@multileaf/ai-workflow 0.1.0

package/package.json

@@ -0,0 +1,76 @@
+{
+  "name": "@multileaf/ai-workflow",
+  "version": "0.1.0",
+  "description": "Portable spec-driven development workflow for AI coding agents",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MultiLeaf/aiw.git"
+  },
+  "homepage": "https://github.com/MultiLeaf/aiw#readme",
+  "bugs": "https://github.com/MultiLeaf/aiw/issues",
+  "keywords": [
+    "ai",
+    "sdd",
+    "codex",
+    "claude",
+    "cursor",
+    "developer-tools"
+  ],
+  "files": [
+    "dist",
+    "resources",
+    "docs",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "bin": {
+    "aiw": "dist/cli.js"
+  },
+  "exports": {
+    ".": "./dist/cli.js",
+    "./plugin-sdk": {
+      "types": "./dist/plugin-sdk.d.ts",
+      "default": "./dist/plugin-sdk.js"
+    },
+    "./orchestration": {
+      "types": "./dist/orchestration.d.ts",
+      "default": "./dist/orchestration.js"
+    }
+  },
+  "scripts": {
+    "build": "node scripts/clean-dist.mjs && tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint .",
+    "typecheck": "tsc --noEmit",
+    "security:check": "npm audit --audit-level=high",
+    "policy:check": "node dist/cli.js policy-check --package=resources/package.yaml",
+    "format": "prettier --write \"src/**/*.{ts,js}\" \"docs/**/*.md\" \"*.{json,js}\"",
+    "format:check": "prettier --check \"src/**/*.{ts,js}\" \"docs/**/*.md\" \"*.{json,js}\"",
+    "check": "npm run format:check && npm run lint && npm run typecheck && npm run build && npm test && npm run security:check",
+    "start": "node dist/cli.js",
+    "release:check": "npm run check && npm run policy:check && npm run release:gate-test && node scripts/release-check.mjs",
+    "release:gate-test": "node --test scripts/*.node-test.mjs",
+    "release:publish-check": "node scripts/release-publish-check.mjs"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.0.0",
+    "eslint": "^10.9.1",
+    "eslint-config-prettier": "^10.1.8",
+    "prettier": "^3.9.6",
+    "typescript": "^5.0.0",
+    "typescript-eslint": "^8.68.0",
+    "vitest": "^3.0.0"
+  }
+}

package/resources/README.md

@@ -0,0 +1,4 @@
+# AIW Self-Hosting Resources
+
+These resources configure AI Workflow to develop and validate itself. All resources are written in English.
+

package/resources/agents/adapter-engineer.md

@@ -0,0 +1,4 @@
+# Adapter Engineer
+
+Implement and test neutral-to-target rendering, capability degradation, conflicts, idempotency, and rollback.
+

package/resources/agents/documentation-writer.md

@@ -0,0 +1,4 @@
+# Documentation Writer
+
+Maintain concise English documentation, examples, requirements, decisions, and release notes based on tested behavior.
+

package/resources/agents/quality-reviewer.md

@@ -0,0 +1,4 @@
+# Quality Reviewer
+
+Review correctness, maintainability, SOLID principles, complexity, tests, formatting, and documentation. Report prioritized evidence-based findings.
+

package/resources/agents/requirements-analyst.md

@@ -0,0 +1,4 @@
+# Requirements Analyst
+
+Turn ideas into stable, testable requirements. Identify assumptions, questions, acceptance criteria, and traceability links. Do not invent decisions.
+

package/resources/agents/security-reviewer.md

@@ -0,0 +1,4 @@
+# Security Reviewer
+
+Review new code and dependencies for trust-boundary, filesystem, shell, network, secret, and supply-chain risks.
+

package/resources/agents/technical-architect.md

@@ -0,0 +1,4 @@
+# Technical Architect
+
+Design modular solutions, compare alternatives, record decisions, and identify risks and validation strategy.
+

package/resources/agents/test-engineer.md

@@ -0,0 +1,4 @@
+# Test Engineer
+
+Design behavioral unit, integration, contract, and end-to-end tests. Cover success, invalid input, conflicts, and safe failure.
+

package/resources/agents/typescript-engineer.md

@@ -0,0 +1,4 @@
+# TypeScript Engineer
+
+Implement approved tasks with strict types, small modules, explicit boundaries, and test-first development.
+

package/resources/hooks/post-change.md

@@ -0,0 +1,4 @@
+# Post-Change Hook
+
+Update traceability and evidence for changed requirements. Flag stale documentation and unresolved risks.
+

package/resources/hooks/post-implementation.md

@@ -0,0 +1,4 @@
+# Post-Implementation Hook
+
+Run the configured quality gate: format check, lint, strict type check, tests, and security checks. Record evidence.
+

package/resources/hooks/pre-commit.md

@@ -0,0 +1,4 @@
+# Pre-Commit Hook
+
+Check staged changes for secrets, generated-file drift, missing tests, and failed quality gates. Do not mutate unrelated files.
+

package/resources/hooks/pre-implementation.md

@@ -0,0 +1,4 @@
+# Pre-Implementation Hook
+
+Verify that the task has an approved specification, acceptance criteria, implementation plan, tests, and affected-file scope. Block when critical information is missing.
+

package/resources/hooks/pre-release.md

@@ -0,0 +1,4 @@
+# Pre-Release Hook
+
+Verify complete tests, build, dependency audit, changelog, version, package contents, and an `npx` smoke test.
+

package/resources/package.yaml

@@ -0,0 +1,36 @@
+schema: 1
+id: multileaf/aiw-self-hosting
+version: 0.1.0
+description: Resources for developing AI Workflow with AI Workflow.
+language: en
+provider: local
+source: ./resources
+engines:
+  ai_workflow: ">=0.1.0"
+dependencies: []
+permissions: []
+policies: []
+provenance:
+  source: ./resources
+  checksum: sha256:pending
+targets: [codex, claude, cursor, gemini, copilot, universal]
+resources:
+  skills:
+    - { id: project-init, version: 0.1.0, path: skills/project-init.md }
+    - { id: brainstorming, version: 0.1.0, path: skills/brainstorming.md }
+    - { id: requirements-specification, version: 0.1.0, path: skills/requirements-specification.md }
+  rules:
+    - { id: language-policy, version: 0.1.0, path: rules/language-policy.md }
+    - { id: tdd-policy, version: 0.1.0, path: rules/tdd-policy.md }
+  agents:
+    - { id: requirements-analyst, version: 0.1.0, path: agents/requirements-analyst.md }
+  hooks:
+    - { id: pre-implementation, version: 0.1.0, path: hooks/pre-implementation.md }
+  templates:
+    - { id: specification, version: 0.1.0, path: templates/specification.md }
+provides:
+  skills: [project-init, brainstorming, requirements-specification, technical-design, implementation-planning, tdd-development, verification, code-review, security-review, documentation-maintenance, adapter-development, skill-authoring]
+  rules: [language-policy, tdd-policy, architecture-policy, quality-gates, security-policy, dependency-policy, generated-files, documentation-policy, self-validation, completion-validation]
+  agents: [requirements-analyst, technical-architect, typescript-engineer, test-engineer, quality-reviewer, security-reviewer, adapter-engineer, documentation-writer]
+  hooks: [pre-implementation, post-implementation, pre-commit, post-change, pre-release]
+  templates: [brainstorm, specification, technical-design, decision-record, implementation-plan, task, test-plan, verification-report, security-review, migration-report]

package/resources/rules/architecture-policy.md

@@ -0,0 +1,4 @@
+# Architecture Policy
+
+Keep domain logic independent from CLI and infrastructure. Prefer cohesive modules, explicit interfaces, dependency inversion, and single responsibility.
+

package/resources/rules/completion-validation.md

@@ -0,0 +1,19 @@
+# Completion Validation Policy
+
+A task is complete only when every affected layer has been validated.
+
+Required validation levels, when applicable:
+
+1. Domain and unit tests.
+2. Module or service integration tests.
+3. CLI or adapter integration tests.
+4. Generated artifact inspection.
+5. End-to-end execution against this repository.
+6. Documentation and traceability updates.
+7. Formatting, linting, type checking, tests, and security checks.
+
+Passing domain tests alone is not sufficient for a feature that affects the CLI, filesystem, providers, adapters, generated artifacts, or project configuration.
+
+For every externally visible task, run an isolated integration validation with an AI subagent in a separate worktree. The subagent must exercise the packaged or executable workflow, report the commands and outcomes, and confirm that its worktree is clean. The main worktree must not be used as a substitute for this validation.
+
+When launching a subagent, explicitly instruct it to send a direct Orca orchestration message to the coordinator terminal when it finishes; a mailbox-only notification is insufficient. The direct notification must include the final status, validation summary, failures if any, and worktree cleanliness.

package/resources/rules/dependency-policy.md

@@ -0,0 +1,4 @@
+# Dependency Policy
+
+Evaluate dependency health before adding packages. Commit lockfiles and reject known critical or high vulnerabilities unless risk is explicitly documented.
+

package/resources/rules/documentation-policy.md

@@ -0,0 +1,4 @@
+# Documentation Policy
+
+Keep documentation and backlog aligned with behavior. Every completed feature must include relevant documentation and validation evidence.
+

package/resources/rules/generated-files.md

@@ -0,0 +1,4 @@
+# Generated Files
+
+Generated target files are derived artifacts. Preserve manual overrides, detect drift, and never overwrite user changes silently.
+

package/resources/rules/language-policy.md

@@ -0,0 +1,4 @@
+# Language Policy
+
+All skills, rules, agents, hooks, templates, specifications, decisions, generated context, and technical documentation must be written in English unless explicitly requested otherwise.
+

package/resources/rules/quality-gates.md

@@ -0,0 +1,4 @@
+# Quality Gates
+
+A change is complete only when formatting, linting, strict type checking, relevant tests, full tests, and security checks pass.
+

package/resources/rules/security-policy.md

@@ -0,0 +1,4 @@
+# Security Policy
+
+Use least privilege. Exclude secrets, validate inputs, avoid unsafe command execution, and require explicit approval for privileged hooks.
+

package/resources/rules/self-validation.md

@@ -0,0 +1,12 @@
+# Self-Validation Policy
+
+AI Workflow must validate every change against its own repository whenever the current capabilities support the task.
+
+For each change:
+
+1. Run the generated or affected CLI command against this repository.
+2. Inspect the generated files and configuration.
+3. Run the complete quality gate.
+4. Record validation evidence and any limitations.
+
+Unit tests alone are not sufficient when the change affects installation, scanning, generation, migration, adapters, or project configuration.

package/resources/rules/tdd-policy.md

@@ -0,0 +1,4 @@
+# TDD Policy
+
+Every behavior change starts with a failing test, followed by the smallest implementation, refactoring, and verification.
+

package/resources/skills/adapter-development.md

@@ -0,0 +1,9 @@
+---
+name: adapter-development
+description: Build and validate translations from neutral resources to an agent target.
+---
+
+# Adapter Development
+
+Implement adapters against the neutral contract. Declare supported resource types and lifecycle events. Preserve unsupported resources, emit warnings, and test rendering, conflicts, idempotency, and rollback.
+

package/resources/skills/brainstorming.md

@@ -0,0 +1,9 @@
+---
+name: brainstorming
+description: Turn an early product idea into structured goals, assumptions, constraints, and questions.
+---
+
+# Brainstorming
+
+Separate facts, hypotheses, decisions, and open questions. Identify users, desired outcomes, constraints, risks, and non-goals. Do not prematurely prescribe implementation. Produce a versioned brainstorm artifact in English.
+

package/resources/skills/code-review.md

@@ -0,0 +1,9 @@
+---
+name: code-review
+description: Review code for correctness, maintainability, design quality, and regression risk.
+---
+
+# Code Review
+
+Review behavior, boundaries, cohesion, naming, types, error handling, duplication, complexity, tests, and documentation. Prioritize actionable findings with severity and evidence.
+

package/resources/skills/documentation-maintenance.md

@@ -0,0 +1,9 @@
+---
+name: documentation-maintenance
+description: Keep product, architecture, and workflow documentation aligned with implementation.
+---
+
+# Documentation Maintenance
+
+Update affected documentation in English. Prefer concise documents and tested examples. Flag stale claims instead of inventing behavior.
+

package/resources/skills/implementation-planning.md

@@ -0,0 +1,9 @@
+---
+name: implementation-planning
+description: Break an approved design into independently verifiable implementation tasks.
+---
+
+# Implementation Planning
+
+Create small ordered tasks. Each task must reference requirements, affected modules, tests, commands, dependencies, and completion evidence.
+

package/resources/skills/project-init.md

@@ -0,0 +1,9 @@
+---
+name: project-init
+description: Inspect a repository, build a project profile, and prepare AI Workflow configuration.
+---
+
+# Project Initialization
+
+Inspect structure and configuration safely. Detect languages, frameworks, package managers, scripts, tests, quality tools, CI, and conventions. Record evidence and confidence in `.ai-workflow/profile.yaml`. Ask for confirmation before treating uncertain inferences as facts. Recommend capabilities with rationale, permissions, and conflicts.
+

package/resources/skills/requirements-specification.md

@@ -0,0 +1,9 @@
+---
+name: requirements-specification
+description: Convert a product idea into testable, traceable requirements.
+---
+
+# Requirements Specification
+
+Give each requirement a stable identifier. Define observable behavior, acceptance criteria, constraints, and unresolved questions. Link requirements to their source brainstorm and distinguish confirmed facts from assumptions. Do not approve ambiguous critical requirements.
+

package/resources/skills/security-review.md

@@ -0,0 +1,9 @@
+---
+name: security-review
+description: Review code, packages, hooks, and adapters for security and supply-chain risks.
+---
+
+# Security Review
+
+Inspect trust boundaries, filesystem access, command execution, network access, secrets, dependencies, and generated instructions. Apply least privilege and report exploitable findings with affected files and safe remediation.
+

package/resources/skills/skill-authoring.md

@@ -0,0 +1,9 @@
+---
+name: skill-authoring
+description: Create focused, portable AI Workflow skills and validate their contracts.
+---
+
+# Skill Authoring
+
+Write concise English instructions with clear scope, constraints, and progressive disclosure. Avoid generic advice and hidden side effects. Validate frontmatter, naming, references, and representative behavior.
+

package/resources/skills/tdd-development.md

@@ -0,0 +1,9 @@
+---
+name: tdd-development
+description: Implement repository changes through test-first development.
+---
+
+# TDD Development
+
+Follow Red, Green, Refactor, Verify. Write a failing behavioral test first, implement the smallest change, refactor for clarity and design quality, then run the relevant quality gate. Never weaken a test to make an implementation pass.
+

package/resources/skills/technical-design.md

@@ -0,0 +1,9 @@
+---
+name: technical-design
+description: Design modular technical solutions from approved requirements.
+---
+
+# Technical Design
+
+Map requirements to components, interfaces, data flows, and validation strategy. Compare meaningful alternatives and record decisions with rationale, risks, and consequences. Prefer small cohesive modules, explicit contracts, dependency inversion, and reversible changes.
+

package/resources/skills/verification.md

@@ -0,0 +1,9 @@
+---
+name: verification
+description: Verify implementation against requirements and produce traceable evidence.
+---
+
+# Verification
+
+Check every acceptance criterion, quality gate, security requirement, and affected adapter. Report passed checks, missing evidence, failures, and residual risks. A task is not complete when required evidence is missing.
+

package/resources/templates/brainstorm.md

@@ -0,0 +1,16 @@
+# Brainstorm
+
+## Goal
+
+## Users
+
+## Facts
+
+## Hypotheses
+
+## Constraints
+
+## Non-goals
+
+## Open Questions
+

package/resources/templates/decision-record.md

@@ -0,0 +1,12 @@
+# Architecture Decision Record
+
+## Decision
+
+## Context
+
+## Options Considered
+
+## Rationale
+
+## Consequences
+

package/resources/templates/implementation-plan.md

@@ -0,0 +1,12 @@
+# Implementation Plan
+
+## Requirements
+
+## Ordered Tasks
+
+## Dependencies
+
+## Validation Commands
+
+## Evidence
+

package/resources/templates/migration-report.md

@@ -0,0 +1,14 @@
+# Migration Report
+
+## Source Target
+
+## Destination Target
+
+## Resources Migrated
+
+## Warnings
+
+## Conflicts
+
+## Rollback Plan
+

package/resources/templates/security-review.md

@@ -0,0 +1,14 @@
+# Security Review
+
+## Scope
+
+## Findings
+
+## Dependency Status
+
+## Permissions
+
+## Remediation
+
+## Decision
+

package/resources/templates/specification.md

@@ -0,0 +1,23 @@
+# Specification
+
+## Requirement ID
+
+Use a stable identifier in the form `REQ-###`.
+
+## Context
+
+## Behavior
+
+## Acceptance Criteria
+
+- Given
+- When
+- Then
+
+## Constraints
+
+## Traceability
+
+Link each requirement to its source brainstorm and related evidence.
+
+## Open Questions

package/resources/templates/task.md

@@ -0,0 +1,14 @@
+# Task
+
+## ID
+
+## Objective
+
+## Requirements
+
+## Files
+
+## Tests First
+
+## Completion Criteria
+

package/resources/templates/technical-design.md

@@ -0,0 +1,14 @@
+# Technical Design
+
+## Context
+
+## Proposed Design
+
+## Alternatives
+
+## Interfaces
+
+## Risks
+
+## Validation
+

package/resources/templates/test-plan.md

@@ -0,0 +1,12 @@
+# Test Plan
+
+## Scope
+
+## Behavioral Cases
+
+## Integration Cases
+
+## Failure Cases
+
+## Evidence
+

package/resources/templates/verification-report.md

@@ -0,0 +1,12 @@
+# Verification Report
+
+## Requirements Checked
+
+## Checks Passed
+
+## Missing Evidence
+
+## Residual Risks
+
+## Decision
+