Add collected project workflow runner

Author: RamazanKara

CHANGELOG.md

@@ -32,6 +32,7 @@
 - Added edge VCL, HAProxy, and Coraza candidate validation for the Cloudflare/Akamai assessment path.
 - Added LiteLLM/vLLM config candidate validation for the OpenAI/Anthropic assessment path.
 - Added project readiness status with pipeline summaries, export readiness, next actions, and `--json` output.
+- Added `openexit run` to execute assessment, mapping, full generation, validation, status reporting, and optional evidence bundle export for collected projects.
 - Updated CI and release workflows to Node.js 24-native GitHub Actions.
 
 ## 0.1.0 - 2026-05-24

README.md

@@ -22,11 +22,7 @@ The Datadog to Grafana LGTM path includes both fixture import and a read-only li
 make build
 ./bin/openexit init ./demo --source datadog --target grafana-lgtm
 ./bin/openexit collect fixture --project ./demo --input ./testdata/datadog/small.json
-./bin/openexit assess --project ./demo --target grafana-lgtm
-./bin/openexit map --project ./demo
-./bin/openexit generate --project ./demo --all
-./bin/openexit validate --project ./demo
-./bin/openexit export --project ./demo --format zip --out ./openexit-demo.zip
+./bin/openexit run --project ./demo --export --out ./openexit-demo.zip
 ```
 
 ## Install From Source
@@ -58,6 +54,7 @@ make example VERSION=0.1.0-dev
 - `openexit version`
 - `openexit init <project-dir> [--source <type> --target <type>]`
 - `openexit status --project <project-dir> [--json]`
+- `openexit run --project <project-dir> [--strict] [--export --out <file>]`
 - `openexit collect fixture --project <project-dir> --input <file>`
 - `openexit collect github --project <project-dir> --owner <org> [--base-url https://github.example.com/api/v3] [--token-env GITHUB_TOKEN] [--repo owner/name]`
 - `openexit collect github-fixture --project <project-dir> --input <file>`
@@ -99,6 +96,7 @@ Included in the current implementation:
 
 - CLI skeleton and project init/status.
 - Project readiness status with pipeline counts, validation state, export readiness, and JSON output for automation.
+- One-command deterministic workflow runner for collected projects, with optional evidence bundle export.
 - Typed project, inventory, assessment, mapping, and validation manifests.
 - Fixture-based Datadog inventory import.
 - Read-only Datadog collection for dashboards, monitors, SLOs, installed integration metadata, and referenced metric/tag metadata.

docs/cli.md

@@ -16,17 +16,15 @@ The minimum local demo is:
 ```bash
 openexit init ./demo --source datadog --target grafana-lgtm
 openexit collect fixture --project ./demo --input ./testdata/datadog/small.json
-openexit assess --project ./demo --target grafana-lgtm
-openexit map --project ./demo
-openexit generate --project ./demo --all
-openexit validate --project ./demo
-openexit export --project ./demo --format zip --out ./openexit-demo.zip
+openexit run --project ./demo --export --out ./openexit-demo.zip
 ```
 
 The CI test suite also runs this definition-of-done pipeline against the fixture inventory and checks that the generated project layout and export bundle contain the expected artifacts. Bundle checksums are verified against the archived file bytes.
 
 The checked-in Datadog example can be refreshed with `make example VERSION=0.1.0-dev`. CI also runs `make example-smoke` as part of `make verify` to ensure the example fixture still completes the full pipeline.
 
+`openexit run --project <project-dir>` is the ergonomic path after collection. It runs assessment, mapping, full artifact generation, validation, and final status reporting. Add `--export --out <file>` to write the evidence bundle after validation passes, or `--strict` to treat validation warnings as failures.
+
 `openexit status --project <project-dir>` summarizes the current pipeline state: project layout, source/target pair, inventory counts, assessment finding severity, mapping counts, generated candidate artifacts, validation check totals, export readiness, and the next recommended command. Use `--json` to feed the same readiness data into automation or release gates.
 
 `openexit validate` performs typed consistency checks, embedded JSON Schema validation, Grafana dashboard candidate validation, Prometheus alert-rule candidate validation, OpenTelemetry collector candidate validation, ArgoCD candidate validation, Forgejo migration candidate validation, identity realm/client candidate validation, edge VCL/HAProxy/Coraza candidate validation, LiteLLM/vLLM candidate validation, YAML/JSON parse checks, evidence reference checks, secret scanning, and optional external tool checks when `promtool` or `kubeconform` are installed.
@@ -40,10 +38,7 @@ The GitHub Enterprise to Forgejo fixture path uses local JSON metadata:
 ```bash
 openexit init ./ghe-demo --source github-enterprise --target forgejo
 openexit collect github-fixture --project ./ghe-demo --input ./testdata/github-enterprise/small.json
-openexit assess --project ./ghe-demo --target forgejo
-openexit map --project ./ghe-demo
-openexit generate --project ./ghe-demo --all
-openexit validate --project ./ghe-demo
+openexit run --project ./ghe-demo
 ```
 
 The same path can collect read-only live GitHub or GitHub Enterprise metadata. Set the token in an environment variable; OpenExit reads it at runtime and does not write it into project files. Organization GitHub App installation metadata is collected when the token can read organization administration metadata; otherwise OpenExit records a warning and continues collecting repository-scoped metadata.
@@ -52,10 +47,7 @@ The same path can collect read-only live GitHub or GitHub Enterprise metadata. S
 export GITHUB_TOKEN=<read-only-token>
 openexit init ./ghe-live --source github-enterprise --target forgejo
 openexit collect github --project ./ghe-live --owner acme --token-env GITHUB_TOKEN
-openexit assess --project ./ghe-live --target forgejo
-openexit map --project ./ghe-live
-openexit generate --project ./ghe-live --all
-openexit validate --project ./ghe-live
+openexit run --project ./ghe-live
 ```
 
 For GitHub Enterprise Server, pass the API root:
@@ -75,10 +67,7 @@ The Okta/Auth0 to Keycloak/Zitadel fixture path uses local JSON metadata:
 ```bash
 openexit init ./identity-demo --source identity --target keycloak-zitadel
 openexit collect identity-fixture --project ./identity-demo --input ./testdata/identity/small.json
-openexit assess --project ./identity-demo --target keycloak-zitadel
-openexit map --project ./identity-demo
-openexit generate --project ./identity-demo --all
-openexit validate --project ./identity-demo
+openexit run --project ./identity-demo
 ```
 
 The same path can collect read-only live Okta metadata. Set the token in an environment variable; OpenExit reads it at runtime and does not write it into project files.
@@ -87,10 +76,7 @@ The same path can collect read-only live Okta metadata. Set the token in an envi
 export OKTA_API_TOKEN=<read-only-token>
 openexit init ./okta-live --source identity --target keycloak-zitadel
 openexit collect okta --project ./okta-live --org-url https://dev-123456.okta.com --token-env OKTA_API_TOKEN
-openexit assess --project ./okta-live --target keycloak-zitadel
-openexit map --project ./okta-live
-openexit generate --project ./okta-live --all
-openexit validate --project ./okta-live
+openexit run --project ./okta-live
 ```
 
 Use repeatable `--break-glass-user` flags to verify named emergency accounts and capture whether they have active factors:
@@ -105,10 +91,7 @@ The same identity path can collect read-only live Auth0 metadata. Set an Auth0 M
 export AUTH0_MANAGEMENT_TOKEN=<read-only-management-token>
 openexit init ./auth0-live --source identity --target keycloak-zitadel
 openexit collect auth0 --project ./auth0-live --domain https://example.us.auth0.com --token-env AUTH0_MANAGEMENT_TOKEN
-openexit assess --project ./auth0-live --target keycloak-zitadel
-openexit map --project ./auth0-live
-openexit generate --project ./auth0-live --all
-openexit validate --project ./auth0-live
+openexit run --project ./auth0-live
 ```
 
 Use repeatable `--break-glass-user` flags with an email, username, or Auth0 user ID to verify emergency accounts:
@@ -122,10 +105,7 @@ The Cloudflare/Akamai to Varnish/HAProxy/Coraza fixture path uses local JSON met
 ```bash
 openexit init ./edge-demo --source edge --target varnish-haproxy-coraza
 openexit collect edge-fixture --project ./edge-demo --input ./testdata/edge/small.json
-openexit assess --project ./edge-demo --target varnish-haproxy-coraza
-openexit map --project ./edge-demo
-openexit generate --project ./edge-demo --all
-openexit validate --project ./edge-demo
+openexit run --project ./edge-demo
 ```
 
 The same path can collect read-only live Cloudflare metadata. Set the API token in an environment variable; OpenExit reads it at runtime and does not write it into project files.
@@ -134,10 +114,7 @@ The same path can collect read-only live Cloudflare metadata. Set the API token
 export CLOUDFLARE_API_TOKEN=<read-only-token>
 openexit init ./cloudflare-live --source edge --target varnish-haproxy-coraza
 openexit collect cloudflare --project ./cloudflare-live --zone-id <zone-id> --token-env CLOUDFLARE_API_TOKEN
-openexit assess --project ./cloudflare-live --target varnish-haproxy-coraza
-openexit map --project ./cloudflare-live
-openexit generate --project ./cloudflare-live --all
-openexit validate --project ./cloudflare-live
+openexit run --project ./cloudflare-live
 ```
 
 The same path can collect read-only live Akamai metadata. The collector reads EdgeGrid credentials from `~/.edgerc` or the `AKAMAI_HOST`, `AKAMAI_CLIENT_TOKEN`, `AKAMAI_ACCESS_TOKEN`, and `AKAMAI_CLIENT_SECRET` environment variables. It records Edge DNS recordsets, Property Manager hostnames and rules, and optional AppSec custom-rule metadata without storing credential values.
@@ -151,10 +128,7 @@ openexit collect akamai \
   --contract-id ctr_1-ABCDEF \
   --group-id grp_12345 \
   --security-config-id 12345:7
-openexit assess --project ./akamai-live --target varnish-haproxy-coraza
-openexit map --project ./akamai-live
-openexit generate --project ./akamai-live --all
-openexit validate --project ./akamai-live
+openexit run --project ./akamai-live
 ```
 
 Use repeatable `--zone`, `--property-id`, and `--security-config-id` flags to scope collection. Use `--discover-properties` with `--contract-id` and `--group-id` to list accessible Property Manager properties before collection, and `--account-switch-key` when the API client needs to act against another account.
@@ -164,10 +138,7 @@ The OpenAI/Anthropic to vLLM/LiteLLM fixture path uses local JSON metadata:
 ```bash
 openexit init ./ai-demo --source ai-provider --target vllm-litellm
 openexit collect ai-fixture --project ./ai-demo --input ./testdata/ai-provider/small.json
-openexit assess --project ./ai-demo --target vllm-litellm
-openexit map --project ./ai-demo
-openexit generate --project ./ai-demo --all
-openexit validate --project ./ai-demo
+openexit run --project ./ai-demo
 ```
 
 The same path can collect read-only aggregate OpenAI usage. Set an OpenAI admin key in an environment variable; OpenExit reads it at runtime and does not write it into project files or evidence. The live collector records model-grouped token usage and available model metadata, not raw prompts or responses.
@@ -182,10 +153,7 @@ openexit collect openai \
   --owner platform-ai \
   --fallback-strategy manual-queue \
   --fallback-manual-queue
-openexit assess --project ./openai-live --target vllm-litellm
-openexit map --project ./openai-live
-openexit generate --project ./openai-live --all
-openexit validate --project ./openai-live
+openexit run --project ./openai-live
 ```
 
 Use `--days` to change the aggregate usage window and `--peak-days` to change the hourly peak-estimate window. Use `--organization-id` or `--project-id` only when your OpenAI account requires those headers.
@@ -203,10 +171,7 @@ openexit collect anthropic \
   --owner platform-ai \
   --fallback-strategy manual-queue \
   --fallback-manual-queue
-openexit assess --project ./anthropic-live --target vllm-litellm
-openexit map --project ./anthropic-live
-openexit generate --project ./anthropic-live --all
-openexit validate --project ./anthropic-live
+openexit run --project ./anthropic-live
 ```
 
 Use `--api-key-id`, `--workspace-id`, or `--model` to restrict the Anthropic usage query. Use `--days` to change the daily aggregate usage window and `--peak-days` to change the hourly peak-estimate window.

docs/openai-anthropic-to-vllm-litellm.md

@@ -58,9 +58,7 @@ API surface used:
 ```bash
 openexit init ./ai-demo --source ai-provider --target vllm-litellm
 openexit collect ai-fixture --project ./ai-demo --input ./testdata/ai-provider/small.json
-openexit assess --project ./ai-demo --target vllm-litellm
-openexit generate --project ./ai-demo --all
-openexit validate --project ./ai-demo
+openexit run --project ./ai-demo
 ```
 
 ## Live OpenAI Demo
@@ -75,9 +73,7 @@ openexit collect openai \
   --owner platform-ai \
   --fallback-strategy manual-queue \
   --fallback-manual-queue
-openexit assess --project ./openai-live --target vllm-litellm
-openexit generate --project ./openai-live --all
-openexit validate --project ./openai-live
+openexit run --project ./openai-live
 ```
 
 ## Live Anthropic Demo
@@ -93,9 +89,7 @@ openexit collect anthropic \
   --owner platform-ai \
   --fallback-strategy manual-queue \
   --fallback-manual-queue
-openexit assess --project ./anthropic-live --target vllm-litellm
-openexit generate --project ./anthropic-live --all
-openexit validate --project ./anthropic-live
+openexit run --project ./anthropic-live
 ```
 
 ## Generated Artifacts

docs/release.md

@@ -8,7 +8,7 @@ The implementation plan names Datadog to Grafana LGTM, Prometheus-compatible ale
 
 Release-blocking v0.1 requirements:
 
-- CLI skeleton, project init, readiness status, version command.
+- CLI skeleton, project init, workflow runner, readiness status, version command.
 - Datadog fixture collector and read-only live Datadog collector.
 - Inventory and assessment manifests with typed validation.
 - Source-to-target mapping manifest with candidate paths and manual-review entries.
@@ -41,6 +41,7 @@ The AI provider path is complete for local fixture assessment workflows and incl
   `init`, `collect fixture`, `assess`, `map`, `generate --all`, `validate`, `export`.
 - [ ] GitHub, Okta, Auth0, Cloudflare, Akamai, OpenAI, and Anthropic fixture/live-collector test coverage pass, and supported fixture provider pipelines validate.
 - [ ] `openexit version` prints name, version, commit, and date from release build flags.
+- [ ] `openexit run --project <demo> --export --out <zip>` completes a collected project through assessment, mapping, generation, validation, status reporting, and bundle export.
 - [ ] `openexit status --project <demo>` reports inventory, assessment, mapping, generated artifacts, validation status, export readiness, and matching `--json` output.
 - [ ] `README.md`, `docs/cli.md`, `docs/security.md`, and this checklist reflect current behavior.
 - [ ] `examples/datadog-to-grafana/README.md` reproduces the primary local demo.