docs: make workflow sync one-command

[wlvh]

Base / head

• Base: main at 821a32a8221d6eb3b808b65ce0cd682905dc57f6
• Head: agent/docs-first-installation-onboarding at 192d415834b6ef36d78d46c447bc278447e91e84
• Latest corrective commit: 192d415834b6ef36d78d46c447bc278447e91e84
• Publication target: existing Draft PR docs: make workflow sync one-command #23 only. No new PR was created; this PR was not marked Ready or merged.

Changed files

The full PR contains:

• README.md
• zh/README.md
• en/README.md
• zh/skills/workflow-docs-sync/SKILL.md
• zh/skills/workflow-docs-sync/agents/openai.yaml
• tests/test_workflow_docs_sync.py

The corrective commit changed only README.md, zh/README.md, en/README.md, zh/skills/workflow-docs-sync/SKILL.md, and tests/test_workflow_docs_sync.py. It did not change agents/openai.yaml, sync_docs.py, either installer, downstream templates, DEC files, or eval files. allow_implicit_invocation: false remains unchanged.

Confirmed corrections

• WDS-I18N-07: zh/README.md contains the exact Chinese first-installation prompt once. en/README.md and the English root README each contain the exact equivalent English prompt once. The two public prompts are intentionally not byte-identical and remain in their first-use entrypoints.
• WDS-TEST-08: FIRST_USE_PROMPT is split into ZH_FIRST_USE_PROMPT and EN_FIRST_USE_PROMPT. Scenario 5 checks each public copy-paste prompt and its entrypoint, while the 24 ordinary-prose SKILL.md substring snapshots were removed. Skill structure, exact public CLI contracts, distribution identifiers, and allow_implicit_invocation: false remain covered.
• WDS-ISOLATION-04: original-worktree protection no longer hashes the whole repository or compares raw Git index-file bytes. It captures NUL-delimited status, staged entries, and ignored-path enumeration; freezes only the invocation-time non-clean/ignored path set; records type, mode, regular-file SHA-256, symlink target, or missing state for that set; then rechecks the same set plus status and staged entries. New ignored paths are not globally rescanned, and detected concurrent changes are not attributed to the Agent without evidence.
• WDS-ONBOARDING-09: both detailed READMEs now distinguish the first-installation instruction from normal use after installation in another project.

The existing same-turn installer continuation, target/language/PR inference, external clean worktree, Draft-only publication, explicit staging, out-of-repository PR body, and remote readback contracts remain in place.

Exact validation

• PYTHONDONTWRITEBYTECODE=1 /Users/lyuhongwang/opt/anaconda3/bin/python3 -m pytest -q -p no:cacheprovider tests/test_workflow_docs_sync.py -k scenario_5 — PASS, 1 passed, 4 deselected in 0.68s.
• PYTHONDONTWRITEBYTECODE=1 /Users/lyuhongwang/opt/anaconda3/bin/python3 -m pytest -q -p no:cacheprovider — PASS, 5 passed in 60.01s.
• PYTHONDONTWRITEBYTECODE=1 /Users/lyuhongwang/opt/anaconda3/bin/python3 /Users/lyuhongwang/.codex/skills/.system/skill-creator/scripts/quick_validate.py zh/skills/workflow-docs-sync — PASS, Skill is valid!.
• PYTHONPYCACHEPREFIX=<external-validation-dir>/pycache python3 -m py_compile zh/skills/workflow-docs-sync/scripts/sync_docs.py zh/scripts/install_skills.py — PASS.
• PYTHONDONTWRITEBYTECODE=1 python3 zh/skills/workflow-docs-sync/scripts/sync_docs.py --help — PASS; public commands remain {prepare,check}.
• git diff --check — PASS before staging.
• git diff --cached --check — PASS after explicitly staging exactly the five corrective paths.
• git show --check HEAD — PASS after commit.
• Validation before/after git status --porcelain=v1 -z --untracked-files=all --ignored comparison — PASS; no repository residue was added.
• GitHub Actions pytest — PASS for push run 31246083319 and pull_request run 31246085744.

Environment limitations recorded without converting them into candidate failures:

• PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q -p no:cacheprovider — BLOCKED: the Homebrew Python has no pytest module.
• PYTHONDONTWRITEBYTECODE=1 python3 /Users/lyuhongwang/.codex/skills/.system/skill-creator/scripts/quick_validate.py zh/skills/workflow-docs-sync — BLOCKED: the Homebrew Python has no yaml module.

One-prompt Codex E2E

One-prompt Codex E2E: NOT_RUN

The exact README prompt resolves /tree/main/ at remote main commit 821a32a8221d6eb3b808b65ce0cd682905dc57f6, while this Draft candidate is 192d415834b6ef36d78d46c447bc278447e91e84. The system installer honors the URL ref, so running the prompt before merge would install and test the prior main Skill rather than this candidate. Under the explicit constraints not to merge and not to change the prompt, that run cannot provide candidate product acceptance. No disposable test PR was created.

Review and final status

A fresh-context, read-only contract review of the frozen five-file corrective diff returned PASS with no BLOCKER or WARN. It checked the bilingual entrypoints, retained machine contracts, targeted worktree proof, allowlist, and unchanged implicit-invocation policy.

• Deterministic local validation: PASS
• GitHub Actions: PASS
• Publication: PASS — the existing Draft PR docs: make workflow sync one-command #23 was updated
• One-prompt Codex E2E: NOT_RUN
• Product acceptance: NOT_RUN
• Overall: PARTIAL — deterministic validation and Draft publication pass, but product acceptance is not complete