Repository

aiwg

Cognitive architecture for AI-augmented software development. Specialized agents, structured workflows, and multi-platform deployment. Claude Code · Codex · Copilot · Cursor · Factory · Warp · Windsurf.

Claim
Evidence
84% cost reduction with human-in-the-loop vs fully autonomous
Agent Laboratory study
47% workflow failure rate without reproducibility constraints
R-LAM evaluation
0% citation hallucination with retrieval-first vs 56% generation-only
LitLLM benchmarks

Specs

  • ClaimEvidence
  • 84% cost reduction with human-in-the-loop vs fully autonomousAgent Laboratory study
  • 47% workflow failure rate without reproducibility constraintsR-LAM evaluation
  • 0% citation hallucination with retrieval-first vs 56% generation-onlyLitLLM benchmarks
  • 17.9% accuracy improvement with multi-path reviewGSM8K benchmarks
  • 18.5x improvement with tree search on planning tasksGame of 24 results
  • PartnerInstall
  • FrameworkAgents
  • AddonWhat It Does
  • RLMRLM
  • Writing QualityWriting Quality
  • Testing QualityTesting Quality
  • Voice FrameworkVoice Framework
  • UAT-MCP ToolkitUAT-MCP Toolkit
  • AIWG EvalsAIWG Evals
  • Agent LoopAgent Loop
  • Agentic InstallerAgentic Installer
  • AIWG DevAIWG Dev
  • DaemonDaemon
  • Compound MemoryCompound Memory
  • Line MemoryLine Memory
  • LLM WikiLLM Wiki
  • NLP ProdNLP Prod
  • Prose IntegrationProse Integration
  • Semantic MemorySemantic Memory
  • Context CuratorContext Curator
  • Verbalized SamplingVerbalized Sampling
  • Guided ImplementationGuided Implementation
  • Skill FactorySkill Factory
  • Doc IntelligenceDoc Intelligence
  • Color PaletteColor Palette
  • Auto MemoryAuto Memory
  • Agent PersistenceAgent Persistence
  • AIWG HooksAIWG Hooks
  • AIWG UtilsAIWG Utils
  • Droid BridgeDroid Bridge
  • AIWG FleetAIWG Fleet
  • Browser ControlBrowser Control
  • Twelve-FactorTwelve-Factor
  • Star PromptStar Prompt

README

AIWG — multi-agent AI framework · one source of truth · 10 platforms # AIWG **Multi-agent AI framework for Claude Code, Copilot, Cursor, Warp, and 6 more platforms** 200+ agents, 109+ CLI commands, 400+ deployable agent/skill/command/rule artifacts, 8 core frameworks, 32 addons, and a 40-plugin Claude Code marketplace. SDLC workflows, digital forensics, research management, marketing operations, media curation, ops infrastructure, knowledge base, and fine-tuning dataset curation — all deployable with one command. The simplest setup is to paste this into a supported AI provider: ```text Install or repair AIWG for this project by following https://aiwg.io/setup.aiwg.yaml Explain the plan before changing anything, preserve my existing work, and ask me only for choices you cannot safely determine. ``` The installer detects old, broken, duplicate, and development-mode installs, then guides you through repair or update. It deploys the preferred complete system with one self-verifying `aiwg use all` command. That command refreshes the indices, regenerates project context, verifies the resulting deployment, and reports whether a provider reload is actually required. For secure long-running agents, install AIWG Cockpit with a self-hosted Agentic Sandbox executor you control and audit: ```text Install or repair AIWG Cockpit and Agentic Sandbox by following https://aiwg.io/agentic-sandbox/setup.aiwg.yaml Install the required prerequisites, explain the plan before changing anything, preserve my existing work, and ask me about the isolation, network, storage, and access choices you cannot safely determine. ``` This option audits the host, installs the approved Docker or KVM/libvirt runtime and sandbox prerequisites, connects Cockpit to the real executor, applies your resource and access choices, and verifies the control and audit path end to end. If you prefer to install manually: ```bash npm i -g aiwg cd /path/to/your/project aiwg use all --provider ``` Replace `` with your AI tool's name, such as `claude`, `codex`, `copilot`, or `cursor`. The final command deploys, indexes, connects, verifies, and reports one outcome. The standalone index, regenerate, status, and doctor commands remain available for advanced maintenance and troubleshooting; they are not extra install steps. For the complete beginner path and provider-name table, see [Install, Connect, and Verify](docs/getting-started/install-connect-verify.md). For a smaller CLI install that resolves signed, versioned resources from the release host: ```bash npm i -g @aiwg/cli aiwg discover "architecture evolution" aiwg show skill architecture-evolution ``` See [Web-Backed AIWG Resources](docs/install/web-backed-resources.md) for source selection, exact-version overrides, cache verification, offline use, and the current framework-graph constraints. Then ask your AI assistant to set up the project for AIWG. The agent-led setup conversation should establish remotes, issue storage, delivery behavior, signing policy, and provider choices; the assistant may call `aiwg setup project` as the underlying CLI helper. macOS users: if npm fails with `EACCES` under `/usr/local/lib/node_modules`, use the [macOS Install Guide](docs/getting-started/macos-install.md). Agents and stewards setting up AIWG end-to-end should use the [Agentic Install Runbook](docs/agentic-install-runbook.md). [![npm version](https://img.shields.io/npm/v/aiwg/latest?label=npm&color=CB3837&logo=npm&style=flat-square)](https://www.npmjs.com/package/aiwg) [![npm downloads](https://img.shields.io/npm/dm/aiwg?color=CB3837&logo=npm&style=flat-square)](https://www.npmjs.com/package/aiwg) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?style=flat-square)](LICENSE) [![GitHub Stars](https://img.shields.io/github/stars/jmagly/aiwg?style=flat-square)](https://github.com/jmagly/aiwg/stargazers) [![Node Version](https://img.shields.io/badge/node-%E2%89%A520.0.0-brightgreen?style=flat-square&logo=node.js)](https://nodejs.org) [![TypeScript](https://img.shields.io/badge/TypeScript-5.x-blue?style=flat-square&logo=typescript)](https://www.typescriptlang.org) [![10 Platforms](https://img.shields.io/badge/Platforms-10-purple?style=flat-square)](#-platform-support) [![Built With AIWG](https://aiwg.io/assets/badges/built-with-aiwg-dark.png)](https://aiwg.io/badges) [**Get Started**](#quick-start) · [**Features**](#what-you-get) · [**Agents**](#agents) · [**Documentation**](#documentation) · [**Community**](#community--support) · [**Badges**](https://aiwg.io/badges) [![Discord](https://img.shields.io/badge/Discord-Join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/BuAusFMxdA) [![Telegram](https://img.shields.io/badge/Telegram-Join-26A5E4?logo=telegram&logoColor=white&style=flat-square)](https://t.me/+oJg9w2lE6A5lOGFh)

Installation Troubleshooting

Optional native features

The base global install intentionally excludes native packages whose lifecycle
scripts require explicit trust. Core deployment, discovery, and provider tooling
work without them. Enable only the capability you need:

aiwg features install pty         # builds node-pty for local interactive terminals
aiwg features install embeddings  # builds hnswlib-node for dense semantic search
aiwg features install graph       # enables the Graphology artifact backend
aiwg features install terminal    # enables auditable headless PTY screen parsing
aiwg doctor                       # verifies the native entry points actually load

The feature installer writes a private manifest and lockfile under the AIWG user
data directory and approves scripts only for that feature. Do not set a broad
user-level npm allow-scripts policy. If an older install left native package
files present but unbuilt, aiwg doctor reports the broken capability and the
same scoped rebuild command.

macOS npm EACCES

If npm install -g aiwg fails with EACCES while writing to
/usr/local/lib/node_modules/aiwg, npm is using a system-owned global install
directory. The recommended Mac path is Node 24 through nvm, then:

npm install -g aiwg
aiwg --version

If Node is already installed and you need a quick recovery, use npm's current
user-owned prefix guidance:

npm config set prefix ~/.local
echo 'PATH="$HOME/.local/bin:$PATH"' >> ~/.profile
echo 'source ~/.profile' >> ~/.zprofile
source ~/.profile
npm install -g aiwg

See macOS Install Guide for the full
walkthrough. Avoid sudo npm install -g aiwg as the default fix; it can create
root-owned npm files that break later upgrades.

aiwg command not found

If aiwg is not found after npm i -g aiwg, the npm global bin directory is not on your PATH. Confirm and fix:

which aiwg                              # empty? PATH is the issue
npm config get prefix                   # find npm's global prefix (bin lives under here)
echo 'export PATH="$(npm config get prefix)/bin:$PATH"' >> ~/.zshrc   # or ~/.bashrc
source ~/.zshrc                         # or restart your shell

You can also invoke AIWG without adjusting PATH by using npx aiwg <command>. For a broader health check — version, deployed providers, missing dependencies, kernel-skill probes — run aiwg doctor, which surfaces the same PATH guidance on every invocation if the binary isn't reachable.


What AIWG Is

AIWG is a deployment tool and support utility for AI context. At its core, aiwg use copies markdown and YAML source files into the specific paths each AI platform looks in — .claude/agents/, .agents/skills/, .cursor/rules/, .github/prompts/, and six more — so one source of truth works across 10 platforms.

Around that core, AIWG ships agent-facing utilities for things the base platforms do not handle on their own: persistent artifact memory (.aiwg/), background orchestration, autonomous loops, artifact indexing, cost telemetry, health diagnostics, and more. These are tools the agent calls when you ask for something AIWG-shaped — you stay in chat. Most are opt-in. The deployment layer works standalone as plain text files the platform reads natively.

aiwg use supports project deployments, additive user mirrors, and a
user-global bootstrap:

  • Project scope — default. Run aiwg use all --provider <provider> from a project root and the artifacts land in that provider's project paths. One project's agent set never bleeds into another's session. This is the recommended default for new users.
  • User scope (additive mirror) — aiwg use all --provider <provider> --scope user keeps the
    project deployment and mirrors it to ~/.claude/agents/,
    ~/.claude/skills/, etc.
  • Global bootstrap — aiwg use all --provider claude --global installs
    framework and kernel assets in native user-level paths while leaving only
    lightweight context and provider bootstrap files in the current project.
    Use aiwg regenerate --provider <name> to wire additional projects without
    deploying their own skill copies.

The trade-off is real: when the same agent set loads into every session, context from one project can bleed into reasoning about another. Research (REF-720, Lost in Multi-Turn Conversation, MSR/Salesforce 2025) measured a 39% capability drop when this happens. The non-blocking project-isolation warning surfaces the trade-off at deploy time so the scope choice is informed. Neither scope is wrong; pick the one that fits the workflow.

See the Agentic Install Runbook for the
zero-to-running setup path, and https://github.com/jmagly/aiwg/blob/main/docs/cli/reference.md (under aiwg use →
"Scope models") for the per-provider details and the global-install rough-edge
inventory.

Simple Building Blocks

AIWG ships five primitive artifact types. All are plain text:

  • Agents — specialized personas (Security Auditor, Test Architect) with a scoped toolset
  • Skills — natural-language workflows the platform auto-invokes on trigger phrases
  • Commands — explicit slash invocations (/flow-security-review-cycle)
  • Rules — enforcement directives the platform loads into every session
  • Behaviors — lifecycle hooks that fire on events (pre-write, post-session)

Each is a single .md file with YAML frontmatter. Nothing executes until an AI platform reads it.

Why It Compounds

Because the primitives are text, they compose without runtime coordination:

  • One agent file becomes one member of a 180-agent SDLC team that reviews architecture, tests, security, and compliance in parallel.
  • One skill becomes a natural-language entry point — "run security review" routes to the right multi-agent flow on every platform that supports skills.
  • One framework (SDLC, forensics, marketing) bundles dozens of agents + skills + rules + templates that cross-reference each other. Deploying a framework deploys a working multi-agent ecosystem.
  • The .aiwg/ directory gives those agents a shared memory — artifacts from Monday's requirements session are read by Thursday's test design.
  • Flows orchestrate Primary Author → Parallel Reviewers → Synthesizer → Archive patterns that no single-prompt workflow can match.

The leverage is not in any one file. It is that hundreds of small files — each independently readable and editable — snap together into workflows that would otherwise take a bespoke agent platform to build.

This is also where the research background lives. AIWG implements patterns from cognitive science (Miller 1956, Sweller 1988), multi-agent systems (Jacobs et al. 1991, MetaGPT, AutoGen), and software engineering (Cooper's stage-gate, FAIR Principles, W3C PROV) — applied as file conventions and deployment rules, not as a runtime you depend on.

How You Actually Use AIWG

The user surface is the conversation with your AI tool. You install AIWG, deploy a framework, and then talk to the agent normally — "help me start a project", "run a security review", "find me a deploy workflow." The agent does the AIWG-specific work for you.

The CLI exists mostly for the agent to call under the hood. The commands a user typically runs by hand are a short list:

  • aiwg use <framework> — deploy AIWG to your project (one-time per framework, per project)
  • Project setup agent/skill — recommended guided setup conversation for repo, tracker, delivery, signing, and provider policy
  • aiwg wizard — guided first-run goal routing
  • aiwg new <project> — scaffold a new project
  • aiwg status — what's deployed and engaged in this workspace
  • aiwg doctor — health check
  • aiwg refresh — keep the install current

Everything else is agent territory. Discovery (aiwg discover), artifact lookup (aiwg show), the index, agent loops, mission control, MCP — those are tools the agent invokes during a chat when you ask for something AIWG-shaped. You stay in the conversation; the agent handles the lookups, runs the loops, and reports back.

Turn the agent-side tooling on (it's on by default once you aiwg use) when you want persistence, parallelism, or automation. Turn it off and the deployed agents, skills, and rules still work — they are still text files the platform reads natively.

What AIWG Is Not

  • Not a prompt library. Prompts are the artifacts, not the product. The product is placing the right prompts where the platform finds them.
  • Not an LLM runtime. AIWG never calls a model. The AI platform you already use does that; AIWG configures what it sees.
  • Not a framework you import into your app. Nothing is imported at build time. Your project gets a .aiwg/ directory (artifacts) and a few provider-specific context dirs (deployed copies). Delete them and your app is unchanged.

Who It's For

If you have used AI coding assistants and thought "this is amazing for small tasks but falls apart on anything complex," AIWG is the missing infrastructure layer that scales AI assistance to multi-week projects.


What Problems Does AIWG Solve?

Base AI assistants (Claude, GPT-4, Copilot without frameworks) have three fundamental limitations:

1. No Memory Across Sessions

Each conversation starts fresh. The assistant has no idea what happened yesterday, what requirements you documented, or what decisions you made last week. You re-explain context every morning.

Without AIWG: Projects stall as context rebuilding eats time. A three-month project requires continuity, not fresh starts every session.

With AIWG: The .aiwg/ directory maintains 50-100+ interconnected artifacts across days, weeks, and months. Later phases build on earlier ones automatically because memory persists. Agents read prior work via @-mentions instead of regenerating from scratch.

The segmented structure also makes large projects tractable. As code files grow, the project doesn't become harder to reason about — agents load only the slice of memory relevant to the current task (@requirements/UC-001.md, @architecture/sad.md, @testing/test-plan.md) rather than the entire codebase. Each subdirectory is a focused knowledge domain that fits comfortably in context, while cross-references keep everything connected.

The artifact index (aiwg index) takes this further. Without any tooling, agents often need to browse 3-6 documents before finding what they need. AIWG's structured artifacts reduce this to 2-3. With the index enabled, agents resolve artifact lookups in one query more often than not — a direct hit on the right requirement, architecture decision, or test case without browsing.

2. No Recovery Patterns

When AI generates broken code or flawed designs, you manually intervene, explain the problem, and hope the next attempt works. There is no systematic learning from failures, no structured retry, no checkpoint-and-resume.

Without AIWG: Research shows 47% of AI workflows produce inconsistent outputs without reproducibility constraints (R-LAM, Sureshkumar et al. 2026). Debugging is trial-and-error.

With AIWG: The agent loop implements closed-loop self-correction — execute, verify, learn from failure, adapt strategy, retry. External Ralph survives crashes and runs for 6-8+ hours autonomously. Debug memory accumulates failure patterns so the agent doesn't repeat mistakes.

3. No Quality Gates

Base assistants optimize for "sounds plausible" not "actually works." A general assistant critiques security, performance, and maintainability simultaneously — poorly. No domain specialization, no multi-perspective review, no human approval checkpoints.

Without AIWG: Production code ships without architectural review, security validation, or operational feasibility assessment.

With AIWG: 162 specialized agents provide domain expertise — Security Auditor reviews security, Test Architect reviews testability, Performance Engineer reviews scalability. Multi-agent review panels with synthesis. Human-in-the-loop gates at every phase transition. Research shows 84% cost reduction keeping humans on high-stakes decisions versus fully autonomous systems (Agent Laboratory, Schmidgall et al. 2025).


The Six Core Components

1. Memory — Structured Semantic Memory

The .aiwg/ directory is a persistent artifact repository storing requirements, architecture decisions, test strategies, risk registers, and deployment plans across sessions. This implements Retrieval-Augmented Generation patterns (Lewis et al., 2020) — agents retrieve from an evolving knowledge base rather than regenerating from scratch.

Each artifact is discoverable via @-mentions (e.g., @.aiwg/requirements/UC-001-login.md). Context sharing between agents happens through artifacts: the requirements analyst writes use cases, the architecture designer reads them.

2. Reasoning — Multi-Agent Deliberation with Synthesis

Instead of a single general-purpose assistant, AIWG provides 162 specialized agents organized by domain. Complex artifacts go through multi-agent review panels:

Architecture Document Creation:
  1. Architecture Designer drafts SAD
  2. Review Panel (3-5 agents run in parallel):
     - Security Auditor    → threat perspective
     - Performance Engineer → scalability perspective
     - Test Architect       → testability perspective
     - Technical Writer     → clarity and consistency
  3. Documentation Synthesizer merges all feedback
  4. Human approval gate → accept, iterate, or escalate

Research shows 17.9% accuracy improvement with multi-path review on complex tasks (Wang et al., GSM8K benchmarks, 2023). Agent specialization means security review is done by a security specialist, not a generalist.

3. Learning — Closed-Loop Self-Correction (Ralph)

Ralph executes tasks iteratively, learns from failures, and adapts strategy based on error patterns. Research from Roig (2025) shows recovery capability — not initial correctness — predicts agentic task success.

Ralph Iteration:
  1. Execute task with current strategy
  2. Verify results (tests pass, lint clean, types check)
  3. If failure: analyze root cause → extract structured learning → adapt strategy
  4. Log iteration state (checkpoint for resume)
  5. Repeat until success or escalate to human after 3 failed attempts

External Ralph adds crash resilience: PID file tracking, automatic restart, cross-session persistence. Tasks run for 6-8+ hours surviving terminal disconnects and system reboots.

4. Verification — Bidirectional Traceability

AIWG maintains links between documentation and code to ensure artifacts stay synchronized:

// src/auth/login.ts
/**
 * @implements @.aiwg/requirements/UC-001-login.md
 * @architecture @.aiwg/architecture/SAD.md#section-4.2
 * @tests @test/unit/auth/login.test.ts
 */
export function authenticateUser(credentials: Credentials): Promise<AuthResult> {

Verification types: Doc → Code, Code → Doc, Code → Tests, Citations → Sources. The retrieval-first citation architecture reduces citation hallucination from 56% to 0% (LitLLM benchmarks, ServiceNow 2025).

5. Planning — Phase Gates with Cognitive Load Management

AIWG structures work using Cooper's Stage-Gate methodology (1990), breaking multi-month projects into bounded phases with explicit quality criteria and human approval:

Inception → Elaboration → Construction → Transition → Production
   LOM          ABM            IOC            PR

Cognitive load optimization follows Miller's 7±2 limits (1956) and Sweller's worked examples approach (1988):

  • 4 phases (not 12)
  • 3-5 artifacts per phase (not 20)
  • 5-7 section headings per template (not 15)
  • 3-5 reviewers per panel (not 10)

6. Style — Controllable Voice Generation

Voice profiles provide continuous control over AI writing style using 12 parameters (formality, technical depth, sentence variety, jargon density, personal tone, humor, directness, examples ratio, uncertainty acknowledgment, opinion strength, transition style, authenticity markers).

Built-in voices: technical-authority (docs, RFCs), friendly-explainer (tutorials), executive-brief (summaries), casual-conversational (blogs, social). Create custom voices from your existing content with /voice-create.


A Real Project Walkthrough

Here is how the six components work together across a project lifecycle. How long each phase takes depends entirely on the project — AIWG is a force multiplier, not a clock. Most projects arrive at a complete, reviewed document set in hours to a day. What takes time is the human work that matters: reviewing, editing, and making decisions. The more input your team provides, the better the output. AIWG memory lets operators participate through the tools they already use — industry-standard documents and templates, issues, and knowledge bases.

Inception

/intake-wizard "Build customer portal with real-time chat" --interactive

Memory: Intake forms capture goals, constraints, stakeholders in .aiwg/intake/
Planning: Executive Orchestrator guides through structured questionnaire
Reasoning: Requirements Analyst drafts initial use cases, Product Designer reviews UX
Verification: Requirements reference intake forms, ensuring alignment
Human Gate: Stakeholder reviews intake → approves transition to Elaboration

Elaboration

/flow-inception-to-elaboration

Memory: Architecture doc, ADRs, threat model, test strategy accumulate in .aiwg/
Reasoning: Multi-agent review panel — Architecture Designer drafts, Security Auditor + Performance Engineer + Test Architect critique in parallel, Documentation Synthesizer merges
Learning: Ralph iterates on ADRs (generate options, evaluate against constraints, refine)
Style: Technical documents use technical-authority, stakeholder summaries use executive-brief
Human Gate: Architect reviews SAD, security team approves threat model

Construction

/flow-elaboration-to-construction
/ralph "Implement authentication module" --completion "npm test passes"

Learning: Ralph handles implementation iterations — execute, verify (run tests), learn ("async race condition in token refresh"), adapt (add synchronization), retry
Verification: Code references requirements (@implements UC-001), tests reference code
Memory: Test plans, implementation, deployment scripts accumulate across iterations
Human Gate: Code review approves merges, QA approves test results

Transition

/flow-deploy-to-production
/flow-hypercare-monitoring 14

Planning: Deployment checklist — monitoring, rollback plan, incident response
Learning: Ralph retries deployment steps if validation fails
Verification: Deployment scripts reference architecture (which services, what order)
Human Gate: Operations team reviews deployment plan → approves production release


Quantified Claims and Evidence

AIWG makes specific, falsifiable claims backed by peer-reviewed research:

Claim Evidence Source
84% cost reduction with human-in-the-loop vs fully autonomous Agent Laboratory study Schmidgall et al. (2025)
47% workflow failure rate without reproducibility constraints R-LAM evaluation Sureshkumar et al. (2026)
0% citation hallucination with retrieval-first vs 56% generation-only LitLLM benchmarks ServiceNow (2025)
17.9% accuracy improvement with multi-path review GSM8K benchmarks Wang et al. (2023)
18.5x improvement with tree search on planning tasks Game of 24 results Yao et al. (2023)

Full references: docs/research/


When to Use AIWG (and When Not To)

Good Fit

Multi-week or multi-month projects where requirements evolve, multiple stakeholders have different concerns, quality gates are required, auditability matters, or context exceeds conversation limits.

Examples: New product features with architecture/security/operational implications, legacy system migrations requiring phased rollback strategies, research projects needing literature review and reproducibility, compliance-heavy domains (healthcare, finance, aerospace) needing audit trails.

Not the Best Fit

Single-session tasks where no memory is needed, quality gates are overkill, and overhead exceeds value.

Examples: "Write a Python script to parse this CSV," "Fix this typo," "Explain how this code works."

The Trade-off

AIWG adds structure (templates, phases, gates) that slows trivial tasks but scales to complex multi-week workflows. If your project fits in a single conversation, use a base assistant. If it spans days, weeks, or months, AIWG provides the infrastructure to maintain quality and context.

User intent → AIWG CLI → Deploy agents + rules + templates → AI platform
                │                                                │
                ▼                                                ▼
         "aiwg use all --provider X"                  Claude Code / Copilot /
                │                                     Cursor / Warp / Factory /
                ▼                                  OpenCode / Codex / Devin Desktop
         ┌──────────────┐
         │ 188 Agents   │  Specialized AI personas with domain expertise
         │ 50 Commands  │  CLI + slash commands for workflow automation
         │ 128 Skills   │  Natural language workflow triggers
         │ 35 Rules     │  Enforcement patterns (security, quality, anti-laziness)
         │ 334 Templates│  SDLC artifact templates with progressive disclosure
         └──────────────┘
                │
                ▼
         .aiwg/ artifacts ← Persistent project memory across sessions

How It Works

For visual diagrams of AIWG's architecture, deploy flow, and discovery model, see docs/architecture-overview.md. The prose walkthrough lives in docs/how-it-works.md.

At a glance — AIWG is a deploy-time tool. aiwg use copies plain-text files into your AI platform's native directories and exits. Nothing runs in the background; the AI platform's own loader handles everything from there.

flowchart LR
  subgraph Source["AIWG framework source"]
    direction TB
    KERN[25 kernel skills<br/>within provider listing budgets]
    STD[~455 standard skills<br/>read from $AIWG_ROOT]
    AGENT[200+ agents]
    RULES[60+ rules]
    TPL[100+ templates]
  end

  CLI([aiwg use all<br/>--provider X]) --> DEPLOY

  subgraph DEPLOY["Deploy step (one-shot)"]
    direction TB
    COPY[Copy kernel skills, agents,<br/>rules to provider-native dirs]
    INDEX[Build artifact index<br/>~/.local/share/aiwg/index/]
    CTX[Emit AIWG.md + AGENTS.md<br/>at project root]
  end

  Source --> CLI
  DEPLOY --> Project

  subgraph Project["Your project (after deploy)"]
    direction TB
    PLAT[.claude/skills/<br/>.codex/agents/<br/>.warp/agents/ ...]
    AIWGMD[AIWG.md / .hermes.md /<br/>WARP.md / AGENTS.md]
    ART[.aiwg/<br/>requirements/<br/>architecture/<br/>...]
  end

  Project --> SESS

  subgraph SESS["AI session (Claude / Codex / Hermes / etc.)"]
    direction TB
    NATIVE[Platform-native loader<br/>reads provider dir]
    DISC([Optional: aiwg discover<br/>+ aiwg show])
  end

  classDef optional stroke-dasharray: 5 5,fill:#fef9e7
  class DISC optional
  class INDEX optional

Multi-agent orchestration — once deployed, AIWG coordinates specialized agents through phase-gated workflows:

You: "transition to elaboration phase"

AIWG: [Step 1] Requirements Analyst   → Analyze vision document, generate use case briefs
      [Step 2] Architecture Designer  → Baseline architecture, identify technical risks     } parallel
      [Step 3] Security Architect     → Threat model, security requirements                 }
      [Step 4] Documentation Synth.   → Merge reviews into Architecture Baseline Milestone
      [Step 5] Human Gate             → GO / CONDITIONAL_GO / NO_GO decision
      [Step 6] → Next phase or iterate

The orchestration pattern: Primary Author → Parallel Reviewers → Synthesizer → Human Gate → Archive. Agents run in parallel where possible, with human-in-the-loop checkpoints at phase transitions.


Features

  • 188 specialized agents — domain experts across testing, security, architecture, DevOps, cloud, frontend, backend, data engineering, documentation, and more
  • 50 CLI commands — framework deployment, project scaffolding, iterative execution, metrics, reproducibility validation
  • 128 workflow skills — natural language triggers for regression testing, forensics, voice profiles, quality gates, and CI/CD integration
  • 35 enforcement rules — anti-laziness detection, token security, citation integrity, executable feedback, failure mitigation across 6 LLM archetypes
  • 334 artifact templates — progressive disclosure templates for requirements, architecture, testing, security, deployment, and more
  • Multi-platform support — deploy to Claude Code, Copilot, Cursor, Warp, Factory AI, OpenCode, Codex, Devin Desktop, OpenClaw, Hermes, and OpenHuman
  • 8 core frameworks + training marketplace package — SDLC, Digital Forensics, Marketing Operations, Research Management, Media Curation, Ops Infrastructure, Knowledge Base, Security Engineering, plus aiwg-training for fine-tuning dataset curation (corpus-to-dataset pipeline with DPO/KTO/ORPO/SimPO export)
  • 32 addons — compound memory, line memory, llm-wiki (Obsidian-native knowledge base), RLM recursive decomposition, fleet operations, browser control, testing quality, and more
  • 40 Claude Code plugins — the complete framework and addon catalog is installable independently from the AIWG marketplace
  • Agent Loop — iterative task execution with automatic error recovery and crash resilience (6-8 hour sessions)
  • RLM addon — recursive context decomposition for processing 10M+ tokens via sub-agent delegation
  • YAML metalanguage — declarative schema-validated workflow definitions (JSON Schema 2020-12)
  • MCP server — Model Context Protocol integration for tool-based AI workflows
  • Bidirectional traceability — @-mention system linking requirements → architecture → code → tests
  • FAIR-aligned artifacts — W3C PROV provenance, GRADE quality assessment, persistent REF-XXX identifiers
  • Reproducibility validation — deterministic execution modes, checkpoints, configuration snapshots

Quick Start

Prerequisites: Node.js >=20.0.0 and an AI platform (Claude Code, GitHub Copilot, Cursor, Warp Terminal, or others). New installs should prefer Node 24. See Prerequisites Guide for details.

Verifying releases (v2026.5.3+): Every AIWG release ships with Sigstore-anchored npm provenance, a signed git tag, a cosign keyless tarball signature, and a signed CycloneDX SBOM. Verification is optional but recommended:

npm view [email protected] --json | jq .dist.attestations

Full walkthrough at docs/releases/verifying.md. Adopt the same pattern for your own packages: docs/security/supply-chain-hardening.md.

Install & Deploy

# Install globally
npm install -g aiwg

# Deploy to your project
cd your-project
aiwg use sdlc              # Full SDLC framework (98 agents, 38 rules, 200+ templates)
aiwg use forensics         # Digital forensics & incident response (13 agents, 10 skills)
aiwg use marketing         # Marketing operations (37 agents, 87+ templates)
aiwg use media-curator     # Media archive management (6 agents, 9 commands)
aiwg use research          # Research workflow automation (8 agents, 8-stage pipeline)
aiwg use rlm               # RLM addon (recursive context decomposition)
aiwg use all               # Everything

# Existing projects: preview, then transactionally extract the canonical graph
aiwg regenerate --existing-project --dry-run
aiwg regenerate --existing-project --apply
aiwg workspace-context doctor

# Recommended default: inspect project state and select the safe branch
aiwg regenerate --dry-run
aiwg regenerate

# Fresh or already-migrated projects: ordinary canonical refresh
aiwg regenerate --workspace

# Legacy compatibility only: inline AIWG context in provider startup files
aiwg regenerate --full-inject

# Or scaffold a new project
aiwg new my-project

# Check installation health
aiwg doctor

Customize Without Forking

Author project-specific rules, skills, agents, addons, or frameworks
directly under .aiwg/{extensions,addons,frameworks}/<name>/. Use
.aiwg/plugins/<name>/ only when you are wrapping a bundle for marketplace
delivery. No fork, no rebuild. Discovered automatically by aiwg use.

aiwg new-bundle my-team-rules --type extension --starter rule
# edit the rule, then:
aiwg use my-team-rules
aiwg doctor --project-local      # health check (counts, validation, drift)
aiwg promote my-team-rules        # graduate to upstream when proven

The bundle is byte-identical in shape to its upstream form, so
aiwg promote is a hash-verified copy with zero rewrite. See the
customization guide for the three paths
(project-local, fork, corpus).

Claude Code Marketplace (Alternative)

/plugin marketplace add jmagly/ai-writing-guide
/plugin install sdlc@aiwg
/plugin install agent-loop@aiwg
/plugin install compound-memory@aiwg

The marketplace contains all 40 packaged frameworks and addons, so you can
install only the capabilities a Claude Code workspace needs.

Multi-Platform Deployment

aiwg use all --provider claude         # Claude Code
aiwg use all --provider codex          # OpenAI Codex
aiwg use all --provider copilot        # GitHub Copilot
aiwg use all --provider cursor         # Cursor
aiwg use all --provider factory        # Factory AI
aiwg use all --provider opencode       # OpenCode
aiwg use all --provider warp           # Warp Terminal
aiwg use all --provider devin          # Devin Desktop
aiwg use all --provider openclaw       # OpenClaw
aiwg use all --provider hermes         # Hermes
aiwg use all --provider openhuman      # OpenHuman

all means the complete deployable end-user surface. It intentionally omits
contributor-only development bundles and packages that cannot be deployed
directly.

First-Party Integrators

Some partners ship AIWG bundled in their runtime — no aiwg use step required. Install the partner tool and AIWG is already wired up.

Partner Install What you get
Omnius npm i -g omnius AIWG framework set, skills, agents, and rules embedded in the Omnius autonomous coding agent. Discoverable through aiwg discover from inside Omnius sessions, surfaceable through Omnius's MCP and REST bridges.

If you ship a product that bundles AIWG and want to be listed here, open an issue at https://github.com/jmagly/aiwg/issues.


What You Get

Frameworks (8)

Framework Agents Templates What It Does
SDLC Complete 98 200+ Full software development lifecycle — Inception through Production with multi-agent orchestration, quality gates, and DORA metrics
Forensics Complete 13 8 Digital forensics and incident response — evidence acquisition, timeline reconstruction, IOC extraction, Sigma rule hunting. NIST SP 800-86, MITRE ATT&CK, STIX 2.1
Media/Marketing Kit 37 87+ End-to-end marketing operations — strategy, content creation, campaign management, brand compliance, analytics, and reporting
Media Curator 6 — Intelligent media archive management — discography analysis, source discovery, quality filtering, transcript sidecars, research handoff preparation, multi-platform export (Plex, Jellyfin, MPD)
Research Complete 8 6 Academic research automation — paper discovery, citation management, RAG-based summarization, GRADE quality scoring, FAIR compliance, W3C PROV provenance
Knowledge Base — 5 General-purpose LLM-assisted wiki — source ingest, entity/concept pages, source summaries, comparisons, syntheses, health checks, and emergent taxonomy
Ops Complete 12 3 Operational infrastructure — incident management, runbooks, troubleshooting workflows
Security Engineering 2 5 Applied security beyond STRIDE/OWASP — cryptographic primitive selection, chain-of-trust integrity, authentication-factor architecture, degraded-mode design, runtime secret hygiene, supply-chain trust, physical-access threats. Pattern-based, product-agnostic

Addons (31)

Addon What It Does
RLM Recursive context decomposition — process 10M+ tokens via sub-agent delegation with parallel fan-out
Writing Quality Content validation, AI pattern detection, authentic voice enforcement
Testing Quality TDD enforcement, mutation testing, flaky test detection and repair
Voice Framework 4 built-in voice profiles (technical-authority, friendly-explainer, executive-brief, casual-conversational) with create/blend/apply skills
UAT-MCP Toolkit User acceptance testing with MCP-powered test execution, coverage tracking, and regression detection
AIWG Evals Agent evaluation framework — archetype resistance testing (Roig 2025), performance benchmarks, quality scoring
Agent Loop Iterative task execution engine (aiwg ralph / aiwg agent-loop-ext) — automatic error recovery, crash resilience, completion tracking
Agentic Installer setup.aiwg.io/v1 SetupManifest installer — cross-platform install workflows with recovery
AIWG Dev AIWG development tooling — extension scaffolding, local-source dev mode
Daemon Persistent daemon mode — background sessions, task queue, health monitoring
Compound Memory Persistent context architecture combining immutable raw inputs, linked wiki knowledge, line-memory facts, generated outputs, and governed maintenance workflows
Line Memory Durable append-only facts with retrieval, reinforcement, decay, pruning, and concurrent process safety
LLM Wiki Obsidian-native knowledge base for LLM agents — semantic linking, vault integration
NLP Prod Production NLP pipelines — entity extraction, classification, summarization
Prose Integration OpenProse contract grammar integration — declarative service contracts
Semantic Memory Semantic memory kernel — query, capture, lifecycle management for agent memory
Context Curator Context pre-filtering to remove distractors — production-grade agent reliability
Verbalized Sampling Probability distribution prompting — 1.6-2.1x output diversity improvement
Guided Implementation Bounded iteration control for issue-to-code automation
Skill Factory Dynamic skill generation and packaging at runtime
Doc Intelligence Document analysis, PDF extraction, documentation site scraping
Color Palette WCAG-compliant color palette generation with trend research
Auto Memory Automatic memory seed templates for new project context initialization
Agent Persistence Agent state management for session continuity
AIWG Hooks Lifecycle event handlers — pre-session, post-write, workflow tracing
AIWG Utils Core meta-utilities (auto-installed with any framework)
Droid Bridge Factory Droid orchestration — multi-platform agent bridge
AIWG Fleet Governed multi-project maintenance with repository discovery, policy-aware planning, approval gates, and auditable execution
Browser Control Permission-aware browser automation for user-controlled sessions through Playwright MCP
Twelve-Factor Evidence-based application architecture review against Twelve-Factor and modern 12+ Factor criteria
Star Prompt Repository star prompt for success celebration

Agents (188)

Specialized AI personas deployed to your platform with defined tools, responsibilities, and operating rhythms.

SDLC Agents (90)

Domain Agents Examples
Testing & Quality 11 Test Engineer, Test Architect, Mutation Analyst, Regression Analyst, Laziness Detector, Reliability Engineer
Security & Compliance 9 Security Auditor, Security Architect, Compliance Checker, Privacy Officer, Citation Verifier
Architecture & Design 12 Architecture Designer, API Designer, Cloud Architect, System Analyst, Product Designer, Decision Matrix Expert
DevOps & Cloud 8 AWS Specialist, Azure Specialist, GCP Specialist, Kubernetes Expert, DevOps Engineer, Multi-Cloud Strategist
Backend & Data 10 Django Expert, Spring Boot Expert, Data Engineer, Database Optimizer, Software Implementer, Incident Responder
Frontend & Mobile 6 React Expert, Frontend Specialist, Mobile Developer, Accessibility Specialist, UX Lead
AI/ML & Performance 5 AI/ML Engineer, Performance Engineer, Cost Optimizer, Metrics Analyst
Code Quality 11 Code Reviewer, Debugger, Dead Code Analyzer, Technical Debt Analyst, Legacy Modernizer
Documentation 7 Technical Writer, Documentation Synthesizer, Documentation Archivist, Context Librarian
Requirements & Planning 7 Requirements Analyst, Requirements Reviewer, Intake Coordinator, RACI Expert
Agent/Tool Smiths 9 AgentSmith, CommandSmith, MCPSmith, SkillSmith, ToolSmith
Governance & Meta 3 Executive Orchestrator, Recovery Orchestrator, Migration Planner

Forensics Agents (13)

Agent What It Does
Forensics Orchestrator Coordinates full investigation lifecycle from scoping through reporting
Triage Agent Quick volatile data capture following RFC 3227 volatility order
Acquisition Agent Evidence collection with chain of custody and SHA-256 hash verification
Log Analyst Auth.log, syslog, journal, and application log analysis for brute force, privilege escalation, lateral movement
Persistence Hunter Sweeps cron, systemd, SSH keys, LD_PRELOAD, PAM modules, kernel modules — maps to MITRE ATT&CK
Container Analyst Docker, containerd, Kubernetes forensics — privilege escalation, container escapes, eBPF monitoring
Network Analyst Connection state, DNS, traffic patterns — beaconing, C2, data exfiltration detection
Memory Analyst Volatility 3 memory forensics — process analysis, rootkit detection, credential extraction
Cloud Analyst AWS/Azure/GCP audit logs, IAM review, network flows, API activity anomaly detection
Timeline Builder Multi-source event correlation — chronological incident timelines with attribution
IOC Analyst IOC extraction, enrichment, STIX 2.1 formatting — actionable IOC register
Recon Agent Target reconnaissance — system topology, services, users, network baselines
Reporting Agent Structured forensic reports — executive summary, technical findings, timeline, remediation

Marketing Agents (37)

Domain Agents
Strategy Campaign Strategist, Brand Guardian, Positioning Specialist, Market Researcher, Content Strategist, Channel Strategist
Creation Copywriter, Content Writer, Email Marketer, Social Media Specialist, SEO Specialist, Graphic Designer, Art Director
Management Campaign Orchestrator, Production Coordinator, Traffic Manager, Asset Manager, Workflow Coordinator
Analytics Marketing Analyst, Data Analyst, Attribution Specialist, Reporting Specialist, Budget Planner
Communications PR Specialist, Crisis Communications, Corporate Communications, Internal Communications, Media Relations

Research Agents (8)

Discovery Agent, Acquisition Agent, Documentation Agent, Citation Agent, Quality Agent, Archival Agent, Provenance Agent, Workflow Agent

Media Curator Agents (6)

Discography Analyst, Source Discoverer, Acquisition Manager, Quality Assessor, Metadata Curator, Completeness Tracker


Rules (35)

Enforcement patterns that prevent common AI failure modes. Rules deploy automatically with their framework.

Core Rules (10) — Always Active

Rule Severity What It Enforces
no-attribution CRITICAL AI tools are tools — never add attribution to commits, PRs, docs, or code
token-security CRITICAL Never hard-code tokens; use heredoc pattern for scoped lifetime; file permissions 600
versioning CRITICAL CalVer YYYY.M.PATCH with NO leading zeros; npm rejects leading zeros
citation-policy CRITICAL Never fabricate citations, DOIs, or URLs; only cite verified sources; GRADE-appropriate hedging
anti-laziness HIGH Never delete tests to pass, skip tests, remove features, or weaken assertions; escalate after 3 failures
executable-feedback HIGH Execute tests before returning code; track execution history; max 3 retries with root cause analysis
failure-mitigation HIGH Detect and recover from 6 LLM failure archetypes: hallucination, context loss, instruction drift, safety, technical, consistency
research-before-decision HIGH Research codebase before acting: IDENTIFY → SEARCH → EXTRACT → REASON → ACT → VERIFY
instruction-comprehension HIGH Fully parse all instructions before acting; track multi-part requests to completion
subagent-scoping HIGH One focused task per subagent; <20% context budget; no delegation chains deeper than 2 levels

SDLC Rules (34) — Active with Framework

Actionable feedback, mention wiring, HITL gates, agent fallback, provenance tracking, TAO loop, reproducibility validation, SDLC orchestration, agent-friendly code, agent generation guardrails, artifact discovery, HITL patterns, human gate display, thought protocol, reasoning sections, few-shot examples, best output selection, reproducibility, progressive disclosure, conversable agent interface, auto-reply chains, criticality panel sizing, qualified references.

Research Rules (2) — Active with Research

Research metadata (FAIR-compliant YAML frontmatter), index generation (auto-generated INDEX.md per FAIR F4).


Skills (128)

Natural language workflow triggers. Say "what's the project status?" and the project-awareness skill activates.

Category Skills Examples
Regression Testing 12 regression-check, regression-baseline, regression-bisect, regression-performance, regression-api-contract, regression-cicd-hooks, regression-learning
Voice & Writing 6 voice-create, voice-analyze, voice-apply, voice-blend, ai-pattern-detection, brand-compliance
Testing & Quality 8 auto-test-execution, test-coverage, test-sync, mutation-test, flaky-detect, flaky-fix, tdd-enforce, qa-protocol
Forensics & Security 8 linux-forensics, memory-forensics, cloud-forensics, container-forensics, sigma-hunting, log-analysis, ioc-extraction, supply-chain-forensics
SDLC & Workflow 10 sdlc-accelerate, sdlc-reports, gate-evaluation, approval-workflow, iteration-control, risk-cycle, parallel-dispatch, decision-support
Documentation 6 doc-sync, doc-scraper, doc-splitter, llms-txt-support, pdf-extractor, source-unifier
Artifacts & Traceability 6 artifact-orchestration, artifact-metadata, artifact-lookup, traceability-check, claims-validator, citation-guard
Research 2 grade-on-ingest, auto-provenance
Infrastructure 5 config-validator, template-engine, code-chunker, decompose-file, workspace-health
Iteration 4 agent-loop, issue-driven-ralph, cross-task-learner, reflection-injection
Other 19 performance-digest, competitive-intel, audience-synthesis, skill-builder, skill-enhancer, skill-packager, quality-checker, nl-router, tot-exploration, and more

Framework Deep Dives

SDLC Complete — Full Software Development Lifecycle

The SDLC framework implements a phase-gated development lifecycle with 90 specialized agents, 34 enforcement rules, and 170+ artifact templates. Natural language commands drive phase transitions with automated quality gates.

 ┌──────────┐    ┌─────────────┐    ┌──────────────┐    ┌────────────┐    ┌────────────┐
 │ CONCEPT  │───▶│  INCEPTION  │───▶│ ELABORATION  │───▶│CONSTRUCTION│───▶│ TRANSITION │
 │          │    │             │    │              │    │            │    │            │
 │ Intake   │    │ Vision      │    │ Architecture │    │ Code       │    │ Deploy     │
 │ Wizard   │    │ Requirements│    │ Risk Retire  │    │ Test       │    │ Hypercare  │
 │ Solution │    │ Stakeholder │    │ Prototype    │    │ Review     │    │ Handoff    │
 │ Profile  │    │ Analysis    │    │ API Design   │    │ Iterate    │    │ Knowledge  │
 └──────────┘    └──────┬──────┘    └──────┬───────┘    └─────┬──────┘    └────────────┘
                        │                  │                   │
                     ┌──▼──┐            ┌──▼──┐            ┌──▼──┐
                     │ LOM │            │ ABM │            │ IOC │    ← Quality Gates
                     │Gate │            │Gate │            │Gate │
                     └─────┘            └─────┘            └─────┘

 LOM = Lifecycle Objectives Milestone    ABM = Architecture Baseline Milestone
 IOC = Initial Operational Capability

SDLC Flow Commands (24):

Command Phase What It Does
/intake-wizard Concept Generate project intake form from natural language description
/intake-start Concept→Inception Validate intake, kick off with agent assignments
/intake-from-codebase Concept Scan existing codebase, generate intake from analysis
/flow-concept-to-inception Concept→Inception Phase transition with intake validation and vision alignment
/flow-inception-to-elaboration Inception→Elaboration Architecture baselining and risk retirement
/flow-elaboration-to-construction Elaboration→Construction Iteration planning, team scaling, full-scale development
/flow-construction-to-transition Construction→Transition IOC validation, production deployment, operational handover
/flow-discovery-track Any Prepare validated requirements one iteration ahead of delivery
/flow-delivery-track Any Test-driven development, quality gates, iteration assessment
/flow-iteration-dual-track Any Synchronized Discovery + Delivery workflows
/flow-deploy-to-production Transition Strategy selection, validation, automated rollback, regression gates
/flow-incident-response Operations Triage, escalation, resolution, post-incident review (ITIL)
/flow-security-review-cycle Any Continuous security validation, threat modeling, vulnerability management
/flow-performance-optimization Any Baseline, bottleneck ID, optimization, load testing, SLO validation
/flow-retrospective-cycle Any Structured feedback, improvement tracking, action items
/flow-change-control Any Baseline management, impact assessment, CCB review, communication
/flow-risk-management-cycle Any Continuous risk identification, assessment, tracking, retirement
/flow-compliance-validation Any Requirements mapping, audit evidence, gap analysis, attestation
/flow-knowledge-transfer Transition Assessment, documentation, shadowing, validation, handover
/flow-team-onboarding Any Pre-boarding, training, buddy assignment, 30/60/90 day check-ins
/flow-hypercare-monitoring Transition 24/7 support, SLO tracking, rapid issue response
/flow-gate-check Any Multi-agent phase gate validation with comprehensive reporting
/flow-handoff-checklist Any Handoff validation between phases and tracks
/flow-guided-implementation Construction Bounded iteration with issue-to-code automation

SDLC Accelerate — Idea to Construction-Ready in One Command:

# From a description
aiwg sdlc-accelerate "AI-powered code review tool with GitHub integration"

# From existing codebase
aiwg sdlc-accelerate --from-codebase .

# Resume interrupted pipeline
aiwg sdlc-accelerate --resume

Generates intake form, vision document, use cases, architecture baseline, risk register, test strategy, and deployment plan — all with human approval gates between phases.

Dual-Track Iteration Model:

        ┌─────────────────────────────────────────────────┐
        │                ITERATION N                       │
        │                                                  │
        │  Discovery Track          Delivery Track         │
        │  (Next iteration)         (Current iteration)    │
        │                                                  │
        │  ┌─────────────┐          ┌──────────────┐      │
        │  │ Requirements│          │ Implement    │      │
        │  │ Research    │          │ Test         │      │
        │  │ Design      │          │ Review       │      │
        │  │ Validate    │          │ Deploy       │      │
        │  └─────┬───────┘          └──────┬───────┘      │
        │        │                         │               │
        │        └────────────┬────────────┘               │
        │                     │                            │
        │              ┌──────▼──────┐                     │
        │              │ Iteration   │                     │
        │              │ Assessment  │                     │
        │              └─────────────┘                     │
        └─────────────────────────────────────────────────┘

Metrics & Quality Tracking:

Metric Category Metrics Tracked
DORA (4) Deployment Frequency, Lead Time, Change Failure Rate, MTTR
Velocity (3) Story Points, Cycle Time, Throughput
Flow (3) WIP Limits, Flow Efficiency, Blocked Items
Quality (13) Test Coverage (4), Defect Metrics (4), Code Quality (3), Technical Debt (2)
Operational (16) SLO/SLI (5), Infrastructure (4), Incidents (4), Cost (3)

Forensics Complete — Digital Forensics & Incident Response

Full DFIR investigation workflow following NIST SP 800-86, with MITRE ATT&CK mapping and Sigma rule hunting.

 ┌──────────┐    ┌──────────┐    ┌────────────┐    ┌──────────┐    ┌──────────┐
 │  SCOPE   │───▶│  TRIAGE  │───▶│  ACQUIRE   │───▶│ ANALYZE  │───▶│  REPORT  │
 │          │    │          │    │            │    │          │    │          │
 │ Profile  │    │ Volatile │    │ Evidence   │    │ Log      │    │ Executive│
 │ target   │    │ data     │    │ collection │    │ Timeline │    │ summary  │
 │ system   │    │ capture  │    │ Chain of   │    │ IOC      │    │ Findings │
 │          │    │ RFC 3227 │    │ custody    │    │ Sigma    │    │ Timeline │
 └──────────┘    └──────────┘    └────────────┘    └──────────┘    └──────────┘
                                       │
                                  SHA-256 hash
                                  verification

Investigation Commands:

/forensics-profile          # Build target system profile via SSH
/forensics-triage           # Quick triage following RFC 3227 volatility order
/forensics-acquire          # Evidence acquisition with chain of custody
/forensics-investigate      # Full multi-agent investigation workflow
/forensics-timeline         # Build correlated event timeline
/forensics-hunt             # Threat hunt using Sigma rules
/forensics-ioc              # Extract and enrich IOCs
/forensics-report           # Generate forensic investigation report
/forensics-status           # Show investigation dashboard

Bundled Sigma Rules (8):

Rule What It Detects
SSH Brute Force Repeated failed SSH authentication attempts
Unauthorized SUID Unexpected SUID/SGID binaries
LD_PRELOAD Rootkit Library injection via LD_PRELOAD
Cron Persistence Unauthorized crontab modifications
Kernel Module Load Suspicious kernel module insertion
PAM Backdoor PAM configuration tampering
SSH Key Injection Unauthorized authorized_keys modifications
Systemd Persistence Suspicious systemd unit creation

Supported Evidence Sources:

Source Agent Analysis
Auth logs Log Analyst Brute force, privilege escalation, lateral movement
Syslog / journal Log Analyst System events, service anomalies
Network connections Network Analyst C2 beaconing, data exfiltration, DNS tunneling
Docker/containerd Container Analyst Container escapes, image tampering, eBPF monitoring
Memory dumps Memory Analyst Process injection, rootkits, credential extraction
AWS/Azure/GCP Cloud Analyst API anomalies, IAM abuse, network flow analysis
File system Persistence Hunter Cron, systemd, SSH keys, PAM, kernel modules

Media/Marketing Kit — Campaign Lifecycle

 ┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐
 │ STRATEGY │───▶│ CREATION │───▶│  REVIEW  │───▶│ PUBLISH  │───▶│ ANALYZE  │
 │          │    │          │    │          │    │          │    │          │
 │ Research │    │ Copy     │    │ Brand    │    │ Schedule │    │ KPIs     │
 │ Audience │    │ Design   │    │ Legal    │    │ Channels │    │ Reports  │
 │ Strategy │    │ Content  │    │ Quality  │    │ Launch   │    │ ROI      │
 └──────────┘    └──────────┘    └──────────┘    └──────────┘    └──────────┘

37 agents across strategy, creation, management, analytics, and communications. 87+ templates covering campaign intake, brand guidelines, content briefs, social playbooks, email sequences, PR kits, and analytics dashboards.

Media Curator — Intelligent Archive Management

# Full curation pipeline
/curate "Pink Floyd"

# Step by step
/analyze-artist "Pink Floyd"           # Identify eras, catalog structure
/find-sources "Pink Floyd" "DSOTM"     # Discover across YouTube, Archive.org, Bandcamp
/acquire                               # Download with format selection
/transcribe-media /path/to/media.wav     # Create timestamped transcript sidecars
/tag-collection                        # Apply metadata, embed artwork, rename
/check-completeness                    # Gap analysis against canonical discography
/assemble "Pink Floyd live 1973"       # Build thematic compilations
/export --format plex                  # Export to Plex, Jellyfin, MPD, or archival
/verify-archive                        # SHA-256 integrity verification

Quality tiers: Tier 1 (Official/Lossless) → Tier 2 (High Quality) → Tier 3 (Acceptable) → Tier 4 (Avoid). Transcript sidecars preserve source hashes, transcript hashes, timestamps, and optional speaker labels for review and future research handoff. Standards: ID3v2.4, Vorbis Comments, MusicBrainz, PREMIS 3.0, W3C PROV-O.

Research Complete — Academic Research Pipeline


 ┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐
 │ DISCOVER │───▶│ ACQUIRE  │───▶│ DOCUMENT │───▶│ ARCHIVE  │
 │          │    │          │    │          │    │          │
 │ Search   │    │ Download │    │ RAG      │    │ OAIS