# Engineering Workflow for Microsoft 365

[![Verify](https://github.com/prateekmulye/engineering-workflow-m365/actions/workflows/verify.yml/badge.svg)](https://github.com/prateekmulye/engineering-workflow-m365/actions/workflows/verify.yml)
[![Quality and security](https://github.com/prateekmulye/engineering-workflow-m365/actions/workflows/quality.yml/badge.svg)](https://github.com/prateekmulye/engineering-workflow-m365/actions/workflows/quality.yml)
[![CodeQL](https://github.com/prateekmulye/engineering-workflow-m365/actions/workflows/codeql.yml/badge.svg)](https://github.com/prateekmulye/engineering-workflow-m365/actions/workflows/codeql.yml)
[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)

An independent, MIT-licensed **release candidate** for a portable enterprise engineering/Gemba workflow, with Microsoft 365 as the first domain adapter. It supports service-specific MCP federation through separately approved connectors. No affiliation with Microsoft, OpenAI, Anthropic, Agilent, or other vendors.

The Python MCP server uses stdio and explicit Entra identities. It ships 18 curated read operations across Microsoft Graph, Power BI, and Dataverse, plus an optional create-only Gemba action tool. No permissions are granted by installation. Broad Microsoft product coverage is an adapter roadmap, not a claim that every product action works today.

## Local dashboard — no SaaS account

```sh
git clone https://github.com/prateekmulye/engineering-workflow-m365.git
cd engineering-workflow-m365
python3 scripts/install.py
.venv/bin/python -m engineering_workflow_m365.dashboard
```

On Windows use `py -3.12 scripts/install.py`, then `.venv\Scripts\python.exe -m engineering_workflow_m365.dashboard`. The browser opens automatically. Workflow runs, review evidence, and event history stay in a local SQLite database. See [dashboard controls and security boundaries](docs/DASHBOARD.md). This records reviewed progress; it does not execute agents or automatically connect a tenant.

## MCP quick start

Use Python 3.12 or 3.13. From the repository on macOS/Linux:

```sh
python3 -m venv .venv
.venv/bin/python -m pip install --require-hashes -r requirements.lock
.venv/bin/python -m pip install --no-deps --no-build-isolation .
export M365_WORKFLOW_CONFIG="$PWD/examples/config.demo.json"
.venv/bin/python -m unittest discover -s tests -v
```

On Windows PowerShell:

```powershell
py -3.12 -m venv .venv
.venv\Scripts\python.exe -m pip install --require-hashes -r requirements.lock
.venv\Scripts\python.exe -m pip install --no-deps --no-build-isolation .
$env:M365_WORKFLOW_CONFIG = "$PWD\examples\config.demo.json"
.venv\Scripts\python.exe -m unittest discover -s tests -v
```

The demo needs no Microsoft credentials: discovery and local draft preparation work offline. Network operations need a real IT-controlled configuration and approved identity. Install into a path writable only by your account/IT. Keep tenant configuration and certificates outside this public repository.

Register the absolute venv Python executable, `-m engineering_workflow_m365.server`, and an absolute `M365_WORKFLOW_CONFIG` path in your client. See [harness setup](docs/HARNESSES.md), [vendor-neutral federation](docs/FEDERATION.md), [reuse research](docs/REUSE_RESEARCH.md), [Microsoft coverage](docs/COVERAGE.md), [security and permissions](SECURITY.md), [architecture](docs/ARCHITECTURE.md), and [Gemba implementation](docs/GEMBA.md).

## What is included

- A portable MCP protocol server with fixed resource handles, separate audience tokens, bounded responses, no redirects, and read-only default configuration.
- An original engineering skill and dedicated role prompts for intake, architecture, test-first implementation, independent verification, Microsoft integration, manufacturing operations, and release.
- A Dataverse Gemba schema and Power Apps/Power Automate implementation recipes. These are source templates, not an exported or tenant-tested managed solution.
- A cross-client configuration generator, CI, hash-locked dependencies, license inventory, threat model, and release instructions.
- A JSON Schema work-packet contract and validator for required reuse decisions and explicit red/green/review evidence states: `python scripts/validate_packet.py examples/work-packet.json`.
- An optional visual automation profile for a separately reviewed browser/computer-use MCP. This release does not contain a browser driver or full desktop-control implementation.

## End-state design

See the editable [architecture SVG](design/architecture.svg), [proposed review console](design/review-console.svg), and [Figma import handoff](design/FIGMA_HANDOFF.md). The SVG console is the broader design concept; the installed dashboard now implements local workflow tracking and review gates. No live Figma file was created.

## Limits

API behavior, permissions, licensing, national clouds, DLP, and client approval settings differ. Windows/macOS configuration examples are provided; runtime tests here ran on Linux. No live tenant is connected or certified. Writes other than PendingReview action creation, native Office document editing, Power Platform administration, Azure administration, SAP/robot control, and unattended GUI actions are not implemented.

See [release verification](docs/VERIFICATION.md) for exact test evidence and publication status. Contributions should add a failing boundary test before extending an adapter. MIT applies to this project; dependency and Microsoft service licenses remain separate. See [third-party notices](THIRD_PARTY_NOTICES.md).