@multileaf/ai-workflow 0.1.3 → 0.1.5

package/dist/recommendations.js

@@ -38,10 +38,26 @@ const CATALOG = [
             { type: "agents", id: "technical-architect" },
             { type: "templates", id: "implementation-plan" },
         ]),
+        requires: ["requirements-specification"],
         matches: (profile) => hasProjectSignals(profile)
             ? { evidence: projectEvidence(profile), confidence: 0.88 }
             : undefined,
     },
+    {
+        id: "technical-design",
+        provider: "multileaf",
+        rationale: "Architecture changes benefit from explicit alternatives, trade-offs, and decision records.",
+        permissions: [],
+        resources: local([
+            { type: "skills", id: "technical-design" },
+            { type: "agents", id: "technical-architect" },
+            { type: "templates", id: "technical-design" },
+            { type: "templates", id: "decision-record" },
+        ]),
+        matches: (profile) => hasProjectSignals(profile)
+            ? { evidence: projectEvidence(profile), confidence: 0.82 }
+            : undefined,
+    },
     {
         id: "code-review",
         provider: "multileaf",
@@ -51,6 +67,7 @@ const CATALOG = [
             { type: "skills", id: "code-review" },
             { type: "agents", id: "quality-reviewer" },
         ]),
+        requires: ["verification"],
         matches: (profile) => profile.runtime.languages.length
             ? { evidence: projectEvidence(profile), confidence: 0.86 }
             : undefined,
@@ -68,9 +85,25 @@ const CATALOG = [
             { type: "hooks", id: "post-implementation" },
             { type: "templates", id: "test-plan" },
         ]),
-        matches: (profile) => profile.testing
-            ? { evidence: [`testing:${profile.testing.name}`], confidence: 1 }
-            : undefined,
+        requires: ["verification"],
+        matches: (profile) => {
+            const runners = [
+                ...(profile.testing ? [profile.testing] : []),
+                ...(profile.modules ?? []).flatMap((module) => module.testing ? [{ ...module.testing, module: module.path }] : []),
+            ];
+            return runners.length
+                ? {
+                    evidence: [
+                        ...new Set(runners.flatMap((runner) => [
+                            ...("module" in runner ? [`workspace:${runner.module}`] : []),
+                            `testing:${runner.name}`,
+                            ...(runner.command ? [`test-command:${runner.command}`] : []),
+                        ])),
+                    ],
+                    confidence: 1,
+                }
+                : undefined;
+        },
     },
     {
         id: "typescript-quality",
@@ -86,18 +119,49 @@ const CATALOG = [
             : undefined,
     },
     {
-        id: "vitest-testing",
+        id: "nestjs-backend",
+        provider: "multileaf",
+        rationale: "NestJS is detected in this project; its module, dependency-injection, and test conventions can guide backend work.",
+        permissions: [],
+        resources: local([
+            { type: "skills", id: "nestjs-development" },
+            { type: "agents", id: "nestjs-engineer" },
+            { type: "rules", id: "architecture-policy" },
+            { type: "templates", id: "technical-design" },
+        ]),
+        matches: (profile) => profile.frameworks.includes("nestjs")
+            ? { evidence: projectEvidence(profile, "nestjs"), confidence: 1 }
+            : undefined,
+    },
+    {
+        id: "prisma-data-access",
         provider: "multileaf",
-        rationale: "Vitest is configured and can be used by the verification skill and test specialist.",
+        rationale: "Prisma is detected; schema and data-access changes need migration-aware guidance aligned to the owning workspace.",
+        permissions: [],
+        resources: local([
+            { type: "skills", id: "prisma-data-access" },
+            { type: "agents", id: "prisma-engineer" },
+            { type: "rules", id: "data-access-policy" },
+            { type: "rules", id: "security-policy" },
+        ]),
+        matches: (profile) => profile.frameworks.includes("prisma")
+            ? { evidence: projectEvidence(profile, "prisma"), confidence: 1 }
+            : undefined,
+    },
+    {
+        id: "verification",
+        provider: "multileaf",
+        rationale: "Verification guidance can use the project's detected test runner and quality commands.",
         permissions: [],
         resources: local([
             { type: "skills", id: "verification" },
-            { type: "agents", id: "test-engineer" },
+            { type: "agents", id: "quality-reviewer" },
             { type: "templates", id: "test-plan" },
             { type: "templates", id: "verification-report" },
         ]),
-        matches: (profile) => profile.testing?.name === "vitest"
-            ? { evidence: ["testing:vitest"], confidence: 1 }
+        requires: ["implementation-planning"],
+        matches: (profile) => hasProjectSignals(profile)
+            ? { evidence: projectEvidence(profile), confidence: profile.testing ? 1 : 0.84 }
             : undefined,
     },
     {
@@ -130,6 +194,21 @@ const CATALOG = [
             ? { evidence: ["framework:nextjs"], confidence: 1 }
             : undefined,
     },
+    {
+        id: "vite-frontend",
+        provider: "multileaf",
+        rationale: "Vite is detected; frontend build, test, and module guidance should follow the owning app's framework and scripts.",
+        permissions: [],
+        resources: local([
+            { type: "skills", id: "vite-frontend" },
+            { type: "agents", id: "typescript-engineer" },
+            { type: "rules", id: "quality-gates" },
+            { type: "templates", id: "technical-design" },
+        ]),
+        matches: (profile) => profile.frameworks.includes("vite")
+            ? { evidence: projectEvidence(profile, "vite"), confidence: 1 }
+            : undefined,
+    },
     {
         id: "security-review",
         provider: "multileaf",
@@ -163,15 +242,22 @@ export function recommendCapabilities(profile) {
     });
 }
 export function resourcesForCapabilities(ids) {
-    const selected = new Set(ids);
-    const resources = CATALOG.filter(({ id }) => selected.has(id)).flatMap(({ resources }) => resources);
+    const normalizedIds = ids.map((id) => (id === "vitest-testing" ? "verification" : id));
+    const selectedCapabilities = new Set(CATALOG.filter(({ id }) => normalizedIds.includes(id)).map(({ id }) => id));
+    const selectedResources = new Set(normalizedIds.filter((id) => id.includes("/")));
+    const resources = CATALOG.flatMap(({ id, resources }) => selectedCapabilities.has(id)
+        ? resources
+        : resources.filter(({ type, id: resourceId }) => selectedResources.has(`${type}/${resourceId}`)));
     return [
         ...new Map(resources.map((resource) => [`${resource.type}/${resource.id}`, resource])).values(),
     ];
 }
 export function serializeRecommendations(items, selected = []) {
     return `schema: 1\nrecommendations:\n${items
-        .map((item) => `  - id: ${item.id}\n    provider: ${item.provider}\n    confidence: ${item.confidence}\n    selected: ${selected.includes(item.id)}\n    resources: [${item.resources.map(({ type, id }) => `${type}/${id}`).join(", ")}]\n    evidence: [${item.evidence.map((evidence) => `"${evidence}"`).join(", ")}]\n    rationale: ${item.rationale}`)
+        .map((item) => `  - id: ${item.id}\n    provider: ${item.provider}\n    confidence: ${item.confidence}\n    selected: ${selected.includes(item.id)}\n    requires: [${(item.requires ?? []).join(", ")}]\n    resources: [${item.resources.map(({ type, id }) => `${type}/${id}`).join(", ")}]\n    selected_resources: [${item.resources
+        .filter(({ type, id }) => selected.includes(`${type}/${id}`))
+        .map(({ type, id }) => `${type}/${id}`)
+        .join(", ")}]\n    evidence: [${item.evidence.map((evidence) => `"${evidence}"`).join(", ")}]\n    rationale: ${item.rationale}`)
         .join("\n")}\n`;
 }
 function hasProjectSignals(profile) {
@@ -182,7 +268,15 @@ function hasProjectSignals(profile) {
         profile.quality.linter ||
         profile.ci.length);
 }
-function projectEvidence(profile) {
+function projectEvidence(profile, framework) {
+    const moduleEvidence = (profile.modules ?? [])
+        .filter((module) => !framework || module.frameworks.includes(framework))
+        .flatMap((module) => [
+        `workspace:${module.path}`,
+        ...module.frameworks.map((name) => `framework:${name}`),
+        ...(module.testing ? [`testing:${module.testing.name}`] : []),
+        ...(module.testing?.command ? [`test-command:${module.testing.command}`] : []),
+    ]);
     return [
         ...profile.runtime.languages.map((language) => `language:${language}`),
         ...profile.frameworks.map((framework) => `framework:${framework}`),
@@ -190,5 +284,6 @@ function projectEvidence(profile) {
         ...(profile.testing ? [`testing:${profile.testing.name}`] : []),
         ...(profile.quality.linter ? [`linter:${profile.quality.linter.name}`] : []),
         ...(profile.ci.length ? profile.ci.map((system) => `ci:${system}`) : []),
+        ...moduleEvidence,
     ];
 }

package/dist/selection.js

@@ -1,11 +1,47 @@
 export async function selectRecommendations(items, answer, selectedIds) {
+    const available = new Set(items.flatMap((item) => [
+        item.id,
+        ...(item.resources ?? []).map(({ type, id }) => `${type}/${id}`),
+    ]));
+    available.add("vitest-testing");
+    if (selectedIds?.includes("all"))
+        return items.map(({ id }) => id);
     if (selectedIds)
-        return selectedIds.filter((id) => items.some((item) => item.id === id));
+        return includeRequirements(items, selectedIds
+            .filter((id) => available.has(id))
+            .map((id) => (id === "vitest-testing" ? "verification" : id)));
     const selected = [];
     for (const item of items) {
         const response = (await answer(`Install ${item.id}? [Y/n] `)).trim().toLowerCase();
         if (response === "" || response === "y" || response === "yes")
             selected.push(item.id);
     }
-    return selected;
+    return includeRequirements(items, selected);
+}
+function includeRequirements(items, selectedIds) {
+    const selected = new Set(selectedIds);
+    const byId = new Map(items.map((item) => [item.id, item]));
+    const owners = new Map();
+    for (const item of items)
+        for (const resource of item.resources ?? [])
+            owners.set(`${resource.type}/${resource.id}`, item.id);
+    const visit = (capabilityId, visited) => {
+        if (visited.has(capabilityId))
+            return;
+        visited.add(capabilityId);
+        const capability = byId.get(capabilityId);
+        if (!capability)
+            return;
+        for (const requirement of capability.requires ?? []) {
+            if (!byId.has(requirement))
+                continue;
+            selected.add(requirement);
+            visit(requirement, visited);
+        }
+    };
+    const initial = [...selected];
+    const visited = new Set();
+    for (const id of initial)
+        visit(byId.has(id) ? id : (owners.get(id) ?? ""), visited);
+    return [...selected];
 }

package/dist/workflow.js

@@ -290,7 +290,7 @@ export async function runCommand(args, root, fs, services = {}) {
             const evidence = profile.facts
                 .map((fact) => `  - key: ${fact.key}\n    value: ${fact.value}\n    state: ${fact.state}\n    method: ${fact.method}\n    confidence: ${fact.confidence}${fact.requiresConfirmation === undefined ? "" : `\n    requires_confirmation: ${fact.requiresConfirmation}`}\n    evidence: [${fact.evidence.map((item) => `"${item.source}"`).join(", ")}]`)
                 .join("\n");
-            fs.write(join(aiw, "profile.yml"), `schema: 1\nstatus: scanned\nfacts:\n${evidence}\nruntime:\n  languages: [${profile.runtime.languages.join(", ")}]\nframeworks: [${profile.frameworks.join(", ")}]\npackage_manager: ${profile.packageManager}\nquality:\n  linter: ${profile.quality.linter?.name ?? "unknown"}\n  linter_command: ${profile.quality.linter?.command ?? "unknown"}\n  formatter: ${profile.quality.formatter?.name ?? "unknown"}\n  formatter_command: ${profile.quality.formatter?.command ?? "unknown"}\n  typecheck: ${profile.quality.typecheck?.name ?? "unknown"}\n  typecheck_command: ${profile.quality.typecheck?.command ?? "unknown"}\ntesting: ${profile.testing?.name ?? "unknown"}\ntesting_command: ${profile.testing?.command ?? "unknown"}\nci: [${profile.ci.join(", ")}]\nworkspaces: [${profile.workspaces.join(", ")}]\npolicies:\n  artifact_language: en\n`);
+            fs.write(join(aiw, "profile.yml"), `schema: 1\nstatus: scanned\nfacts:\n${evidence}\nruntime:\n  languages: [${profile.runtime.languages.join(", ")}]\nframeworks: [${profile.frameworks.join(", ")}]\npackage_manager: ${profile.packageManager}\nquality:\n  linter: ${profile.quality.linter?.name ?? "unknown"}\n  linter_command: ${profile.quality.linter?.command ?? "unknown"}\n  formatter: ${profile.quality.formatter?.name ?? "unknown"}\n  formatter_command: ${profile.quality.formatter?.command ?? "unknown"}\n  typecheck: ${profile.quality.typecheck?.name ?? "unknown"}\n  typecheck_command: ${profile.quality.typecheck?.command ?? "unknown"}\ntesting: ${profile.testing?.name ?? "unknown"}\ntesting_command: ${profile.testing?.command ?? "unknown"}\nci: [${profile.ci.join(", ")}]\nworkspaces: [${profile.workspaces.join(", ")}]\nproject_modules: ${JSON.stringify(profile.modules ?? [])}\npolicies:\n  artifact_language: en\n`);
             return { exitCode: 0, output: "Project profile generated." };
         }
         if (command === "target") {
@@ -749,6 +749,36 @@ export async function runCommand(args, root, fs, services = {}) {
                 : await profileProject(root);
             const selectedArg = args.find((arg) => arg.startsWith("--select="))?.split("=", 2)[1];
             const selected = selectedArg?.split(",") ?? (command === "sync" ? readSelectedRecommendations(fs, aiw) : []);
+            if (command === "sync") {
+                const result = syncSelectedResources(fs, root, aiw, profile, selected);
+                if (result.error)
+                    return { exitCode: 1, error: result.error };
+                const messages = [result.output ?? "Selected bundled resources synchronized."];
+                if (selected.includes("react-best-practices")) {
+                    const approvedPermissions = parseApprovedPermissions(args);
+                    if (!approvedPermissions.includes("network:external")) {
+                        messages.push("Remote skill pending: network:external was not approved. Bundled resources were installed; rerun sync with --allow=network:external only if you approve external access.");
+                    }
+                    else {
+                        try {
+                            enforceConfiguredOrganizationPolicy(fs, aiw, {
+                                provider: "vercel-skills",
+                                source: "vercel-labs/agent-skills",
+                                permissions: ["network:external"],
+                            });
+                            const target = parseManifest(fs.read(join(aiw, "manifest.yml"))).target.active;
+                            await installVercelSkill(services.externalSkills ?? nodeCommandExecutor, "vercel-labs/agent-skills", "vercel-react-best-practices", target);
+                            writeVercelSkillLock(fs, root, aiw, "vercel-labs/agent-skills", "vercel-react-best-practices");
+                            messages.push("Remote React best-practices skill installed.");
+                        }
+                        catch (error) {
+                            const reason = error instanceof Error ? error.message : String(error);
+                            messages.push(`Remote skill pending: ${reason}`);
+                        }
+                    }
+                }
+                return { exitCode: 0, output: messages.join(" ") };
+            }
             if (selected.includes("react-best-practices")) {
                 const approvedPermissions = parseApprovedPermissions(args);
                 if (!approvedPermissions.includes("network:external"))
@@ -765,12 +795,6 @@ export async function runCommand(args, root, fs, services = {}) {
                 await installVercelSkill(services.externalSkills ?? nodeCommandExecutor, "vercel-labs/agent-skills", "vercel-react-best-practices", target);
                 writeVercelSkillLock(fs, root, aiw, "vercel-labs/agent-skills", "vercel-react-best-practices");
             }
-            if (command === "sync") {
-                const result = syncSelectedResources(fs, root, aiw, profile, selected);
-                return result.error
-                    ? { exitCode: 1, error: result.error }
-                    : { exitCode: 0, output: result.output };
-            }
             const conflicts = [];
             generateProjectResources(profile, selected, (path, content) => {
                 const destination = join(aiw, path);
@@ -1019,12 +1043,16 @@ export async function runCommand(args, root, fs, services = {}) {
                 return { exitCode: 1, error: "Run `aiw install` first." };
             const stage = args[1];
             const requirements = {
-                specification: "generated/specs/brainstorm.md",
-                plan: "generated/specs/specification.md",
-                verification: "generated/plans/implementation-plan.md",
+                brainstorming: "generated/specs/brainstorm.md",
+                specification: "generated/specs/specification.md",
+                plan: "generated/plans/implementation-plan.md",
+                verification: "generated/reports/verification-report.md",
             };
-            if (!stage || !(stage in requirements))
-                return { exitCode: 1, error: "Usage: aiw gate <specification|plan|verification>" };
+            if (!stage || !Object.hasOwn(requirements, stage))
+                return {
+                    exitCode: 1,
+                    error: "Usage: aiw gate <brainstorming|specification|plan|verification>",
+                };
             const gateStage = stage;
             const artifact = requirements[gateStage];
             if (!fs.exists(join(aiw, artifact)))
@@ -1630,7 +1658,19 @@ function syncSelectedResources(fs, root, aiw, profile, selected) {
     };
 }
 function personalizeBundledResource(type, id, content, profile) {
-    if (type !== "rules" || !["quality-gates", "tdd-policy", "dependency-policy"].includes(id))
+    const contextual = (type === "rules" &&
+        [
+            "quality-gates",
+            "tdd-policy",
+            "dependency-policy",
+            "architecture-policy",
+            "data-access-policy",
+        ].includes(id)) ||
+        (type === "skills" &&
+            ["nestjs-development", "prisma-data-access", "vite-frontend"].includes(id)) ||
+        (type === "agents" &&
+            ["technical-architect", "typescript-engineer", "nestjs-engineer", "prisma-engineer"].includes(id));
+    if (!contextual)
         return content;
     const signals = [
         profile.runtime.languages.length ? `- Languages: ${profile.runtime.languages.join(", ")}` : "",
@@ -1647,6 +1687,24 @@ function personalizeBundledResource(type, id, content, profile) {
         profile.quality.formatter?.command
             ? `- Format command: \`${safeProjectSignal(profile.quality.formatter.command)}\``
             : "",
+        ...(profile.modules ?? []).map((module) => {
+            const parts = [
+                module.name
+                    ? `${safeProjectSignal(module.name)} (${safeProjectSignal(module.path)})`
+                    : safeProjectSignal(module.path),
+                module.frameworks.length ? `frameworks: ${module.frameworks.join(", ")}` : "",
+                ...(module.architecture ?? []).map((item) => `architecture: ${safeProjectSignal(item)}`),
+                ...(module.patterns ?? []).map((item) => `patterns: ${safeProjectSignal(item)}`),
+                module.testing
+                    ? `tests: ${module.testing.name}${module.testing.command ? ` (${safeProjectSignal(module.testing.command)})` : ""}`
+                    : "",
+                module.quality.linter
+                    ? `linter: ${module.quality.linter.name}${module.quality.linter.command ? ` (${safeProjectSignal(module.quality.linter.command)})` : ""}`
+                    : "",
+            ].filter(Boolean);
+            const evidence = (module.evidence ?? []).slice(0, 8).map(safeProjectSignal);
+            return `- Module ${parts.join("; ")}${evidence.length ? `; evidence: ${evidence.join(", ")}` : ""}`;
+        }),
     ].filter(Boolean);
     return signals.length
         ? `${content.trimEnd()}\n\n## Detected project context\n\n${signals.join("\n")}\n`
@@ -1666,11 +1724,20 @@ function readSelectedRecommendations(fs, aiw) {
     if (!fs.exists(join(aiw, "recommendations.yml")))
         return [];
     const content = fs.read(join(aiw, "recommendations.yml"));
-    return content
+    const selections = content
         .split(/^\s{2}- id: /m)
         .slice(1)
-        .filter((block) => block.includes("selected: true"))
-        .map((block) => block.split("\n", 1)[0].trim());
+        .flatMap((block) => {
+        const id = block.split("\n", 1)[0].trim();
+        const selectedCapability = /^\s{4}selected: true$/m.test(block) ? [id] : [];
+        const selectedResources = block
+            .match(/^\s{4}selected_resources: \[([^\]]*)\]$/m)?.[1]
+            ?.split(",")
+            .map((resource) => resource.trim())
+            .filter(Boolean) ?? [];
+        return [...selectedCapability, ...selectedResources];
+    });
+    return [...new Set(selections)];
 }
 function parseApprovedPermissions(args) {
     return args

package/docs/ai-init-workflow-spec.md

@@ -0,0 +1,47 @@
+# AI Init Project Onboarding Specification
+
+## Goal
+
+Make `/ai-init` a guided, evidence-backed onboarding flow. The initial `npx` install remains a small bootstrap; `/ai-init` analyzes the repository, recommends project-matched capabilities, gets an explicit selection, installs only that selection, and reports any restart needed to load it.
+
+## User flow
+
+1. **Model and consent.** Before repository analysis, recommend switching to a lower-cost model. Do not change model settings. Ask whether the user switched or wants to continue with the current model. Explain that repository analysis is read-only until resource selection.
+2. **Parallel project analysis.** Use the host's native subagent mechanism to start independent read-only scans in parallel. Assign separate work to (a) technologies and package/workspace topology, (b) architecture, modules, and code patterns, and (c) tests, quality tools, and CI. The initiating agent is the orchestrator: it consolidates findings, resolves conflicts using repository evidence, and records paths for every material conclusion. If the host cannot start subagents, do the same scans directly and say so.
+3. **Monorepo coverage.** Discover root and nested project manifests, workspace definitions, package boundaries, framework configs, tests, and module entry points. Analyze each workspace separately, then summarize shared tooling and cross-workspace relationships. Never infer that root dependencies apply to every workspace.
+4. **Scan record.** Run the deterministic AI Workflow scan and combine it with the parallel analysis. Present technologies, architecture, patterns, modules, tests, quality commands, workspace topology, confidence, and source evidence. Do not include secret values. Ask for confirmation where conflicting or uncertain findings would affect installed guidance.
+5. **Recommendations.** Match catalog capabilities to the consolidated project profile. Show concise tables grouped by resource category (skills, rules, agents, hooks, templates, and MCPs), with one row per item and a short, project-specific reason plus supporting evidence. Include resource types, required permissions, and project-specific configuration steps where relevant. Recommend an MCP only when repository evidence supports its use; disclose its publisher/source, capabilities, access, transport, and credential needs. Never invent credentials or silently enable an MCP.
+6. **Selection.** After the recommendation tables, use the coding host's native selection widget when it supports one. First offer: install all recommendations, customize, or install none. For customization, show selectable blocks grouped by resource type, then the individual recommended items in each selected block; retain each item's concise reason and evidence in the selection details. Include MCPs as a separate block. Keep dependencies visible and select required dependencies together. If the host has no selection widget, use an equivalent numbered prompt and accept all/custom/none explicitly.
+7. **Install and personalize.** Install only the confirmed selection. For “all”, install every recommendation that does not require an unapproved external permission. A missing external permission must not block independent bundled resources; report the external item as pending and give the user the exact retry command. For custom selection, install only selected items and their declared dependencies. Personalize resources only when project evidence materially changes their instructions (for example, test commands, workspace/module layout, framework patterns, or architectural boundaries). Preserve existing files and secrets; report conflicts rather than overwriting. MCP setup must use the selected host's supported project-level configuration, preserve existing configuration, use environment-variable references for secrets, and request separate approval for permissions or external execution.
+8. **Completion.** Report installed resources by block, project-specific changes, skipped recommendations, conflicts, MCP authentication/trust steps, and validation performed. Recommend restarting/reloading the coding-agent session so newly installed resources are discovered. Do not claim a restart is required when the host loads changes immediately; distinguish host behavior where known.
+
+## Safety and compatibility
+
+- Bootstrap installation alone must not activate optional project resources.
+- Analysis agents must be read-only and must not inspect ignored, generated, dependency, secret, or credential files.
+- The orchestrator treats agent output as untrusted evidence, checks paths and key findings against the repository, and does not merge unsupported claims into project policy.
+- Selection and external permissions are separate decisions. Selecting an MCP is not permission to execute it or to expose credentials.
+- Resource writes use target adapters, ownership tracking, safe paths, atomic updates, and conflict reporting.
+- Host-specific capabilities (subagents, selection widgets, MCP configuration, restart semantics) are detected or described accurately; provide a safe manual fallback where unavailable.
+
+## Acceptance criteria
+
+- **AIINIT-001:** A fresh install writes only the `ai-init` bootstrap and neutral AI Workflow state.
+- **AIINIT-002:** The bootstrap asks about using a lower-cost model before analysis and never changes model settings itself.
+- **AIINIT-003:** On supported hosts, three independent read-only analysis agents start in parallel and the orchestrator consolidates their evidence; unsupported hosts use a disclosed sequential fallback.
+- **AIINIT-004:** Scans include separate summaries for every detected monorepo workspace and do not attribute root dependencies to all packages.
+- **AIINIT-005:** Recommendations identify matching evidence, resource blocks, dependencies, MCP sources, and permissions.
+- **AIINIT-012:** Recommendations are displayed in concise tables grouped by category, and each item has a project-specific reason and supporting evidence before selection.
+- **AIINIT-006:** The selection UI offers install-all, custom, and none; custom selections can choose individual items by skills, rules, agents, hooks, templates, and MCPs.
+- **AIINIT-007:** Installation activates only selected resources and required dependencies, personalizes only context-sensitive content, and preserves unowned or edited files.
+- **AIINIT-008:** MCP setup is target-aware, merges safely with existing configuration, never stores literal secrets, and requires separate permission approval.
+- **AIINIT-009:** Completion lists changes and recommends a session restart/reload to discover installed resources.
+- **AIINIT-010:** CLI tests cover mixed-stack monorepos, all/custom/none selection, permission gating, MCP config merging, personalization, conflicts, and completion output.
+- **AIINIT-011:** Custom selections can choose individual resource references by block, while `--select=all` selects every recommended capability and `--select=` selects none.
+- **AIINIT-013:** A selected remote resource without approved network access does not block independent bundled resource sync; sync reports the remote item as pending and preserves unrelated project files.
+
+## Delivery slices
+
+1. Bootstrap orchestration, host-native selection, model-cost prompt, and completion/reload guidance.
+2. Deterministic monorepo profiles, stack-specific capability recommendations, resource-level selection, and context-aware sync.
+3. MCP catalog provenance, per-target project configuration/merge support, credential placeholders, ownership, and config validation.

package/docs/backlog.md

@@ -43,6 +43,7 @@ Priority levels: **P0** blocks the product or makes it unsafe; **P1** is require
 - [x] **SDD-005** Implement verification skill. _Acceptance:_ missing evidence and untested requirements are reported.
 - [x] **SDD-006** Implement requirement-to-evidence traceability graph. _Acceptance:_ requirement → decision → task → code → test → evidence is queryable.
 - [x] **SDD-007** Add quality gates between workflow stages. _Acceptance:_ incomplete artifacts block progression with actionable feedback.
+- [x] **SDD-008** Connect workflow recommendations and quality gates to the SDD sequence. _Acceptance:_ selected later stages include declared prerequisites; verification is recommended for supported project profiles and test runners; each gate checks the matching artifact; review instructions do not refer to a nonexistent CLI gate.
 
 ## Adapters and migration — P1/P2
 

package/docs/product-requirements.md

@@ -24,6 +24,7 @@
 - Selected resources must be customized using confirmed project facts.
 - `/ai-init` must orchestrate scan → recommendations → user selection → selected-resource sync and summarize what it added.
 - The bootstrap must invoke CLI operations through the package runner; it cannot assume `aiw` is installed globally or in the consuming project's dependencies.
+- The complete onboarding behavior and acceptance criteria are defined in [`ai-init-workflow-spec.md`](./ai-init-workflow-spec.md).
 
 ### Development workflow
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multileaf/ai-workflow",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Portable spec-driven development workflow for AI coding agents",
   "license": "MIT",
   "repository": {

package/resources/agents/nestjs-engineer.md

@@ -0,0 +1,3 @@
+# NestJS Engineer
+
+Analyze the target NestJS module and its tests before proposing changes. Report relevant controllers, providers, dependency-injection relationships, DTO validation, and module boundaries with file evidence. Implement only within the assigned scope, preserve existing patterns, and return changed paths plus the exact workspace checks run. Do not access secrets or run migrations.

package/resources/agents/prisma-engineer.md

@@ -0,0 +1,3 @@
+# Prisma Engineer
+
+Inspect the active Prisma schema, generated-client usage, migrations, and data-access tests. Explain the impact of proposed schema/query changes and preserve the project's transaction and migration conventions. Never reset, migrate, or access a database without explicit approval. Return evidence paths, changed paths, and workspace-scoped validation results; do not include connection strings or credentials.

package/resources/package.yaml

@@ -28,6 +28,9 @@ resources:
     - { id: documentation-maintenance, version: 0.1.0, path: skills/documentation-maintenance.md }
     - { id: adapter-development, version: 0.1.0, path: skills/adapter-development.md }
     - { id: skill-authoring, version: 0.1.0, path: skills/skill-authoring.md }
+    - { id: nestjs-development, version: 0.1.0, path: skills/nestjs-development.md }
+    - { id: prisma-data-access, version: 0.1.0, path: skills/prisma-data-access.md }
+    - { id: vite-frontend, version: 0.1.0, path: skills/vite-frontend.md }
   rules:
     - { id: language-policy, version: 0.1.0, path: rules/language-policy.md }
     - { id: tdd-policy, version: 0.1.0, path: rules/tdd-policy.md }
@@ -39,6 +42,7 @@ resources:
     - { id: documentation-policy, version: 0.1.0, path: rules/documentation-policy.md }
     - { id: self-validation, version: 0.1.0, path: rules/self-validation.md }
     - { id: completion-validation, version: 0.1.0, path: rules/completion-validation.md }
+    - { id: data-access-policy, version: 0.1.0, path: rules/data-access-policy.md }
   agents:
     - { id: requirements-analyst, version: 0.1.0, path: agents/requirements-analyst.md }
     - { id: technical-architect, version: 0.1.0, path: agents/technical-architect.md }
@@ -48,6 +52,8 @@ resources:
     - { id: security-reviewer, version: 0.1.0, path: agents/security-reviewer.md }
     - { id: adapter-engineer, version: 0.1.0, path: agents/adapter-engineer.md }
     - { id: documentation-writer, version: 0.1.0, path: agents/documentation-writer.md }
+    - { id: nestjs-engineer, version: 0.1.0, path: agents/nestjs-engineer.md }
+    - { id: prisma-engineer, version: 0.1.0, path: agents/prisma-engineer.md }
   hooks:
     - { id: pre-implementation, version: 0.1.0, path: hooks/pre-implementation.md }
     - { id: post-implementation, version: 0.1.0, path: hooks/post-implementation.md }
@@ -66,8 +72,62 @@ resources:
     - { id: security-review, version: 0.1.0, path: templates/security-review.md }
     - { id: migration-report, version: 0.1.0, path: templates/migration-report.md }
 provides:
-  skills: [project-init, brainstorming, requirements-specification, technical-design, implementation-planning, tdd-development, verification, code-review, security-review, documentation-maintenance, adapter-development, skill-authoring]
-  rules: [language-policy, tdd-policy, architecture-policy, quality-gates, security-policy, dependency-policy, generated-files, documentation-policy, self-validation, completion-validation]
-  agents: [requirements-analyst, technical-architect, typescript-engineer, test-engineer, quality-reviewer, security-reviewer, adapter-engineer, documentation-writer]
+  skills:
+    [
+      project-init,
+      brainstorming,
+      requirements-specification,
+      technical-design,
+      implementation-planning,
+      tdd-development,
+      verification,
+      code-review,
+      security-review,
+      documentation-maintenance,
+      adapter-development,
+      skill-authoring,
+      nestjs-development,
+      prisma-data-access,
+      vite-frontend,
+    ]
+  rules:
+    [
+      language-policy,
+      tdd-policy,
+      architecture-policy,
+      quality-gates,
+      security-policy,
+      dependency-policy,
+      generated-files,
+      documentation-policy,
+      self-validation,
+      completion-validation,
+      data-access-policy,
+    ]
+  agents:
+    [
+      requirements-analyst,
+      technical-architect,
+      typescript-engineer,
+      test-engineer,
+      quality-reviewer,
+      security-reviewer,
+      adapter-engineer,
+      documentation-writer,
+      nestjs-engineer,
+      prisma-engineer,
+    ]
   hooks: [pre-implementation, post-implementation, pre-commit, post-change, pre-release]
-  templates: [brainstorm, specification, technical-design, decision-record, implementation-plan, task, test-plan, verification-report, security-review, migration-report]
+  templates:
+    [
+      brainstorm,
+      specification,
+      technical-design,
+      decision-record,
+      implementation-plan,
+      task,
+      test-plan,
+      verification-report,
+      security-review,
+      migration-report,
+    ]

package/resources/rules/data-access-policy.md

@@ -0,0 +1,7 @@
+# Data Access Policy
+
+- Follow the repository's existing data-access and transaction boundaries.
+- Scope commands and tests to the workspace that owns the database schema or query.
+- Review migration contents before applying them; never run destructive database commands without explicit approval.
+- Keep credentials in the project's approved secret store or environment, never in source, logs, or generated AI instructions.
+- Validate data-access changes with relevant tests and report any migration or compatibility impact.

package/resources/skills/brainstorming.md

@@ -7,3 +7,4 @@ description: Turn an early product idea into structured goals, assumptions, cons
 
 Separate facts, hypotheses, decisions, and open questions. Identify users, desired outcomes, constraints, risks, and non-goals. Do not prematurely prescribe implementation. Produce a versioned brainstorm artifact in English.
 
+When the request is already clear, skip brainstorming. Once the goal and constraints are clear, hand off to `requirements-specification` and link the specification to this brainstorm when one exists.

package/resources/skills/code-review.md

@@ -7,3 +7,4 @@ description: Review code for correctness, maintainability, design quality, and r
 
 Review behavior, boundaries, cohesion, naming, types, error handling, duplication, complexity, tests, and documentation. Prioritize actionable findings with severity and evidence.
 
+If findings require changes, send them back to implementation and require verification again. If there are no blocking findings, record the review result and complete traceability. This skill is a review checklist, not a CLI quality gate.

package/resources/skills/implementation-planning.md

@@ -7,3 +7,4 @@ description: Break an approved design into independently verifiable implementati
 
 Create small ordered tasks. Each task must reference requirements, affected modules, tests, commands, dependencies, and completion evidence.
 
+After the plan passes its gate, implement in task order. Use `tdd-development` when it is installed and the project has a test workflow; otherwise use the repository's existing validation methods. Hand completed work to `verification`.

package/resources/skills/nestjs-development.md

@@ -0,0 +1,8 @@
+---
+name: nestjs-development
+description: Implement and review NestJS services using the repository's module boundaries and conventions.
+---
+
+# NestJS Development
+
+Inspect the relevant NestJS module before editing. Follow the project's established controller, provider, dependency-injection, guard, pipe, interceptor, and DTO patterns; do not introduce a new architectural layer without evidence or approval. Keep transport concerns in controllers and business behavior in the existing service/domain boundaries. Validate external input with the project's configured validation approach. Add focused unit or integration tests using the test runner configured for this workspace, and run that workspace's declared quality commands.

package/resources/skills/prisma-data-access.md

@@ -0,0 +1,8 @@
+---
+name: prisma-data-access
+description: Change Prisma schemas and data access safely within the repository's database conventions.
+---
+
+# Prisma Data Access
+
+Read the active Prisma schema, client setup, existing migrations, and callers before changing data access. Preserve naming, relation, transaction, and repository patterns already used by the project. Do not apply migrations, reset databases, or run destructive commands without explicit approval. When schema changes are selected, explain migration impact, add or update tests around affected queries, and use the exact Prisma and test commands declared by the relevant workspace. Never copy connection strings or credentials into generated instructions.

package/resources/skills/project-init.md

@@ -5,5 +5,4 @@ description: Inspect a repository, build a project profile, and prepare AI Workf
 
 # Project Initialization
 
-Inspect structure and configuration safely. Detect languages, frameworks, package managers, scripts, tests, quality tools, CI, and conventions. Record evidence and confidence in `.ai-workflow/profile.yaml`. Ask for confirmation before treating uncertain inferences as facts. Recommend capabilities with rationale, permissions, and conflicts.
-
+Inspect structure and configuration safely. Detect languages, frameworks, package managers, scripts, tests, quality tools, CI, and conventions. Record evidence and confidence in `.aiw/profile.yml`. Ask for confirmation before treating uncertain inferences as facts. Recommend capabilities with rationale, permissions, and conflicts.