[asdd-agent]

What & why

The one-line install merged in #35, but a reader of the docs could not find it: only the README mentioned it, and the docs site's Get started pages (guides/deploy, guides/operate-goose), adopt-govern, slash-commands and cli/README.md still said pip install git+.... It also did not work yet. The README's releases/latest/download/install.sh returns 404, because the latest release (v0.1.0) predates install.sh.

This PR fixes both. Spec: docs/specs/one-line-install.md, whose scope now names the pages covered.

How

• Docs. docs/guides/deploy.md (the docs-site Get started page) gets the one full explanation: the command, flags, pinning in CI with $GITHUB_PATH, what the installer checks, what the checksum does not prove, uninstall, and the pip alternative. adopt-govern, slash-commands, operate-goose and cli/README.md show the command and link to it rather than repeating it. The README's uninstall line now works for someone who only ran the one-liner (... sh uninstall).
• Release prep (0.2.0). asdd_cli.py, pyproject.toml and the MCP serverInfo are set to 0.2.0, the changelog gets a [0.2.0] - 2026-10-22 section above an empty [Unreleased], and the pinned examples use 0.2.0 (0.1.0 has no installer archive). 0.2.0 rather than 0.1.1 because [Unreleased] already held many features.
• Not done here, on purpose: tagging. Pushing v0.2.0 after this merges runs release.yml: it checks the tag against those versions, installs from the archive it just built, then publishes the archive, its SHA-256 and install.sh. Until that tag exists the one-liner returns 404.

Checked locally: the repo's security_scan.py reports no findings on this diff and no added line pipes into a shell; no banned words; the doc anchors exist; the release workflow's version check passes; a git archive of this branch installs as 0.2.0 with the documented sh -c "$(curl ...)" sh --version 0.2.0 and reports asdd 0.2.0; asdd_cli.test.sh and asdd-mcp.test.sh pass.

Disclosure (required: ASDD §1)

• Authored by a human.
• Authored or co-authored by an AI agent under human direction. The agent identity is named
  below and each agent commit carries the Agent: trailer.

Agent identity (if any): asdd-agent (GitHub App), work by claude-code (Sonnet 5.5) · Instructed by (human handle): welsbach

Change scope (required: ASDD framework-impact lens)

• Non-normative: a fix, docs, chore, or reference-implementation change that does NOT change the
  standard's text or any behaviour adopters rely on for conformance.
• Normative

Checklist

• Commits are signed off (DCO): Signed-off-by: Name <email> (use git commit -s).
• Conventional Commit message(s).
• Change scope declared above; if normative, the impact analysis and target version are filled in.
• Quality gates pass locally (lint / types / tests as applicable).
• If this touches a protected path, a named human owner is requested for review. It touches no .github/ file; CODEOWNERS still requests @welsbach.
• Docs shipped with the change: this PR is the docs.

---

_{This project follows ASDD: agents disclose,
humans approve merges, security and quality are gates.}

[github-actions]

ASDD review - advisory (recommendation: comment)

Produced by an automated agent under human direction. Advisory only: a human approves and merges.
Nothing here merges automatically.

This PR bumps the version to 0.2.0 across the CLI, MCP server, pyproject.toml, and install.sh examples, adds a CHANGELOG section, and updates the docs pages to reference the one-line installer instead of pip. The version strings are consistent across all touched files, the spec (docs/specs/one-line-install.md) is present and its scope was updated to name the covered pages, and the change is correctly declared non-normative. No correctness, security, or spec-conformance defects were found; the findings below are minor notes. | Adversarial pass: This PR is a documentation update plus a mechanical version bump from 0.1.0 to 0.2.0. It replaces stale pip install git+... instructions across five guide pages with the one-line installer, adds a focused install section to deploy.md, and bumps the version string in the four files that carry it. No new abstractions, wrappers, config, or defensive scaffolding are introduced; the change removes more confusion (broken/contradictory install instructions) than it adds in concept. The only substantive concern is that three pages link to a deploy.md anchor I cannot verify from the diff, and the README and deploy.md now carry partially overlapping installer descriptions that must be kept in sync. Security scan (deterministic + SAST): no new issues. Impact scan: 1 finding(s), 0 block.

CODE - ok

• note: The uninstall instruction in README.md and deploy.md now says 'run the same command with sh uninstall at the end', while install.sh's own header comment still shows 'sh install.sh uninstall'. Both are valid for different contexts (curl one-liner vs. local file), but a reader who downloads install.sh first and then reads its header may be confused by the different syntax. Consider aligning the comment or adding a one-line clarification.
• note: deploy.md uses '...' as a placeholder for the full curl URL in the --prefix example ('sh -c "$(curl -fsSL ...)" sh --prefix DIR'). Other pages always spell out the full URL. A reader copy-pasting this example will get a broken command. Consider using the full URL or an explicit <…> placeholder.

SECURITY - ok

• note: No security concerns. No new or bumped dependencies, no CI/workflow changes, no secrets, no dangerous sinks. The install.sh diff is limited to version-string updates in comments and error messages.

SPEC - ok

• note: The spec docs/specs/one-line-install.md is present and its scope section was updated to name the install guide and the pages that tell readers how to install the CLI. The diff touches exactly those pages (deploy.md, adopt-govern.md, slash-commands.md, operate-goose.md, cli/README.md, README.md) plus the version bump and changelog entry, matching the spec's scope with no scope creep.

IMPACT - concerns

• note: Non-normative change correctly declared. The diff is documentation updates and a version-string bump (0.1.0 → 0.2.0) in asdd_cli.py, pyproject.toml, cli/asdd-mcp.py, and install.sh comments/examples. None of these alter the standard's text, a gate's verdict, a lens's contract, an agent's fixed prompt, or the meaning of a MUST. No impact analysis or target version is required for a non-normative change.
• warn: This change touches a behavioural surface (a gate, lens, agent prompt, or the runtime seam: asdd_cli.py, cli/README.md, cli/asdd-mcp.py). If it changes behaviour adopters rely on for conformance, it is normative: declare it and add an impact analysis and target version. If it preserves behaviour, no action.

QUALITY - ok

• note: Three pages (cli/README.md, operate-goose.md, slash-commands.md) link to deploy.md#2-scaffold-asdd-into-your-repo. That anchor is not in the diff, so a human should confirm it exists in the full deploy.md before merge.
• note: The README and deploy.md now both describe what the installer checks (SHA-256, archive layout, no overwrite, no sudo). If the installer's behaviour changes, both passages need updating. Consider whether the README description can be shortened to a link to deploy.md to reduce the maintenance surface.
• note: The one-liner will 404 until v0.2.0 is tagged, as the PR body acknowledges. This does not make the codebase worse (the previous state also 404'd), but a human should ensure the tag is pushed promptly after merge.

---

_{Generated by the ASDD advisory review. Mode: live.}

[github-actions]

ASDD review - advisory (recommendation: comment)

Produced by an automated agent under human direction. Advisory only: a human approves and merges.
Nothing here merges automatically.

The review runtime returned invalid output; a human should review manually. Security scan (deterministic + SAST): no new issues. Impact scan: 1 finding(s), 0 block.

SECURITY - ok

No findings.

IMPACT - concerns

• warn: This change touches a behavioural surface (a gate, lens, agent prompt, or the runtime seam: asdd_cli.py, cli/README.md, cli/asdd-mcp.py). If it changes behaviour adopters rely on for conformance, it is normative: declare it and add an impact analysis and target version. If it preserves behaviour, no action.

---

_{Generated by the ASDD advisory review. Mode: live.}

[welsbach]

check