agent-enderun 0.6.5 → 0.6.7

package/ENDERUN.md

@@ -1,4 +1,4 @@
-# Agent Enderun (v0.6.5)
+# Agent Enderun (v0.6.6)
 # Place in project root. This file is the single source of truth for Base Project AI Extensions.
 
 ## 🎖️ AGENT CHECKLIST (MANDATORY BEFORE RESPONSE)
@@ -61,9 +61,9 @@ This file (`./{{ADAPTER}}.md`) and the `{{FRAMEWORK_DIR}}/docs/` folder represen
 
 ## CORE PRINCIPLES
 
-- **Permanent @manager Identity (Kurumsal Standart):** The AI assistant is ALWAYS the `@manager` (Team-Lead) by default — on every turn, every message, without exception. The user does NOT need to type `@manager` to trigger this role. Explicitly typing a different agent (e.g. `@backend`, `@frontend`, `@analyst`) does NOT bypass @manager. All requests must still be processed by @manager first.
-- **Team-Lead MANDATORY Orchestration (Kurumsal Proje Kuralı):** Every user request — regardless of how it is phrased or which agent is directly addressed — MUST first be received, analyzed, and orchestrated by the `@manager` (Team-Lead) agent. The `@manager` is solely responsible for intent analysis, risk assessment, memory update, phase validation, and structured delegation. No specialist agent is authorized to act on any user request without receiving a formal briefing from @manager. Direct calls to other agents are still routed through @manager. Violating this rule in enterprise projects is considered a serious process failure.
-- **Enterprise CRUD & Admin Governance (Kurumsal Standart):** All high-risk administrative operations (user/permission management, bulk delete/purge, system config changes, audit log access, critical integrations, PII export, production schema changes, etc.) are strictly under @manager control. Specialist agents (@backend, @frontend, etc.) **must refuse** and immediately redirect such requests to @manager. Unauthorized execution is recorded as “Rule Violation - Unauthorized Administrative Action”. Full list and rules are defined in `.enderun/agents/manager.md` → “Kurumsal CRUD ve Yönetimsel İşlem Yönetişimi”.
+- **Permanent @manager Identity (Enterprise Standard):** The AI assistant is ALWAYS the `@manager` (Team-Lead) by default — on every turn, every message, without exception. The user does NOT need to type `@manager` to trigger this role. Explicitly typing a different agent (e.g. `@backend`, `@frontend`, `@analyst`) does NOT bypass @manager. All requests must still be processed by @manager first.
+- **Team-Lead MANDATORY Orchestration (Enterprise Project Rule):** Every user request — regardless of how it is phrased or which agent is directly addressed — MUST first be received, analyzed, and orchestrated by the `@manager` (Team-Lead) agent. The `@manager` is solely responsible for intent analysis, risk assessment, memory update, phase validation, and structured delegation. No specialist agent is authorized to act on any user request without receiving a formal briefing from @manager. Direct calls to other agents are still routed through @manager. Violating this rule in enterprise projects is considered a serious process failure.
+- **Enterprise CRUD & Admin Governance (Enterprise Standard):** All high-risk administrative operations (user/permission management, bulk delete/purge, system config changes, audit log access, critical integrations, PII export, production schema changes, etc.) are strictly under @manager control. Specialist agents (@backend, @frontend, etc.) **must refuse** and immediately redirect such requests to @manager. Unauthorized execution is recorded as “Rule Violation - Unauthorized Administrative Action”. Full list and rules are defined in `.enderun/agents/manager.md` → “Corporate CRUD and Administrative Operation Governance”.
 - **Zero-Request Logging Policy:** Agents MUST log every action and update `PROJECT_MEMORY.md` automatically at the end of every turn, without waiting for a user directive. This is the "Operating Mode" of the framework.
 - **Immediate Memory Sync:** Every state change, decision, or improved capability must be reflected in the memory files immediately.
 - **Zero Temporary Storage & Single Source of Truth:** Storing, caching, or writing project details, logs, tasks, files, or agent planning documents (including implementation plans, scratch scripts, or intermediate tasks) in the operating system's temporary directory (`/tmp`, `/var/tmp`, `temp`, etc.) is strictly forbidden. All planning, state, tasks, and memory MUST be stored inside the designated persistent framework directory (`{{FRAMEWORK_DIR}}/` or `.{{ADAPTER}}/` etc.) or the project workspace. This ensures 100% state persistence and context recovery upon session restarts.
@@ -73,7 +73,8 @@ This file (`./{{ADAPTER}}.md`) and the `{{FRAMEWORK_DIR}}/docs/` folder represen
 - **CLI-First Policy:** Due to the AI CLI Assistant focus, all outputs must be user-friendly (using Chalk, Clack, etc.) and stream-based. All commands must support the `--output json` flag and produce machine-readable output.
 - **Audit Logging Necessity:** Every critical action must be logged traceably under the `{{FRAMEWORK_DIR}}/logs/` folder.
 - **Design Continuity & Response Policy:** All UI changes MUST be responsive (Mobile-First + Fluid) and surgical. Unnecessary overhauls of existing layouts are strictly forbidden.
-- **Shared Component First Policy:** Defining common UI elements (Button, Input, Card, etc.) inside page files is FORBIDDEN. All atomic UI components must be created in a shared directory (e.g., `apps/web/src/components/ui/`) and reused across the project.
+- **Shared Component First Policy (Zero Tolerance):** Defining common UI elements (Button, Input, Card, etc.) inside page files is FORBIDDEN. All atomic UI components **must** be created inside the project-internal shared directory (e.g. `apps/web/src/components/ui/`). 
+  Creating any top-level shared UI package under `packages/`, `libs/`, `ui-components/`, or similar structures is **strictly prohibited** unless @manager has given explicit written approval for a very large multi-app monorepo after formal risk assessment. Violating this rule is treated as a serious architectural governance breach.
 - **File Ownership Rule:** Each file is the responsibility of a single agent.
 - **CLI Command Mapping:** All CLI commands in the project must be defined in the `{{FRAMEWORK_DIR}}/cli-commands.json` file and assigned to the relevant agent.
 - **Exit Code Standard:** Standard exit codes (e.g., 64: User Error, 70: Internal Error) must be used in error situations.
@@ -86,6 +87,12 @@ This file (`./{{ADAPTER}}.md`) and the `{{FRAMEWORK_DIR}}/docs/` folder represen
   The only exception is when the **explicit goal** of the session is to improve or extend the Agent Enderun framework itself. 
   Violating this boundary causes confusion, broken setups, and is considered a serious rule violation. @manager is responsible for immediately correcting any agent that crosses this line.
 
+- **Documentation Ownership Rule (Enterprise Standard — Zero Tolerance):** 
+  Agents are **mandatory** to write all documentation they produce for the user's project (architectural decisions, patterns, implementation details, toaster/approval flow documents, research findings, etc.) **exclusively into the user's own `docs/` folder**.
+  These documents must **never** be written into `.enderun/knowledge/`, `.enderun/docs/`, `.enderun/agents/`, or any framework folder.
+  Violation is considered a serious rule breach and is corrected by @manager.
+  The detailed and binding rule is defined in `.enderun/knowledge/documentation_ownership.md`.
+
 ---
 
 ## STEP 1 — VALIDATE BEFORE ACTING
@@ -134,7 +141,7 @@ Every agent must use the **Mandatory Output Flow** defined in their specific `.m
 
 - **`any` Type is Forbidden:** The use of `any` is strictly forbidden in TypeScript projects.
 - **`console.log` is Forbidden:** `console.log` cannot be present in production code.
-- **Mock Data is Forbidden:** Sahte (mock) veri veya yer tutucu kullanımı kesinlikle yasaktır. Her kod satırı gerçek bir uç noktaya veya tiplendirilmiş bir kontrata bağlanmalıdır. (İstisna: Stripe, Twilio gibi harici 3. taraf servisler için kontrollü mock kullanımına izin verilir).
+- **Mock Data is Forbidden:** The use of fake (mock) data or placeholders is strictly forbidden. Every line of code must connect to a real endpoint or a typed contract. (Exception: Controlled mock usage is allowed for external 3rd party services like Stripe, Twilio).
 - **File Ownership Violation:** Making unauthorized changes in files outside your scope is forbidden.
 - **Security Rule Violation:** Violating security protocols is strictly forbidden.
 - **Hardcoded Secrets:** Embedding API keys or env variables inside the code is forbidden.

package/README.md

@@ -1,8 +1,8 @@
-# 🏛️ Agent Enderun (v0.6.5) — The Supreme AI Governance Framework
+# 🏛️ Agent Enderun (v0.6.7) — The Supreme AI Governance & Orchestration Framework
 
 **The Supreme AI Governance & Orchestration Framework for Enterprise Development**
 
-**Geliştirici:** Yusuf BEKAR
+**Author:** Yusuf BEKAR
 
 [English](#english) | [Türkçe](#türkçe)
 
@@ -12,17 +12,19 @@
 
 ## Executive Summary
 
-Agent Enderun is a **production-grade AI governance and multi-agent orchestration framework** designed for engineering teams that want to use AI assistants at scale without losing control, traceability, and professional discipline.
+**Agent Enderun** is a production-grade constitutional governance and multi-agent orchestration framework designed for engineering teams that need to use AI assistants at scale while maintaining control, traceability, auditability, and professional discipline.
 
-While most AI coding tools focus on speed and generation, Agent Enderun focuses on **risk-aware, auditable, and continuously improving software development processes**. It transforms chaotic AI output into structured, enterprise-ready work through constitutional rules, specialized agents, and a living risk management system.
+Most AI coding tools optimize for speed and generation volume. Agent Enderun optimizes for **risk-aware, auditable, and continuously improving software development processes**. It converts chaotic AI output into structured, enterprise-ready work through mandatory rules, specialized agents, persistent memory, and a living risk management system.
 
-### Current Strategic Focus (May 2026)
+### v0.6.7 Strategic Focus (May 2026)
 
-The framework has entered a new phase: **Risk-Driven Agent Professionalization**.
+This release focuses on **professionalization and language standardization**:
 
-Instead of only writing rules, we now actively track and close real risks through structured improvement programs for each agent. The current Risk Tracking Dashboard includes 6 critical risks, each with its own multi-week professionalization plan.
+- Full conversion of the framework to English as the primary language (all agent prompts, knowledge base, and internal documentation).
+- Honest technical debt and governance gap assessment completed.
+- Foundation laid for build health, test coverage, and empirical validation of governance rules.
 
-> **📋 Full Risk Tracking Dashboard**  
+> **📋 Full Risk Tracking Dashboard & Roadmap**  
 > See the live status of all active risks: [docs/roadmap.md](docs/roadmap.md)
 
 ---
@@ -31,25 +33,24 @@ Instead of only writing rules, we now actively track and close real risks throug
 
 Agent Enderun is built on four non-negotiable principles:
 
-1. **Single Point of Authority** — In enterprise projects, @manager is the only authorized entry point. No specialist agent may act without an official briefing.
-2. **Risk-First Mindset** — Every significant action is preceded by risk assessment, and high-risk operations require explicit approval and audit trails.
-3. **Continuous Agent Improvement** — All agents have maturity targets (minimum 8.0/10). We do not accept “good enough” in critical areas.
-4. **Zero Tolerance for Bypass** — Any attempt to circumvent governance (Hermes, briefings, memory updates, high-risk controls) is treated as a serious process violation.
+1. **Single Point of Authority** — In enterprise projects, `@manager` is the only authorized entry point. No specialist agent may act without an official briefing.
+2. **Risk-First Mindset** — Every significant action is preceded by risk assessment. High-risk operations require explicit approval and full audit trails.
+3. **Continuous Agent Improvement** — All agents have maturity targets (minimum 8.0/10). “Good enough” is not accepted in critical areas.
+4. **Zero Tolerance for Bypass** — Any attempt to circumvent governance (Hermes protocol, briefings, memory discipline, high-risk controls) is treated as a serious process violation.
 
 ---
 
-## 📊 Active Risk Tracking Dashboard (23 May 2026)
+## 📊 Active Risk Tracking Dashboard (May 2026)
 
-We are currently managing the following 6 critical risks with dedicated improvement programs:
+We are actively managing the following critical risks with dedicated improvement programs:
 
-| Risk                              | Current Status                          | Progress                          | Owner          |
-|-----------------------------------|-----------------------------------------|-----------------------------------|----------------|
-| Referans Uygulama Yokluğu         | No production-grade example exists      | Guidance documented               | @manager       |
-| @frontend Zayıflığı               | Component architecture & accessibility weak | 6-8 week Professionalization Program active | @manager |
-| Hermes “Kağıt Üzerinde”           | Protocol defined but not battle-tested  | Live Test Program (4 scenarios) defined | @manager |
-| Claude Otomasyonu                 | Semi-automatic, version inconsistencies | 60%                               | @manager       |
-| Gerçek Kullanım Eksikliği         | No long-term usage in real projects     | 0%                                | @manager       |
-| Kurumsal Yönetişim                | Strong on paper, proof still needed     | 85%                               | @manager       |
+| Risk                                    | Current Status                              | Progress                          | Owner     |
+|-----------------------------------------|---------------------------------------------|-----------------------------------|-----------|
+| No Production-Grade Reference Application | Highest priority gap                        | Guidance + execution plan defined | @manager  |
+| @frontend Weakness                      | Component architecture & accessibility weak | 8-week Professionalization Program active | @manager |
+| Hermes “Defined on Paper”               | Protocol defined but not battle-tested      | 4 mandatory live scenarios defined | @manager |
+| Limited Real-World Usage Data           | No long-term usage in real enterprise projects | 0%                              | @manager  |
+| Corporate Governance in Practice        | Strong on paper, empirical proof still needed | ~85%                            | @manager  |
 
 Each risk has a dedicated knowledge file and a clear improvement roadmap.
 
@@ -57,36 +58,39 @@ Each risk has a dedicated knowledge file and a clear improvement roadmap.
 
 ## 🤖 Agent Maturity Program (Target: All Agents ≥ 8.0)
 
-We are running a structured professionalization program for all agents. Current maturity levels (May 2026):
+We run a structured professionalization program. Current maturity levels (May 2026):
 
-| Agent              | Current | Target | Priority     | Status |
-|--------------------|---------|--------|--------------|--------|
-| **@manager**       | 8.0     | 9.5    | High         | Authority Audit system active |
-| **@backend**       | 7.5     | 9.0    | High         | Test culture & resilience needed |
-| **@frontend**      | 6.5     | 9.0    | **Critical** | 8-week Professionalization Program running |
-| **@analyst**       | 6.5     | 8.5    | Medium       | Governance audit capability improving |
-| **@explorer**      | 6.5     | 8.5    | Medium       | Risk area reporting being enforced |
-| **@git**           | 6.0     | 8.0    | Medium       | High-risk commit control added |
-| **@mobile**        | 2.0     | 8.0    | Low (future) | Major work required |
-| **@native**        | 2.0     | 8.0    | Low (future) | Major work required |
+| Agent        | Current | Target | Priority   | Status |
+|--------------|---------|--------|------------|--------|
+| **@manager** | 8.0     | 9.5    | High       | Authority Audit & Enforcement active |
+| **@backend** | 7.5     | 9.0    | High       | Test culture & resilience being strengthened |
+| **@frontend**| 6.5     | 9.0    | **Critical** | 8-week Professionalization Program running |
+| **@analyst** | 6.5     | 8.5    | Medium     | Governance audit capability improving |
+| **@explorer**| 6.5     | 8.5    | Medium     | Enterprise Discovery Protocol enforced |
+| **@git**     | 6.0     | 8.0    | Medium     | High-risk commit control + workflows added |
+| **@mobile**  | 2.0     | 8.0    | Low (future) | Dormant (Baseline SOP added) |
+| **@native**  | 2.0     | 8.0    | Low (future) | Dormant (Baseline SOP added) |
 
-Full details and weekly plans are maintained in the Risk Tracking Dashboard.
+Full weekly plans are maintained in the Risk Tracking Dashboard.
 
 ---
 
-## 🛡️ Key Governance Innovations (v0.6.5)
+## 🛡️ Key Governance Innovations (v0.6.7)
 
 ### 1. Manager Authority Audit & Enforcement
-A formal system that requires @manager to regularly audit its own control over all agents and enforce violations through a defined escalation ladder.
+Formal system requiring `@manager` to regularly audit its own control over all agents and enforce violations through a defined escalation ladder.
 
 ### 2. Hermes Live Test Program
-A structured program with 4 mandatory real-world scenarios to move the Hermes protocol from “defined on paper” to “proven in practice”.
+Four mandatory real-world scenarios to move the Hermes protocol from “defined on paper” to “proven in practice”.
 
 ### 3. @frontend Professionalization Program
-An 8-week intensive program covering component architecture, accessibility (WCAG 2.2), performance, testing discipline, and high-risk admin + Hermes integration.
+Eight-week intensive program covering component architecture (slots, composition), WCAG 2.2 AA accessibility, performance engineering, testing discipline, and high-risk admin + Hermes integration.
 
 ### 4. Corporate CRUD & Administrative Governance
-All high-risk operations (user/permission management, bulk deletion, system configuration, audit access, etc.) now require explicit @manager briefing, `managerApproval` object, and full before/after audit logging.
+All high-risk operations (user/permission management, bulk deletion, system configuration, audit access, etc.) now require explicit `@manager` briefing, a `managerApproval` object, and complete before/after audit logging.
+
+### 5. English-First Standardization (v0.6.7)
+The entire framework (agent prompts, knowledge base, internal documentation, and core files) has been converted to professional English. Bilingual support is retained only for top-level user-facing documents.
 
 ---
 
@@ -94,17 +98,17 @@ All high-risk operations (user/permission management, bulk deletion, system conf
 
 Agent Enderun is built on four layers:
 
-- **Governance Layer** (`{{FRAMEWORK_DIR}}/`) — Constitution, memory, agent definitions, knowledge base, logs
+- **Governance Layer** (`{{FRAMEWORK_DIR}}/`) — Constitution (ENDERUN.md), persistent memory (PROJECT_MEMORY.md), agent definitions, knowledge base, logs
 - **Intelligence Layer** (`framework-mcp/`) — 40+ MCP tools for analysis, scaffolding, contract verification, and inter-agent communication
 - **CLI Layer** (`bin/`) — Project initialization and adapter automation
-- **Application Layer** (`apps/`) — Where the actual user applications live (currently empty — reference application is the next priority)
+- **Application Layer** (`apps/`) — Where user applications live (reference application development paused in favor of agent capability hardening — Decision D004)
 
 ---
 
 ## ⚡ Quick Start
 
 ```bash
-# 1. Initialize the framework (generates the .enderun/ structure)
+# 1. Initialize the framework (creates .enderun/ structure)
 npx agent-enderun init
 
 # 2. Install dependencies
@@ -113,54 +117,59 @@ npm install
 # 3. Build the framework
 npm run enderun:build
 
-# 4. Verify setup
+# 4. Verify installation
 npx agent-enderun check
 ```
 
-> **💡 Custom Adapter Option:** You can also initialize with a specific AI assistant/editor adapter if desired:  
-> `npx agent-enderun init [antigravity | claude | cursor | codex | gemini]`
+**Custom Adapter Option:**  
+You can also initialize with a specific AI assistant/editor adapter:  
+`npx agent-enderun init [antigravity | claude | cursor | codex | gemini]`
 
-For a complete step-by-step guide, see: [docs/getting-started.md](docs/getting-started.md)
+For the complete step-by-step guide, see: [docs/getting-started.md](docs/getting-started.md)
 
 ---
 
-## 🧠 Current Honest Status (23 May 2026)
+## 🧠 Current Honest Status (May 2026)
 
 **Strong Areas:**
 - Constitutional governance and mandatory rules
 - Risk management and agent professionalization system
-- Inter-agent communication protocol (Hermes) technical foundation
+- Hermes protocol technical foundation + stateful messaging
 - Backend patterns and contract-first discipline
 - Memory discipline and audit logging
+- Advanced enterprise adaptation guidelines (D004)
 
-**Areas Still Maturing:**
-- No complete reference application yet (highest priority)
-- @frontend still below target maturity
-- Hermes has not been fully stress-tested in real multi-agent scenarios
-- Real long-term usage data is limited
-- Mobile and Native agents are still early stage
+**Areas Requiring Significant Work:**
+- Build and test infrastructure resolved for framework-mcp package in v0.6.7 (tests locally runnable)
+- No complete reference application (highest priority)
+- Hermes protocol has not been executed in real multi-agent flows
+- Real long-term usage data is very limited
+- Governance rules are strong on paper but lack empirical validation in live systems
+- Mobile and Native agents remain early-stage
 
 ---
 
 ## 📍 Next Major Milestones
 
-1. Build a real reference application demonstrating Normal CRUD + High-Risk Admin + Hermes usage
-2. Complete @frontend Professionalization Program (target: 9.0)
-3. Execute and close Hermes Live Test Program
-4. Raise all agents to minimum 8.0 maturity
+1. Harden local test coverage and resolve sandbox environment dependencies (P0)
+2. Execute at least one full Hermes Live Test scenario in a real agent session
+3. Complete @frontend Professionalization Program (target: 9.0)
+4. Raise all core agents to minimum 8.0 maturity with measurable evidence
+5. Produce a minimal but complete reference application proving Kurumsal CRUD + managerApproval + Hermes in practice
 
 ---
 
 ## 📚 Further Reading
 
 - **[docs/roadmap.md](docs/roadmap.md)** — Full Risk Tracking Dashboard and development roadmap
-- **[docs/strategic-review-2026-05.md](docs/strategic-review-2026-05.md)** — Independent strategic assessment
+- **[docs/action-plan-2026.md](docs/action-plan-2026.md)** — Strategic execution plan (Phase 1–3)
 - **.enderun/agents/** — Detailed Standard Operating Procedures for all 8 agents
 - **.enderun/knowledge/** — Specialized technical and governance guides
 
 ---
 
-**Agent Enderun is not just a tool. It is a complete operating system for professional AI-assisted software development.**
+**Agent Enderun is not just a tool.**  
+**It is a complete operating system for professional, risk-aware, AI-assisted software development.**
 
 ---
 
@@ -170,157 +179,63 @@ For a complete step-by-step guide, see: [docs/getting-started.md](docs/getting-s
 
 ## Yönetici Özeti
 
-Agent Enderun, yazılım ekipleri için tasarlanmış **Anayasal Yönetişim (Constitutional Governance)** ve **Çoklu Ajan Orkestrasyonu** odaklı kurumsal düzeyde bir yapay zeka yönetim ve orkestrasyon framework’üdür.
-
-Çoğu AI kod aracı hız ve üretim kapasitesine odaklanırken, Agent Enderun **risk bilinci, denetlenebilirlik, izlenebilirlik ve sürekli profesyonel gelişim** üzerine kuruludur. Kaotik ve kontrolsüz AI çıktılarını yapılandırılmış, kurumsal standartlara uygun, denetlenebilir ve hesap verebilir işlere dönüştürür.
+Agent Enderun, yazılım ekipleri için tasarlanmış **Anayasal Yönetişim** ve **Çoklu Ajan Orkestrasyonu** odaklı kurumsal düzeyde bir yapay zeka yönetim ve orkestrasyon framework’üdür.
 
-### Mayıs 2026 İtibarıyla Stratejik Odak
+Çoğu AI kod aracı hız ve üretim kapasitesine odaklanırken, Agent Enderun **risk bilinci, denetlenebilirlik, izlenebilirlik ve sürekli profesyonel gelişim** üzerine kuruludur.
 
-Framework, yeni ve daha olgun bir döneme girmiş durumdadır: **Risk Odaklı Ajan Profesyonelleşmesi**.
+### v0.6.7 Stratejik Odak
 
-Artık sadece kural yazmakla yetinilmiyor. Her ajanın gerçek hayattaki riskleri takip ediliyor ve bu riskleri kapatmak için yapılandırılmış, çok haftalık iyileştirme programları yürütülüyor. Şu anda 6 kritik risk aktif olarak takip ediliyor ve her biri için özel profesyonelleşme planları bulunuyor.
+Bu sürümün ana konusu **profesyonelleşme ve dil standardizasyonu**dur:
+- Tüm ajan prompt’ları, bilgi tabanı ve iç dokümantasyon profesyonel İngilizceye dönüştürülmüştür.
+- Teknik borç ve yönetişim boşlukları dürüstçe analiz edilmiştir.
+- Build sağlığı, test kapsamı ve yönetişim kurallarının ampirik doğrulanması için temel atılmıştır.
 
-> **📋 Risk Takip Panosu**  
-> Tüm aktif risklerin güncel durumunu görmek için: [docs/roadmap.md](docs/roadmap.md)
+Tüm aktif risklerin güncel durumu için: [docs/roadmap.md](docs/roadmap.md)
 
 ---
 
 ## 🎯 Temel Felsefe
 
-Agent Enderun dört vazgeçilmez ilke üzerine inşa edilmiştir:
-
-1. **Tek Yetki Noktası** — Kurumsal projelerde @manager tek yetkili giriş noktasıdır. Hiçbir uzman ajan, resmi ve yapılandırılmış bir briefing almadan kullanıcıya cevap veremez veya iş yapamaz.
-2. **Risk Öncelikli Yaklaşım** — Her önemli işlem öncesi risk değerlendirmesi yapılır. Yüksek riskli işlemler için açık @manager onayı ve detaylı audit kaydı zorunludur.
-3. **Sürekli Ajan Geliştirme** — Tüm ajanların olgunluk hedefi minimum **8.0/10** olarak belirlenmiştir. Kritik alanlarda “yeterince iyi” kabul edilmez.
-4. **Sıfır Tolerans** — Yönetişimi bypass eden her girişim (Hermes kullanımı, briefing zorunluluğu, memory güncelleme, yüksek riskli işlem kontrolleri) ciddi süreç ihlali olarak değerlendirilir ve kayıt altına alınır.
-
----
-
-## 📊 Aktif Risk Takip Panosu (23 Mayıs 2026)
-
-Şu anda aşağıdaki 6 kritik risk, özel iyileştirme programlarıyla aktif olarak yönetilmektedir:
-
-| Risk                              | Mevcut Durum                                      | İlerleme Durumu                                      | Sahip      |
-|-----------------------------------|---------------------------------------------------|------------------------------------------------------|------------|
-| Referans Uygulama Yokluğu         | Henüz production-grade bir örnek proje yok        | Rehber ve program tanımlandı                         | @manager   |
-| @frontend Zayıflığı               | Bileşen mimarisi ve erişilebilirlik zayıf         | 6-8 haftalık Profesyonelleşme Programı aktif         | @manager   |
-| Hermes “Kağıt Üzerinde”           | Protokol tanımlı ancak gerçek hayatta test edilmedi | 4 senaryoluk Canlı Test Programı tanımlandı          | @manager   |
-| Claude Otomasyonu                 | Yarı otomatik, farklı versiyonlarda sorunlar var  | %60                                                  | @manager   |
-| Gerçek Kullanım Eksikliği         | Gerçek projelerde uzun süreli kullanım verisi yok | %0                                                   | @manager   |
-| Kurumsal Yönetişim                | Kurallar kağıt üzerinde güçlü, kanıt henüz yetersiz | %85                                                  | @manager   |
-
-Her risk için ayrı bir knowledge dosyası ve net bir iyileştirme yol haritası bulunmaktadır.
-
----
-
-## 🤖 Ajan Olgunluk Programı (Hedef: Tüm Ajanlar ≥ 8.0)
-
-Tüm ajanlar için yapılandırılmış bir profesyonelleşme programı yürütülmektedir. Mayıs 2026 itibarıyla mevcut olgunluk seviyeleri şu şekildedir:
+Dört vazgeçilmez ilke üzerine inşa edilmiştir:
 
-| Ajan               | Mevcut | Hedef | Öncelik     | Durum |
-|--------------------|--------|-------|-------------|-------|
-| **@manager**       | 8.0    | 9.5   | Yüksek      | Authority Audit & Enforcement sistemi aktif |
-| **@backend**       | 7.5    | 9.0   | Yüksek      | Test kültürü ve resilience güçlendiriliyor |
-| **@frontend**      | 6.5    | 9.0   | **Kritik**  | 8 haftalık Profesyonelleşme Programı devam ediyor |
-| **@analyst**       | 6.5    | 8.5   | Orta        | Governance denetim ve metrik yeteneği geliştiriliyor |
-| **@explorer**      | 6.5    | 8.5   | Orta        | Riskli alan raporlaması zorunlu hale getiriliyor |
-| **@git**           | 6.0    | 8.0   | Orta        | Yüksek riskli commit kontrolü eklendi |
-| **@mobile**        | 2.0    | 8.0   | Düşük       | İleride büyük çalışma gerekecek |
-| **@native**        | 2.0    | 8.0   | Düşük       | İleride büyük çalışma gerekecek |
-
-Detaylı haftalık planlar ve gelişim raporları Risk Takip Panosu’nda yer almaktadır.
+1. **Tek Yetki Noktası** — Kurumsal projelerde `@manager` tek yetkili giriş noktasıdır.
+2. **Risk Öncelikli Yaklaşım** — Her önemli işlem öncesi risk değerlendirmesi zorunludur.
+3. **Sürekli Ajan Geliştirme** — Tüm ajanların olgunluk hedefi minimum **8.0/10**’dur.
+4. **Sıfır Tolerans** — Yönetişimi bypass eden her girişim ciddi süreç ihlali olarak kabul edilir.
 
 ---
 
-## 🛡️ Önemli Yönetişim Yenilikleri (v0.6.5)
-
-### 1. Manager Authority Audit & Enforcement
-@manager’ın tüm ajanlar üzerindeki kontrolünü düzenli olarak denetlemesini ve ihlalleri tanımlanmış bir süreçle (düzeltme → kayıt → koçluk → kapsam kısıtlama) düzeltmesini sağlayan resmi sistem.
+## 🛡️ Önemli Yönetişim Yenilikleri (v0.6.7)
 
-### 2. Hermes Live Test Programı
-Hermes protokolünün “kağıt üzerinde tanımlı” olmaktan çıkıp “gerçek hayatta kanıtlanmış” hale gelmesi için 4 zorunlu canlı senaryo (Delegasyon, Yüksek Riskli İşlem Koordinasyonu, Çatışma Çözümü, Bilgi Paylaşımı) içeren yapılandırılmış program.
-
-### 3. @frontend Profesyonelleşme Programı
-Bileşen mimarisi (Compound Components & Slots), erişilebilirlik (WCAG 2.2 AA), performans mühendisliği, test disiplini ve yüksek riskli admin işlemleri + Hermes entegrasyonunu kapsayan 8 haftalık yoğun program.
-
-### 4. Kurumsal CRUD ve Yönetimsel İşlem Yönetişimi
-Kullanıcı/yetki yönetimi, toplu silme, sistem konfigürasyonu, audit log erişimi gibi yüksek riskli işlemler artık zorunlu @manager briefing, `managerApproval` nesnesi ve detaylı before/after audit log ile yapılmak zorundadır.
+- Manager Authority Audit & Enforcement
+- Hermes Live Test Program (4 zorunlu senaryo)
+- @frontend Profesyonelleşme Programı (8 hafta)
+- Kurumsal CRUD ve Yönetimsel İşlem Yönetişimi (`managerApproval`)
+- **v0.6.7:** Tüm framework İngilizce standardizasyonu ve MCP derleme hatası düzeltmesi
 
 ---
 
-## 🏗️ Mimari Özet
+## 🧠 Dürüst Durum (Mayıs 2026)
 
-Agent Enderun dört ana katmandan oluşur:
+**Güçlü Yönler:** Anayasal yönetişim, risk yönetimi, Hermes protokolü temeli, contract-first disiplin, ileri düzey kurumsal adaptasyon kuralları.
 
-- **Yönetişim Katmanı** (`{{FRAMEWORK_DIR}}/`) — Anayasa (`ENDERUN.md`), bellek (`PROJECT_MEMORY.md`), ajan tanımları, bilgi tabanı, loglar
-- **Zeka Katmanı** (`framework-mcp/`) — 40+ MCP aracı (kod analizi, scaffolding, kontrat doğrulama, ajan iletişimi, güvenlik taraması vb.)
-- **CLI Katmanı** (`bin/`) — Proje başlatma ve adaptör otomasyonu
-- **Uygulama Katmanı** (`apps/`) — Gerçek kullanıcı uygulamalarının geliştirileceği alan (şu anda boş — referans uygulama en yüksek önceliktir)
-
----
-
-## ⚡ Hızlı Başlangıç
-
-```bash
-# 1. Framework'ü başlat (.enderun/ klasörünü oluşturur)
-npx agent-enderun init
-
-# 2. Bağımlılıkları yükle
-npm install
-
-# 3. Framework’ü derle
-npm run enderun:build
-
-# 4. Kurulumu doğrula
-npx agent-enderun check
-```
-
-> **💡 Özel Adaptör Seçeneği:** İsterseniz belirli bir yapay zeka asistanı veya editör adaptörü ile de başlatabilirsiniz:  
-> `npx agent-enderun init [antigravity | claude | cursor | codex | gemini]`
-
-Adım adım detaylı kurulum rehberi için: [docs/getting-started.md](docs/getting-started.md)
-
----
-
-## 🧠 Dürüst Durum (23 Mayıs 2026)
-
-**Güçlü Yönler:**
-- Anayasal yönetişim ve zorunlu kurallar sistemi
-- Risk yönetimi ve ajan profesyonelleşme altyapısı
-- Hermes protokolünün teknik temeli ve zorunlu kullanım kuralları
-- Backend tarafında güçlü desenler ve contract-first disiplini
-- Bellek disiplini ve kalıcı denetim kaydı
-
-**Hâlâ Geliştirilmesi Gereken Alanlar:**
-- Henüz tam teşekküllü bir referans uygulama bulunmamaktadır (en yüksek öncelik)
-- @frontend henüz hedef olgunluk seviyesine ulaşmamıştır
-- Hermes protokolü henüz gerçek çoklu ajan senaryolarında tam olarak test edilmemiştir
-- Gerçek uzun vadeli kullanım verisi sınırlıdır
-- Mobile ve Native ajanlar erken aşamadadır
+**Geliştirilmesi Gereken Alanlar:** Build ve test altyapısı kırık, referans uygulama yok, Hermes henüz canlı test edilmemiş, gerçek kullanım verisi sınırlı, yönetişim kuralları kağıt üzerinde güçlü ancak pratikte kanıtlanmamış.
 
 ---
 
 ## 📍 Önümüzdeki Önemli Hedefler
 
-1. Normal CRUD + Yüksek Riskli Admin işlemi + Hermes kullanımını gösteren gerçek bir referans uygulama kurmak
-2. @frontend Profesyonelleşme Programını tamamlamak (hedef: 9.0)
-3. Hermes Live Test Programını çalıştırıp riski kapatmak
-4. Tüm ajanları minimum 8.0 olgunluk seviyesine çıkarmak
-
----
-
-## 📚 İlgili Dokümanlar
-
-- **[docs/roadmap.md](docs/roadmap.md)** — Risk Takip Panosu ve geliştirme yol haritası
-- **[docs/strategic-review-2026-05.md](docs/strategic-review-2026-05.md)** — Bağımsız stratejik değerlendirme raporu
-- **.enderun/agents/** — 8 ajanın detaylı Standart İş Prosedürleri (SOP)
-- **.enderun/knowledge/** — Uzmanlaşmış teknik ve yönetişim rehberleri
+1. Build, lint ve test pipeline’ını düzeltmek (P0)
+2. En az bir Hermes Live Test senaryosunu gerçek ajan oturumunda çalıştırmak
+3. @frontend Profesyonelleşme Programını tamamlamak
+4. Tüm ajanları ölçülebilir şekilde 8.0+ olgunluğa çıkarmak
+5. Kurumsal CRUD + managerApproval + Hermes’i kanıtlayan minimal referans uygulama üretmek
 
 ---
 
 **Agent Enderun yalnızca bir araç değildir.**  
-**Profesyonel, yapay zeka destekli yazılım geliştirme süreçleri için eksiksiz bir işletim sistemidir.**
+**Profesyonel, risk farkındalıklı, yapay zeka destekli yazılım geliştirme süreçleri için eksiksiz bir işletim sistemidir.**
 
 ---
 
-**README’nin her iki dili de (English + Türkçe) detaylı ve profesyonel şekilde tamamlandı.**
+**v0.6.7 — English Standardization & MCP Build Fix Release**

package/bin/hermes-sandbox.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+
+/**
+ * Agent Enderun — Hermes Protocol Stateful Simulation Sandbox
+ * 
+ * Demonstrates:
+ * - Scenario 1: Autonomous task delegation.
+ * - Scenario 2: High-risk admin action block & managerApproval injection.
+ */
+
+import fs from "fs";
+import path from "path";
+
+const MESSAGES_DIR = path.resolve("./.enderun/messages");
+const TRACE_ID = "01H7K9P2Q3R4S5T6U7V8W9X0Z2";
+
+console.log("🎬 STARTING HERMES PROTOCOL STATEFUL SANDBOX...");
+console.log(`Trace ID: ${TRACE_ID}`);
+console.log("--------------------------------------------------");
+
+// Ensure messages directory exists
+if (!fs.existsSync(MESSAGES_DIR)) {
+    fs.mkdirSync(MESSAGES_DIR, { recursive: true });
+}
+
+// Clean up previous test messages
+const cleanInbox = (agent) => {
+    const p = path.join(MESSAGES_DIR, `${agent}.json`);
+    if (fs.existsSync(p)) fs.unlinkSync(p);
+};
+cleanInbox("backend");
+cleanInbox("manager");
+
+function sendMessage(from, to, content, category = "INFO") {
+    const messagePath = path.join(MESSAGES_DIR, `${to}.json`);
+    const messages = fs.existsSync(messagePath) ? JSON.parse(fs.readFileSync(messagePath, "utf-8")) : [];
+    
+    const msg = {
+        timestamp: new Date().toISOString(),
+        from,
+        to,
+        traceId: TRACE_ID,
+        category,
+        priority: "HIGH",
+        content,
+        status: "PENDING"
+    };
+    
+    messages.push(msg);
+    fs.writeFileSync(messagePath, JSON.stringify(messages, null, 2));
+    console.log(`📡 [Hermes Msg] ${from} ➡️ ${to} [${category}]: "${content}"`);
+}
+
+function readInbox(agent) {
+    const messagePath = path.join(MESSAGES_DIR, `${agent}.json`);
+    if (!fs.existsSync(messagePath)) return [];
+    
+    const messages = JSON.parse(fs.readFileSync(messagePath, "utf-8"));
+    const pending = messages.filter(m => m.status === "PENDING" || m.status === "READ");
+    
+    // Mark as read
+    const updated = messages.map(m => m.status === "PENDING" ? { ...m, status: "READ" } : m);
+    fs.writeFileSync(messagePath, JSON.stringify(updated, null, 2));
+    
+    return pending;
+}
+
+function updateStatus(agent, traceId, status) {
+    const messagePath = path.join(MESSAGES_DIR, `${agent}.json`);
+    if (!fs.existsSync(messagePath)) return;
+    
+    const messages = JSON.parse(fs.readFileSync(messagePath, "utf-8"));
+    const updated = messages.map(m => m.traceId === traceId ? { ...m, status } : m);
+    fs.writeFileSync(messagePath, JSON.stringify(updated, null, 2));
+    console.log(`🔒 [Hermes LifeCycle] Message on @${agent} marked as: ${status}`);
+}
+
+// --- STEP 1: @manager Delegates Task (Scenario 1) ---
+console.log("\n[Step 1: Task Scaffolding & Briefing Delegation]");
+sendMessage("manager", "backend", "Upgrade User 42 role to SuperAdmin inside target database.", "DELEGATION");
+
+// --- STEP 2: @backend Reads & Detects High-Risk Action without approval (Scenario 2) ---
+console.log("\n[Step 2: @backend Inbox Check & High-Risk Guard Trigger]");
+const backendInbox1 = readInbox("backend");
+const taskMsg = backendInbox1.find(m => m.category === "DELEGATION");
+
+if (taskMsg) {
+    console.log(`⚙️  @backend is processing delegation trace: ${taskMsg.traceId}`);
+    console.log("⚠️  @backend security check: 'Upgrade User 42 role' detected as High-Risk Administrative Action!");
+    console.log("❌ @backend security block: Action rejected due to missing 'managerApproval' signature payload!");
+    
+    sendMessage("backend", "manager", "ALERT: Cannot upgrade role for User 42. High-risk administrative action requires dynamic 'managerApproval' token.", "ALERT");
+    updateStatus("backend", TRACE_ID, "REJECTED");
+}
+
+// --- STEP 3: @manager Processes Block, Generates Approval Token, Re-sends msg ---
+console.log("\n[Step 3: @manager Token Generation & Re-Delegation]");
+const managerInbox = readInbox("manager");
+const alertMsg = managerInbox.find(m => m.category === "ALERT");
+
+if (alertMsg) {
+    console.log(`💡 @manager received alert: "${alertMsg.content}"`);
+    console.log("🔐 @manager Dynamic Key Signing active...");
+    
+    const approvalToken = {
+        approved: true,
+        traceId: TRACE_ID,
+        approvedBy: "@manager",
+        approvedAt: new Date().toISOString(),
+        reason: "Authorized Role Upgrade for Enterprise Compliance",
+        riskLevel: "Critical",
+        rollbackPlan: "Demote role back to standard User via database rollback script."
+    };
+    
+    console.log("✅ managerApproval Token generated successfully:", JSON.stringify(approvalToken, null, 2));
+    
+    sendMessage("manager", "backend", `APPROVED: Here is the signed token: ${JSON.stringify(approvalToken)}`, "DELEGATION");
+}
+
+// --- STEP 4: @backend Receives Approval, Executes Simulated DDL/DML, Completes lifecycle ---
+console.log("\n[Step 4: @backend final validation and execution]");
+const backendInbox2 = readInbox("backend");
+const approvedMsg = backendInbox2.find(m => m.category === "DELEGATION" && m.content.startsWith("APPROVED:"));
+
+if (approvedMsg) {
+    console.log("📥 @backend received approval token.");
+    console.log("🛡️  @backend validation: managerApproval signature MATCHED.");
+    console.log("🚀 @backend execution: Running mock SQL transaction... 'UPDATE users SET role = 'SuperAdmin' WHERE id = 42;'");
+    console.log("📝 @backend logging: Audit log record generated with Trace ID.");
+    
+    sendMessage("backend", "manager", "SUCCESS: User 42 successfully upgraded to SuperAdmin. Trace record finalized.", "INFO");
+    updateStatus("backend", TRACE_ID, "COMPLETED");
+}
+
+console.log("\n--------------------------------------------------");
+console.log("🎉 HERMES STATEFUL SIMULATION COMPLETED SUCCESSFULLY!");