@williambeto/ai-workflow 2.4.9 → 2.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williambeto/ai-workflow",
-  "version": "2.4.9",
+  "version": "2.6.3",
   "description": "AI Workflow Kit — OpenCode-first software delivery workflow with agents, commands, skills, validation, and evidence",
   "license": "MIT",
   "author": "José Willams",
@@ -34,69 +34,12 @@
   },
   "files": [
     "bin",
-    "src",
+    "core",
     "dist-assets",
-    "PUBLISH_MANIFEST.json",
+    "*.js",
+    "package.json",
     "README.md",
     "LICENSE",
-    "CHANGELOG.md",
-    "AGENTS.md",
-    "docs/getting-started",
-    "docs/compatibility"
-  ],
-  "scripts": {
-    "build": "node internal/validate/build-publish.mjs",
-    "validate": "node internal/validate/validate-all.mjs",
-    "validate:json": "node internal/validate/validate-json.mjs",
-    "validate:structure": "node internal/validate/validate-structure.mjs",
-    "validate:refs": "node internal/validate/validate-refs.mjs",
-    "validate:artifact-safety": "node internal/validate/validate-artifact-safety.mjs",
-    "validate:links": "node internal/validate/validate-links.mjs",
-    "validate:docs-consistency": "node internal/validate/validate-doc-consistency.mjs",
-    "validate:workflow": "node internal/validate/validate-workflow.mjs",
-    "validate:schemas": "node internal/validate/validate-schemas.mjs",
-    "validate:skills": "node internal/validate/validate-skills.mjs",
-    "validate:subagents": "node internal/validate/validate-subagents.mjs",
-    "validate:commands": "node internal/validate/validate-commands.mjs",
-    "validate:agents": "node internal/validate/validate-agents.mjs",
-    "validate:policy-refs": "node internal/validate/validate-policy-refs.mjs",
-    "validate:privacy-gate": "node internal/validate/validate-privacy-gate.mjs",
-    "validate:ui-evidence": "node internal/validate/validate-ui-evidence-gate.mjs",
-    "validate:delegation": "node internal/validate/validate-delegation.mjs",
-    "validate:routing": "node internal/validate/validate-routing-consistency.mjs",
-    "validate:cli-smoke": "node internal/validate/validate-cli-smoke.mjs",
-    "validate:cli-docs": "node internal/validate/validate-cli-docs.mjs",
-    "lint:md": "markdownlint \"**/*.md\"",
-    "validate:registry": "node internal/validate/validate-registry-integrity.mjs",
-    "clean:verify": "node -e \"const fs = require('fs'); fs.rmSync('dist', { recursive: true, force: true }); fs.readdirSync('.').filter(f => f.endsWith('.tgz')).forEach(f => fs.rmSync(f, { force: true }));\"",
-    "test": "npm run test:unit",
-    "test:unit": "vitest run tests/unit/",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "test:e2e": "node tests/validate-e2e.mjs && vitest run tests/e2e/consumer-workflow.test.js",
-    "test:e2e:runtime": "AI_WORKFLOW_RELEASE=1 vitest run tests/e2e/consumer-workflow.test.js -t \"Real OpenCode Smoke Test\"",
-    "release:verify": "npm run clean:verify && npm test && npm run test:e2e && npm run validate && npm run pack:verify && npm run test:e2e:runtime",
-    "pack:verify": "node tests/e2e/verify-packed-consumer.mjs",
-    "pack:safe": "node internal/validate/pack-safe.mjs",
-    "validate:behavioral-contracts": "node internal/validate/validate-behavioral-contracts.mjs",
-    "validate:token-economy": "node internal/validate/validate-token-economy.mjs",
-    "validate:upgrade": "node internal/validate/validate-upgrade-path.mjs",
-    "validate:visual": "node internal/validate/validate-visual.mjs",
-    "validate:release-readiness": "node internal/validate/validate-release-readiness.mjs"
-  },
-  "devDependencies": {
-    "@playwright/test": "^1.60.0",
-    "@semantic-release/changelog": "^6.0.3",
-    "@semantic-release/git": "^10.0.1",
-    "@semantic-release/github": "^12.0.8",
-    "@semantic-release/npm": "^13.1.5",
-    "@vitest/coverage-v8": "^4.1.7",
-    "ajv": "^8.20.0",
-    "ajv-formats": "^3.0.1",
-    "axe-core": "^4.10.0",
-    "markdownlint-cli": "^0.49.0",
-    "playwright": "^1.60.0",
-    "semantic-release": "^25.0.3",
-    "vitest": "^4.1.7"
-  }
-}
+    "CHANGELOG.md"
+  ]
+}

package/{src/core/workspace/read-only-workspace.js → read-only-workspace-PZBE7KAX.js}

@@ -1,8 +1,10 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-import os from "node:os";
-import crypto from "node:crypto";
+import "./chunk-5WRI5ZAA.js";
 
+// src/core/workspace/read-only-workspace.ts
+import fs from "fs/promises";
+import path from "path";
+import os from "os";
+import crypto from "crypto";
 async function copyDirectory(src, dest) {
   const entries = await fs.readdir(src, { withFileTypes: true });
   for (const entry of entries) {
@@ -11,7 +13,6 @@ async function copyDirectory(src, dest) {
     }
     const srcPath = path.join(src, entry.name);
     const destPath = path.join(dest, entry.name);
-
     if (entry.isDirectory()) {
       await fs.mkdir(destPath, { recursive: true });
       await copyDirectory(srcPath, destPath);
@@ -20,13 +21,11 @@ async function copyDirectory(src, dest) {
     }
   }
 }
-
 async function captureHashSnapshot(dir) {
   const snapshot = {};
   await scanDir(dir, dir, snapshot);
   return snapshot;
 }
-
 async function scanDir(baseDir, currentDir, snapshot) {
   const entries = await fs.readdir(currentDir, { withFileTypes: true });
   for (const entry of entries) {
@@ -35,7 +34,6 @@ async function scanDir(baseDir, currentDir, snapshot) {
     }
     const fullPath = path.join(currentDir, entry.name);
     const relPath = path.relative(baseDir, fullPath);
-
     if (entry.isDirectory()) {
       await scanDir(baseDir, fullPath, snapshot);
     } else if (entry.isFile()) {
@@ -44,24 +42,14 @@ async function scanDir(baseDir, currentDir, snapshot) {
         const hash = crypto.createHash("sha256").update(content).digest("hex");
         snapshot[relPath] = hash;
       } catch {
-        // ignore
       }
     }
   }
 }
-
-/**
- * Runs a function inside a temporary copy of the workspace.
- * Mutating the workspace inside this temp directory will trigger a BLOCKED result.
- */
-export async function runInReadOnlyWorkspace(originalCwd, runFn) {
+async function runInReadOnlyWorkspace(originalCwd, runFn) {
   const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "opencode-ro-"));
-  
   try {
-    // 1. Copy repository files recursively (excluding git/node_modules/tmp)
     await copyDirectory(originalCwd, tempDir);
-
-    // 2. Write the required opencode.jsonc permission config file
     const opencodeConfig = {
       permission: {
         edit: "deny",
@@ -80,16 +68,9 @@ export async function runInReadOnlyWorkspace(originalCwd, runFn) {
       path.join(tempDir, "opencode.jsonc"),
       JSON.stringify(opencodeConfig, null, 2)
     );
-
-    // 3. Capture initial file hash snapshot
     const snapshotBefore = await captureHashSnapshot(tempDir);
-
-    // 4. Execute the callback function inside the temp directory
     const runResult = await runFn(tempDir);
-
-    // 5. Capture post-run snapshot and verify no file mutations occurred
     const snapshotAfter = await captureHashSnapshot(tempDir);
-
     const mutated = [];
     for (const [file, hash] of Object.entries(snapshotAfter)) {
       if (snapshotBefore[file] !== hash) {
@@ -97,11 +78,10 @@ export async function runInReadOnlyWorkspace(originalCwd, runFn) {
       }
     }
     for (const file of Object.keys(snapshotBefore)) {
-      if (snapshotAfter[file] === undefined) {
+      if (snapshotAfter[file] === void 0) {
         mutated.push(file);
       }
     }
-
     if (mutated.length > 0) {
       return {
         success: false,
@@ -110,10 +90,13 @@ export async function runInReadOnlyWorkspace(originalCwd, runFn) {
         eventCount: runResult.eventCount || 0
       };
     }
-
     return runResult;
   } finally {
-    // 6. Delete the temporary workspace copy
-    await fs.rm(tempDir, { recursive: true, force: true }).catch(() => {});
+    await fs.rm(tempDir, { recursive: true, force: true }).catch(() => {
+    });
   }
 }
+export {
+  runInReadOnlyWorkspace
+};
+//# sourceMappingURL=read-only-workspace-PZBE7KAX.js.map

package/{src/commands/validate.js → validate-Q2NLLQ5G.js}

@@ -1,32 +1,42 @@
-import { EvidenceCollector } from "../core/validation/evidence-collector.js";
-import { QualityGuard } from "../core/validation/quality-guard.js";
-import { ValidationPlanner } from "../core/validation/validation-planner.js";
-import { VisualVerifier } from "../core/validation/visual-verifier.js";
-import fs from "node:fs/promises";
-import path from "node:path";
+import {
+  EvidenceCollector,
+  QualityGuard,
+  ValidationPlanner,
+  VisualVerifier
+} from "./chunk-6EMG6FAO.js";
+import "./chunk-2AOV2ATY.js";
+import "./chunk-5WRI5ZAA.js";
 
-export async function runValidate({ cwd = process.cwd(), exitOnError = true, taskSlug = null, a11y = false, visualDist = null, port = 8080 }) {
+// src/cli/commands/validate.ts
+import fs from "fs/promises";
+import path from "path";
+async function runValidate({
+  cwd = process.cwd(),
+  exitOnError = true,
+  taskSlug = null,
+  a11y = false,
+  visualDist = null,
+  port = 8080
+}) {
   console.log("--- Running Validation ---");
-  const qualityGuard = new QualityGuard({ cwd, taskSlug, mode: "standard" });
+  const qualityGuard = new QualityGuard({ cwd, taskSlug, evidencePolicy: "optional", riskLevel: "medium" });
   const planner = new ValidationPlanner({ cwd, qualityGuard });
   const tasks = await planner.plan("standard");
-
-  const collector = new EvidenceCollector({ cwd, timeout: 60000, taskSlug, mode: "standard" });
+  const collector = new EvidenceCollector({ cwd, timeout: 6e4, taskSlug, evidencePolicy: "optional" });
   const results = [];
-  
   for (const task of tasks) {
     console.log(`Running validation task: ${task.name}...`);
     const res = collector.runTask(task);
     results.push(res);
     console.log(`- Status: ${res.status} (${res.summary})`);
   }
-
   let a11yResult = null;
   if (a11y) {
     if (!visualDist) {
       throw new Error("Accessibility audit (--a11y) requires a target build directory specified via --visual-dist=<path>.");
     }
-    console.log(`\n--- Running Accessibility Audit ---`);
+    console.log(`
+--- Running Accessibility Audit ---`);
     console.log(`Serving ${visualDist} on port ${port}...`);
     try {
       const verifier = new VisualVerifier({ cwd, visualDist, port });
@@ -41,21 +51,17 @@ export async function runValidate({ cwd = process.cwd(), exitOnError = true, tas
       throw err;
     }
   }
-
-  // Load future configuration if present
   let config = {};
   try {
     const configContent = await fs.readFile(path.join(cwd, "ai-workflow.config.json"), "utf8");
     config = JSON.parse(configContent);
-  } catch {}
-
+  } catch {
+  }
   const hasFailure = results.some((r) => ["FAIL", "BLOCKED", "FAIL_QUALITY_GATE"].includes(r.status));
-  
   let hasA11yFailure = false;
   if (a11yResult) {
-    const criticalIsBlocker = true; // Critical violations are always blockers
+    const criticalIsBlocker = true;
     const seriousIsBlocker = config.a11y?.seriousAsBlocker === true;
-    
     if (criticalIsBlocker && a11yResult.critical.length > 0) {
       hasA11yFailure = true;
       console.error(`Accessibility FAILED: ${a11yResult.critical.length} critical accessibility violations detected.`);
@@ -69,13 +75,15 @@ export async function runValidate({ cwd = process.cwd(), exitOnError = true, tas
       }
     }
   }
-
   if (hasFailure || hasA11yFailure) {
     console.log("\nValidation FAILED.");
     if (exitOnError) process.exit(1);
     return { passed: false, results, a11yResult };
   }
-
   console.log("\nValidation PASSED.");
   return { passed: true, results, a11yResult };
 }
+export {
+  runValidate
+};
+//# sourceMappingURL=validate-Q2NLLQ5G.js.map

package/AGENTS.md

@@ -1,34 +0,0 @@
-# AI Workflow Kit contributor contract
-
-## Purpose
-
-Deliver useful software through proportionate workflow, minimum diff, observed validation, and concise evidence.
-
-## Non-negotiable safety
-
-- Never implement on `main` or `master`.
-- Preserve unrelated dirty work.
-- Run existing relevant validation commands.
-- Never report success after failed or unavailable required validation.
-- Bound remediation and stop when no progress is made.
-- Always await explicit conversational authorization from the human user in the chat before executing any codebase modification, Git commit, tagging, or remote push. Automated system approval hooks (e.g., artifact reviews) do not bypass this human-in-the-loop requirement.
-- Remote push is only permitted on non-protected feature/maintenance branches (e.g. feat/*, fix/*, chore/*, docs/*) with explicit conversational authorization, and is strictly prohibited on protected branches like main or master.
-
-## Routing & Delegation
-
-Atlas routes. Nexus owns discovery, requirements, and spec authoring. Orion owns planning, PR sequencing, and release strategy. Astra implements substantial scoped work. Sage independently validates when risk or full mode justifies separation. Phoenix performs bounded remediation. Delegation must improve the result; do not create agent theatre or claim handoffs that did not occur.
-
-## Modes
-
-- quick: small change, targeted validation, short summary;
-- standard: scoped feature, relevant validation, optional delegation;
-- full: formal planning, specialist implementation, independent validation, persisted evidence.
-
-## Evidence
-
-Quick and standard work require only branch, changed areas, commands/results, and limitations in the handoff. Full/release/audit/security work may persist machine-generated evidence.
-
-## Core Concept
-
-AI Workflow is an npm CLI that installs agents, commands, skills, policies and templates into your repository.
-It guides coding agents from request to implementation, validation and evidence. AI Workflow Kit preserves workflow integrity so coding agents cannot skip from request to code to success without an explicit implementation path, proportional validation, and final evidence.

package/CHANGELOG.md

@@ -1,259 +0,0 @@
-## [2.4.9] - 2026-06-28
-
-### Added
-- Created developer guide `docs/getting-started/authoring-custom-skills.md` for writing and integrating custom capability skills.
-- Enhanced `dist-assets/docs/visual-validation-guide.md` with advanced Playwright session state authentication and Axe-core accessibility auditing.
-
-### Fixed
-- Mapped all legacy skill references (e.g. `tester`, `build-and-validate`) to v2 skill names across all prompts and runbooks templates.
-- Removed obsolete third-party integration guides (`use-napkin-project-memory.md` and `use-linear-for-operational-planning.md`) from packaged runbooks.
-- Removed `read_only_safety_verification.md` from the npm publish files list to reduce package size.
-- Fixed MD029 markdown lint style violation in the visual validation guide.
-
-## [2.4.8] - 2026-06-27
-
-### Added
-- Created 5 new specialized domain skills (`cyber-security`, `database`, `devops`, `localization`, and `performance`) under `.ai-workflow/opencode/skills/` to provide guidance on security, database design, pipelines, i18n, and profiling.
-- Added unit tests for `identity.js`, `canonical-finalization.js`, and `branch-gate.js` exceptions to increase test coverage.
-- Optimized route classifier to automatically trigger appropriate subagent and skill loading rules based on the intent context.
-
-### Fixed
-- Fixed vitest code coverage failures by adjusting thresholds and excludes.
-
-## [2.4.7] - 2026-06-27
-
-### Added
-- Integrated `@vitest/coverage-v8` to compute code coverage, establishing a strict **80% minimum threshold** for lines, functions, branches, and statements in `vitest.config.js`.
-- Added the `npm run test:coverage` script in `package.json` for easy local and CI coverage reporting.
-- Created the official community Code of Conduct template at `.github/CODE_OF_CONDUCT.md` with maintainer contact method.
-- Excluded the `coverage/` directory from git tracking in `.gitignore`.
-
-### Fixed
-- Mitigated shell injection risks in the `cli-remediation-executor.js` by removing the insecure `shell:true` parameter and spawning native subprocess commands directly via platform detection (`npm` on POSIX and `npm.cmd` on Windows).
-- Fixed 3 failing unit tests in `visual-verifier.test.js` to align with the CSS variables flexibilization threshold (>200 chars) introduced in v2.4.6.
-- Documented `ai-workflow clean` limitations regarding the absolute deletion of custom `opencode.jsonc` configs in `cli-reference.md` and `troubleshooting.md`.
-
-### Changed
-- Bumped and updated development dependencies (dev-dependencies group) to their latest stable versions for security and build stability.
-
-## [2.4.6] - 2026-06-25
-
-### Fixed
-- Flexibilized Design System CSS variables check in `ArtifactFidelityGate` to only enforce the validation when CSS rules volume is substantial (>200 characters), preventing false-positive blocks on tiny or simple style additions.
-
-## [2.4.5] - 2026-06-24
-
-### Changed
-- Refined Design System token validation to support both CSS custom property declarations and usages via `var()`, reducing false-positive quality gate blocks on minor style adjustments.
-- Flexibilized `git push` policy to allow remote pushes to non-protected feature/maintenance branches upon explicit human authorization in the chat, keeping `main` and `master` branches strictly protected.
-
-## [2.4.4] - 2026-06-24
-
-### Added
-- Added `clean` CLI command (`aw clean`) to cleanly de-initialize and remove AI Workflow files and symlinks from a project.
-- Translated all E2E test titles and comments in the codebase to English for consistent localization.
-
-## [2.4.3] - 2026-06-24
-
-### Added
-- Hardened agent prompt contract rules and safety gates for all 6 agents (Atlas, Nexus, Orion, Astra, Sage, Phoenix).
-- Hardened workflow procedures and validation checks for core commands (validate, release, deploy, implement, spec-create).
-- Enhanced all 19 default skills with stricter constraint and procedure parameters.
-
-## [2.4.2] - 2026-06-21
-
-### Added
-- Registered `Frontend-Design-System-Specialist` subagent in `opencode.jsonc` templates and configurations.
-- Updated `Astra` agent prompt contract to explicitly load `frontend-design-system` skill when active.
-
-## [2.4.1] - 2026-06-21
-
-### Fixed
-- Hardened visual and accessibility quality gates.
-- Enhanced `ArtifactFidelityGate` to check all skill folder path variations for `frontend-design-system`.
-- Documented Playwright, browser, and Axe-core preconditions in README and quickstart documentation.
-- Improved validation resiliency by warning instead of crashing when browser binaries are missing.
-
-## [2.4.0] - 2026-06-20
-
-### Added
-- Native Visual Evidence capture in `collect-evidence` via `--visual-dist` and `--port` parameters, launching a static loopback server and capturing Chromium screenshots using Playwright.
-- CSS/HTML Design System Gate validation in `ArtifactFidelityGate` that automatically runs when the `frontend-design-system` skill is loaded in the repository, checking for CSS custom properties, inline style density, CDN scripts, and semantic HTML layout tags.
-- Native accessibility auditing command `npx aw validate --a11y` via Axe-core running inside Playwright, blocking critical violations and persisting reports in `.evidence/a11y/report.json`.
-- Standard `frontend-design-system` skill (`.agents/skills/frontend-design-system/SKILL.md`) to guide Astra and other agents through visual hierarchy, spacing grids, theme palettes, accessible contrast, and output rules.
-- Automated tests covering static loopback servers, Playwright screenshots, Axe-core checks, inline style gates, CSS tokens, and HTML semantics.
-
-## [2.3.7] - 2026-06-20
-
-### Changed
-- Bumped version to 2.3.7.
-
-## [2.3.6] - 2026-06-20
-
-### Added
-- Request-aware delivery decision and artifact fidelity gates (GREEN phase) to prevent false-positive completions in frontend/backend stack tasks.
-- Hardened check for blocking delivery decisions in `ArtifactFidelityGate` and `Finalizer`.
-- False-positive regression tests and release readiness audit documentation.
-
-### Fixed
-- Aligned WordPress root detection logic between `DeliveryDecisionEngine` and `ArtifactFidelityGate`.
-- Corrected architecture and design patterns policy relative paths in the technical plan prompt.
-- Normalized approved release decision string to `RELEASE_OR_DEPLOY_APPROVED`.
-
-## [2.3.5] - 2026-06-20
-
-### Fixed
-- Corrected the governance policy relative path header in all standard skill Markdown files.
-
-## [2.3.4] - 2026-06-20
-
-### Fixed
-- Corrected the mapping and resolution path of policies under `opencode/docs`.
-
-## [2.3.3] - 2026-06-20
-
-### Added
-- First phase implementation of the Delivery Decision Engine and Artifact Fidelity Gate checking for correct technology stacks.
-- Hardened PromptContracts and validation scripts for stack-aware quality checking.
-
-## [2.3.2] - 2026-06-19
-
-
-### Documentation
-- Clarified first-time usage with `npx @williambeto/ai-workflow init`.
-- Clarified local installed-package alias usage with `npx aw init`, `npx aw doctor`, and `npx aw run`.
-
-### Notes
-- No CLI behavior changed.
-- No runtime behavior changed.
-
-## [2.3.1] - 2026-06-18
-
-### Fixed
-- Enforced runtime actor selection for explicit actor routing.
-- Prevented silent fallback to default runtime behavior when a selected specialized actor cannot be applied.
-- Blocked specialized actor execution when the runtime does not support `--agent`.
-- Added truthful ledger evidence for requested actor, selected actor, runtime requested actor and runtime applied actor.
-- Hardened routing consistency validation across agents, runtime adapter and delegation ledger.
-
-### Added
-- Unit tests covering OpenCode runtime actor enforcement and fail-closed checks.
-- E2E coverage for explicit actor routing, blocked fallbacks and default non-specialized execution.
-- Updated routing consistency validation to catch unsupported actor execution returning success.
-
-### Release
-- Prepared locally only.
-- Not published to npm.
-- No git tag created.
-- No remote push performed.
-
-## [2.3.0] - 2026-06-16
-
-### Added
-- Isolated read-only workspace runner to prevent execution modifications from altering the original repository.
-- Sage validation agent execution in full/deep task mode, logging events to the ledger and handling revalidation.
-- Real OpenCode smoke test integration inside the `release:verify` suite.
-- Scenario 17 in E2E tests verifying the complete multi-agent coordination loop (`Astra -> Sage -> Phoenix -> Sage`).
-
-### Fixed
-- Sequential state transitions for read-only runs (`IMPLEMENTING -> IMPLEMENTED -> VALIDATING -> COMPLETED`).
-- Snapshot comparison logic to correctly target `.snapshot.files` and compare `.sha256` properties.
-- Bypassed physical writing of ledger histories and handoff markdown files during read-only executions.
-- Injected mock OpenCode environment configuration inside `verify-packed-consumer.mjs` for autonomous sandbox runs.
-
-## [2.0.5] - 2026-06-08
-
-### Fixed
-
-- Locked standard/full Atlas completion behind current-task Sage, Evidence Collector, and QualityGuard execution.
-- Rejected direct Atlas `PASS`, user-deferred `/validate`, self-validation, and missing executable finalizer paths.
-- Added canonical cross-field validation for branch evidence, owners, artifacts, truthfulness, collector/final status, and Phoenix/Sage consistency.
-- Strengthened fictitious-product claim detection for unsupported market superlatives, pricing, SLA/support, API, batch, and export capabilities.
-- Added regression tests for runtime completion lock and internally inconsistent canonical results.
-
-## [2.0.3] - 2026-06-08
-
-### Added
-
-- Lightweight workflow profiles separating execution mode from domain quality guidance.
-- Deterministic profile routing for frontend product, frontend utility, backend API, refactor, documentation, and security review work.
-- Objective owner-completion contract with one bounded resume before `BLOCKED`.
-- Consumer workflow profile documentation.
-
-### Changed
-
-- Visual validation now uses objective rendered checks instead of subjective labels or benchmark comparison.
-- Frontend product and utility profiles load both frontend and UI/UX skills without imposing a fixed SaaS page template.
-- Product Truthfulness accepts clear page-level conceptual labels for non-authoritative commercial concepts while keeping official/live/security/SLA claims strict.
-- Atlas handoff guidance is shorter and outcome-first.
-
-# Changelog
-
-## [2.0.4] - 2026-06-08
-
-### Fixed
-
-- Removed circular finalization evidence by deriving canonical results from executed policy checks and persisting them in `EVIDENCE.json`.
-- Enforced all canonical standard/full final response fields from one machine-readable contract.
-- Persisted and rendered delegation owners, loaded skills, delivery artifacts, Sage revalidation, Evidence Collector, QualityGuard, Product Truthfulness, finalizer, and terminal status.
-- Required structured TypeScript waivers with an explicit source and concrete constraint.
-- Added regression coverage for omitted fields, direct finalizer bypass, remediation without Sage revalidation, and canonical status spelling.
-
-
-## 2.0.2
-
-### Fixed
-
-- Enforced mode-specific final delivery artifacts so `standard` cannot pass with `delivery-summary.md`.
-- Added mandatory finalization evidence for collector, QualityGuard, Product Truthfulness, delegation, and finalizer identity.
-- Prevented `PASS` when canonical finalization fields are missing or inconsistent.
-- Added direct tests for standard artifact mismatch and finalization evidence.
-- Kept bounded remediation responsible for correcting final-gate failures before promotion.
-
-## 2.0.1
-
-### Fixed
-
-- Added bounded, progress-aware remediation for recoverable quality and delegation gates.
-- Prevented unresolved gate failures from being downgraded to `PASS_WITH_NOTES`.
-- Added hard remediation limits by execution mode and blocking on repeated/no-progress findings.
-- Synchronized the root evidence contract with the canonical distributed contract.
-- Added direct coverage for implementation documentation and remediation lifecycle behavior.
-
-## 2.0.0
-
-### Added
-
-- OpenCode-first workflow with six primary ownership roles.
-- Proportional `quick`, `standard`, and `full` delivery modes.
-- Persisted delivery artifacts and executable evidence collection.
-- Branch recovery, quality gates, delegation statuses, Product Truthfulness, and safe packaging.
-- TypeScript default for new frontend applications unless explicitly waived.
-- Consumer quickstart, runtime compatibility guidance, and v2 upgrade documentation.
-- Optional Codex, Claude Code, and Gemini adapter assets.
-
-### Changed
-
-- Public version identity is now aligned with the npm upgrade path from `1.x` to `2.0.0`.
-- Active documentation describes only the current 2.0 product and supported migration path.
-- Repository-maintenance paths are separated from consumer-facing paths.
-- The initial `2.0.0` rollout uses the npm `next` dist-tag without moving `latest`.
-
-### Removed
-
-- Obsolete pre-2.0 runtime guidance, taxonomies, aliases, package paths, and intermediate release-candidate documentation.
-
-## Previous public releases
-
-The previous npm line ends at `1.19.1`. Detailed historical changes remain available in Git history and GitHub Releases.
-
-## 2.1.0
-
-### Changed
-
-- Recovered the original product direction: proportionate workflows, useful software, and concise evidence.
-- Kept protected-branch enforcement, required validation execution, bounded remediation, and false-success prevention as non-negotiable guardrails.
-- Removed mandatory canonical response fields, owner JSON, fixed delivery filenames, and persisted evidence from quick/standard work.
-- Simplified Atlas to route and coordinate without forcing multi-agent ceremony.
-- Simplified QualityGuard to objective branch, validation, documentation, UI-evidence, and full-mode persistence checks.
-- Replaced keyword-driven Product Truthfulness enforcement with semantic guidance.

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 AI Workflow Kit contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/PUBLISH_MANIFEST.json

@@ -1,34 +0,0 @@
-{
-  "name": "ai-workflow-publish-manifest",
-  "version": "1.0.0",
-  "layers": {
-    "core": [
-      "bin/**",
-      "src/**",
-      "package.json",
-      "opencode.jsonc"
-    ],
-    "assets": [
-      "dist-assets/skills/**",
-      "dist-assets/agents/**",
-      "dist-assets/commands/**",
-      "dist-assets/prompts/**",
-      "dist-assets/templates/**",
-      "dist-assets/schemas/**",
-      "dist-assets/runbooks/**",
-      "dist-assets/harness/**",
-      "dist-assets/docs/**",
-      "dist-assets/examples/**",
-      "dist-assets/AGENTS.md"
-    ]
-  },
-  "exclude": [
-    "internal/**",
-    "**/tests/**",
-    "**/evidence/**",
-    "**/*.original.md",
-    ".git/**",
-    ".ai-workflow/**",
-    "node_modules/**"
-  ]
-}