## What
- **One-liners per OS** that set up a KofTwentyTwo workstation:
- Windows: `& ([scriptblock]::Create((irm
https://raw.githubusercontent.com/KofTwentyTwo/standards/main/setup/bootstrap.ps1)))`
- macOS/Linux: `curl -fsSL
https://raw.githubusercontent.com/KofTwentyTwo/standards/main/setup/bootstrap.sh
| bash`
- `setup/Install-Workstation.ps1` (PowerShell 7, all three OSes)
installs the core tools plus optional language toolchains, configures
git to **sign with an SSH key held in 1Password** (`op-ssh-sign`),
points ssh at the 1Password agent, can register the signing key on
GitHub, and checks disk encryption, firewall, malware protection, and
private key files on disk. Idempotent; `-WhatIf` and `-CheckOnly`.
- New **workstation standard** (`K22-WS-*`); the security program now
names 1Password and forbids private key files (`K22-SEC-10`,
`K22-SEC-14`).
- README "Set up your machine" rewritten around the one-liners.
## Why
Setup instructions were a list of commands to type; keys were allowed as
files. A single script makes every machine identical and re-checkable,
and keys created in 1Password never touch disk.
## How tested
On Windows 11 (this machine):
- `-CheckOnly` and `-WhatIf`: correct detection (including the Microsoft
Store 1Password install), the right signing key chosen, no changes made.
- PSScriptAnalyzer with `configs/shell/PSScriptAnalyzerSettings.psd1`: 0
findings; `Invoke-Formatter`: no layout changes.
- `shellcheck --enable=all` and `shfmt --diff` on `bootstrap.sh`: clean.
Not yet run on macOS or Linux.
Depends on #1 for the markdownlint config (one code-fence finding in
`policies/README.md` is fixed there).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5
529d9637ef