@multileaf/ai-workflow 0.1.0 → 0.1.2

package/docs/adapter-model.md

@@ -13,4 +13,6 @@ Each adapter must declare supported resource types and lifecycle events. Adapter
 
 ## Migration
 
-`aiw target <target>` performs a dry-run analysis, reports additions, removals, conflicts, fallbacks, and unsupported features, then renders the new target after confirmation. User-modified generated files require explicit conflict handling.
+`aiw target <target>` performs a dry-run analysis and reports additions, removals, conflicts, and malformed or unsupported neutral resources. Migration keeps the neutral source, renders the destination target, updates `.aiw/ownership.yml` and the active target in `.aiw/manifest.yml`, and removes obsolete target files only when the ownership inventory proves AIW created them and their bytes still match the recorded digest. Modified or unowned files are preserved and block migration when they occupy a required destination or obsolete owned path.
+
+Before applying changes, migration writes `.aiw/checkpoints/migration-backup.yml` with exact prior bytes and expected post-migration bytes for every changed path. A failed mutation restores those bytes and the previous ownership inventory and active target. `aiw rollback` restores only files that still match the recorded post-migration state, preserving and reporting user edits while safely rolling back untouched paths. The checkpoint remains for unresolved conflicts and is removed when rollback completes or AIW is uninstalled. Older installations without ownership records cannot safely clean up legacy target files; migrate only after reviewing the dry-run and resolving any reported conflicts.

package/docs/backlog.md

@@ -18,11 +18,11 @@ Priority levels: **P0** blocks the product or makes it unsafe; **P1** is require
 - [x] **INS-003** Install and register the base `ai-init` skill. _Acceptance:_ generated artifact is valid for every supported target.
 - [x] **INS-004** Implement `status`, `doctor`, and actionable diagnostics. _Acceptance:_ missing, stale, conflicting, and unsupported state is explained.
 - [x] **INS-005** Implement package resolution and lockfile generation. _Acceptance:_ same lockfile produces the same resources.
-- [x] **INS-006** Implement uninstall and repair safely. _Acceptance:_ only AIW-owned generated files are removed or restored.
+- [x] **INS-006** Implement uninstall and repair safely. _Acceptance:_ an install-time path/content-hash inventory proves ownership; uninstall removes unchanged resources, preserves and reports modified or unsafe paths, and its dry-run is read-only.
 
 ## Project intelligence — P1
 
-- [x] **SCAN-001** Build ignore-aware repository scanner. _Acceptance:_ respects `.gitignore`, excludes secrets, and has deterministic output.
+- [x] **SCAN-001** Build ignore-aware repository scanner. _Acceptance:_ matches Git ignore behavior for root and nested `.gitignore` rules, including anchoring, globstar, escaping, directory rules, and negation; mandatory sensitive-file exclusions cannot be negated; output is deterministic.
 - [x] **SCAN-002** Detect languages, frameworks, package managers, scripts, tests, linters, formatters, CI, and workspace structure. _Acceptance:_ fixtures cover common project types.
 - [x] **SCAN-003** Store confidence and evidence for detected facts. _Acceptance:_ each inferred fact points to a source and confidence score.
 - [x] **SCAN-005** Define the hybrid intelligence contract. _Acceptance:_ detected, inferred, and confirmed states are represented and AI inference cannot silently replace deterministic facts.

package/docs/package-model.md

@@ -26,13 +26,15 @@ package/
 
 Packages may come from local paths, Git repositories, npm-compatible providers, Vercel Skills, or a future Multileaf registry.
 
+The package distributed by AI Workflow is a catalog, not an automatic project install. `aiw install` writes only the target-specific `ai-init` bootstrap and neutral state. `/ai-init` scans the project, recommends matching capabilities, asks which to activate, and `aiw sync` renders only the selected resources. Supported rules and project-quality guidance are personalized from detected project tools; existing or user-edited files are preserved and reported as conflicts.
+
 Local directories and Git repositories are resolved with `aiw resolve --source=<source>`. A local source may be a package directory or its `package.yaml`; relative paths are resolved from the project. Git sources support `git+https`, HTTPS, SSH, and `file://` URLs. Git packages are cloned into an isolated temporary checkout, validated before the lockfile is changed, and removed after resolution. The lockfile records the selected provider and normalized source rather than trusting those fields from the fetched manifest. The legacy `--package=<path>` form remains available for direct manifest resolution.
 
 Vercel Skills is exposed through `aiw skills search`, `inspect`, `install`, `check`, and `update`. AIW delegates to the official `npx skills` CLI with argument arrays, requires explicit `network:external` permission for network-mutating/check operations, and records installed skills and upstream integrity in `.aiw/lock.yml`. Update output is inspected for upstream failure text because some CLI releases may report failures with a successful process exit code.
 
 Use `aiw audit-package --package=<path>` before resolution or installation to review requested permissions and their risk levels. Every permission must belong to AIW's known permission catalog, and every requested permission requires an exact `--allow=<permission>` approval. Unknown permissions are rejected even when passed through `--allow`; denied audits and approvals must not modify package state.
 
-Organizations can install a versioned policy with `aiw organization-policy --file=<path>`. The policy defines approved provider/source patterns and denied permissions. A trailing `*` performs an explicit prefix match; all other entries require an exact match. Once configured, AIW validates the provider and source before loading a package, so unapproved Git sources are rejected before a clone or temporary checkout is created. Permissions are validated after the package manifest is loaded and before project state or the lockfile changes; temporary checkouts created for approved Git sources are removed when permission validation fails. Replacing an existing policy requires the explicit `--replace` flag.
+Organizations can install a versioned policy with `aiw organization-policy --file=<path>`. The policy defines approved provider/source patterns and denied permissions. A trailing `*` performs an explicit prefix match; all other entries require an exact match. Once configured, AIW validates the provider and source before loading a package, so unapproved Git sources are rejected before a clone or temporary checkout is created. HTTP(S), SSH, and Git-protocol sources require both organization approval and explicit `--allow=network:external` before the loader is called; local paths and `file://` sources do not require network approval. After loading an approved remote manifest, AIW validates every declared package permission before changing project state or the lockfile. Temporary checkouts created for approved Git sources are removed when manifest validation or permission validation fails. Replacing an existing policy requires the explicit `--replace` flag.
 
 Repositories enforce the tracked policy in CI with `aiw policy-check --package=<path>`. The gate validates declared package permissions, every package source in the lockfile, and configured private registries. It fails when the organization policy is missing, malformed, or violated and is intended to run on pushes and pull requests after the normal quality pipeline.
 
@@ -40,9 +42,9 @@ Teams can commit a portable preset with package requirements and named registry
 
 Private registries are configured with `aiw registry configure --file=<path>`. Each HTTPS registry entry stores a name, URL, and environment-variable reference such as `AIW_ENGINEERING_TOKEN`; inline secrets, URL credentials, query strings, and fragments are rejected. The complete document is validated before an atomic replacement, so malformed entries cannot apply a valid subset or overwrite the previous configuration. `aiw registry --private=<name> --search=<query>` reads the credential only at execution time, applies organization source and `network:external` policy before the request, validates the response and known permissions, and never serializes the token. Registry configuration is stored in `.aiw/registries.yml` and requires `--replace` for updates.
 
-Every package must declare an identifier, package version, provider, source, engine compatibility, resources, dependencies, supported targets, permissions, and provenance. Each resource has its own stable identifier, version, and path.
+Every package must declare a non-empty identifier, package version, provider, source, resources, dependencies, permissions, and provenance source. All five resource sections must be present; unused sections use `[]`. Each resource has its own non-empty identifier, version, and normalized relative path. The YAML document is parsed with duplicate-key and unknown-field rejection, and malformed entries fail as a whole.
 
-The project manifest stores requested version ranges. The lockfile stores the exact resolved version, provider, source, integrity information, requested permissions, and resource versions used by the project. The CI policy gate parses every lock entry strictly and evaluates it independently from package manifests, including entries with matching identifiers. Updates compare the requested range with the resolved lockfile version and never rely on a filename or list position.
+The project manifest stores requested version ranges. The lockfile stores the exact resolved version, provider, source, integrity information, requested permissions, and resource versions used by the project. For local and Git packages, `integrity` is `sha256-` followed by 64 lowercase hexadecimal digits. AIW hashes the exact `package.yaml` bytes and every declared resource file, ordered by normalized relative path. The hash input starts with `aiw-package-snapshot-v1\0`; each entry is framed by a four-byte big-endian UTF-8 path length, the path bytes, an eight-byte big-endian content length, and the exact file bytes. This detects content changes even when package identifiers and versions stay the same. It is an integrity digest, not a signature and does not prove who authored a package. Other providers may record their upstream integrity format. Resolve merges one package by id and preserves other valid entries. The CI policy gate parses every lock entry strictly and evaluates it independently from package manifests, including entries with matching identifiers. Updates compare the requested range with the resolved lockfile version and never rely on a filename or list position.
 
 ```yaml
 packages:

package/docs/product-requirements.md

@@ -5,6 +5,7 @@
 ### Installation
 
 - The CLI must install with `npx @multileaf/ai-workflow install`.
+- Initial installation must add only the target-specific `ai-init` bootstrap and neutral state; optional skills, rules, agents, hooks, and templates must not be activated before project analysis and user selection.
 - Installation must support Codex, Claude Code, Cursor, Gemini CLI, GitHub Copilot, and a universal target over time.
 - Installation must be idempotent and preserve user overrides.
 - Installation must create a neutral `.aiw/` source of truth.
@@ -21,6 +22,7 @@
 - Recommendations must explain their evidence, capabilities, permissions, and conflicts.
 - The user must select which capabilities to install.
 - Selected resources must be customized using confirmed project facts.
+- `/ai-init` must orchestrate scan → recommendations → user selection → selected-resource sync and summarize what it added.
 
 ### Development workflow
 

package/docs/project-intelligence.md

@@ -10,7 +10,7 @@ Deterministic detectors → Detected project profile → Relevant context select
 
 ## Deterministic layer
 
-Detectors establish observable facts: files, dependencies, versions, package managers, scripts, frameworks, quality tools, tests, CI, workspaces, ignored paths, and configuration files. Each fact includes its source and detection method.
+Detectors establish observable facts: files, dependencies, versions, package managers, scripts, frameworks, quality tools, tests, CI, workspaces, ignored paths, and configuration files. The scanner applies root and nested `.gitignore` rules with Git-compatible anchoring, globstar, escaping, directory, and negation behavior. Mandatory exclusions for secrets and AIW/dependency/build state take precedence over project negations. Each fact includes its source and detection method.
 
 ```yaml
 fact: tool.eslint
@@ -26,6 +26,8 @@ The interpreter handles architecture conventions, naming patterns, testing style
 
 The runtime exposes a provider-neutral `AiProvider` interface. Provider adapters receive an English system instruction, a scoped prompt, a token ceiling, and a JSON response requirement. The interpreter validates and normalizes that response into evidence facts; provider output cannot choose evidence state or cite a file outside the supplied context.
 
+Before sending context, AIW redacts common credential assignments such as cloud access keys, API keys, tokens, passwords, and client secrets across shell, JSON, and YAML forms. It also masks bearer credentials, recognizable GitHub/Slack/Google/OpenAI tokens, and private-key blocks. Content that cannot be read as UTF-8 is omitted. Redaction is defense in depth; sensitive files are still excluded and unusual credential formats may require project-specific handling.
+
 ```yaml
 fact: architecture.style
 value: feature-based

package/docs/release-backlog.md

@@ -4,4 +4,4 @@
 
 - [x] **REL-001** Prepare a reproducible release candidate. _Acceptance:_ metadata, changelog, package allowlist, clean compilation, automated release checks, exact-tarball smoke tests, and provenance-ready CI are present and validated.
 - [x] **REL-002** Approve the public package license and configure secure npm publishing for `MultiLeaf/aiw`. _Acceptance:_ MIT is approved, the granular bootstrap token is stored only as an environment secret, and the protected GitHub `npm` environment requires review, rejects administrative bypass, and accepts only version tags.
-- [ ] **REL-003** Publish and verify version `0.1.0`. _Acceptance:_ the signed Git tag, GitHub release, npm package, provenance statement, clean `npx` installation, and post-publication smoke tests all agree on the immutable version.
+- [x] **REL-003** Publish and verify version `0.1.0`. _Acceptance:_ the signed Git tag, GitHub release, npm package, provenance statement, clean `npx` installation, and post-publication smoke tests all agree on the immutable version.

package/docs/security.md

@@ -8,11 +8,15 @@ AI Workflow can install instructions and execute hooks, so packages are supply-c
 - Pin resolved versions in `lock.yaml`.
 - Record source and checksums where available.
 - Declare filesystem, shell, network, and secret permissions.
+- Require organization source approval and explicit `network:external` consent before loading remote package sources.
 - Require confirmation for privileged hooks.
 - Exclude secret files and ignored paths from scans.
+- Redact credential assignments (including common cloud/provider key names, JSON/YAML and quoted forms), bearer credentials, recognizable provider tokens, and private-key blocks before project context reaches an AI provider. Files that fail reading or UTF-8 decoding are omitted from the request.
 - Provide `--dry-run`, audit output, and rollback.
 - Run dependency and code security scans in CI.
 - Enforce the tracked organization policy on every push and pull request with `npm run policy:check`.
 - Keep telemetry disabled by default and exclude arguments, paths, content, output, errors, credentials, and identifiers from its event contract.
 
 Packages with critical or high vulnerabilities, malicious provenance, archival status, or stale maintenance should be rejected or require an explicit documented override.
+
+Context redaction is defense in depth, not a complete secret detector. Sensitive file exclusions remain mandatory, and unusual encodings or unreadable files fail closed by omission.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multileaf/ai-workflow",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Portable spec-driven development workflow for AI coding agents",
   "license": "MIT",
   "repository": {
@@ -65,12 +65,16 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^22.0.0",
-    "eslint": "^10.9.1",
+    "@types/node": "^22.20.2",
+    "eslint": "^10.10.0",
     "eslint-config-prettier": "^10.1.8",
     "prettier": "^3.9.6",
     "typescript": "^5.0.0",
-    "typescript-eslint": "^8.68.0",
-    "vitest": "^3.0.0"
+    "typescript-eslint": "^8.70.0",
+    "vitest": "^4.1.11"
+  },
+  "dependencies": {
+    "ignore": "^7.0.9",
+    "yaml": "^2.9.1"
   }
 }

package/resources/package.yaml

@@ -19,15 +19,52 @@ resources:
     - { id: project-init, version: 0.1.0, path: skills/project-init.md }
     - { id: brainstorming, version: 0.1.0, path: skills/brainstorming.md }
     - { id: requirements-specification, version: 0.1.0, path: skills/requirements-specification.md }
+    - { id: technical-design, version: 0.1.0, path: skills/technical-design.md }
+    - { id: implementation-planning, version: 0.1.0, path: skills/implementation-planning.md }
+    - { id: tdd-development, version: 0.1.0, path: skills/tdd-development.md }
+    - { id: verification, version: 0.1.0, path: skills/verification.md }
+    - { id: code-review, version: 0.1.0, path: skills/code-review.md }
+    - { id: security-review, version: 0.1.0, path: skills/security-review.md }
+    - { id: documentation-maintenance, version: 0.1.0, path: skills/documentation-maintenance.md }
+    - { id: adapter-development, version: 0.1.0, path: skills/adapter-development.md }
+    - { id: skill-authoring, version: 0.1.0, path: skills/skill-authoring.md }
   rules:
     - { id: language-policy, version: 0.1.0, path: rules/language-policy.md }
     - { id: tdd-policy, version: 0.1.0, path: rules/tdd-policy.md }
+    - { id: architecture-policy, version: 0.1.0, path: rules/architecture-policy.md }
+    - { id: quality-gates, version: 0.1.0, path: rules/quality-gates.md }
+    - { id: security-policy, version: 0.1.0, path: rules/security-policy.md }
+    - { id: dependency-policy, version: 0.1.0, path: rules/dependency-policy.md }
+    - { id: generated-files, version: 0.1.0, path: rules/generated-files.md }
+    - { id: documentation-policy, version: 0.1.0, path: rules/documentation-policy.md }
+    - { id: self-validation, version: 0.1.0, path: rules/self-validation.md }
+    - { id: completion-validation, version: 0.1.0, path: rules/completion-validation.md }
   agents:
     - { id: requirements-analyst, version: 0.1.0, path: agents/requirements-analyst.md }
+    - { id: technical-architect, version: 0.1.0, path: agents/technical-architect.md }
+    - { id: typescript-engineer, version: 0.1.0, path: agents/typescript-engineer.md }
+    - { id: test-engineer, version: 0.1.0, path: agents/test-engineer.md }
+    - { id: quality-reviewer, version: 0.1.0, path: agents/quality-reviewer.md }
+    - { id: security-reviewer, version: 0.1.0, path: agents/security-reviewer.md }
+    - { id: adapter-engineer, version: 0.1.0, path: agents/adapter-engineer.md }
+    - { id: documentation-writer, version: 0.1.0, path: agents/documentation-writer.md }
   hooks:
     - { id: pre-implementation, version: 0.1.0, path: hooks/pre-implementation.md }
+    - { id: post-implementation, version: 0.1.0, path: hooks/post-implementation.md }
+    - { id: pre-commit, version: 0.1.0, path: hooks/pre-commit.md }
+    - { id: post-change, version: 0.1.0, path: hooks/post-change.md }
+    - { id: pre-release, version: 0.1.0, path: hooks/pre-release.md }
   templates:
     - { id: specification, version: 0.1.0, path: templates/specification.md }
+    - { id: brainstorm, version: 0.1.0, path: templates/brainstorm.md }
+    - { id: technical-design, version: 0.1.0, path: templates/technical-design.md }
+    - { id: decision-record, version: 0.1.0, path: templates/decision-record.md }
+    - { id: implementation-plan, version: 0.1.0, path: templates/implementation-plan.md }
+    - { id: task, version: 0.1.0, path: templates/task.md }
+    - { id: test-plan, version: 0.1.0, path: templates/test-plan.md }
+    - { id: verification-report, version: 0.1.0, path: templates/verification-report.md }
+    - { id: security-review, version: 0.1.0, path: templates/security-review.md }
+    - { id: migration-report, version: 0.1.0, path: templates/migration-report.md }
 provides:
   skills: [project-init, brainstorming, requirements-specification, technical-design, implementation-planning, tdd-development, verification, code-review, security-review, documentation-maintenance, adapter-development, skill-authoring]
   rules: [language-policy, tdd-policy, architecture-policy, quality-gates, security-policy, dependency-policy, generated-files, documentation-policy, self-validation, completion-validation]