/workspace-json/agents-audit/blob/e47eb1b8556c4f361db9a78190a2f36b400756e8/CHANGELOG.md>

CONTRIBUTING.md

@@ -0,0 +1,49 @@
+# Contributing
+
+This repository holds the workspace.json **CLI** packages. The specification,
+schema and rules live in `workspacejson/standard` and are consumed here as
+released packages — do not vendor or edit them here.
+
+## Before You Start
+
+- Read `AGENTS.md` and `OWNERSHIP.md` at the repo root
+- Know which of the two CLI packages you are changing:
+  - `packages/agents-audit/` — published `agents-audit`, contains the real generator
+  - `packages/cli/` — private `@workspacejson/cli`, the DataHub/dbt join shim
+- Keep changes within the owning package when possible
+- Avoid changing package entrypoints unless the public surface changes
+
+## Common Commands
+
+```bash
+pnpm install
+pnpm typecheck
+pnpm test
+pnpm build
+pnpm run check:architecture
+node packages/agents-audit/dist/cli.js scan .
+```
+
+## Change Expectations
+
+- Update package READMEs when public APIs change
+- Update `CHANGELOG.md` for repository-level changes and
+  `packages/agents-audit/CHANGELOG.md` for package release notes
+- Keep the CLI contract documented in `packages/agents-audit/README.md`
+- Add a changeset for anything user-facing in `agents-audit`
+
+## Boundaries enforced in CI
+
+`scripts/check-architecture.mjs` fails the build on:
+
+- imports of `@marcelle-labs/*`, private Vreko source, or `workspace.vreko.json`
+- copies of the normative schema (that belongs to `workspacejson/standard`)
+- host-integration or site code landing in this repository
+- committed `workspace:`, `file:../`, `link:` or sibling-checkout dependencies
+- `@workspacejson/cli` losing `private: true`
+- any workflow attempting to publish `@workspacejson/spec` or `@workspacejson/rules`
+
+## Reporting Issues
+
+File bugs at [GitHub Issues](https://github.com/workspacejson/cli/issues).
+For security vulnerabilities, follow the process in [`SECURITY.md`](./SECURITY.md).

LICENSE

@@ -0,0 +1,12 @@
+Apache License 2.0
+
+Copyright (c) 2026 workspace-json contributors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may obtain a copy of the License at
+
+https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

OWNERSHIP.md

@@ -0,0 +1,70 @@
+# Ownership — `workspacejson/cli`
+
+Machine-checked by `scripts/check-architecture.mjs`, run in CI. This document
+states the intent; the script is what enforces it.
+
+## Owns
+
+* Producer and audit CLI implementation (`packages/agents-audit/`)
+* Repository scanning, deterministic generation and reconciliation of
+  `.agents/workspace.json`
+* Manual-evidence preservation, drift detection and atomic-write behavior
+* The DataHub/dbt adapter package (`packages/cli/`)
+* CLI package distribution and the CLI release workflow
+
+## Consumes
+
+* Released public contracts from `workspacejson/standard`:
+  `@workspacejson/spec`, `@workspacejson/rules` — pinned to registry-backed
+  versions, never workspace links or sibling checkouts
+
+## Must never define
+
+* The normative schema or specification text — that is `workspacejson/standard`
+* MCP, Codex, VS Code or other editor/host integration behavior — that is
+  `workspacejson/integrations`
+* Site content as a source of truth — that is `workspacejson/site`
+* Private product behavior of any kind
+
+## Dependency direction
+
+```text
+workspacejson/standard
+        ↓
+workspacejson/cli       workspacejson/integrations
+        \                    /
+              workspacejson/site
+```
+
+This repository depends **downstream only**. It must never be imported by
+`workspacejson/standard`.
+
+## Clean-room boundary
+
+No code in this repository may import, copy, require or assume:
+
+```text
+@marcelle-labs/*
+private Vreko source
+workspace.vreko.json
+```
+
+Proprietary repositories may consume released Apache-2.0 `@workspacejson/*`
+packages. The reverse direction is prohibited.
+
+## Publish authority
+
+| Package | Publishable from here | Current authority |
+| -- | -- | -- |
+| `agents-audit` | Metadata says yes; **workflow disabled** | `workspace-json/agents-audit` until META-243 |
+| `@workspacejson/cli` | **No** — `private: true`, must not be published | none (unpublished by design) |
+| `@workspacejson/spec` | **Never** — not owned here | `workspacejson/standard` |
+| `@workspacejson/rules` | **Never** — not owned here | `workspacejson/standard` |
+
+This repository holds no publish-capable secret. Authority transfer is
+META-243's job, not this repository's.
+
+## Migration source and provenance
+
+Extracted from `workspace-json/agents-audit@e47eb1b8556c4f361db9a78190a2f36b400756e8`
+on 2026-07-26 under META-240. See [`migration/PROVENANCE.md`](./migration/PROVENANCE.md).