diff --git a/workplans/KONT-WP-0015-first-release-readiness.md b/workplans/KONT-WP-0015-first-release-readiness.md
new file mode 100644
index 0000000..e19d43e
--- /dev/null
+++ b/workplans/KONT-WP-0015-first-release-readiness.md
@@ -0,0 +1,128 @@
+---
+id: KONT-WP-0015
+type: workplan
+title: "First Release Readiness"
+domain: markitect
+repo: kontextual-engine
+status: active
+owner: codex
+topic_slug: markitect
+planning_priority: high
+planning_order: 15
+created: "2026-05-14"
+updated: "2026-05-14"
+state_hub_workstream_id: "cb525023-1139-4d6c-9226-d6fdd1f5fd8f"
+---
+
+# KONT-WP-0015: First Release Readiness
+
+## Purpose
+
+Prepare `kontextual-engine` for a controlled `0.1.0` preview release. The goal
+is not to add broad new scope; it is to make the current foundation
+reproducible, honest, operable, and easy to validate.
+
+## References
+
+- `docs/first-release-readiness.md`
+- `docs/cmis-1-1-capability-scorecard.md`
+- `docs/cmis-opencmis-tck-release-readiness-evidence-2026-05-13T223537Z.md`
+- `docs/blob-storage-content-streaming-workplan.md`
+- `pyproject.toml`
+- `tests/`
+- `/home/worsch/guide-board`
+- `/home/worsch/open-cmis-tck`
+
+## Architecture Boundary
+
+This workplan should harden the release envelope without changing the engine's
+scope. CMIS remains a profiled Browser Binding adapter above native services.
+Blob storage, policy, audit, and State Hub integration remain authoritative
+release concerns.
+
+## D15.1 - Final Verification Pass
+
+```task
+id: KONT-WP-0015-T001
+status: todo
+priority: high
+state_hub_task_id: "82ee46b4-d865-4741-b60c-083f06210c4d"
+```
+
+Acceptance:
+
+- Full venv test suite passes.
+- Focused CMIS tests pass without skipped service dependencies.
+- OpenCMIS selected baseline is rerun after final release edits.
+- Performance drift warnings are either absent under a quiet system or recorded
+  as advisory release notes.
+
+## D15.2 - Packaging And Install Smoke
+
+```task
+id: KONT-WP-0015-T002
+status: pending
+priority: high
+state_hub_task_id: "7e5398e0-0c54-44cc-b63c-04bc9f0edabb"
+```
+
+Acceptance:
+
+- `pyproject.toml` version and optional extras are release-appropriate.
+- Wheel and source distribution build successfully.
+- A clean install can import `kontextual_engine` and create the FastAPI app
+  with service extras installed.
+- Release artifacts do not depend on local sibling repos unless the optional
+  extras explicitly declare that boundary.
+
+## D15.3 - Security, Configuration, And Storage Review
+
+```task
+id: KONT-WP-0015-T003
+status: pending
+priority: high
+state_hub_task_id: "724b6882-f76e-4452-91d8-e56dda215cfe"
+```
+
+Acceptance:
+
+- CMIS access-point profiles and default exposure are reviewed.
+- Production-facing CMIS endpoints require HTTPS termination.
+- Actor headers, service-account expectations, and profile gates are documented.
+- Local blob and S3 backend configuration are documented with backup/restore
+  expectations.
+- Secrets and credentials are not embedded in examples or runtime defaults.
+
+## D15.4 - Operations And Runbook Readiness
+
+```task
+id: KONT-WP-0015-T004
+status: pending
+priority: medium
+state_hub_task_id: "298b2628-139e-4e74-8790-dd0e92d091f3"
+```
+
+Acceptance:
+
+- Health checks, logs, performance history, and accepted local warnings are
+  documented in a release runbook.
+- Known limitations are listed in release notes.
+- Rollback and data-safety expectations are documented for preview deployments.
+- State Hub consistency check passes and registers this workplan.
+
+## D15.5 - Release Notes And Tag Gate
+
+```task
+id: KONT-WP-0015-T005
+status: pending
+priority: medium
+state_hub_task_id: "bf42c477-2d21-48dc-9469-a6ce90982928"
+```
+
+Acceptance:
+
+- Release notes summarize implemented capabilities, CMIS evidence, storage
+  posture, and known limitations.
+- Any waived gate has an explicit rationale and follow-up workplan item.
+- The release tag is created only after the go/no-go gates are complete or
+  intentionally waived.