@manhd_d/ai-harness 0.10.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## Unreleased
+
+### Added
+- Continuous development workflow: fresh baselines, proportional cross-role impact, selective living documentation and source-policy proposals, feedback triage and session handoff.
+- Seven Core behavioral scenarios plus a cross-capability scenario, installation/update preservation coverage and package checks.
+
+### Changed
+- Existing Core/Product/Architecture/Delivery skills and OpenSpec templates retain stable IDs and distinguish implementation, merge and release evidence.
+- Product 1.5.0, Architecture/Delivery 1.1.0; no new runtime, CLI commands or config schemas. Distribution version and release automation remain unchanged.
+
+## Unreleased — Adaptive verification and TechSpec
+- Add read-only adaptive discovery and digest/pointer-based requirement evidence validation; preserve advisory verify behavior.
+- Add Core verification and Product 1.4.0 selective TechSpec maintenance using existing artifact routes/policies.
+- Add cross-project fixtures, actual isolated HTTP role/state workflow and package coverage. Live host/model evaluation remains unscored.
+
 ## Unreleased — Project artifact contracts
 - Add project-owned input/output/storage/canonical/source-write contracts and dynamic host connection declarations; seed/preserve and validate them before writes.
 - Add read-only artifacts reports/setup storage questions, local docs routing and explicit external template handoffs without network calls or fallback copies.
@@ -110,6 +125,20 @@
 - Check release metadata consistency and establish single-release-PR version discipline; retain v0.6.0 until a dedicated release PR.
 
 
+## [0.12.0](https://github.com/manh0303/ai-harness/compare/v0.11.0...v0.12.0) (2026-10-13)
+
+
+### Features
+
+* continuous development and living documentation ([e87f007](https://github.com/manh0303/ai-harness/commit/e87f007c31a4a0d99f98b47f75c00ff632d92023))
+
+## [0.11.0](https://github.com/manh0303/ai-harness/compare/v0.10.0...v0.11.0) (2026-10-13)
+
+
+### Features
+
+* add adaptive verification and selective TechSpec ([2049514](https://github.com/manh0303/ai-harness/commit/2049514a3f97aede8ed0d9cc1f2bb18da7f6dfe9))
+
 ## [0.10.0](https://github.com/manh0303/ai-harness/compare/v0.9.0...v0.10.0) (2026-10-13)
 
 

package/README.md

@@ -51,3 +51,5 @@ If `--detect` cannot identify the stack, [select modules explicitly](docs/gettin
 [Getting started](docs/getting-started.md) · [Docs & examples](docs/README.md) · [Input/output & integrations](docs/artifact-contract.md) · [Model/agent configuration](docs/agent-configuration.md)
 
 [Contributing](CONTRIBUTING.md) · [Harness maintenance](docs/harness-maintenance.md) · [MIT](LICENSE).
+
+[Continuous development](docs/continuous-development.md) · [Adaptive verification & TechSpec](docs/adaptive-verification.md): successive changes, current context and selective docs.

package/capabilities/architecture/capability.json

@@ -26,7 +26,7 @@
     "workflows/discovery-to-design.md",
     "workflows/change-review.md"
   ],
-  "module_version": "1.0.0",
+  "module_version": "1.1.0",
   "recommends": [
     "capability:product"
   ],

package/capabilities/architecture/checks/verification.json

@@ -24,6 +24,17 @@
         "Configured checks vs manual/unavailable verification"
       ],
       "execution": "manual"
+    },
+    {
+      "id": "continuous-maintenance",
+      "title": "Continuous change review",
+      "command": [],
+      "when_file": null,
+      "evidence": [
+        "Current code/map/ADR revisions and authority decision for drift",
+        "Affected data/API/event consumers, NFR and compatibility/regression impact"
+      ],
+      "execution": "manual"
     }
   ]
 }

package/capabilities/architecture/evals/cases.json

@@ -30,6 +30,16 @@
         "Updates affected context only on verified facts or reviewed decisions and preserves history"
       ],
       "critical": true
+    },
+    {
+      "id": "continuous-drift",
+      "prompt": "Approved BR-003 says retention 30 days; current code uses 60; a draft says 90. Fix the inconsistency; no accepted decision resolves the conflict.",
+      "criteria": [
+        "Cites conflicting source anchors/revisions and distinguishes approved/draft/superseded status",
+        "Identifies authority/owner and resolves disputed intent before editing that behavior rather than choosing code or docs silently",
+        "Continues independent authorized work and records conflict/blocker in existing decisions/impact"
+      ],
+      "critical": true
     }
   ]
 }

package/capabilities/architecture/skills/harness-architecture-change-impact/SKILL.md

@@ -41,3 +41,8 @@ Follow Core permissions, clarification and project-conventions. Ask only consequ
 2–3 distinct options, evidence-based recommendation and free text; reuse established answers.
 No invented source, measured result, target, estimate or approval. No external messaging/publishing,
 paid tool use or production changes beyond the user's explicit authorization.
+
+## Session continuity
+Use Core `continuous-development.md` to compare map, requirements/ADRs, code and evidence revisions
+with the prior handoff. Record drift with both source anchors and authority/owner; do not choose code
+or docs by recency alone. Refresh only touched map/contract/ADR sections after reconciliation.

package/capabilities/architecture/templates/project-map.md

@@ -24,3 +24,8 @@ Refresh the touched entries; do not regenerate the entire project for every task
 ## Review and handoff
 Record actual owner decisions, unresolved consequential questions, verification performed/skipped,
 next role, source/output paths and affected OpenSpec change. Draft text is not an accepted decision.
+
+## Resume reconciliation
+Compare previous verified revisions with current touched source/working-tree changes. Link the active
+OpenSpec baseline, stale assumptions/evidence, authority decision and pending refresh; do not copy
+change-level progress into a second log.

package/capabilities/architecture/workflows/change-review.md

@@ -10,3 +10,5 @@ updated affected context and explicit residual risk.
 5. Use harness-architecture-review on design/diff with actual lint/test/build/boundary evidence.
    State manual-only checks, skipped environments and author-vs-independent review explicitly.
 6. Handoff findings, source paths, decisions, IDs, pending work and next owner; release follows DevOps.
+
+Enter via Core `continuous-development.md` to reconcile the current baseline with the previous handoff. Record remaining work and separate implementation, merge and release evidence in the existing change; feedback stays proposed until an owner accepts scope.

package/capabilities/delivery/capability.json

@@ -19,7 +19,7 @@
     "workflows/planning.md",
     "workflows/execution-change.md"
   ],
-  "module_version": "1.0.0",
+  "module_version": "1.1.0",
   "recommends": [
     "capability:product",
     "capability:architecture"

package/capabilities/delivery/checks/verification.json

@@ -24,6 +24,17 @@
         "No invented schedule, progress or stakeholder messaging"
       ],
       "execution": "manual"
+    },
+    {
+      "id": "continuous-maintenance",
+      "title": "Continuous change review",
+      "command": [],
+      "when_file": null,
+      "evidence": [
+        "Actual progress/dependency/risk evidence and remaining work",
+        "Implementation complete, merged and released separate; no invented dates"
+      ],
+      "execution": "manual"
     }
   ]
 }

package/capabilities/delivery/evals/cases.json

@@ -20,6 +20,16 @@
         "Records actual owner answer before affected implementation and updates traceability/plan"
       ],
       "critical": true
+    },
+    {
+      "id": "continuous-resume",
+      "prompt": "Continue change X. Its handoff says code A and FR-002 rev 2 with PASS at A. Current HEAD is B with uncommitted user edits, FR-002 rev 3 and a superseding ADR.",
+      "criteria": [
+        "Re-reads current code/docs/ADR and working tree instead of trusting old summary",
+        "Reconciles changed assumptions and re-runs affected impact/checks; does not reuse old PASS as current proof",
+        "Preserves user edits and updates existing tasks/design/map with evidence and next step instead of a new context store"
+      ],
+      "critical": true
     }
   ]
 }

package/capabilities/delivery/skills/harness-delivery-scope-change/SKILL.md

@@ -41,3 +41,9 @@ Follow Core permissions, clarification and project-conventions. Ask only consequ
 2–3 distinct options, evidence-based recommendation and free text; reuse established answers.
 No invented source, measured result, target, estimate or approval. No external messaging/publishing,
 paid tool use or production changes beyond the user's explicit authorization.
+
+## Feedback and evidence
+Use Core `continuous-development.md` for proposed feedback vs accepted scope and session continuity.
+Update dependencies, risks and plan progress from actual evidence. Track implementation complete,
+merged and released separately with PR/release references; absent evidence stays unknown. Store
+remaining work and next action in existing change tasks, without another progress registry.

package/capabilities/delivery/workflows/execution-change.md

@@ -7,3 +7,5 @@
 4. Update affected plan, requirements, ADRs and OpenSpec only after the actual decision; keep history.
 5. Produce a status draft with completed/pending/blocked work and evidence. Release ownership/gates
    remain in DevOps; PM proposals do not approve delivery or production changes.
+
+Enter via Core `continuous-development.md` to reconcile the current baseline with the previous handoff. Record remaining work and separate implementation, merge and release evidence in the existing change; feedback stays proposed until an owner accepts scope.

package/capabilities/product/capability.json

@@ -17,7 +17,8 @@
     "harness-product-srs-generation",
     "harness-product-use-case-generation",
     "harness-product-mvp-definition",
-    "harness-product-product-outcomes"
+    "harness-product-product-outcomes",
+    "harness-product-techspec"
   ],
   "workflows": [
     "workflows/idea-to-prd.md",
@@ -25,7 +26,8 @@
     "workflows/change-impact-analysis.md",
     "workflows/idea-driven.md",
     "workflows/document-driven.md",
-    "workflows/product-to-solution.md"
+    "workflows/product-to-solution.md",
+    "workflows/techspec-maintenance.md"
   ],
   "agents": [
     "agents/business-analyst.md",
@@ -52,9 +54,10 @@
     "templates/srs.md",
     "templates/use-cases.md",
     "templates/mvp.md",
-    "templates/outcomes.md"
+    "templates/outcomes.md",
+    "templates/techspec.md"
   ],
-  "module_version": "1.3.0",
+  "module_version": "1.5.0",
   "verification": "checks/verification.json",
   "evaluation": "evals/cases.json"
 }

package/capabilities/product/checks/verification.json

@@ -48,6 +48,29 @@
         "Metrics/targets and scope approval source or unresolved owner"
       ],
       "execution": "manual"
+    },
+    {
+      "id": "adaptive-evidence-review",
+      "title": "Review proportional verification and selective docs",
+      "command": [],
+      "when_file": null,
+      "evidence": [
+        "Applicable project methods and actual host limitations",
+        "Requirement-linked raw evidence, business assertions and owned cleanup",
+        "Static UNVERIFIED claims and affected-section source policy"
+      ],
+      "execution": "manual"
+    },
+    {
+      "id": "continuous-maintenance",
+      "title": "Continuous change review",
+      "command": [],
+      "when_file": null,
+      "evidence": [
+        "Stable rule/AC IDs and source-linked section changes",
+        "Feedback deduplicated and proposed until accepted; no automatic scope expansion"
+      ],
+      "execution": "manual"
     }
   ]
 }

package/capabilities/product/evals/cases.json

@@ -40,6 +40,27 @@
         "Does not invent success metrics or approve the MVP on behalf of the owner"
       ],
       "critical": true
+    },
+    {
+      "id": "selective-techspec",
+      "prompt": "Maintain an existing read-only BA document and TechSpec after a state transition change. Only static source analysis is available.",
+      "criteria": [
+        "Preserve unaffected approved sections and observed revisions",
+        "Propose affected changes without unauthorized source write",
+        "Keep static claims UNVERIFIED and missing runtime evidence explicit",
+        "Reuse canonical artifact routing"
+      ],
+      "critical": true
+    },
+    {
+      "id": "continuous-feedback",
+      "prompt": "Triage UAT-12 duplicating an existing null-label defect, UAT-13 requesting bulk import outside accepted release scope, and a supplied operating error report. No new implementation or release is authorized.",
+      "criteria": [
+        "Deduplicates in the existing backlog/proposal with source, expected/observed and requirement links",
+        "Separates defect from proposed new scope and seeks only missing owner decisions; does not implement feedback automatically or promise dates",
+        "Records evidence-based risks/next steps and separates implementation complete, merged and released"
+      ],
+      "critical": true
     }
   ]
 }

package/capabilities/product/skills/harness-product-backlog-prioritization/SKILL.md

@@ -40,3 +40,10 @@ Synthetic illustration: Rank secure create/search before optional import using a
 Use `.harness/capabilities/product/workflows/product-to-solution.md`; supply reviewed source/requirement
 IDs, output paths and actual owner decisions to the next BA/PO/SA/PM role as applicable. Return gaps
 to their owner; a single host may perform roles sequentially without claiming independent approval.
+
+## Feedback intake
+Under Core `continuous-development.md`, triage supplied bug reports, UAT findings, user feedback and
+operational evidence into the existing backlog or a policy-compliant proposal. Deduplicate source and
+requirement IDs; distinguish defects against approved AC from new wishes. Record expected/observed,
+severity/value, decision owner and proposed action. Only an actual accepted scope decision enters the
+active change; no automatic scope expansion, fabricated priority or promised timeline.

package/capabilities/product/skills/harness-product-business-analysis/SKILL.md

@@ -41,3 +41,8 @@ Synthetic illustration: BR-001 requires organization-scoped search; AS-IS behavi
 Use `.harness/capabilities/product/workflows/product-to-solution.md`; supply reviewed source/requirement
 IDs, output paths and actual owner decisions to the next BA/PO/SA/PM role as applicable. Return gaps
 to their owner; a single host may perform roles sequentially without claiming independent approval.
+
+## Continuous changes
+Use Core `continuous-development.md`. Compare approved vs proposed rule/use-case/AC deltas at actual
+source revisions; retain IDs and withdrawn history. Trace changed rules into API/data/event contracts
+and regression expectations. Record docs–code disagreement and its decision owner before propagation.

package/capabilities/product/skills/harness-product-techspec/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: harness-product-techspec
+description: Maintain a selective technical specification from requirements, scoped code, contracts and honest verification evidence.
+---
+
+# TechSpec
+
+## Input
+Approved/provisional requirements, code revision, applicable contracts, existing canonical docs, artifact/source-write policy and runtime evidence.
+
+## Procedure
+1. Use existing artifacts.json/integrations.json. Reuse known storage answers; for idea-only input ask where canonical docs should live before writing. External tools need actual host capability, not just a configured alias.
+2. Inspect existing documentation and affected code/contracts. Identify facts, proposals and unknowns; do not derive runtime success from static inspection.
+3. Include only relevant overview, architecture, business rules, API/error contracts, data/auth, UI flows, dependencies, compatibility, security and operations sections. Do not force a CRM template, database or API onto every project.
+4. Link requirement IDs to scenario status and raw evidence. Use Core harness-verification; keep static statements UNVERIFIED until checked. Record BLOCKED/NOT_RUN and measured usage honestly.
+5. For existing documents, propose affected section changes and retain unaffected user edits. Compare observed source revision and before/after contracts; record artifact-impact. Source read-only means no write; propose means reviewable patch; write still requires actual host authorization and concurrency checks.
+6. Route a new draft with `aih new-doc techspec`, optionally `--report verification/report.json`. The CLI refuses overwrite and hands external destinations to the host; it does not publish or automatically update sources.
+
+## Output
+Selective draft TechSpec, traceability, evidence and affected-section maintenance proposal.
+
+## Constraints
+No invented requirements, universal test suite, credentials, blanket regeneration or automatic merge/deployment. Existing BA source is writable only under its declared policy plus actual host permission.
+
+## Template
+Use `.harness/capabilities/product/templates/techspec.md` and existing canonical documents.
+
+## Example
+Idea: a static calculator needs UX/formula/build/accessibility evidence, no API section. Existing document: an approval transition needs role/state assertions and a proposed affected-section patch.
+
+## Quality checklist
+Source revisions, requirement IDs, contracts, actual execution evidence and limits are distinguishable. Partial updates preserve approved text.
+
+## Handoff
+Use `.harness/capabilities/product/workflows/techspec-maintenance.md`; pass evidence and proposed changes to review. Documentation remains pending-review until accepted.

package/capabilities/product/skills/harness-product-traceability/SKILL.md

@@ -13,7 +13,7 @@ description: Maintain bidirectional links from document sources through BRD/PRD/
 2. Verify referential integrity: no duplicate IDs, orphan stories, orphan AC, or nonexistent source anchors.
 3. Mark not-yet-created artifacts as `pending`; never manufacture Figma node IDs or repository commits.
 4. Compute coverage (e.g. requirements with story, AC and review status) and explicitly state excluded or deferred items.
-5. On source change, compare source version/content, create an impact report for BRD/PRD/stories/UX/OpenSpec and require approval before propagation.
+5. On source change, compare source version/content, create an impact report for BRD/PRD/stories/UX/OpenSpec and resolve only missing consequential owner decisions before propagation; reuse existing scoped authorization.
 
 ## Output
 - `docs/product/traceability.md` and `change-impact.md` when requested.
@@ -39,3 +39,9 @@ Synthetic illustration: SRC-001 → FR-001 → US-001 → AC-US-001-01 → ADR-0
 Use `.harness/capabilities/product/workflows/product-to-solution.md`; supply reviewed source/requirement
 IDs, output paths and actual owner decisions to the next BA/PO/SA/PM role as applicable. Return gaps
 to their owner; a single host may perform roles sequentially without claiming independent approval.
+
+## Continuous changes
+Extend the same matrix through scoped code/contracts and tests/raw evidence with their revisions.
+On resume, revalidate touched links and invalidate stale coverage; missing artifacts remain pending.
+Preserve stable IDs and unrelated rows. Use Core `continuous-development.md` for source authority,
+section-level proposals and unchanged reasons rather than generating another trace registry.

package/capabilities/product/templates/backlog.md

@@ -21,3 +21,10 @@ Version: 0.1-draft | PO: <person> | Prioritization method: proposed / approved
 - [ ] Story acceptance criteria are testable
 - [ ] UX states and permissions are specified where relevant
 - [ ] PO has explicitly approved priority and readiness
+
+## Feedback triage
+| Feedback ID / source / revision | Expected vs observed | Existing requirement / AC | Defect or new request / duplicate of | Proposed priority / value | Decision owner / accepted evidence | Change / next step |
+| --- | --- | --- | --- | --- | --- | --- |
+
+Bug reports, UAT findings, user feedback and supplied operating results remain proposals until an
+owner accepts scope. Do not promise a date or add work to the active change just because feedback exists.

package/capabilities/product/templates/techspec.md

@@ -0,0 +1,17 @@
+# TechSpec
+
+Status: draft / pending-review
+Source revision: UNVERIFIED
+Canonical storage / source-write policy: pending
+
+## Feature overview and requirements
+Link approved or provisional requirement IDs and authoritative source revisions.
+
+## Applicable design and contracts
+UNVERIFIED: inspect scoped code. Include only relevant architecture, business rules, UI flows, API/error/data/auth/integration contracts, compatibility and operational concerns.
+
+## Verification
+Link requirement → scenario → actual evidence. Record PASSED/FAILED/BLOCKED/NOT_RUN and VERIFIED/UNVERIFIED coverage. Static inspection is not runtime proof.
+
+## Maintenance and limitations
+Propose affected sections only; preserve existing edits and apply artifact/source policies. Record unknowns, evidence gaps and review decisions.

package/capabilities/product/templates/traceability.md

@@ -21,3 +21,10 @@ Version: 0.1-draft | Status: pending-review | Sources reviewed at: <date>
 - Missing or pending mappings: <number>
 
 Do not fabricate Figma node IDs, code commits or approvals. Write `pending` until they exist.
+
+## Implementation and verification links
+| Stable requirement / AC | Spec section / revision | Code / contract path / revision | Test / raw evidence / tested revision | Result / gap |
+| --- | --- | --- | --- | --- |
+
+Only observed execution supports runtime PASS. Invalidate affected stale coverage after baseline
+changes; record BLOCKED/NOT_RUN and their reasons. Preserve unchanged rows and retired ID history.

package/capabilities/product/workflows/change-impact-analysis.md

@@ -9,11 +9,15 @@ A Confluence page, approved brief, BRD/PRD requirement or business rule changed.
 3. Identify downstream UI screen IDs and OpenSpec changes only when real mapping entries exist; `pending` is not evidence of a completed artifact.
 4. Analyze scope, security, privacy, business process, cost and schedule impacts. Ask accountable owners to decide whether to accept the change.
 5. Draft proposed changes with new source anchors and a rollback/review plan; never overwrite approved Figma, code or product docs automatically.
-6. Re-run document-review and request a new human approval before downstream handoff.
+6. Re-run document-review; resolve new consequential decisions before downstream handoff. Reuse existing scoped authorization and approval evidence instead of repeating approvals.
 
 ## Output
-A `docs/product/change-impact.md` mapping `old source version → new version → affected IDs → proposed change → owner/status` and explicit review checkpoints. No automatic external updates.
+Impact in the active OpenSpec design or existing canonical change-impact document (do not create a parallel log), mapping `old source version → new version → affected IDs → proposed change → owner/status` and explicit review checkpoints. No automatic external updates.
 
 Apply `.harness/core/workflows/artifact-contract.md` for canonical source revisions and storage/write
 policies. Record configured output impact in artifact-impact.json; complete docs/spec/UI updates or
 report blocking dependencies with evidence before review. Do not treat structural readiness as approval.
+
+For implementation documentation and affected-section evidence updates, follow `techspec-maintenance.md` with `harness-product-techspec`.
+
+Enter via Core `continuous-development.md` for each change/resume; reconcile baseline and carry stable IDs into code/tests/evidence. Treat supplied feedback as proposed backlog scope until accepted.

package/capabilities/product/workflows/document-driven.md

@@ -20,3 +20,5 @@ Canonical enterprise source stays in the enterprise system; consumer repo stores
 For new/material journeys, continue with `product-to-solution.md` after resolving the relevant scope.
 Use reviewed MVP/outcomes and optional Architecture/Delivery to assess solution/dependencies before
 OpenSpec implementation. Existing approved sources remain canonical; small clear changes stay compact.
+
+For implementation documentation and affected-section evidence updates, follow `techspec-maintenance.md` with `harness-product-techspec`.

package/capabilities/product/workflows/idea-driven.md

@@ -20,3 +20,5 @@ Deliverables are **consumer-owned** `docs/discovery/`, `docs/product/` and `open
 For new/material journeys, continue with `product-to-solution.md` after resolving the relevant scope.
 Use reviewed MVP/outcomes and optional Architecture/Delivery to assess solution/dependencies before
 OpenSpec implementation. Existing approved sources remain canonical; small clear changes stay compact.
+
+For implementation documentation and affected-section evidence updates, follow `techspec-maintenance.md` with `harness-product-techspec`.

package/capabilities/product/workflows/techspec-maintenance.md

@@ -0,0 +1,7 @@
+# TechSpec maintenance
+
+Use `harness-product-techspec` after idea/document intake or a code/contract change. Apply Core artifact-contract before selecting canonical storage and Core adaptive-verification before runtime claims. Requirements, scoped code/contracts and evidence jointly inform the draft; approved SRS intent must not be silently rewritten to match code. If sources conflict, record both revisions and establish the authoritative source/owner decision before changing disputed behavior.
+
+For new docs clarify unknown storage, then scaffold only missing documents. For existing docs inspect observed revision and propose affected sections with before/after contracts and artifact-impact. External Confluence/Jira/Figma/database connections remain host-dependent aliases under existing integrations.json, with no new configuration or provider runtime. Recheck actual permission and source-write policy before writes. Return a reviewed patch/publication receipt or a precise BLOCKED handoff; never overwrite or merge automatically.
+
+Use Core `continuous-development.md` for every resume: recheck revisions immediately before section writes, reconcile concurrent edits and invalidate affected stale evidence. Preserve stable IDs and unrelated sections; a proposed patch is not canonical publication.

package/cli/harness.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import { emptyEnvironment, environmentReport } from './environment.js';
 import { AGENT_CONFIG, agentDefaults, loadAgentConfig } from './agents.js';
+import { reviewVerification, techspecEvidence } from './verification-report.js';
 import { ARTIFACTS, INTEGRATIONS, emptyArtifacts, emptyIntegrations, loadArtifactContract, artifactReport, docRoute } from './artifacts.js';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
@@ -250,7 +251,7 @@ export function newChange(root, name) {
 }
 
 // Capability drafts are project-owned and never added to the managed bundle.
-export function newDoc(root, name, capability = 'product') {
+export function newDoc(root, name, capability = 'product', options = {}) {
   if (!SLUG.test(name)) throw new HarnessError('Document type must be a lowercase hyphenated slug');
   if (!SLUG.test(capability)) throw new HarnessError('Capability must be a lowercase hyphenated slug');
   return guard(root, () => {
@@ -266,15 +267,17 @@ export function newDoc(root, name, capability = 'product') {
     const declared = loadCapability(path.join(root, '.harness'), capability).templates;
     if (!declared.includes(`templates/${name}.md`)) throw new HarnessError(`Unknown document type for ${capability}: ${name}`);
     if (!Object.hasOwn(lock.files, sourceName)) throw new HarnessError(`Document template is not locked: ${capability}/${name}`);
+    if (options.report && (capability !== 'product' || name !== 'techspec')) throw new HarnessError('--report is supported only for product techspec');
+    const content = options.report ? techspecEvidence(reviewVerification(root, options.report)) : fs.readFileSync(safe(root, sourceName), 'utf8');
     const folder = capability === 'product' && ['idea', 'research'].includes(name) ? 'discovery' : capability;
     const route = docRoute(root, capability, name);
     if (route?.external) return { status: 'planned', type: name, capability, destination: route.destination,
       write_policy: route.write_policy, executed: false,
-      template: fs.readFileSync(safe(root, sourceName), 'utf8'),
+      template: content,
       note: 'External destination: host handoff only. No local fallback or remote write. Use the declared connection and existing authorization; preserve observed revision and return publication evidence.' };
     const outputName = route?.path ?? `docs/${folder}/${name}.md`;
     if (stat(safe(root, outputName))) throw new HarnessError(`Document already exists: ${outputName}`);
-    transaction(root, { [outputName]: fs.readFileSync(safe(root, sourceName)) });
+    transaction(root, { [outputName]: content });
     return { status: 'ok', type: name, capability, path: outputName,
       note: 'Template only; populate from authorized evidence and obtain human approval.' };
   });

package/cli/main.js

@@ -4,6 +4,8 @@ import { resolveModules } from './composition.js';
 import { parseArgs } from 'node:util';
 import { setupPlan } from './environment.js';
 import { ready } from './readiness.js';
+import { adaptiveVerification } from './verification.js';
+import { reviewVerification } from './verification-report.js';
 import { artifactReport } from './artifacts.js';
 import { SOURCE, readJson, targetRoot, install, check, doctor, newChange, newDoc, loadLock } from './harness.js';
 import path from 'node:path';
@@ -16,7 +18,7 @@ Usage: aih <command> [options]
   skill <name>         Load one installed skill on demand
   detect               Suggest adapters with evidence from target files
   resolve              Validate a module selection and show compatibility warnings
-  verify               Show installed advisory checks (does not execute)
+  verify               Plan checks or validate --report evidence (does not execute)
   eval                 Emit evaluation template, or score --report <file>
   init                 Install rules and selected adapters
   update               Apply the installed CLI bundle to the project (no download)
@@ -36,7 +38,8 @@ Options:
   --agent-preset <id> init only: recommended (default), economy, custom; no overwrite
   --host <id>         setup only: codex,claude-code,gemini-cli,cursor,copilot or custom host ID
   --scope <type>      verify/eval: adapters (default), capabilities, core, all
-  --report <file>     eval only: score a reviewer-completed JSON report
+  --adaptive          verify: discover a read-only project verification plan
+  --report <file>     eval: score; verify: validate evidence; new-doc techspec: link evidence
   --adapters <a,b>     init/resolve: java-spring,react-nextjs,react-native,ai-python,kubernetes,astro
   --capabilities <a,b> init/resolve: uiux,product,architecture,delivery,devops,monetization
   --source <directory> init/update/list/detect/resolve: trusted alternate bundle directory
@@ -46,7 +49,7 @@ Options:
   -v, --version       Show installed CLI version
 
 Start: init → fill .harness/local.md → ask your AI host to read AGENTS.md.
-The host runs application tests; verify only prints a checklist.
+The host runs application tests; verify prints plans or validates supplied evidence.
 Update a global CLI with npm install -g @manhd_d/ai-harness@latest,
 then run aih update --dry-run, aih update, and aih check in the project.
 
@@ -61,6 +64,9 @@ Examples:
   aih doctor
   aih ready add-order --stage implement
   aih skills
+  aih verify --adaptive
+  aih verify --report verification/report.json
+  aih new-doc techspec --report verification/report.json
   aih new-doc brd
   aih new-doc idea
   aih new-doc research
@@ -83,7 +89,7 @@ export function main(argv = process.argv.slice(2)) {
     args = parseArgs({ args: argv, allowPositionals: true, strict: true, tokens: true, options: {
       target: { type: 'string' }, adapters: { type: 'string' }, capabilities: { type: 'string' }, capability: { type: 'string' }, source: { type: 'string' },
       'agent-preset': { type: 'string' }, host: { type: 'string' },
-      detect: { type: 'boolean' }, report: { type: 'string' }, scope: { type: 'string' }, stage: { type: 'string' },
+      adaptive: { type: 'boolean' }, detect: { type: 'boolean' }, report: { type: 'string' }, scope: { type: 'string' }, stage: { type: 'string' },
       'dry-run': { type: 'boolean' }, 'allow-major': { type: 'boolean' },
       help: { type: 'boolean', short: 'h' }, version: { type: 'boolean', short: 'v' },
     } });
@@ -98,7 +104,10 @@ export function main(argv = process.argv.slice(2)) {
     if (!['init', 'update', 'check', 'doctor', 'new-change', 'new-doc', 'list', 'detect', 'resolve', 'verify', 'eval', 'skills', 'skill', 'setup', 'ready', 'artifacts'].includes(command)) throw new Error(`Unknown command: ${command}`);
     if (extra.length || (!['new-change', 'new-doc', 'skill', 'ready'].includes(command) && name !== undefined) || (['new-change', 'new-doc', 'skill', 'ready'].includes(command) && name === undefined)) throw new Error('Unexpected or missing positional argument; run aih --help');
     const allowed = new Set(['target', ...(['init', 'update'].includes(command) ? ['source', 'dry-run', 'allow-major'] : []), ...(['init', 'resolve'].includes(command) ? ['adapters', 'capabilities'] : []), ...(command === 'init' ? ['detect'] : []), ...(['list', 'detect', 'resolve'].includes(command) ? ['source'] : []), ...(command === 'eval' ? ['report'] : []), ...(command === 'ready' ? ['stage'] : []), ...(['verify', 'eval'].includes(command) ? ['scope'] : [])]);
-    if (command === 'new-doc') allowed.add('capability');
+    if (command === 'new-doc') { allowed.add('capability'); allowed.add('report'); }
+    if (command === 'verify') { allowed.add('adaptive'); allowed.add('report'); }
+    if (args.values.adaptive && args.values.report) throw new Error('Choose --adaptive or --report');
+    if (args.values.scope && (args.values.adaptive || (command === 'verify' && args.values.report))) throw new Error('--scope applies only to advisory checks');
     if (command === 'init') allowed.add('agent-preset');
     if (command === 'setup') allowed.add('host');
     for (const key of Object.keys(args.values)) if (!allowed.has(key)) throw new Error(`--${key} is not supported for ${command}`);
@@ -131,7 +140,10 @@ export function main(argv = process.argv.slice(2)) {
       capabilities: values.capabilities === undefined ? [] : values.capabilities.split(',').map(x => x.trim()),
     });
     else if (command === 'detect') result = detect(root, targetRoot(values.source ?? SOURCE));
-    else if (command === 'verify') result = verify(root, values.scope ?? 'adapters');
+    else if (command === 'verify') {
+      if (values.adaptive || values.report) { if (check(root).status !== 'ok') throw new Error('Fix installation drift before verification'); }
+      result = values.report ? reviewVerification(root, values.report) : values.adaptive ? adaptiveVerification(root, SOURCE) : verify(root, values.scope ?? 'adapters');
+    }
     else if (command === 'eval') result = evaluate(root, values.report, values.scope ?? 'adapters');
     else if (command === 'artifacts') {
       if (check(root).status !== 'ok') throw new Error('Fix installation drift before reading artifact declarations');
@@ -143,7 +155,7 @@ export function main(argv = process.argv.slice(2)) {
       result = command === 'setup' ? setupPlan(root, loadLock(root).adapters, process.env, values.host) : ready(root, name, values.stage ?? 'implement');
     }
     else if (command === 'new-change') result = newChange(root, name);
-    else if (command === 'new-doc') result = newDoc(root, name, values.capability ?? 'product');
+    else if (command === 'new-doc') result = newDoc(root, name, values.capability ?? 'product', { report: values.report });
     else result = command === 'doctor' ? doctor(root) : check(root);
     if (command === 'init' || command === 'update') result.next_steps = values['dry-run']
       ? ['Review the proposed changes, then repeat without --dry-run.']