From 357ced0ec8f914a6e871ff544f39008c3a5c17cc Mon Sep 17 00:00:00 2001
From: Qwynn Marcelle <qwynn@marcellelabs.io>
Date: Sun, 26 Jul 2026 23:38:05 -0400
Subject: [PATCH] fix(cli): correct the package README, which said the package
 was unpublished
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`packages/cli/README.md` is listed in `files`, so it ships in the tarball and
renders on the npm package page. It still carried the pre-release notice — "Not
yet published. This package is not on npm… Do not document
`npm install @workspacejson/cli` as if it works" — so the page for a published
package was advising against installing it and redirecting to `agents-audit`.

I missed it when updating the publishing docs: I fixed the root README and the
changelog and never checked the per-package README, which is the one users
actually see.

Replaced with install instructions, a note that releases carry npm provenance,
and a migration table for anyone arriving from `agents-audit` — renamed binary,
no `scan`, `.agentsauditrc` not read.

Cut as 0.5.2. A README-only change still needs a release, because the text on the
npm page updates only on publish.

Verified: architecture guard, 108 tests, and the packed tarball carries the
corrected README.
---
 packages/cli/CHANGELOG.md | 18 ++++++++++++++++++
 packages/cli/README.md    | 24 ++++++++++++++++++++----
 packages/cli/package.json |  2 +-
 3 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index d611f9c..c027beb 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Changelog — `@workspacejson/cli`
 
+## 0.5.2
+
+### Patch Changes
+
+- **Fixed:** the package README told readers the package was not published.
+
+  `README.md` is listed in `files`, so it ships in the tarball and renders on the
+  npm package page. It still carried the pre-release notice — "Not yet published.
+  This package is not on npm… Do not document `npm install @workspacejson/cli` as
+  if it works" — which meant the page for a published package advised against
+  installing it and pointed at `agents-audit` instead.
+
+  Replaced with real install instructions, a note that releases carry npm
+  provenance, and a migration table for anyone arriving from `agents-audit`: the
+  binary is renamed, there is no `scan`, and `.agentsauditrc` is not read.
+
+  Documentation only; no code change.
+
 ## 0.5.1
 
 ### Patch Changes
diff --git a/packages/cli/README.md b/packages/cli/README.md
index fc9e59b..311b410 100644
--- a/packages/cli/README.md
+++ b/packages/cli/README.md
@@ -4,10 +4,26 @@ The **workspace.json producer**. Scans a repository and generates
 `.agents/workspace.json` deterministically, preserving human-authored `manual`
 evidence across regenerations.
 
-> **Not yet published.** This package is not on npm. Until the coordinated
-> publish-authority cutover, the working public command is
-> `npx agents-audit generate`, which runs this same producer implementation.
-> Do not document `npm install @workspacejson/cli` as if it works.
+## Install
+
+```bash
+npm install -g @workspacejson/cli   # or: npx @workspacejson/cli generate
+```
+
+Requires Node.js >= 20. Published from
+[`workspacejson/cli`](https://github.com/workspacejson/cli) with
+[npm provenance](https://docs.npmjs.com/generating-provenance-statements), so
+every release is traceable to the workflow run and commit that built it.
+
+> **Migrating from `agents-audit`?** That package is frozen at `0.4.4` and this
+> one continues its version line from `0.5.0`. The producer is the same
+> implementation, but the surface is deliberately smaller:
+>
+> | `agents-audit` | `@workspacejson/cli` |
+> | -- | -- |
+> | `agents-audit generate` | `workspacejson generate` |
+> | `agents-audit scan` | no equivalent — this is the producer, not the audit |
+> | `.agentsauditrc` | not read; a neutral config file is still to be named |
 
 ## Commands
 
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 903247c..83b940e 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@workspacejson/cli",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "The workspace.json producer — scans a repository and generates .agents/workspace.json deterministically, preserving human-authored manual evidence.",
   "license": "Apache-2.0",
   "author": "workspace.json contributors",