@multileaf/ai-workflow 0.1.3 → 0.1.5

package/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to this project are documented in this file. The format foll
 
 ## [Unreleased]
 
+## [0.1.5] - 2026-09-12
+
+### Fixed
+
+- Connect SDD capability recommendations through explicit prerequisites so custom selections include required earlier workflow stages.
+- Recommend verification for supported project profiles and test runners, including test commands discovered in monorepo workspaces.
+- Align brainstorming, specification, planning, and verification gates with their matching artifacts; remove references to a nonexistent review gate command.
+- Clarify skill handoffs across brainstorming, requirements, design, planning, implementation, verification, and code review.
+- Correct the project profile path referenced by the project initialization skill.
+
+## [0.1.4] - 2026-09-12
+
+### Added
+
+- Guided `/ai-init` onboarding with model-cost guidance, parallel project analysis, monorepo-aware profiles, selectable resource blocks, and project-specific resource personalization.
+- NestJS, Prisma, and Vite capability recommendations with matching skills, agents, and data-access guidance.
+
+### Changed
+
+- Allow recommendation selection by individual resource, including an explicit select-all option.
+- Expand project profiles with workspace-level technologies, quality tools, test runners, architecture, patterns, and evidence.
+
+### Documentation
+
+- Specify onboarding flow, host capabilities, MCP recommendations, safety expectations, and acceptance criteria.
+
 ## [0.1.3] - 2026-09-12
 
 ### Fixed
@@ -50,7 +76,9 @@ All notable changes to this project are documented in this file. The format foll
 
 - Path confinement, symlink protection, explicit permission gates, secret redaction, strict parsers, atomic migrations, and immutable execution checkpoints.
 
-[Unreleased]: https://github.com/MultiLeaf/aiw/compare/v0.1.3...HEAD
+[Unreleased]: https://github.com/MultiLeaf/aiw/compare/v0.1.5...HEAD
+[0.1.5]: https://github.com/MultiLeaf/aiw/compare/v0.1.4...v0.1.5
+[0.1.4]: https://github.com/MultiLeaf/aiw/compare/v0.1.3...v0.1.4
 [0.1.3]: https://github.com/MultiLeaf/aiw/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/MultiLeaf/aiw/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/MultiLeaf/aiw/releases/tag/v0.1.1

package/README.md

@@ -122,49 +122,52 @@ flowchart TD
     D --> E[(.aiw/recommendations.yml)]
     E --> F{User confirms scope}
     F -->|Revise| B
-    F -->|Proceed| G[Brainstorm]
-
-    G --> H[(generated/specs/brainstorm.md)]
-    H --> I{Brainstorm gate}
-    I -->|Incomplete| G
-    I -->|Complete| J[Write specification]
-
-    J --> K[(generated/specs/specification.md)]
-    K --> L{Specification gate}
-    L -->|Incomplete| J
-    L -->|Complete| M{Architecture decision needed?}
-
-    M -->|Yes| N[Create ADR]
-    N --> O[(.context/adrs/ADR-NNN-title.md)]
-    O --> P[Update ADR index]
-    P --> Q[(.context/adrs/INDEX.md)]
-    M -->|No| R[Create implementation plan]
-    Q --> R
-
-    R --> S[(generated/plans/implementation-plan.md)]
-    S --> T{Plan gate}
-    T -->|Incomplete| R
-    T -->|Ready| U[Implement tasks with TDD]
-
-    U --> V[Write code and tests]
-    V --> W[Run task validation commands]
-    W --> X{Validation passes?}
-    X -->|No| U
-    X -->|Yes| Y[Record completion evidence]
-
-    Y --> Z[(generated/artifacts and checkpoint evidence)]
-    Z --> AA[Verify declared evidence]
-    AA --> AB{Verification gate}
-    AB -->|Missing evidence| U
-    AB -->|Complete| AC[Build traceability graph]
-
-    AC --> AD[Requirement → ADR → Task → Code → Test → Evidence]
-    AD --> AE[(generated artifacts and trace output)]
-    AE --> AF[Run repository self-validation]
-    AF --> AG[(.aiw/checkpoints/self-validation-TICKET.yml)]
-    AG --> AH{Review outcome}
-    AH -->|Changes required| U
-    AH -->|Accepted| AI[Commit and independent integration validation]
+    F -->|Proceed| G{Clarification needed?}
+
+    G -->|Yes| H[Brainstorm]
+    H --> I[(generated/specs/brainstorm.md)]
+    I --> J{Brainstorm gate}
+    J -->|Incomplete| H
+    J -->|Complete| K[Write specification]
+    G -->|No| K
+
+    K --> L[(generated/specs/specification.md)]
+    L --> M{Specification gate}
+    M -->|Incomplete| K
+    M -->|Complete| N{Architecture decision needed?}
+
+    N -->|Yes| O[Create ADR]
+    O --> P[(.context/adrs/ADR-NNN-title.md)]
+    P --> Q[Update ADR index]
+    Q --> R[(.context/adrs/INDEX.md)]
+    N -->|No| S[Create implementation plan]
+    R --> S
+
+    S --> T[(generated/plans/implementation-plan.md)]
+    T --> U{Plan gate}
+    U -->|Incomplete| S
+    U -->|Ready| V[Implement tasks with TDD]
+
+    V --> W[Write code and tests]
+    W --> X[Run task validation commands]
+    X --> Y{Validation passes?}
+    Y -->|No| V
+    Y -->|Yes| Z[Record completion evidence]
+
+    Z --> AA[(generated/artifacts and checkpoint evidence)]
+    AA --> AB[Write verification report]
+    AB --> AC{Verification gate}
+    AC -->|Missing evidence| V
+    AC -->|Complete| AD[Build traceability graph]
+
+    AD --> AE[Requirement → ADR → Task → Code → Test → Evidence]
+    AE --> AF[(generated artifacts and trace output)]
+    AF --> AG[Run code-review skill when installed]
+    AG --> AH{Review findings?}
+    AH -->|Changes required| V
+    AH -->|Clear| AI[Run repository self-validation]
+    AI --> AJ[(.aiw/checkpoints/self-validation-TICKET.yml)]
+    AJ --> AK[Commit and independent integration validation]
 
     B -. command history and evidence .-> LOGS[(.aiw/checkpoints/)]
     D -. command history and evidence .-> LOGS
@@ -180,7 +183,7 @@ npx @multileaf/ai-workflow scan
 npx @multileaf/ai-workflow recommend
 
 # In CI, provide comma-separated recommendation IDs detected for that project.
-npx @multileaf/ai-workflow recommend --select=typescript-quality,vitest-testing
+npx @multileaf/ai-workflow recommend --select=typescript-quality,verification
 
 # Create structured product artifacts.
 npx @multileaf/ai-workflow brainstorm --title="Feature name"
@@ -188,13 +191,18 @@ npx @multileaf/ai-workflow spec --title="Feature requirements"
 npx @multileaf/ai-workflow adr --id=001 --title="Technical decision"
 npx @multileaf/ai-workflow plan --title="Implementation plan"
 
-# Fill the generated scaffold sections before running their quality gates.
+# Optional, after creating a brainstorm artifact for an unclear request:
+npx @multileaf/ai-workflow gate brainstorming
+# After filling the specification and plan scaffolds shown above:
 npx @multileaf/ai-workflow gate specification
+npx @multileaf/ai-workflow gate plan
+# After writing .aiw/generated/reports/verification-report.md from the verification report template:
+npx @multileaf/ai-workflow gate verification
 npx @multileaf/ai-workflow verify
 npx @multileaf/ai-workflow trace
 ```
 
-Scaffold commands write deterministic files at fixed paths and a repeated invocation replaces that scaffold. Complete and review each artifact before advancing. Requirements use stable identifiers and Given/When/Then acceptance criteria. Plans link tasks to requirements, tests, risks, dependencies, and expected evidence. `gate` performs textual completeness checks, `verify` validates the expected verification fields rather than running a test command, and `trace` records declared links between requirements, decisions, tasks, code, tests, and evidence.
+Scaffold commands write deterministic files at fixed paths and a repeated invocation replaces that scaffold. Complete and review each artifact before advancing. Requirements use stable identifiers and Given/When/Then acceptance criteria. Plans link tasks to requirements, tests, risks, dependencies, and expected evidence. Each `gate` validates the artifact named by its stage. `verify` checks that the specification has acceptance criteria and the plan links requirements to validation; it does not execute project test commands. `trace` records declared links between requirements, decisions, tasks, code, tests, and evidence. Code review is performed with the `code-review` skill when installed; there is no separate review gate command.
 
 ## Project intelligence
 

package/dist/adapter.js

@@ -40,22 +40,24 @@ This skill is the bootstrap for AI Workflow. The installer intentionally install
 
 ## First-run setup
 
-1. Inspect the repository's existing AI instructions and project structure. Preserve user-authored files and do not expose secrets.
-2. Run \`npx --yes --package=@multileaf/ai-workflow -- aiw scan\`. Explain the detected facts and their evidence; ask the user to confirm uncertain inferences before they influence generated content.
-3. Run \`npx --yes --package=@multileaf/ai-workflow -- aiw recommend\`, then read \`.aiw/recommendations.yml\` and \`.aiw/profile.yml\`. Explain why each suggested skill, rule, agent, hook, or template fits and identify external permissions. Ask which capabilities to install, and ask separately before granting an external permission such as \`network:external\`.
-4. Record the user's choices with \`npx --yes --package=@multileaf/ai-workflow -- aiw recommend --select=id,id\`; use \`npx --yes --package=@multileaf/ai-workflow -- aiw recommend --select=\` when all recommendations are declined. If at least one capability is selected, run \`npx --yes --package=@multileaf/ai-workflow -- aiw sync\`; when the user separately approved external network access, add \`--allow=network:external\`. Sync installs only selected resources and fills supported project rules with detected stack and quality-tool details. Do not add unselected resources or overwrite existing files.
-5. Review the installed resource list and the generated project-specific files with the user. Ask before changing project policy or tailoring any other skill/rule.
-6. Introduce the selected workflow gates: brainstorming → specification → architecture decision when needed → implementation plan → implementation with tests → verification → traceability → review. Use only gates supported by the resources the user chose.
+1. Before scanning, recommend that the user switch to a cheaper model for this onboarding. Ask whether they switched or prefer to continue with the current model; never change model settings yourself. Explain that analysis is read-only and optional resources will not be installed without their selection.
+2. Use the host's native subagent mechanism to launch these read-only analyses in parallel: (a) technologies, root and nested manifests, workspaces, and monorepo boundaries; (b) architecture, modules, entry points, and recurring code patterns; (c) tests, quality commands, CI, and developer tools. Keep the main agent as orchestrator. Wait for all results, verify important claims against cited project files, reconcile disagreements, and consolidate one evidence-backed project profile. Do not inspect secrets, ignored files, dependency directories such as \`node_modules\`, or generated output; inspect declared dependencies in project manifests. If subagents are unavailable, perform the same analyses directly and disclose the fallback.
+3. Run \`npx --yes --package=@multileaf/ai-workflow -- aiw scan\` and read \`.aiw/profile.yml\`. Treat this deterministic scan as another evidence source, not as a replacement for workspace-level analysis. Summarize each workspace separately; do not assume root dependencies or commands apply to every module. Ask the user to confirm uncertain or conflicting facts before using them as project policy. Add confirmed architecture and recurring patterns to the matching entries in the \`project_modules\` JSON array in \`.aiw/profile.yml\`, including file-path evidence; create a root-level entry when only the root project exists. Preserve existing detected fields and never store secrets or source-code excerpts there.
+4. Run \`npx --yes --package=@multileaf/ai-workflow -- aiw recommend\` and read \`.aiw/recommendations.yml\`. Combine catalog results with the consolidated project profile. Recommend matching skills, rules, agents, hooks, templates, and MCP servers. For every MCP, disclose its publisher/source, purpose, capabilities, permissions, transport, and credential needs; verify them against current official host and server documentation. Recommend only integrations supported by project evidence and never invent credentials.
+5. Present recommendations as concise tables grouped by category: skills, rules, agents, hooks, templates, and MCPs. Include one row per recommended item and columns for the item, a short project-specific reason for the recommendation, and relevant evidence. For MCP rows, also summarize purpose, source, permissions, transport, and credential needs (use a separate table if needed). Do not show a flat list without category headings or generic reasons such as “useful for this project.” After the tables, use the host's native selection widget to offer three choices: install all recommendations, customize, or install none. If the user customizes, show selectable category blocks and individual items, keeping each item's short reason and declared prerequisites visible. Read \`requires\` from \`.aiw/recommendations.yml\`; explain that choosing a stage auto-selects its prerequisite capabilities and their resources. If the host lacks a multi-select widget, use a numbered all/custom/none prompt and grouped checklists. MCP selection does not grant permission to execute the server or use external access; ask separately for those permissions.
+6. Record all recommendations with \`npx --yes --package=@multileaf/ai-workflow -- aiw recommend --select=all\`; for customized item-level choices, pass the selected resource references such as \`skills/verification,rules/tdd-policy,agents/test-engineer\`. Use \`npx --yes --package=@multileaf/ai-workflow -- aiw recommend --select=\` when none are chosen. If any AI Workflow resources are selected, run \`npx --yes --package=@multileaf/ai-workflow -- aiw sync\` without extra permissions first. It installs selected bundled resources and reports any external resource that is still pending approval. Only if the user separately approves external access, rerun with \`--allow=network:external\` to install that pending external resource. Install only selected resources and declared dependencies. Tailor instructions only where project evidence changes their usefulness (such as test commands, workspace boundaries, framework patterns, or module architecture). Preserve existing files, configuration, and secrets; report conflicts rather than overwriting them.
+7. For selected MCPs, add only the selected servers to the host's supported project configuration. Check current official host and server documentation for the configuration format, merge existing settings without replacing unrelated entries, and use environment-variable references instead of literal credentials. Do not run server install/start/authentication commands without separate approval. If the target requires user-level changes or safe configuration cannot be validated, give the user exact manual steps and report the MCP as pending rather than installed.
+8. Report installed resources by block, project-specific changes, skipped recommendations, MCP trust/authentication steps, and conflicts. Recommend restarting or reloading the coding-agent session so it discovers newly installed resources; follow known host behavior if it reloads changes automatically. Introduce only the gates supported by installed resources: brainstorming → specification → architecture decision when needed → implementation plan → implementation with tests → verification → traceability → review.
 
 If the user declines all recommendations, leave the project with only the bootstrap skill and scan state. Do not treat scanning or recommendation as consent to install.
 
 ## For each feature request after setup
 
-- Start with the brainstorming skill when scope, users, constraints, or assumptions are unclear.
-- Create and complete a specification with stable requirement IDs and Given/When/Then acceptance criteria; pass \`npx --yes --package=@multileaf/ai-workflow -- aiw gate specification\` before planning.
-- Record consequential architecture choices as ADRs. Create an implementation plan that links tasks to requirements, tests, risks, and validation commands; pass \`npx --yes --package=@multileaf/ai-workflow -- aiw gate plan\` before coding.
-- Follow the TDD policy and project quality rules. Use specialist agents for requirements, architecture, implementation, tests, security, documentation, and review when useful.
-- Run the declared checks, then \`npx --yes --package=@multileaf/ai-workflow -- aiw verify\`, \`npx --yes --package=@multileaf/ai-workflow -- aiw trace\`, and the review gate. Do not claim completion without evidence.
+- Use the brainstorming skill when scope, users, constraints, or assumptions are unclear; create its artifact with \`npx --yes --package=@multileaf/ai-workflow -- aiw brainstorm\`, then validate it with \`npx --yes --package=@multileaf/ai-workflow -- aiw gate brainstorming\`.
+- Create a specification with stable requirement IDs and Given/When/Then acceptance criteria; pass \`npx --yes --package=@multileaf/ai-workflow -- aiw gate specification\` before planning.
+- For changes with architecture impact, use technical design, record consequential choices as ADRs with \`npx --yes --package=@multileaf/ai-workflow -- aiw adr\`, and link those decisions to the requirements. Then create an implementation plan with \`npx --yes --package=@multileaf/ai-workflow -- aiw plan\`, linking tasks to requirements, tests, risks, and validation commands; pass \`npx --yes --package=@multileaf/ai-workflow -- aiw gate plan\` before coding.
+- When TDD resources are installed and the project has a test workflow, follow the TDD policy; otherwise use the project's existing validation methods. Follow installed project quality rules and use specialist agents only when they are installed and useful.
+- Run the declared checks, write \`.aiw/generated/reports/verification-report.md\` using the verification-report template, and pass \`npx --yes --package=@multileaf/ai-workflow -- aiw gate verification\`. Then run \`npx --yes --package=@multileaf/ai-workflow -- aiw verify\` and \`npx --yes --package=@multileaf/ai-workflow -- aiw trace\`. Use the code-review skill when installed and record its findings; AI Workflow does not provide a separate review gate. Do not claim completion without evidence.
 
 ## Language policy
 

package/dist/generator.js

@@ -2,16 +2,28 @@ import { resolveGeneratedPath } from "./drift.js";
 export function generateProjectResources(profile, selected, write) {
     const linterCommand = safeInlineValue(profile.quality.linter?.command);
     const formatterCommand = safeInlineValue(profile.quality.formatter?.command);
-    const testCommand = safeInlineValue(profile.testing?.command);
-    if (selected.includes("typescript-quality"))
+    const testCommands = [
+        ...(profile.testing?.command ? [{ scope: "project", command: profile.testing.command }] : []),
+        ...(profile.modules ?? []).flatMap((module) => module.testing?.command
+            ? [{ scope: `workspace ${module.path}`, command: module.testing.command }]
+            : []),
+    ].map(({ scope, command }) => ({ scope, command: safeInlineValue(command) }));
+    const uniqueTestCommands = [
+        ...new Map(testCommands
+            .filter(({ command }) => command)
+            .map(({ scope, command }) => [`${scope}:${command}`, { scope, command }])).values(),
+    ];
+    if (selected.includes("typescript-quality") || selected.includes("rules/project-quality"))
         write(resolveGeneratedPath("rules/project-quality.md"), `# Project Quality Rules\n\n- Use ${profile.runtime.languages.map((language) => (language === "typescript" ? "TypeScript" : language)).join(", ")} with strict typing.\n${linterCommand ? `- Run \`${linterCommand}\` before completion.\n` : ""}${formatterCommand ? `- Run \`${formatterCommand}\` before review.\n` : ""}- Keep all generated AI Workflow artifacts in English.\n`);
-    if (selected.includes("tdd-development"))
-        write(resolveGeneratedPath("rules/tdd-project-policy.md"), `# TDD Project Policy\n\n${testCommand ? `- Run \`${testCommand}\` for verification.\n` : ""}- Write a failing behavioral test before implementation.\n- Refactor only after the test is green.\n`);
-    if (selected.includes("nextjs-development") || selected.includes("react-best-practices"))
+    if (selected.includes("tdd-development") || selected.includes("rules/tdd-project-policy"))
+        write(resolveGeneratedPath("rules/tdd-project-policy.md"), `# TDD Project Policy\n\n${uniqueTestCommands.map(({ scope, command }) => `- Run the ${scope} test command \`${command}\` for verification.`).join("\n")}${uniqueTestCommands.length ? "\n" : ""}- Write a failing behavioral test before implementation.\n- Refactor only after the test is green.\n`);
+    if (selected.includes("nextjs-development") ||
+        selected.includes("react-best-practices") ||
+        selected.includes("rules/architecture-policy"))
         write(resolveGeneratedPath("agents/project-context.md"), `# Project Context\n\nThis project uses ${profile.frameworks.map((framework) => (framework === "nextjs" ? "Next.js" : framework)).join(", ")}. Follow the detected project structure and existing framework conventions.\n`);
     if (selected.length > 0) {
         write(resolveGeneratedPath("context/project-profile.md"), `# Confirmed Project Profile\n\n- Languages: ${profile.runtime.languages.join(", ") || "none detected"}\n- Frameworks: ${profile.frameworks.join(", ") || "none detected"}\n- Package manager: ${profile.packageManager}\n- All generated content is in English.\n`);
-        write(resolveGeneratedPath("hooks/quality-check.md"), `# Quality Check Hook\n\nRun the available project quality commands before completion.${linterCommand ? `\n\n- Linter: \`${linterCommand}\`` : ""}${formatterCommand ? `\n- Formatter: \`${formatterCommand}\`` : ""}${testCommand ? `\n- Tests: \`${testCommand}\`` : ""}\n`);
+        write(resolveGeneratedPath("hooks/quality-check.md"), `# Quality Check Hook\n\nRun the available project quality commands before completion.${linterCommand ? `\n\n- Linter: \`${linterCommand}\`` : ""}${formatterCommand ? `\n- Formatter: \`${formatterCommand}\`` : ""}${uniqueTestCommands.map(({ scope, command }) => `\n- ${scope} tests: \`${command}\``).join("")}\n`);
     }
 }
 function safeInlineValue(value) {

package/dist/profile.d.ts

@@ -3,6 +3,24 @@ export type Tool = {
     name: string;
     command?: string;
 };
+export type ProjectModule = {
+    path: string;
+    name?: string;
+    runtime: {
+        languages: string[];
+    };
+    frameworks: string[];
+    packageManager: string;
+    quality: {
+        linter?: Tool;
+        formatter?: Tool;
+        typecheck?: Tool;
+    };
+    testing?: Tool;
+    architecture?: string[];
+    patterns?: string[];
+    evidence?: string[];
+};
 export type ProjectProfile = {
     runtime: {
         languages: string[];
@@ -17,6 +35,7 @@ export type ProjectProfile = {
     testing?: Tool;
     ci: string[];
     workspaces: string[];
+    modules?: ProjectModule[];
     facts: EvidenceFact[];
 };
 export declare function parseProjectProfile(content: string): ProjectProfile;

package/dist/profile.js

@@ -1,5 +1,5 @@
 import { readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { scanProject } from "./scanner.js";
 import { buildFacts } from "./evidence.js";
 function scalar(content, key) {
@@ -36,6 +36,15 @@ export function parseProjectProfile(content) {
         const toolName = scalar(content, name);
         return toolName ? { name: toolName, command: scalar(content, command) } : undefined;
     };
+    let modules = [];
+    try {
+        const parsed = JSON.parse(scalar(content, "project_modules") ?? "[]");
+        if (Array.isArray(parsed))
+            modules = parseModules(parsed);
+    }
+    catch {
+        modules = [];
+    }
     return {
         runtime: { languages },
         frameworks,
@@ -48,12 +57,68 @@ export function parseProjectProfile(content) {
         testing: tool("testing", "testing_command"),
         ci: list(content, "ci"),
         workspaces: list(content, "workspaces"),
+        modules,
         facts: [],
     };
 }
+function parseModules(values) {
+    return values.slice(0, 256).flatMap((value) => {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return [];
+        const item = value;
+        if (typeof item.path !== "string" || !item.path.trim())
+            return [];
+        const runtime = item.runtime && typeof item.runtime === "object"
+            ? item.runtime
+            : {};
+        const quality = item.quality && typeof item.quality === "object"
+            ? item.quality
+            : {};
+        const tool = (candidate) => {
+            if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+                return undefined;
+            const details = candidate;
+            if (typeof details.name !== "string" || !details.name.trim())
+                return undefined;
+            return {
+                name: details.name.slice(0, 180),
+                command: typeof details.command === "string" ? details.command.slice(0, 180) : undefined,
+            };
+        };
+        return [
+            {
+                path: item.path.slice(0, 240),
+                name: typeof item.name === "string" ? item.name.slice(0, 180) : undefined,
+                runtime: { languages: stringArray(runtime.languages) },
+                frameworks: stringArray(item.frameworks),
+                packageManager: typeof item.packageManager === "string" ? item.packageManager.slice(0, 80) : "unknown",
+                quality: {
+                    linter: tool(quality.linter),
+                    formatter: tool(quality.formatter),
+                    typecheck: tool(quality.typecheck),
+                },
+                testing: tool(item.testing),
+                architecture: stringArray(item.architecture),
+                patterns: stringArray(item.patterns),
+                evidence: stringArray(item.evidence),
+            },
+        ];
+    });
+}
+function stringArray(value) {
+    return Array.isArray(value)
+        ? value
+            .filter((item) => typeof item === "string")
+            .slice(0, 32)
+            .map((item) => item.slice(0, 240))
+        : [];
+}
 async function packageManifest(root) {
+    return packageManifestFile(join(root, "package.json"));
+}
+async function packageManifestFile(path) {
     try {
-        return JSON.parse(await readFile(join(root, "package.json"), "utf8"));
+        return JSON.parse(await readFile(path, "utf8"));
     }
     catch {
         return {};
@@ -69,17 +134,21 @@ export async function profileProject(root) {
     const scan = await scanProject(root);
     const manifest = await packageManifest(root);
     const files = scan.files;
+    const moduleManifests = files.filter((file) => /(^|\/)package\.json$/.test(file));
+    const packageDirectories = moduleManifests.map((file) => dirname(file));
+    const modules = await Promise.all(moduleManifests
+        .filter((file) => dirname(file) !== ".")
+        .map((file) => profileModule(root, file, files, scan.evidence, undefined, packageDirectories)));
+    const rootModule = await profileModule(root, "package.json", files, scan.evidence, manifest, packageDirectories);
     const languages = [
-        ...new Set(scan.evidence
-            .filter((item) => item.fact.startsWith("language."))
-            .map((item) => item.fact.replace("language.", ""))),
+        ...new Set([
+            ...rootModule.runtime.languages,
+            ...modules.flatMap((item) => item.runtime.languages),
+        ]),
     ];
     const frameworks = [
-        hasDependency(manifest, "next") ? "nextjs" : "",
-        hasDependency(manifest, "react") ? "react" : "",
-        hasDependency(manifest, "vue") ? "vue" : "",
-        hasDependency(manifest, "express") ? "express" : "",
-    ].filter(Boolean);
+        ...new Set([...rootModule.frameworks, ...modules.flatMap((item) => item.frameworks)]),
+    ];
     const packageManager = files.includes("pnpm-lock.yaml")
         ? "pnpm"
         : files.includes("yarn.lock")
@@ -116,8 +185,74 @@ export async function profileProject(root) {
         testing: testingName ? { name: testingName, command: commandFor(manifest, "test") } : undefined,
         ci: files.some((file) => file.startsWith(".github/workflows/")) ? ["github-actions"] : [],
         workspaces,
+        modules,
         facts: [],
     };
     profile.facts = buildFacts(profile, scan.evidence);
     return profile;
 }
+async function profileModule(root, manifestPath, files, evidence, existingManifest, packageDirectories = []) {
+    const manifest = existingManifest ?? (await packageManifestFile(join(root, manifestPath)));
+    const modulePath = dirname(manifestPath) === "." ? "." : dirname(manifestPath).split("\\").join("/");
+    const prefix = modulePath === "." ? "" : `${modulePath}/`;
+    const childPrefixes = packageDirectories
+        .filter((directory) => directory !== modulePath && directory.startsWith(prefix))
+        .map((directory) => `${directory}/`);
+    const moduleFiles = files.filter((file) => file.startsWith(prefix) && !childPrefixes.some((childPrefix) => file.startsWith(childPrefix)));
+    const languages = [
+        ...new Set(evidence
+            .filter((item) => item.fact.startsWith("language.") && item.source.startsWith(prefix))
+            .map((item) => item.fact.slice("language.".length))),
+    ];
+    const frameworkSet = new Set();
+    const addDependency = (dependency, label) => {
+        if (hasDependency(manifest, dependency))
+            frameworkSet.add(label);
+    };
+    addDependency("next", "nextjs");
+    addDependency("react", "react");
+    addDependency("vue", "vue");
+    addDependency("express", "express");
+    addDependency("@nestjs/core", "nestjs");
+    addDependency("@prisma/client", "prisma");
+    addDependency("prisma", "prisma");
+    addDependency("vite", "vite");
+    addDependency("fastify", "fastify");
+    if (moduleFiles.some((file) => file.startsWith(`${prefix}prisma/`) && file.endsWith(".prisma")))
+        frameworkSet.add("prisma");
+    const testingName = hasDependency(manifest, "vitest")
+        ? "vitest"
+        : hasDependency(manifest, "jest")
+            ? "jest"
+            : hasDependency(manifest, "@playwright/test")
+                ? "playwright"
+                : hasDependency(manifest, "cypress")
+                    ? "cypress"
+                    : undefined;
+    const qualityTool = (dependency, config, script, name) => hasDependency(manifest, dependency) ||
+        moduleFiles.some((file) => file.startsWith(`${prefix}${config}`))
+        ? { name, command: commandFor(manifest, script) }
+        : undefined;
+    const packageManager = moduleFiles.some((file) => file === `${prefix}pnpm-lock.yaml`)
+        ? "pnpm"
+        : moduleFiles.some((file) => file === `${prefix}yarn.lock`)
+            ? "yarn"
+            : moduleFiles.some((file) => file === `${prefix}package-lock.json`)
+                ? "npm"
+                : "unknown";
+    return {
+        path: modulePath,
+        name: typeof manifest.name === "string" ? manifest.name : undefined,
+        runtime: { languages },
+        frameworks: [...frameworkSet],
+        packageManager,
+        quality: {
+            linter: qualityTool("eslint", "eslint.config", "lint", "eslint"),
+            formatter: qualityTool("prettier", "prettier", "format", "prettier"),
+            typecheck: commandFor(manifest, "typecheck")
+                ? { name: "typescript", command: commandFor(manifest, "typecheck") }
+                : undefined,
+        },
+        testing: testingName ? { name: testingName, command: commandFor(manifest, "test") } : undefined,
+    };
+}

package/dist/quality-gates.d.ts

@@ -1,2 +1,2 @@
-export type QualityGateStage = "specification" | "plan" | "verification";
+export type QualityGateStage = "brainstorming" | "specification" | "plan" | "verification";
 export declare function evaluateQualityGate(stage: QualityGateStage, content: string): string[];

package/dist/quality-gates.js

@@ -11,7 +11,7 @@ function requireSections(content, artifact, headings) {
     });
 }
 export function evaluateQualityGate(stage, content) {
-    if (stage === "specification")
+    if (stage === "brainstorming")
         return requireSections(content, "Brainstorm", [
             "Goal",
             "Users",
@@ -19,7 +19,7 @@ export function evaluateQualityGate(stage, content) {
             "Risks",
             "Non-goals",
         ]);
-    if (stage === "plan") {
+    if (stage === "specification") {
         const issues = [];
         if (!/REQ-\d+/.test(content))
             issues.push("Specification must define a stable REQ-### ID.");
@@ -29,12 +29,21 @@ export function evaluateQualityGate(stage, content) {
             issues.push("Requirement acceptance criteria must use Given, When, and Then.");
         return issues;
     }
-    const fields = ["Requirement", "Code", "Tests", "Validation", "Evidence"];
-    const issues = !/TASK-\d+/.test(content)
-        ? ["Implementation plan must define a TASK-### ID."]
-        : [];
-    for (const field of fields)
-        if (!new RegExp(`^[ \\t]*-?[ \\t]*${field}:[ \\t]*\\S+`, "im").test(content))
-            issues.push(`Implementation plan task must define ${field}.`);
-    return issues;
+    if (stage === "plan") {
+        const fields = ["Requirement", "Code", "Tests", "Validation", "Evidence"];
+        const issues = !/TASK-\d+/.test(content)
+            ? ["Implementation plan must define a TASK-### ID."]
+            : [];
+        for (const field of fields)
+            if (!new RegExp(`^[ \\t]*-?[ \\t]*${field}:[ \\t]*\\S+`, "im").test(content))
+                issues.push(`Implementation plan task must define ${field}.`);
+        return issues;
+    }
+    return requireSections(content, "Verification Report", [
+        "Requirements Checked",
+        "Checks Passed",
+        "Missing Evidence",
+        "Residual Risks",
+        "Decision",
+    ]);
 }

package/dist/recommendations.d.ts

@@ -13,6 +13,7 @@ export type CapabilityRecommendation = {
     permissions: string[];
     conflicts: string[];
     resources: RecommendedResource[];
+    requires?: string[];
 };
 export declare function recommendCapabilities(profile: ProjectProfile): CapabilityRecommendation[];
 export declare function resourcesForCapabilities(ids: string[]): RecommendedResource[];