agent-enderun 0.8.1 → 0.8.2

package/.enderun/agents/{security/prompt.md → security.md}

@@ -1,10 +1,54 @@
----
 agent: "@security"
-version: "1.0.0"
+version: "0.8.2"
 role: Security Auditor & Compliance Officer
 capability: 9.3
 ---
 
+# @security — Security Auditor & Compliance Officer (v0.8.2)
+rules:
+  - "NEVER write application code. Your role is exclusively to audit, assess, and report — never to implement."
+  - "Run security_audit_scan before every merge/deploy gate. A failing scan is a hard BLOCK — no exceptions."
+  - "All findings must be categorized by severity: CRITICAL, HIGH, MEDIUM, LOW. Only CRITICAL and HIGH require immediate escalation to @manager."
+  - "Never expose secrets, credentials, or PII in your reports — redact all sensitive values."
+  - "Maintain a running security findings log in {{FRAMEWORK_DIR}}/logs/security.json. Every scan appends — never overwrites."
+  - "Constitution compliance (analyze_constitution_compliance) must be run on every full session, not just on deploys."
+  - "Dependency vulnerability scans must reference a real package manifest (package.json, requirements.txt, etc.) — never fabricate CVE data."
+  - "All penetration test scenarios must be tagged with the OWASP category they target."
+permittedDirectories:
+  - "{{FRAMEWORK_DIR}}/"
+  - "apps/backend/src/"
+  - "apps/web/"
+  - "framework-mcp/src/"
+  - "docs/"
+hermesChannels:
+  - "@security->@manager"
+  - "@security->@backend"
+  - "@security->@git"
+  - "@security->@devops"
+tags:
+  - "specialist"
+  - "security"
+  - "governance"
+stateMachine:
+  schemaRef: "../schema/agent-lifecycle-schema.json"
+checklists:
+  beforeEveryAudit:
+    - "Confirm scope: which directories/files are in scope for this audit?"
+    - "Verify security_audit_scan tool is available via MCP"
+    - "Check {{FRAMEWORK_DIR}}/logs/security.json for previous findings to track regressions"
+    - "Confirm no real secrets will appear in the report output"
+  afterEveryAudit:
+    - "Write all findings to {{FRAMEWORK_DIR}}/logs/security.json with Trace ID"
+    - "Escalate CRITICAL/HIGH findings to @manager via Hermes immediately"
+    - "Update STATUS.md with current security health"
+    - "Log audit action via log_agent_action MCP tool"
+  deployGate:
+    - "Run security_audit_scan — zero CRITICAL findings required"
+    - "Run analyze_constitution_compliance — zero violations required"
+    - "Confirm all hardcoded secrets check passed"
+    - "Sign off to @devops and @manager"
+---
+
 # @security — Security Auditor & Compliance Officer
 
 ## Identity & Mission
@@ -152,3 +196,4 @@ GATE: BLOCKED | PASSED | CONDITIONAL_PASS
 - ❌ Fabricating CVE data or vulnerability reports
 - ❌ Bypassing the deploy gate — even under time pressure from @manager
 - ❌ Exposing real secrets in logs or reports
+---

package/.enderun/gemini.md

@@ -2,18 +2,18 @@
 
 This file is the entry point when using Agent Enderun with Gemini CLI.
 
-The framework installs into the `.gemini/` folder for Gemini users.
+The framework installs into the `.enderun/` folder for Gemini users.
 
 ### Primary Constitution
 All governance rules, agent checklists, and project memory live here:
 
-👉 **[.gemini/ENDERUN.md](.gemini/ENDERUN.md)**
+👉 **[.enderun/ENDERUN.md](.enderun/ENDERUN.md)**
 
 ### 🤖 Agent Directive (Gemini CLI users)
 You are operating under the Agent Enderun governance framework.
 
 At the **start of every session**, before any work:
-1. Read `.gemini/PROJECT_MEMORY.md` to restore state, active Trace ID, and history.
-2. Read the relevant agent definition under `.gemini/agents/{agent}/agent.json` (especially `@manager`).
+1. Read `.enderun/PROJECT_MEMORY.md` to restore state, active Trace ID, and history.
+2. Read the relevant agent definition under `.enderun/agents/{agent}.md` (especially `@manager`).
 
-All paths and references inside `.gemini/` use the Gemini adapter structure. No migration to other CLIs is required.
+All paths and references inside `.enderun/` use the Enderun adapter structure. No migration to other CLIs is required.

package/.enderun/knowledge/corporate-governance/corporate-project-kickoff-checklist.md

@@ -9,7 +9,7 @@ This checklist must be completed (and documented in `PROJECT_MEMORY.md`) at the
 
 ## Phase 0 – Governance Alignment
 
-- [ ] @manager has read all files in `.gemini/knowledge/corporate-governance/`
+- [ ] @manager has read all files in `.enderun/knowledge/corporate-governance/`
 - [ ] User has been given the Governance Baseline Briefing
 - [ ] User has explicitly acknowledged the corporate standards
 - [ ] Decision recorded in `PROJECT_MEMORY.md` under "Critical Decisions"

package/.enderun/knowledge/corporate-governance/corporate-project-scaffolding-sop.md

@@ -82,7 +82,7 @@ When delegating any work to `@backend` or `@frontend`:
 The briefing message **must** include:
 - Exact path to the contract types for this feature.
 - Classification of whether the feature contains high-risk actions.
-- Explicit references to the relevant files in `.gemini/knowledge/corporate-governance/`.
+- Explicit references to the relevant files in `.enderun/knowledge/corporate-governance/`.
 - Requirement to notify @manager before implementing any high-risk path.
 - Mandate to produce ADR documentation for any new governance decisions.
 

package/.enderun/knowledge/framework_vs_user_project_boundary.md

@@ -7,7 +7,7 @@ This is one of the most important rules in Agent Enderun.
 There is a strict separation between two things:
 
 1. **The Agent Enderun Framework** (the tool)
-   - Located in: `framework-mcp/`, `.gemini/`, `bin/`, root config files (`panda.config.ts`, etc.)
+   - Located in: `framework-mcp/`, `.enderun/`, `bin/`, root config files (`panda.config.ts`, etc.)
    - Purpose: Governance, agents, MCP tools, CLI, knowledge base, blueprints
 
 2. **The User's Application** (what the user is actually building)
@@ -22,14 +22,14 @@ All new code, files, features, and modifications must happen **exclusively** ins
 
 ### Forbidden Actions (When Building User's Project)
 - Creating files in `framework-mcp/src/utils/`, `framework-mcp/src/tools/`, etc.
-- Modifying agent definitions in `.gemini/agents/`
+- Modifying agent definitions in `.enderun/agents/`
 - Editing `panda.config.ts` at the root (unless the project itself uses it directly)
 - Adding new MCP tools unless the explicit task is "improve the framework"
 
 ### Allowed Actions
 - Creating files in `apps/backend/src/...`
 - Creating files in `apps/web/src/...`
-- Adding blueprints and knowledge under `.gemini/` **only** when improving the framework for everyone
+- Adding blueprints and knowledge under `.enderun/` **only** when improving the framework for everyone
 - Updating project-specific configs inside the user's `apps/` or root project files
 
 ## Why This Rule Exists

package/.enderun/knowledge/frontend_professionalization_guidelines.md

@@ -98,8 +98,8 @@ The "@frontend Zayıflığı" risk can be closed when:
 
 ## Related Documents
 
-- `.gemini/agents/frontend.md` (main definition)
-- `.gemini/knowledge/reference_application_guidelines.md`
+- `.enderun/agents/frontend.md` (main definition)
+- `.enderun/knowledge/reference_application_guidelines.md`
 - `docs/roadmap.md` → Risk Tracking Dashboard
 - `PROJECT_MEMORY.md` → STRATEGIC ROADMAP
 

package/.enderun/knowledge/hermes_live_test_guidelines.md

@@ -78,10 +78,10 @@ The "Hermes Kağıt Üzerinde" risk can be closed only when **all** of the follo
 
 ## Related Documents
 
-- `.gemini/knowledge/hermes_protocol.md` (original protocol definition)
-- `.gemini/agents/manager.md` → Hermes Communication Mandate section
-- `.gemini/knowledge/frontend_professionalization_guidelines.md`
-- `.gemini/knowledge/reference_application_guidelines.md`
+- `.enderun/knowledge/hermes_protocol.md` (original protocol definition)
+- `.enderun/agents/manager.md` → Hermes Communication Mandate section
+- `.enderun/knowledge/frontend_professionalization_guidelines.md`
+- `.enderun/knowledge/reference_application_guidelines.md`
 - `docs/roadmap.md` → Risk Tracking Dashboard
 - `PROJECT_MEMORY.md` → STRATEGIC ROADMAP
 

package/.enderun/knowledge/hermes_protocol.md

@@ -45,10 +45,10 @@ Every message sent via `send_agent_message` must follow this conceptual structur
 
 ## 🔄 Lifecycle Protocol
 
-1.  **Dispatch:** Agent calls `send_agent_message`. Message is saved in `.gemini/messages/recipient.json`.
+1.  **Dispatch:** Agent calls `send_agent_message`. Message is saved in `.enderun/messages/recipient.json`.
 2.  **Notification:** The recipient agent checks their inbox during their turn via `read_agent_messages`.
 3.  **Acknowledgment:** For `ACTION` or `DELEGATION`, the recipient should send an `INFO` message back once started or completed.
-4.  **Logging:** All critical communications must be summarized in the agent's log file (`.gemini/logs/agent.json`).
+4.  **Logging:** All critical communications must be summarized in the agent's log file (`.enderun/logs/agent.json`).
 
 ---
 

package/.enderun/knowledge/manager_authority_audit_enforcement.md

@@ -92,10 +92,10 @@ Every time a reference application or major task is executed, @manager must run
 
 ## Related Documents
 
-- `.gemini/agents/manager.md` → Kurumsal Proje İçin @manager Zorunlu Davranış Kuralları + Hermes Communication Mandate
-- `.gemini/knowledge/hermes_live_test_guidelines.md`
-- `.gemini/knowledge/frontend_professionalization_guidelines.md`
-- `.gemini/knowledge/reference_application_guidelines.md`
+- `.enderun/agents/manager.md` → Kurumsal Proje İçin @manager Zorunlu Davranış Kuralları + Hermes Communication Mandate
+- `.enderun/knowledge/hermes_live_test_guidelines.md`
+- `.enderun/knowledge/frontend_professionalization_guidelines.md`
+- `.enderun/knowledge/reference_application_guidelines.md`
 - `docs/roadmap.md` → Risk Tracking Dashboard
 - `PROJECT_MEMORY.md` → STRATEGIC ROADMAP + HISTORY
 

package/.enderun/knowledge/project_scaffold_guidelines.md

@@ -88,10 +88,10 @@ A project scaffold is considered successful when:
 
 ## Related Documents
 
-- `.gemini/knowledge/reference_application_guidelines.md`
-- `.gemini/knowledge/frontend_professionalization_guidelines.md`
-- `.gemini/knowledge/hermes_live_test_guidelines.md`
-- `.gemini/knowledge/manager_authority_audit_enforcement.md`
+- `.enderun/knowledge/reference_application_guidelines.md`
+- `.enderun/knowledge/frontend_professionalization_guidelines.md`
+- `.enderun/knowledge/hermes_live_test_guidelines.md`
+- `.enderun/knowledge/manager_authority_audit_enforcement.md`
 - `docs/roadmap.md` → Risk Tracking Dashboard
 
 ---

package/.enderun/knowledge/reference_application_guidelines.md

@@ -44,7 +44,7 @@ Any reference application **must** demonstrate the following:
 
 6. **Framework Boundary Respect**
    - All code lives strictly inside `apps/`
-   - No modifications to `framework-mcp/`, `.gemini/agents/`, or root framework files
+   - No modifications to `framework-mcp/`, `.enderun/agents/`, or root framework files
 
 7. **Professional Standards**
    - Error handling with DomainError hierarchy

package/.enderun/memory-graph/shared-facts.json

@@ -47,6 +47,6 @@
     { "agent": "@native", "capability": 8.9, "primaryDomain": "native" },
     { "agent": "@mobile", "capability": 8.8, "primaryDomain": "mobile" }
   ],
-  "frameworkVersion": "1.0.0-alpha",
+  "frameworkVersion": "0.8.2",
   "constitutionFile": "ENDERUN.md"
 }

package/ENDERUN.md

@@ -1,4 +1,4 @@
-# Agent Enderun (v0.7.5)
+# Agent Enderun (v0.8.2)
 # Place in project root. This file is the single source of truth for Base Project AI Extensions.
 
 ## 🎖️ AGENT CHECKLIST (MANDATORY BEFORE RESPONSE)
@@ -47,7 +47,7 @@ This file (`./{{ADAPTER}}.md`) and the `{{FRAMEWORK_DIR}}/docs/` folder represen
      - `CRITICAL DECISIONS` (Previous design decisions to comply with)
      - `ACTIVE TASKS` (Ongoing work and agent assignments)
      - `HISTORY` (To see exactly what agents did recently)
-   - **Load Agent Prompt:** By default, you operate as `@manager`. Immediately read and load `{{FRAMEWORK_DIR}}/agents/manager/agent.json` to adopt its exact rules, workflows, and checklists. If the user explicitly invokes a specialist (e.g., `@backend`), immediately read and load the corresponding agent file (e.g., `{{FRAMEWORK_DIR}}/agents/backend/agent.json`).
+   - **Load Agent Prompt:** By default, you operate as `@manager`. Immediately read and load `{{FRAMEWORK_DIR}}/agents/manager.md` to adopt its exact rules, workflows, and checklists. If the user explicitly invokes a specialist (e.g., `@backend`), immediately read and load the corresponding agent file (e.g., `{{FRAMEWORK_DIR}}/agents/backend.md`).
 2. **Read ./{{ADAPTER}}.md First:** Read and fully understand this file before taking any action.
 3. **Check `docs/` Folder:** Verify the existence of the `docs/` folder (located at the root directory of the project).
 4. **Absorb Context:** Read `docs/README.md` and `docs/getting-started.md`. If they are missing, check if the architecture folder exists.
@@ -63,7 +63,7 @@ This file (`./{{ADAPTER}}.md`) and the `{{FRAMEWORK_DIR}}/docs/` folder represen
 
 - **Permanent @manager Identity (Enterprise Standard):** The AI assistant is ALWAYS the `@manager` (Team-Lead) by default — on every turn, every message, without exception. The user does NOT need to type `@manager` to trigger this role. Explicitly typing a different agent (e.g. `@backend`, `@frontend`, `@analyst`) does NOT bypass @manager. All requests must still be processed by @manager first.
 - **Team-Lead MANDATORY Orchestration (Enterprise Project Rule):** Every user request — regardless of how it is phrased or which agent is directly addressed — MUST first be received, analyzed, and orchestrated by the `@manager` (Team-Lead) agent. The `@manager` is solely responsible for intent analysis, risk assessment, memory update, phase validation, and structured delegation. No specialist agent is authorized to act on any user request without receiving a formal briefing from @manager. Direct calls to other agents are still routed through @manager. Violating this rule in enterprise projects is considered a serious process failure.
-- **Enterprise CRUD & Admin Governance (Enterprise Standard):** All high-risk administrative operations (user/permission management, bulk delete/purge, system config changes, audit log access, critical integrations, PII export, production schema changes, etc.) are strictly under @manager control. Specialist agents (@backend, @frontend, etc.) **must refuse** and immediately redirect such requests to @manager. Unauthorized execution is recorded as “Rule Violation - Unauthorized Administrative Action”. Full list and rules are defined in `{{FRAMEWORK_DIR}}/agents/manager/agent.json` → “Corporate CRUD and Administrative Operation Governance”.
+- **Enterprise CRUD & Admin Governance (Enterprise Standard):** All high-risk administrative operations (user/permission management, bulk delete/purge, system config changes, audit log access, critical integrations, PII export, production schema changes, etc.) are strictly under @manager control. Specialist agents (@backend, @frontend, etc.) **must refuse** and immediately redirect such requests to @manager. Unauthorized execution is recorded as “Rule Violation - Unauthorized Administrative Action”. Full list and rules are defined in `{{FRAMEWORK_DIR}}/agents/manager.md` → “Corporate CRUD and Administrative Operation Governance”.
 - **Zero-Request Logging Policy:** Agents MUST log every action and update `PROJECT_MEMORY.md` automatically at the end of every turn, without waiting for a user directive. This is the "Operating Mode" of the framework.
 - **Immediate Memory Sync:** Every state change, decision, or improved capability must be reflected in the memory files immediately.
 - **Zero Temporary Storage & Single Source of Truth:** Storing, caching, or writing project details, logs, tasks, files, or agent planning documents (including implementation plans, scratch scripts, or intermediate tasks) in the operating system's temporary directory (`/tmp`, `/var/tmp`, `temp`, etc.) is strictly forbidden. All planning, state, tasks, and memory MUST be stored inside the designated persistent framework directory (`{{FRAMEWORK_DIR}}/` or `.{{ADAPTER}}/` etc.) or the project workspace. This ensures 100% state persistence and context recovery upon session restarts.

package/README.md

@@ -20,7 +20,7 @@ Most AI coding tools optimize for speed and generation volume. Agent Enderun opt
 
 > [!NOTE]
 > **v0.7.0 Strategic Consolidation:**
-> The active runtime folder in user projects is `.gemini/`. The framework ships its templates from `.enderun/`. All specialist agent configurations live as strongly-typed `agent.json` under `.gemini/agents/{agent_name}/agent.json`. Duplicate or staging structures have been retired.
+> The active runtime folder in user projects is `.enderun/`. The framework ships its templates from `.enderun/`. All specialist agent configurations live as strongly-typed `agent.json` under `.enderun/agents/{agent_name}.md`. Duplicate or staging structures have been retired.
 
 ---
 
@@ -36,7 +36,7 @@ This is the supreme law of the framework, dictating mandatory rules and protocol
 - **Procedural Continuity:** All agents MUST adhere to the existing architectural and stylistic patterns of the project.
 
 ### 2. Project Memory (`PROJECT_MEMORY.md`)
-This file, located in `.gemini/`, is the **Single Source of Truth (SSOT)** for the project's state. It is a human-readable Markdown file that all agents read at the start of a session and update at the end. Its key sections are:
+This file, located in `.enderun/`, is the **Single Source of Truth (SSOT)** for the project's state. It is a human-readable Markdown file that all agents read at the start of a session and update at the end. Its key sections are:
 - **`CURRENT STATUS`:** Tracks the active phase, Trace ID, and any blockers.
 - **`CRITICAL DECISIONS`:** A log of important architectural choices to ensure consistency.
 - **`ACTIVE TASKS`:** A table of all ongoing tasks, their status, priority, and assigned agent.
@@ -52,7 +52,7 @@ Every task or logical unit of work is assigned a unique **Trace ID** (a 26-chara
 Each agent in the Enderun Army is governed by a strongly-typed `agent.json` definition that defines their precise rules, permitted directories, and capability ratings.
 
 ### Workspace Agent Path:
-👉 `[project-root]/.gemini/agents/{agent_name}/agent.json`
+👉 `[project-root]/.enderun/agents/{agent_name}.md`
 
 ### Agent Army Overview (v1.0 - 12 Specialists):
 
@@ -75,7 +75,7 @@ Each agent in the Enderun Army is governed by a strongly-typed `agent.json` defi
 
 ### 📂 Core Directories Analysis & Operational Purposes
 
-The Agent Enderun framework organizes agent actions and runtime intelligence through highly structured directories remapped to `.gemini/` (or `.claude/` / `.cursor/`) inside user workspaces:
+The Agent Enderun framework organizes agent actions and runtime intelligence through highly structured directories remapped to `.enderun/` (or `.claude/` / `.cursor/`) inside user workspaces:
 
 * **`skills/` (Dynamic Executables):** Serves as a folder for model-specific executable scripts and custom tools. Developers can inject project-specific helpers here, allowing agents to load and execute them dynamically on-demand during active briefs.
 * **`benchmarks/` (LLM Evaluation):** Dedicated folder for metrics, token consumption, and response accuracy logs comparing different LLM engines (e.g. Gemini 1.5 Pro vs Claude 3.5 Sonnet vs Codex). Helps evaluate the coding intelligence of the active army.
@@ -166,7 +166,7 @@ Agent Enderun comes with a powerful set of CLI tools for managing the project.
 
 > [!NOTE]
 > **v0.7.0 Stratejik Konsolidasyon:**
-> Çalışma zamanı klasörü kullanıcı projelerinde `.gemini/` olarak oluşturulur. Ajan yapılandırmaları `.gemini/agents/{agent_name}/agent.json` altında yer alır. Eski veya mükerrer yapılar tamamen kaldırılmıştır.
+> Çalışma zamanı klasörü kullanıcı projelerinde `.enderun/` olarak oluşturulur. Ajan yapılandırmaları `.enderun/agents/{agent_name}.md` altında yer alır. Eski veya mükerrer yapılar tamamen kaldırılmıştır.
 
 ---
 
@@ -182,7 +182,7 @@ Bu, tüm ajanlar için zorunlu kuralları ve protokolleri dikte eden, çerçeven
 - **Prosedürel Devamlılık:** Tüm ajanlar, projenin mevcut mimari ve stilistik kalıplarına uymak ZORUNDADIR.
 
 ### 2. Proje Hafızası (`PROJECT_MEMORY.md`)
-`.gemini/` içinde bulunan bu dosya, projenin durumu için **Tek Doğruluk Kaynağıdır (SSOT)**. Tüm ajanların bir oturumun başında okuduğu ve sonunda güncellediği, insan tarafından okunabilir bir Markdown dosyasıdır. Ana bölümleri şunlardır:
+`.enderun/` içinde bulunan bu dosya, projenin durumu için **Tek Doğruluk Kaynağıdır (SSOT)**. Tüm ajanların bir oturumun başında okuduğu ve sonunda güncellediği, insan tarafından okunabilir bir Markdown dosyasıdır. Ana bölümleri şunlardır:
 - **`CURRENT STATUS`:** Aktif aşamayı, Trace ID'yi ve varsa engelleyicileri izler.
 - **`CRITICAL DECISIONS`:** Tutarlılığı sağlamak için önemli mimari seçimlerin bir kaydı.
 - **`ACTIVE TASKS`:** Devam eden tüm görevlerin, durumlarının, önceliklerinin ve atanan ajanın bir tablosu.
@@ -198,7 +198,7 @@ Her göreve veya mantıksal iş birimine benzersiz bir **Trace ID** (26 karakter
 Enderun Ordusu'ndaki her ajan, kendilerine ait kuralları, izin verilen dizinleri ve yetenek derecelendirmelerini tanımlayan güçlü tipli bir `agent.json` dosyası tarafından yönetilir.
 
 ### Çalışma Alanı Ajan Yolu:
-👉 `[proje-kök-dizini]/.gemini/agents/{agent_name}/agent.json`
+👉 `[proje-kök-dizini]/.enderun/agents/{agent_name}.md`
 
 ### Ajan Ordusuna Genel Bakış (v1.0 - 12 Uzman Ajan):
 
@@ -226,7 +226,7 @@ Enderun Ordusu'ndaki her ajan, kendilerine ait kuralları, izin verilen dizinler
 ### 📂 1. Kapsamlı Klasör ve Dosya Yapısı Analizi
 
 * **🧠 Çekirdek Komuta Klasörü (`.enderun/`):** 
-  * Ajanların şablon kaynak dosyalarının yer aldığı ve hedef projede `.gemini/` (veya `.claude/` / `.cursor/`) olarak yeniden adlandırılan ana zeka merkezidir.
+  * Ajanların şablon kaynak dosyalarının yer aldığı ve hedef projede `.enderun/` (veya `.claude/` / `.cursor/`) olarak yeniden adlandırılan ana zeka merkezidir.
   * **`agents/` (Ajan Tanımları & SOP'lar)**: 12 uzman ajanın davranış kurallarını barındırır. Her ajanın altında bir `agent.json` ve prompt/SOP dosyaları (`prompt.md`) bulunur. Durum makinesi şeması `schema/agent-lifecycle-schema.json` ile yönetilir.
   * **`knowledge/` (Bilgi Bankası)**: Projenin anayasasını, sıfır UI kütüphanesi politikasını ve veri tabanı/kod standartlarını içeren 26 adet Markdown kılavuzunu barındırır. `corporate-governance/` alt klasöründe onay mekanizmaları, branded types hukuku ve audit loglama standartları gibi kurumsal düzeydeki 17 katı yönetişim kılavuzu yer alır.
   * **`memory-graph/` (Bellek Grafiği)**: Ajanların etkileşim ağını (`graph.json`), ortak paylaştıkları doğruları (`shared-facts.json`) ve her bir ajanın yerel bağlam belleklerini (`agent-contexts/`) saklar.

package/bin/validate-agent-army.js

@@ -3,30 +3,55 @@
 import fs from "fs";
 import path from "path";
 
-const AGENTS_DIR = path.resolve("./.gemini/agents");
-const SCHEMA_PATH = path.resolve("./.gemini/agents/agent_army_schema.json");
+const frameworkDir = fs.existsSync("./.enderun") ? "./.enderun" : "./.gemini";
+const AGENTS_DIR = path.resolve(frameworkDir, "agents");
+const SCHEMA_PATH = path.resolve(frameworkDir, "agents/agent_army_schema.json");
 
-console.log("🛡️  STARTING AUTOMATED AGENT ARMY VALIDATION...");
+console.log(`🛡️  STARTING AUTOMATED AGENT ARMY VALIDATION (${frameworkDir})...`);
 
 try {
     const schema = JSON.parse(fs.readFileSync(SCHEMA_PATH, "utf8"));
     const requiredKeys = schema.required;
-    const agents = fs.readdirSync(AGENTS_DIR);
+    const files = fs.readdirSync(AGENTS_DIR);
     let totalFailed = 0;
 
     console.log("--------------------------------------------------");
     console.log("| Agent ID  | Status    | Score | Category       |");
     console.log("--------------------------------------------------");
 
-    for (const agentDirName of agents) {
-        const agentJsonPath = path.join(AGENTS_DIR, agentDirName, "agent.json");
-        if (!fs.existsSync(agentJsonPath)) continue;
+    for (const fileName of files) {
+        if (!fileName.endsWith(".md")) continue;
+        const filePath = path.join(AGENTS_DIR, fileName);
+        const content = fs.readFileSync(filePath, "utf8");
+
+        // Simple YAML frontmatter parser
+        const match = content.match(/^---\n([\s\S]*?)\n---/);
+        if (!match) {
+            console.log(`| ${fileName.padEnd(9)} | ❌ NO YAML | ----- | ---------------- |`);
+            totalFailed++;
+            continue;
+        }
+
+        const yamlContent = match[1];
+        const agent = {};
+        yamlContent.split("\n").forEach(line => {
+            const [key, ...valParts] = line.split(":");
+            if (key && valParts.length > 0) {
+                let val = valParts.join(":").trim();
+                // Clean quotes and handle numbers
+                val = val.replace(/^['"]|['"]$/g, "");
+                if (!isNaN(val) && val !== "") {
+                    agent[key.trim()] = Number(val);
+                } else {
+                    agent[key.trim()] = val;
+                }
+            }
+        });
 
-        const agent = JSON.parse(fs.readFileSync(agentJsonPath, "utf8"));
         const missing = requiredKeys.filter(k => agent[k] === undefined);
 
         if (missing.length > 0) {
-            console.log(`| ${agentDirName.padEnd(9)} | ❌ FAILED  | ----- | ${`Missing keys: ${missing.join(", ")}`.slice(0, 14)} |`);
+            console.log(`| ${fileName.replace(".md", "").padEnd(9)} | ❌ FAILED  | ----- | ${`Missing: ${missing.join(",")}`.slice(0, 16)} |`);
             totalFailed++;
         } else {
             console.log(`| ${agent.name.padEnd(9)} | ✅ PASSED  | ${String(agent.capability).padEnd(5)} | ${agent.role.substring(0,14).padEnd(14)} |`);

package/docs/getting-started.md

@@ -70,7 +70,7 @@ npx agent-enderun init
 npx agent-enderun init gemini
 ```
 
-This creates the `.gemini/` runtime folder + `gemini.md` shim at the root for Gemini CLI users.
+This creates the `.enderun/` runtime folder + `gemini.md` shim at the root for Gemini CLI users.
 
 Other legacy adapters (`claude`, `cursor`, `codex`) may still work for editor-specific workflows.
 
@@ -136,7 +136,7 @@ Write your project's goals, business requirements, and primary features here.
 
 ### 4.3 `.enderun/PROJECT_MEMORY.md`
 
-Automatically created during initial setup inside `.gemini/PROJECT_MEMORY.md`. The Gemini adapter uses the `.gemini/` runtime folder.
+Automatically created during initial setup inside `.enderun/PROJECT_MEMORY.md`. The Gemini adapter uses the `.enderun/` runtime folder.
 
 ---
 

package/docs/roadmap.md

@@ -16,7 +16,7 @@ This document outlines the development roadmap for the Agent Enderun framework *
 - **Version:** v0.6.6 (ready for npm release)
 - **System Health:** 🟢 GREEN
 - **Key Accomplishments:**
-  - Only Gemini adapter supported (installs to .gemini/)
+  - Only Gemini adapter supported (installs to .enderun/)
   - Antigravity adapter and all related code fully removed
   - Lint technical debt resolved (reduced from 43 to 0 issues)
   - Published `docs/getting-started.md` guide

package/framework-mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-enderun-mcp",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Enterprise-grade MCP Server for AI Agent Framework",
   "author": "Yusuf BEKAR",
   "license": "MIT",

package/framework-mcp/src/tools/governance.ts

@@ -1,7 +1,7 @@
 /**
  * Governance Tools - MCP Tools for enforcing corporate governance standards
  * 
- * These tools bridge the .gemini/knowledge/corporate-governance/ knowledge base
+ * These tools bridge the .enderun/knowledge/corporate-governance/ knowledge base
  * with actual code-level compliance verification.
  * 
  * Philosophy: We do not just document standards — we actively verify them.

package/framework-mcp/src/utils.ts

@@ -10,7 +10,7 @@ const getPackageVersion = (): string => {
         const pkgPath = path.join(__dirname, "../package.json");
         if (fs.existsSync(pkgPath)) {
             const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
-            return pkg.version || "0.7.5";
+            return pkg.version || "0.8.2";
         }
     } catch {
         // fallback

package/gemini.md

@@ -2,18 +2,18 @@
 
 This file is the entry point when using Agent Enderun with Gemini CLI.
 
-The framework installs into the `.gemini/` folder for Gemini users.
+The framework installs into the `.enderun/` folder for Gemini users.
 
 ### Primary Constitution
 All governance rules, agent checklists, and project memory live here:
 
-👉 **[.gemini/ENDERUN.md](.gemini/ENDERUN.md)**
+👉 **[.enderun/ENDERUN.md](.enderun/ENDERUN.md)**
 
 ### 🤖 Agent Directive (Gemini CLI users)
 You are operating under the Agent Enderun governance framework.
 
 At the **start of every session**, before any work:
-1. Read `.gemini/PROJECT_MEMORY.md` to restore state, active Trace ID, and history.
-2. Read the relevant agent definition under `.gemini/agents/{agent}/agent.json` (especially `@manager`).
+1. Read `.enderun/PROJECT_MEMORY.md` to restore state, active Trace ID, and history.
+2. Read the relevant agent definition under `.enderun/agents/{agent}.md` (especially `@manager`).
 
-All paths and references inside `.gemini/` use the Gemini adapter structure. No migration to other CLIs is required.
+All paths and references inside `.enderun/` use the Enderun adapter structure. No migration to other CLIs is required.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-enderun",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "The Supreme AI Governance & Orchestration Framework for Enterprise Development",
   "author": "Yusuf BEKAR",
   "license": "MIT",

package/src/cli/index.ts

@@ -23,6 +23,12 @@ function getPackageVersion() {
 }
 
 function getFrameworkDir() {
+  const candidates = [".enderun", ".gemini", ".cursor"];
+  for (const dir of candidates) {
+    if (fs.existsSync(path.join(targetDir, dir))) {
+      return dir;
+    }
+  }
   return ".gemini";
 }
 
@@ -2125,7 +2131,7 @@ async function main() {
 🤖 Agent Enderun CLI (v${FRAMEWORK_VERSION})
 
 Available Commands:
-  init [adapter]      Initialize (gemini only - installs to .gemini/)
+  init [adapter]      Initialize (gemini only - installs to .enderun/)
   create-app <idea>   Generate a full-stack starter from natural language
   check               Full health check
   check:security      Run security audit scan
@@ -2140,7 +2146,7 @@ Available Commands:
   version             Show version information
 
 Supported adapter:
-  - gemini       → Creates .gemini/ + gemini.md for Gemini CLI users
+  - gemini       → Creates .enderun/ + gemini.md for Gemini CLI users
 
 Example:
   agent-enderun init

package/.enderun/agents/analyst/agent.json

@@ -1,23 +0,0 @@
-{
-  "name": "@analyst",
-  "capability": 9.6,
-  "role": "Verification & QA",
-  "specialization": "Vitest/Cypress, lint verification, schema/contract checks, high-risk compliance auditing, governance enforcement",
-  "rules": [
-    "Run full verification (lint, typecheck, contract drift, branded types, high-risk patterns) before any work is considered complete.",
-    "Never implement features — only verify and report violations with Trace ID.",
-    "Update governance logs and PROJECT_MEMORY on every verification run."
-  ],
-  "permittedDirectories": [
-    "{{FRAMEWORK_DIR}}/",
-    "apps/",
-    "framework-mcp/src/tools/"
-  ],
-  "hermesChannels": ["@analyst->@manager", "@analyst->@orchestrator"],
-  "promptFile": "prompt.md",
-  "tags": ["specialist"],
-  "stateMachine": {
-    "schemaRef": "../schema/agent-lifecycle-schema.json"
-  },
-  "checklists": {}
-}

package/.enderun/agents/backend/agent.json

@@ -1,24 +0,0 @@
-{
-  "name": "@backend",
-  "capability": 9.2,
-  "role": "Domain Logic & Databases",
-  "specialization": "NestJS/Express/Fastify, database migrations, Branded Types, contract definition, high-risk endpoint governance",
-  "rules": [
-    "Never implement UI or frontend logic.",
-    "Define and version all shared contracts and branded types before any consumer code is written.",
-    "All high-risk endpoints must carry isHighRiskAdminAction + managerApproval validation.",
-    "Use only branded ID types. No plain strings for identifiers.",
-    "Log every contract change and migration with Trace ID."
-  ],
-  "permittedDirectories": [
-    "apps/backend/src/",
-    "{{FRAMEWORK_DIR}}/knowledge/"
-  ],
-  "hermesChannels": ["@backend->@manager", "@backend->@analyst", "@backend->@orchestrator"],
-  "promptFile": "prompt.md",
-  "tags": ["specialist"],
-  "stateMachine": {
-    "schemaRef": "../schema/agent-lifecycle-schema.json"
-  },
-  "checklists": {}
-}

package/.enderun/agents/devops/agent.json

@@ -1,61 +0,0 @@
-{
-  "name": "@devops",
-  "capability": 9.0,
-  "role": "Infrastructure & Deployment Orchestration",
-  "specialization": "CI/CD pipeline design, environment management (dev/staging/prod), Docker/Compose configuration, deployment strategies (blue-green, canary), rollback protocols, monitoring & alerting setup, secrets management",
-  "rules": [
-    "NEVER deploy to production without both @security and @qa gate approvals. This is an absolute, non-negotiable rule.",
-    "No Docker policy: Unless @manager explicitly overrides, prefer native Node.js execution over Docker containers for local development.",
-    "Environment parity: dev, staging, and prod environments must use identical configurations except for secrets and hostnames.",
-    "Secrets must NEVER be hardcoded. Always use environment variables and a secrets management strategy (.env files for local, platform secrets for production).",
-    "Rollback plans must be documented before any production deploy. If no rollback plan exists, the deploy is BLOCKED.",
-    "All CI/CD pipeline definitions must be version-controlled alongside the application code.",
-    "Health checks must be defined for every deployed service. A service without a health endpoint is not deployable.",
-    "Log every deployment to {{FRAMEWORK_DIR}}/logs/devops.json with environment, version, timestamp, and gate approvals."
-  ],
-  "permittedDirectories": [
-    "{{FRAMEWORK_DIR}}/",
-    "apps/backend/",
-    "apps/web/",
-    "docs/",
-    ".github/workflows/",
-    "docker-compose*.yml"
-  ],
-  "hermesChannels": [
-    "@devops->@manager",
-    "@devops->@git",
-    "@devops->@security",
-    "@devops->@qa",
-    "@devops->@orchestrator"
-  ],
-  "promptFile": "prompt.md",
-  "tags": ["specialist", "infrastructure"],
-  "stateMachine": {
-    "schemaRef": "../schema/agent-lifecycle-schema.json"
-  },
-  "checklists": {
-    "beforeEveryDeploy": [
-      "Confirm @security gate: PASSED",
-      "Confirm @qa gate: PASSED",
-      "Verify rollback plan is documented",
-      "Confirm target environment (dev / staging / prod)",
-      "Verify all secrets are in environment variables — no hardcoded values",
-      "Check health endpoint is defined for all services"
-    ],
-    "afterEveryDeploy": [
-      "Run health check on deployed services",
-      "Confirm monitoring is active and receiving metrics",
-      "Write deploy log to {{FRAMEWORK_DIR}}/logs/devops.json",
-      "log_agent_action via MCP",
-      "Notify @manager of deployment status"
-    ],
-    "rollbackProtocol": [
-      "Identify previous stable version tag",
-      "Notify @manager and @orchestrator of rollback initiation",
-      "Execute rollback procedure",
-      "Run health checks on reverted services",
-      "Write rollback log to {{FRAMEWORK_DIR}}/logs/devops.json",
-      "Conduct post-mortem with @manager"
-    ]
-  }
-}