# openspec/changes/wf-launch-with-proof/proposal.md

## Why

A launch post says what shipped, but nobody checked that the docs match the release, and a claim made on launch day cannot be checked a month later. Buyers, press and investors repeat launch claims. A wrong one is expensive to chase down; a claim with a record behind it is one less question in every sales call.

## What Changes

- Add the `launch-with-proof` workflow to the PromptReports workflow library, run by the workflow runner as an agent acting for a person.
- ContextFile: Check each docs page against the release's context version (today: Built).
- RepoOps: Trace what shipped from the merged changes and their agent sessions (today: Planned).
- PromptReports: Draft the announcement, one claim per sentence (today: Planned).
- PromptCompute: A person approves the announcement before it publishes (today: Planned).
- AI Source of Truth: Record each claim with its source change (today: Built).
- PromptReports: Show the record badge on the post (today: Switching on).
- Gate `cms.post.publish`, `social.post.publish`, `aisot.record.publish` through PromptCompute approvals; each gated step runs only after `verifyResume` passes, with `final_args`.
- Write a signed record at the end of each run and count one workflow request.

## Impact

- Products: ContextFile, RepoOps, PromptCompute, AI Source of Truth, PromptReports.
- Outside the family: GitHub, Your blog or CMS, A social account (optional).
- State: Partly built. Three of five parts merged. The RepoOps release trace and the PromptCompute approval are still to build.
- Plan row: LDG-2269.

# openspec/changes/wf-launch-with-proof/tasks.md

## 1. Connect and authorize

- [ ] 1.1 Confirm the org has a connection for each of: ContextFile, RepoOps, PromptCompute, AI Source of Truth, PromptReports. Stop and tell the user which is missing.
- [ ] 1.2 Get a PromptReports ID agent token for each product the run calls (RFC 8693 exchange). Where a product does not accept ID tokens yet, use its connect key.
- [ ] 1.3 Register policy for `cms.post.publish`, `social.post.publish`, `aisot.record.publish` with `require_approval` as the default.

## 2. Build the steps

- [ ] 2.1 ContextFile: Check each docs page against the release's context version.
- [ ] 2.2 RepoOps: Trace what shipped from the merged changes and their agent sessions. Blocked: this part is Planned; until it ships, record the step's evidence as `missing` and continue.
- [ ] 2.3 PromptReports: Draft the announcement, one claim per sentence. Blocked: this part is Planned; until it ships, record the step's evidence as `missing` and continue.
- [ ] 2.4 PromptCompute: A person approves the announcement before it publishes. Blocked: this part is Planned; until it ships, record the step's evidence as `missing` and continue.
- [ ] 2.5 AI Source of Truth: Record each claim with its source change.
- [ ] 2.6 PromptReports: Show the record badge on the post.

## 3. Verify and record

- [ ] 3.1 Run a dry run with the user's inputs: Release tag = v2.8.0; Docs to check = docs/, the changelog; Where to publish = Blog, LinkedIn.
- [ ] 3.2 Run it once for real; approve each gate as the user.
- [ ] 3.3 Measure the outcomes: Share of launch claims with a public record: target 100%; Docs pages out of date on launch day: target 0; Hours from release tag to approved announcement.
- [ ] 3.4 Confirm the run left a signed record with a task id and one workflow request counted.

# openspec/changes/wf-launch-with-proof/specs/workflow-launch-with-proof/spec.md

## ADDED Requirements

### Requirement: Every claim carries a record

The workflow SHALL attach an AI Source of Truth record id to each claim in an approved announcement.

#### Scenario: Every claim carries a record (1)

- **WHEN** the announcement is approved
- **THEN** each claim sentence links to a record that names its source change

#### Scenario: Every claim carries a record (2)

- **WHEN** a claim has no source change
- **THEN** the step marks it missing and the approval card lists it before the person decides

### Requirement: Nothing publishes without a person

The publish step SHALL run only with a verified PromptCompute resume credential for this run and step.

#### Scenario: Nothing publishes without a person (1)

- **WHEN** the publish step receives a decision without a resume credential
- **THEN** the step refuses with missing_credential and the run waits

#### Scenario: Nothing publishes without a person (2)

- **WHEN** the approver edits the text
- **THEN** the step publishes final_args, never the first draft

### Requirement: Evidence stays honest

Each step SHALL report what it saw as measured, inferred or missing, and SHALL never report missing as measured.

#### Scenario: A product part is not built

- **WHEN** a step depends on a part that is Planned or Proposed
- **THEN** the step records `missing`, names the part, and the approval card shows the gap

### Requirement: One run is one workflow request

The runner SHALL count one workflow request when the first step starts, and SHALL NOT count retries, resumes or dry runs.

#### Scenario: A gated step resumes after two days

- **WHEN** a person approves a step and the run resumes
- **THEN** the org's usage does not change