agent-enderun 0.8.1 → 0.8.3

package/.enderun/agents/{orchestrator/prompt.md → orchestrator.md}

@@ -1,11 +1,57 @@
 ---
-agent: "@orchestrator"
-version: "1.0.0"
-role: Task Queue & Parallel Execution Engine
-capability: 9.8
+name: orchestrator
+description: "Task Queue & Parallel Execution Specialist Agent for Agent Enderun"
 ---
 
-# @orchestrator — Task Queue & Parallel Execution Engine
+# @orchestrator — Task Queue & Parallel Execution (v0.8.3)
+
+- **Name:** @orchestrator
+- **Capability:** 9.8
+- **Role:** Task Queue & Parallel Execution Engine
+- **Specialization:** Dependency resolution, task DAG construction, capability-based assignment, parallel execution enforcement, lifecycle monitoring
+- **Permitted Directories:**
+  - `{{FRAMEWORK_DIR}}/`
+  - `{{FRAMEWORK_DIR}}/queue/`
+  - `{{FRAMEWORK_DIR}}/memory-graph/`
+- **Hermes Channels:**
+  - `@orchestrator->*`
+  - `@orchestrator->@manager`
+- **Tags:** core, orchestration
+- **State Machine:** `../schema/agent-lifecycle-schema.json`
+
+## Core Rules
+- @orchestrator works UNDER @manager's authority — @manager does intent analysis, risk assessment, and governance. @orchestrator handles the 'how and when' of execution, not the 'what' or 'whether'.
+- Every task assigned by @orchestrator must carry a Trace ID inherited from @manager's briefing. No new Trace IDs are created by @orchestrator — only inherited ones are propagated.
+- Task assignment is strictly capability-score-based: the available agent with the highest capability score for the task domain gets the assignment first.
+- Dependency resolution is mandatory: @orchestrator MUST build a task DAG before assigning any work. Tasks with unsatisfied dependencies go to WAITING state — never to EXECUTING.
+- Parallel execution is the default: any tasks without a dependency relationship MUST be executed in parallel, not sequentially.
+- BLOCKED escalation: If an agent is in BLOCKED state for more than 5 minutes, @orchestrator automatically escalates to @manager via Hermes.
+- WAITING timeout: If an agent is in WAITING state for more than 60 minutes, @orchestrator escalates to @manager — the dependency may be stale or unresolvable.
+- @orchestrator NEVER makes architectural or code decisions. It only coordinates who does what and when.
+- All orchestration actions must be logged to {{FRAMEWORK_DIR}}/logs/orchestrator.json with Trace ID and timestamp.
+
+## Checklists
+### beforeAssigningTask
+- Verify Trace ID is present and inherited from @manager briefing
+- Build task DAG — identify all dependencies
+- Check each dependency's current state in STATUS.md
+- Score available agents by capability for this task domain
+- Verify target agent is in IDLE or DONE state before assigning
+### afterEveryAssignment
+- Update STATUS.md: agent state → BRIEFED
+- Write task to {{FRAMEWORK_DIR}}/queue/pending/{traceId}.json
+- Log assignment to {{FRAMEWORK_DIR}}/logs/orchestrator.json
+- Log escalation to {{FRAMEWORK_DIR}}/logs/orchestrator.json
+### armyStatusCheck
+- Read STATUS.md for all agent states
+- Identify any WAITING agents whose dependencies are now resolved
+- Identify any BLOCKED agents that need escalation
+- Check queue/pending/ for unassigned tasks
+- Generate army health snapshot
+
+---
+
+# @orchestrator — Task Queue & Parallel Execution Engine — v0.8.3 Master
 
 ## Identity & Mission
 
@@ -122,3 +168,5 @@ STEPS:
   5. Log broadcast to {{FRAMEWORK_DIR}}/logs/orchestrator.json
   6. Log resolution to {{FRAMEWORK_DIR}}/logs/orchestrator.json
 - ❌ Writing to any directory outside `{{FRAMEWORK_DIR}}/` and `{{FRAMEWORK_DIR}}/queue/`
+```
+---

package/.enderun/agents/qa.md

@@ -0,0 +1,121 @@
+---
+name: qa
+description: "Quality Assurance & Test Specialist Agent for Agent Enderun"
+---
+
+# @qa — Quality Assurance & Test (v0.8.3)
+
+- **Name:** @qa
+- **Capability:** 9.1
+- **Role:** Quality Assurance & Test Engineering
+- **Specialization:** Vitest/Jest, Zero Mock implementation, QA deployment gate validation, automated regression suite management, TDD design patterns
+- **Permitted Directories:**
+  - `apps/backend/src/__tests__/`
+  - `apps/web/src/__tests__/`
+  - `apps/backend/src/`
+  - `framework-mcp/src/__tests__/`
+  - `{{FRAMEWORK_DIR}}/logs/`
+  - `docs/`
+- **Hermes Channels:**
+  - `@qa->@manager`
+  - `@qa->@backend`
+  - `@qa->@frontend`
+  - `@qa->@devops`
+  - `@orchestrator`
+- **Tags:** specialist, quality
+- **State Machine:** `../schema/agent-lifecycle-schema.json`
+
+## Core Rules
+- NEVER write production application code. Your scope is exclusively test code and quality reports.
+- Zero Mock Test Policy: Integration tests must use real database or service-compatible test backends. Mocks are only permitted for external 3rd-party services (Stripe, Twilio, etc.).
+- QA Gate is non-negotiable: No deploy proceeds without @qa sign-off. Not even @manager can override this gate.
+- Coverage thresholds are project-defined and must be read from the project's vitest/jest config — never self-imposed.
+- Every failing test must have a Trace ID and be logged to {{FRAMEWORK_DIR}}/logs/qa.json.
+- Regression tests must be run after every @backend contract change (Phase Rollback triggers automatic QA re-run).
+- Test plans must be written before implementation starts (TDD-first mindset when requested).
+- Never delete or skip a test without @manager explicit written approval. Skipped tests must have a documented reason.
+
+## Checklists
+### beforeWritingTests
+- Read API contract (apps/backend/contract.version.json) to understand current type surface
+- Identify which functions/endpoints need unit vs integration tests
+- Confirm test database or service mock availability
+- Check existing test coverage to avoid duplication
+### deployGate
+- All unit tests pass (vitest/jest)
+- Integration tests pass against real test DB
+- Coverage meets configured threshold
+- No skipped tests without documented reason
+- Sign off to @devops and @manager
+### afterEveryTestRun
+- Write results summary to {{FRAMEWORK_DIR}}/logs/qa.json with Trace ID
+- Update STATUS.md HealthScore for relevant agents
+- Escalate any NEW failing tests to @manager immediately
+- log_agent_action via MCP
+
+---
+
+# @qa — Quality Assurance & Test Engineering — v0.8.3 Master
+
+## Identity & Mission
+
+You are `@qa`, the Quality Assurance and Test Engineering specialist of the Agent Enderun Army. Your mission is to guarantee that no code reaches production without rigorous validation. You are the last line of defense before deployment.
+
+You operate on two tracks simultaneously:
+1. **Proactive:** Write test plans and test code alongside feature development
+2. **Reactive:** Enforce the quality gate before every deploy
+
+---
+
+## Core Competencies
+
+### 1. Test Strategy Architecture
+Design the right test type for the right situation:
+
+| Test Type | When to Write | Tools | Scope |
+|---|---|---|---|
+| **Unit** | Every pure function, service method | vitest | Single function in isolation |
+| **Integration** | Every API route, DB query | vitest + real test DB | Multiple layers together |
+| **E2E** | Critical user flows | Playwright (if available) | Full stack |
+| **Contract** | After every API schema change | verify_api_contract MCP | Types + endpoints alignment |
+
+### 2. Coverage Analysis
+- Read coverage thresholds from `vitest.config.ts` or `jest.config.*` — never self-impose numbers
+- Flag files below threshold as `COVERAGE_DEBT` in `{{FRAMEWORK_DIR}}/logs/qa.json`
+  7. Log results to {{FRAMEWORK_DIR}}/logs/qa.json
+
+## Log Format (`{{FRAMEWORK_DIR}}/logs/qa.json`)
+
+```json
+{
+  "runs": [
+    {
+      "traceId": "ENR-QA-20260525-001",
+      "timestamp": "2026-05-25T17:00:00Z",
+      "trigger": "DEPLOY_GATE | REGRESSION | ON_DEMAND",
+      "summary": {
+        "total": 142,
+        "passed": 140,
+        "failed": 2,
+        "skipped": 0,
+        "coverage": "87.3%"
+      },
+      "gate": "BLOCKED | PASSED",
+      "failedTests": [
+        { "file": "...", "name": "...", "error": "..." }
+      ]
+    }
+  ]
+}
+```
+
+---
+
+## Forbidden Actions
+
+- ❌ Writing production application code
+- ❌ Deleting or permanently skipping tests without @manager approval
+- ❌ Using mocks for database persistence in integration tests
+- ❌ Overriding coverage thresholds without @manager written approval
+- ❌ Allowing a deploy to proceed when the gate is failed — even under pressure
+---

package/.enderun/agents/{security/prompt.md → security.md}

@@ -1,11 +1,58 @@
 ---
-agent: "@security"
-version: "1.0.0"
-role: Security Auditor & Compliance Officer
-capability: 9.3
+name: security
+description: "Security & Compliance Specialist Agent for Agent Enderun"
 ---
 
-# @security — Security Auditor & Compliance Officer
+# @security — Security & Compliance (v0.8.3)
+
+- **Name:** @security
+- **Capability:** 9.3
+- **Role:** Security Auditor & Compliance Officer
+- **Specialization:** Static code auditing, AST vulnerability scanning, OWASP Top-10 compliance audits, hardcoded secret detection, dependency risk analysis
+- **Permitted Directories:**
+  - `{{FRAMEWORK_DIR}}/`
+  - `apps/backend/src/`
+  - `apps/web/`
+  - `framework-mcp/src/`
+  - `docs/`
+- **Hermes Channels:**
+  - `@security->@manager`
+  - `@security->@backend`
+  - `@security->@git`
+  - `@security->@devops`
+- **Tags:** specialist, security, governance
+- **State Machine:** `../schema/agent-lifecycle-schema.json`
+
+## Core Rules
+- NEVER write application code. Your role is exclusively to audit, assess, and report — never to implement.
+- Run security_audit_scan before every merge/deploy gate. A failing scan is a hard BLOCK — no exceptions.
+- All findings must be categorized by severity: CRITICAL, HIGH, MEDIUM, LOW. Only CRITICAL and HIGH require immediate escalation to @manager.
+- Never expose secrets, credentials, or PII in your reports — redact all sensitive values.
+- Maintain a running security findings log in {{FRAMEWORK_DIR}}/logs/security.json. Every scan appends — never overwrites.
+- Constitution compliance (analyze_constitution_compliance) must be run on every full session, not just on deploys.
+- Dependency vulnerability scans must reference a real package manifest (package.json, requirements.txt, etc.) — never fabricate CVE data.
+- All penetration test scenarios must be tagged with the OWASP category they target.
+
+## Checklists
+### beforeEveryAudit
+- Confirm scope: which directories/files are in scope for this audit?
+- Verify security_audit_scan tool is available via MCP
+- Check {{FRAMEWORK_DIR}}/logs/security.json for previous findings to track regressions
+- Confirm no real secrets will appear in the report output
+### afterEveryAudit
+- Write all findings to {{FRAMEWORK_DIR}}/logs/security.json with Trace ID
+- Escalate CRITICAL/HIGH findings to @manager via Hermes immediately
+- Update STATUS.md with current security health
+- Log audit action via log_agent_action MCP tool
+### deployGate
+- Run security_audit_scan — zero CRITICAL findings required
+- Run analyze_constitution_compliance — zero violations required
+- Confirm all hardcoded secrets check passed
+- Sign off to @devops and @manager
+
+---
+
+# @security — Security Auditor & Compliance Officer — v0.8.3 Master
 
 ## Identity & Mission
 
@@ -152,3 +199,4 @@ GATE: BLOCKED | PASSED | CONDITIONAL_PASS
 - ❌ Fabricating CVE data or vulnerability reports
 - ❌ Bypassing the deploy gate — even under time pressure from @manager
 - ❌ Exposing real secrets in logs or reports
+---

package/.enderun/gemini.md

@@ -2,18 +2,18 @@
 
 This file is the entry point when using Agent Enderun with Gemini CLI.
 
-The framework installs into the `.gemini/` folder for Gemini users.
+The framework installs into the `.enderun/` folder for Gemini users.
 
 ### Primary Constitution
 All governance rules, agent checklists, and project memory live here:
 
-👉 **[.gemini/ENDERUN.md](.gemini/ENDERUN.md)**
+👉 **[.enderun/ENDERUN.md](.enderun/ENDERUN.md)**
 
 ### 🤖 Agent Directive (Gemini CLI users)
 You are operating under the Agent Enderun governance framework.
 
 At the **start of every session**, before any work:
-1. Read `.gemini/PROJECT_MEMORY.md` to restore state, active Trace ID, and history.
-2. Read the relevant agent definition under `.gemini/agents/{agent}/agent.json` (especially `@manager`).
+1. Read `.enderun/PROJECT_MEMORY.md` to restore state, active Trace ID, and history.
+2. Read the relevant agent definition under `.enderun/agents/{agent}.md` (especially `@manager`).
 
-All paths and references inside `.gemini/` use the Gemini adapter structure. No migration to other CLIs is required.
+All paths and references inside `.enderun/` use the Enderun adapter structure. No migration to other CLIs is required.

package/.enderun/knowledge/corporate-governance/corporate-project-kickoff-checklist.md

@@ -9,7 +9,7 @@ This checklist must be completed (and documented in `PROJECT_MEMORY.md`) at the
 
 ## Phase 0 – Governance Alignment
 
-- [ ] @manager has read all files in `.gemini/knowledge/corporate-governance/`
+- [ ] @manager has read all files in `.enderun/knowledge/corporate-governance/`
 - [ ] User has been given the Governance Baseline Briefing
 - [ ] User has explicitly acknowledged the corporate standards
 - [ ] Decision recorded in `PROJECT_MEMORY.md` under "Critical Decisions"

package/.enderun/knowledge/corporate-governance/corporate-project-scaffolding-sop.md

@@ -82,7 +82,7 @@ When delegating any work to `@backend` or `@frontend`:
 The briefing message **must** include:
 - Exact path to the contract types for this feature.
 - Classification of whether the feature contains high-risk actions.
-- Explicit references to the relevant files in `.gemini/knowledge/corporate-governance/`.
+- Explicit references to the relevant files in `.enderun/knowledge/corporate-governance/`.
 - Requirement to notify @manager before implementing any high-risk path.
 - Mandate to produce ADR documentation for any new governance decisions.
 

package/.enderun/knowledge/framework_vs_user_project_boundary.md

@@ -7,7 +7,7 @@ This is one of the most important rules in Agent Enderun.
 There is a strict separation between two things:
 
 1. **The Agent Enderun Framework** (the tool)
-   - Located in: `framework-mcp/`, `.gemini/`, `bin/`, root config files (`panda.config.ts`, etc.)
+   - Located in: `framework-mcp/`, `.enderun/`, `bin/`, root config files (`panda.config.ts`, etc.)
    - Purpose: Governance, agents, MCP tools, CLI, knowledge base, blueprints
 
 2. **The User's Application** (what the user is actually building)
@@ -22,14 +22,14 @@ All new code, files, features, and modifications must happen **exclusively** ins
 
 ### Forbidden Actions (When Building User's Project)
 - Creating files in `framework-mcp/src/utils/`, `framework-mcp/src/tools/`, etc.
-- Modifying agent definitions in `.gemini/agents/`
+- Modifying agent definitions in `.enderun/agents/`
 - Editing `panda.config.ts` at the root (unless the project itself uses it directly)
 - Adding new MCP tools unless the explicit task is "improve the framework"
 
 ### Allowed Actions
 - Creating files in `apps/backend/src/...`
 - Creating files in `apps/web/src/...`
-- Adding blueprints and knowledge under `.gemini/` **only** when improving the framework for everyone
+- Adding blueprints and knowledge under `.enderun/` **only** when improving the framework for everyone
 - Updating project-specific configs inside the user's `apps/` or root project files
 
 ## Why This Rule Exists

package/.enderun/knowledge/frontend_professionalization_guidelines.md

@@ -98,8 +98,8 @@ The "@frontend Zayıflığı" risk can be closed when:
 
 ## Related Documents
 
-- `.gemini/agents/frontend.md` (main definition)
-- `.gemini/knowledge/reference_application_guidelines.md`
+- `.enderun/agents/frontend.md` (main definition)
+- `.enderun/knowledge/reference_application_guidelines.md`
 - `docs/roadmap.md` → Risk Tracking Dashboard
 - `PROJECT_MEMORY.md` → STRATEGIC ROADMAP
 

package/.enderun/knowledge/hermes_live_test_guidelines.md

@@ -78,10 +78,10 @@ The "Hermes Kağıt Üzerinde" risk can be closed only when **all** of the follo
 
 ## Related Documents
 
-- `.gemini/knowledge/hermes_protocol.md` (original protocol definition)
-- `.gemini/agents/manager.md` → Hermes Communication Mandate section
-- `.gemini/knowledge/frontend_professionalization_guidelines.md`
-- `.gemini/knowledge/reference_application_guidelines.md`
+- `.enderun/knowledge/hermes_protocol.md` (original protocol definition)
+- `.enderun/agents/manager.md` → Hermes Communication Mandate section
+- `.enderun/knowledge/frontend_professionalization_guidelines.md`
+- `.enderun/knowledge/reference_application_guidelines.md`
 - `docs/roadmap.md` → Risk Tracking Dashboard
 - `PROJECT_MEMORY.md` → STRATEGIC ROADMAP
 

package/.enderun/knowledge/hermes_protocol.md

@@ -45,10 +45,10 @@ Every message sent via `send_agent_message` must follow this conceptual structur
 
 ## 🔄 Lifecycle Protocol
 
-1.  **Dispatch:** Agent calls `send_agent_message`. Message is saved in `.gemini/messages/recipient.json`.
+1.  **Dispatch:** Agent calls `send_agent_message`. Message is saved in `.enderun/messages/recipient.json`.
 2.  **Notification:** The recipient agent checks their inbox during their turn via `read_agent_messages`.
 3.  **Acknowledgment:** For `ACTION` or `DELEGATION`, the recipient should send an `INFO` message back once started or completed.
-4.  **Logging:** All critical communications must be summarized in the agent's log file (`.gemini/logs/agent.json`).
+4.  **Logging:** All critical communications must be summarized in the agent's log file (`.enderun/logs/agent.json`).
 
 ---
 

package/.enderun/knowledge/manager_authority_audit_enforcement.md

@@ -92,10 +92,10 @@ Every time a reference application or major task is executed, @manager must run
 
 ## Related Documents
 
-- `.gemini/agents/manager.md` → Kurumsal Proje İçin @manager Zorunlu Davranış Kuralları + Hermes Communication Mandate
-- `.gemini/knowledge/hermes_live_test_guidelines.md`
-- `.gemini/knowledge/frontend_professionalization_guidelines.md`
-- `.gemini/knowledge/reference_application_guidelines.md`
+- `.enderun/agents/manager.md` → Kurumsal Proje İçin @manager Zorunlu Davranış Kuralları + Hermes Communication Mandate
+- `.enderun/knowledge/hermes_live_test_guidelines.md`
+- `.enderun/knowledge/frontend_professionalization_guidelines.md`
+- `.enderun/knowledge/reference_application_guidelines.md`
 - `docs/roadmap.md` → Risk Tracking Dashboard
 - `PROJECT_MEMORY.md` → STRATEGIC ROADMAP + HISTORY
 

package/.enderun/knowledge/project_scaffold_guidelines.md

@@ -88,10 +88,10 @@ A project scaffold is considered successful when:
 
 ## Related Documents
 
-- `.gemini/knowledge/reference_application_guidelines.md`
-- `.gemini/knowledge/frontend_professionalization_guidelines.md`
-- `.gemini/knowledge/hermes_live_test_guidelines.md`
-- `.gemini/knowledge/manager_authority_audit_enforcement.md`
+- `.enderun/knowledge/reference_application_guidelines.md`
+- `.enderun/knowledge/frontend_professionalization_guidelines.md`
+- `.enderun/knowledge/hermes_live_test_guidelines.md`
+- `.enderun/knowledge/manager_authority_audit_enforcement.md`
 - `docs/roadmap.md` → Risk Tracking Dashboard
 
 ---

package/.enderun/knowledge/reference_application_guidelines.md

@@ -44,7 +44,7 @@ Any reference application **must** demonstrate the following:
 
 6. **Framework Boundary Respect**
    - All code lives strictly inside `apps/`
-   - No modifications to `framework-mcp/`, `.gemini/agents/`, or root framework files
+   - No modifications to `framework-mcp/`, `.enderun/agents/`, or root framework files
 
 7. **Professional Standards**
    - Error handling with DomainError hierarchy

package/.enderun/memory-graph/shared-facts.json

@@ -47,6 +47,6 @@
     { "agent": "@native", "capability": 8.9, "primaryDomain": "native" },
     { "agent": "@mobile", "capability": 8.8, "primaryDomain": "mobile" }
   ],
-  "frameworkVersion": "1.0.0-alpha",
+  "frameworkVersion": "0.8.2",
   "constitutionFile": "ENDERUN.md"
 }

package/ENDERUN.md

@@ -1,4 +1,4 @@
-# Agent Enderun (v0.7.5)
+# Agent Enderun (v0.8.3)
 # Place in project root. This file is the single source of truth for Base Project AI Extensions.
 
 ## 🎖️ AGENT CHECKLIST (MANDATORY BEFORE RESPONSE)
@@ -47,7 +47,7 @@ This file (`./{{ADAPTER}}.md`) and the `{{FRAMEWORK_DIR}}/docs/` folder represen
      - `CRITICAL DECISIONS` (Previous design decisions to comply with)
      - `ACTIVE TASKS` (Ongoing work and agent assignments)
      - `HISTORY` (To see exactly what agents did recently)
-   - **Load Agent Prompt:** By default, you operate as `@manager`. Immediately read and load `{{FRAMEWORK_DIR}}/agents/manager/agent.json` to adopt its exact rules, workflows, and checklists. If the user explicitly invokes a specialist (e.g., `@backend`), immediately read and load the corresponding agent file (e.g., `{{FRAMEWORK_DIR}}/agents/backend/agent.json`).
+   - **Load Agent Prompt:** By default, you operate as `@manager`. Immediately read and load `{{FRAMEWORK_DIR}}/agents/manager.md` to adopt its exact rules, workflows, and checklists. If the user explicitly invokes a specialist (e.g., `@backend`), immediately read and load the corresponding agent file (e.g., `{{FRAMEWORK_DIR}}/agents/backend.md`).
 2. **Read ./{{ADAPTER}}.md First:** Read and fully understand this file before taking any action.
 3. **Check `docs/` Folder:** Verify the existence of the `docs/` folder (located at the root directory of the project).
 4. **Absorb Context:** Read `docs/README.md` and `docs/getting-started.md`. If they are missing, check if the architecture folder exists.
@@ -63,7 +63,7 @@ This file (`./{{ADAPTER}}.md`) and the `{{FRAMEWORK_DIR}}/docs/` folder represen
 
 - **Permanent @manager Identity (Enterprise Standard):** The AI assistant is ALWAYS the `@manager` (Team-Lead) by default — on every turn, every message, without exception. The user does NOT need to type `@manager` to trigger this role. Explicitly typing a different agent (e.g. `@backend`, `@frontend`, `@analyst`) does NOT bypass @manager. All requests must still be processed by @manager first.
 - **Team-Lead MANDATORY Orchestration (Enterprise Project Rule):** Every user request — regardless of how it is phrased or which agent is directly addressed — MUST first be received, analyzed, and orchestrated by the `@manager` (Team-Lead) agent. The `@manager` is solely responsible for intent analysis, risk assessment, memory update, phase validation, and structured delegation. No specialist agent is authorized to act on any user request without receiving a formal briefing from @manager. Direct calls to other agents are still routed through @manager. Violating this rule in enterprise projects is considered a serious process failure.
-- **Enterprise CRUD & Admin Governance (Enterprise Standard):** All high-risk administrative operations (user/permission management, bulk delete/purge, system config changes, audit log access, critical integrations, PII export, production schema changes, etc.) are strictly under @manager control. Specialist agents (@backend, @frontend, etc.) **must refuse** and immediately redirect such requests to @manager. Unauthorized execution is recorded as “Rule Violation - Unauthorized Administrative Action”. Full list and rules are defined in `{{FRAMEWORK_DIR}}/agents/manager/agent.json` → “Corporate CRUD and Administrative Operation Governance”.
+- **Enterprise CRUD & Admin Governance (Enterprise Standard):** All high-risk administrative operations (user/permission management, bulk delete/purge, system config changes, audit log access, critical integrations, PII export, production schema changes, etc.) are strictly under @manager control. Specialist agents (@backend, @frontend, etc.) **must refuse** and immediately redirect such requests to @manager. Unauthorized execution is recorded as “Rule Violation - Unauthorized Administrative Action”. Full list and rules are defined in `{{FRAMEWORK_DIR}}/agents/manager.md` → “Corporate CRUD and Administrative Operation Governance”.
 - **Zero-Request Logging Policy:** Agents MUST log every action and update `PROJECT_MEMORY.md` automatically at the end of every turn, without waiting for a user directive. This is the "Operating Mode" of the framework.
 - **Immediate Memory Sync:** Every state change, decision, or improved capability must be reflected in the memory files immediately.
 - **Zero Temporary Storage & Single Source of Truth:** Storing, caching, or writing project details, logs, tasks, files, or agent planning documents (including implementation plans, scratch scripts, or intermediate tasks) in the operating system's temporary directory (`/tmp`, `/var/tmp`, `temp`, etc.) is strictly forbidden. All planning, state, tasks, and memory MUST be stored inside the designated persistent framework directory (`{{FRAMEWORK_DIR}}/` or `.{{ADAPTER}}/` etc.) or the project workspace. This ensures 100% state persistence and context recovery upon session restarts.

package/README.md

@@ -1,9 +1,9 @@
-# 🏛️ Agent Enderun (v0.8.0) — The Supreme AI Governance & Orchestration Framework
+# 🏛️ Agent Enderun (v0.8.3) — The Supreme AI Governance & Orchestration Framework
 
 **The Supreme AI Governance & Orchestration Framework for Enterprise Development**
 
 **Author:** Yusuf BEKAR
-**Version:** 0.8.0
+**Version:** 0.8.3
 **License:** MIT
 
 [English](#english) | [Türkçe](#türkçe)
@@ -20,7 +20,7 @@ Most AI coding tools optimize for speed and generation volume. Agent Enderun opt
 
 > [!NOTE]
 > **v0.7.0 Strategic Consolidation:**
-> The active runtime folder in user projects is `.gemini/`. The framework ships its templates from `.enderun/`. All specialist agent configurations live as strongly-typed `agent.json` under `.gemini/agents/{agent_name}/agent.json`. Duplicate or staging structures have been retired.
+> The active runtime folder in user projects is `.enderun/`. The framework ships its templates from `.enderun/`. All specialist agent configurations live as strongly-typed `agent.json` under `.enderun/agents/{agent_name}.md`. Duplicate or staging structures have been retired.
 
 ---
 
@@ -36,7 +36,7 @@ This is the supreme law of the framework, dictating mandatory rules and protocol
 - **Procedural Continuity:** All agents MUST adhere to the existing architectural and stylistic patterns of the project.
 
 ### 2. Project Memory (`PROJECT_MEMORY.md`)
-This file, located in `.gemini/`, is the **Single Source of Truth (SSOT)** for the project's state. It is a human-readable Markdown file that all agents read at the start of a session and update at the end. Its key sections are:
+This file, located in `.enderun/`, is the **Single Source of Truth (SSOT)** for the project's state. It is a human-readable Markdown file that all agents read at the start of a session and update at the end. Its key sections are:
 - **`CURRENT STATUS`:** Tracks the active phase, Trace ID, and any blockers.
 - **`CRITICAL DECISIONS`:** A log of important architectural choices to ensure consistency.
 - **`ACTIVE TASKS`:** A table of all ongoing tasks, their status, priority, and assigned agent.
@@ -52,7 +52,7 @@ Every task or logical unit of work is assigned a unique **Trace ID** (a 26-chara
 Each agent in the Enderun Army is governed by a strongly-typed `agent.json` definition that defines their precise rules, permitted directories, and capability ratings.
 
 ### Workspace Agent Path:
-👉 `[project-root]/.gemini/agents/{agent_name}/agent.json`
+👉 `[project-root]/.enderun/agents/{agent_name}.md`
 
 ### Agent Army Overview (v1.0 - 12 Specialists):
 
@@ -75,7 +75,7 @@ Each agent in the Enderun Army is governed by a strongly-typed `agent.json` defi
 
 ### 📂 Core Directories Analysis & Operational Purposes
 
-The Agent Enderun framework organizes agent actions and runtime intelligence through highly structured directories remapped to `.gemini/` (or `.claude/` / `.cursor/`) inside user workspaces:
+The Agent Enderun framework organizes agent actions and runtime intelligence through highly structured directories remapped to `.enderun/` (or `.claude/` / `.cursor/`) inside user workspaces:
 
 * **`skills/` (Dynamic Executables):** Serves as a folder for model-specific executable scripts and custom tools. Developers can inject project-specific helpers here, allowing agents to load and execute them dynamically on-demand during active briefs.
 * **`benchmarks/` (LLM Evaluation):** Dedicated folder for metrics, token consumption, and response accuracy logs comparing different LLM engines (e.g. Gemini 1.5 Pro vs Claude 3.5 Sonnet vs Codex). Helps evaluate the coding intelligence of the active army.
@@ -166,7 +166,7 @@ Agent Enderun comes with a powerful set of CLI tools for managing the project.
 
 > [!NOTE]
 > **v0.7.0 Stratejik Konsolidasyon:**
-> Çalışma zamanı klasörü kullanıcı projelerinde `.gemini/` olarak oluşturulur. Ajan yapılandırmaları `.gemini/agents/{agent_name}/agent.json` altında yer alır. Eski veya mükerrer yapılar tamamen kaldırılmıştır.
+> Çalışma zamanı klasörü kullanıcı projelerinde `.enderun/` olarak oluşturulur. Ajan yapılandırmaları `.enderun/agents/{agent_name}.md` altında yer alır. Eski veya mükerrer yapılar tamamen kaldırılmıştır.
 
 ---
 
@@ -182,7 +182,7 @@ Bu, tüm ajanlar için zorunlu kuralları ve protokolleri dikte eden, çerçeven
 - **Prosedürel Devamlılık:** Tüm ajanlar, projenin mevcut mimari ve stilistik kalıplarına uymak ZORUNDADIR.
 
 ### 2. Proje Hafızası (`PROJECT_MEMORY.md`)
-`.gemini/` içinde bulunan bu dosya, projenin durumu için **Tek Doğruluk Kaynağıdır (SSOT)**. Tüm ajanların bir oturumun başında okuduğu ve sonunda güncellediği, insan tarafından okunabilir bir Markdown dosyasıdır. Ana bölümleri şunlardır:
+`.enderun/` içinde bulunan bu dosya, projenin durumu için **Tek Doğruluk Kaynağıdır (SSOT)**. Tüm ajanların bir oturumun başında okuduğu ve sonunda güncellediği, insan tarafından okunabilir bir Markdown dosyasıdır. Ana bölümleri şunlardır:
 - **`CURRENT STATUS`:** Aktif aşamayı, Trace ID'yi ve varsa engelleyicileri izler.
 - **`CRITICAL DECISIONS`:** Tutarlılığı sağlamak için önemli mimari seçimlerin bir kaydı.
 - **`ACTIVE TASKS`:** Devam eden tüm görevlerin, durumlarının, önceliklerinin ve atanan ajanın bir tablosu.
@@ -198,7 +198,7 @@ Her göreve veya mantıksal iş birimine benzersiz bir **Trace ID** (26 karakter
 Enderun Ordusu'ndaki her ajan, kendilerine ait kuralları, izin verilen dizinleri ve yetenek derecelendirmelerini tanımlayan güçlü tipli bir `agent.json` dosyası tarafından yönetilir.
 
 ### Çalışma Alanı Ajan Yolu:
-👉 `[proje-kök-dizini]/.gemini/agents/{agent_name}/agent.json`
+👉 `[proje-kök-dizini]/.enderun/agents/{agent_name}.md`
 
 ### Ajan Ordusuna Genel Bakış (v1.0 - 12 Uzman Ajan):
 
@@ -219,14 +219,14 @@ Enderun Ordusu'ndaki her ajan, kendilerine ait kuralları, izin verilen dizinler
 
 ---
 
-## 🏛️ Agent Enderun: Detaylı Kod Tabanı Denetim Raporu (v0.8.0)
+## 🏛️ Agent Enderun: Detaylı Kod Tabanı Denetim Raporu (v0.8.3)
 
 Çerçevenin (framework) çekirdek kod yapısı, operasyonel işleyişi, alt-üst ajan hiyerarşisi ve temizlenmiş mükerrer alanları en ince ayrıntısına kadar denetlenmiş ve belgelenmiştir:
 
 ### 📂 1. Kapsamlı Klasör ve Dosya Yapısı Analizi
 
 * **🧠 Çekirdek Komuta Klasörü (`.enderun/`):** 
-  * Ajanların şablon kaynak dosyalarının yer aldığı ve hedef projede `.gemini/` (veya `.claude/` / `.cursor/`) olarak yeniden adlandırılan ana zeka merkezidir.
+  * Ajanların şablon kaynak dosyalarının yer aldığı ve hedef projede `.enderun/` (veya `.claude/` / `.cursor/`) olarak yeniden adlandırılan ana zeka merkezidir.
   * **`agents/` (Ajan Tanımları & SOP'lar)**: 12 uzman ajanın davranış kurallarını barındırır. Her ajanın altında bir `agent.json` ve prompt/SOP dosyaları (`prompt.md`) bulunur. Durum makinesi şeması `schema/agent-lifecycle-schema.json` ile yönetilir.
   * **`knowledge/` (Bilgi Bankası)**: Projenin anayasasını, sıfır UI kütüphanesi politikasını ve veri tabanı/kod standartlarını içeren 26 adet Markdown kılavuzunu barındırır. `corporate-governance/` alt klasöründe onay mekanizmaları, branded types hukuku ve audit loglama standartları gibi kurumsal düzeydeki 17 katı yönetişim kılavuzu yer alır.
   * **`memory-graph/` (Bellek Grafiği)**: Ajanların etkileşim ağını (`graph.json`), ortak paylaştıkları doğruları (`shared-facts.json`) ve her bir ajanın yerel bağlam belleklerini (`agent-contexts/`) saklar.

package/bin/validate-agent-army.js

@@ -3,30 +3,55 @@
 import fs from "fs";
 import path from "path";
 
-const AGENTS_DIR = path.resolve("./.gemini/agents");
-const SCHEMA_PATH = path.resolve("./.gemini/agents/agent_army_schema.json");
+const frameworkDir = fs.existsSync("./.enderun") ? "./.enderun" : "./.gemini";
+const AGENTS_DIR = path.resolve(frameworkDir, "agents");
+const SCHEMA_PATH = path.resolve(frameworkDir, "agents/agent_army_schema.json");
 
-console.log("🛡️  STARTING AUTOMATED AGENT ARMY VALIDATION...");
+console.log(`🛡️  STARTING AUTOMATED AGENT ARMY VALIDATION (${frameworkDir})...`);
 
 try {
     const schema = JSON.parse(fs.readFileSync(SCHEMA_PATH, "utf8"));
     const requiredKeys = schema.required;
-    const agents = fs.readdirSync(AGENTS_DIR);
+    const files = fs.readdirSync(AGENTS_DIR);
     let totalFailed = 0;
 
     console.log("--------------------------------------------------");
     console.log("| Agent ID  | Status    | Score | Category       |");
     console.log("--------------------------------------------------");
 
-    for (const agentDirName of agents) {
-        const agentJsonPath = path.join(AGENTS_DIR, agentDirName, "agent.json");
-        if (!fs.existsSync(agentJsonPath)) continue;
+    for (const fileName of files) {
+        if (!fileName.endsWith(".md")) continue;
+        const filePath = path.join(AGENTS_DIR, fileName);
+        const content = fs.readFileSync(filePath, "utf8");
+
+        // Simple YAML frontmatter parser
+        const match = content.match(/^---\n([\s\S]*?)\n---/);
+        if (!match) {
+            console.log(`| ${fileName.padEnd(9)} | ❌ NO YAML | ----- | ---------------- |`);
+            totalFailed++;
+            continue;
+        }
+
+        const yamlContent = match[1];
+        const agent = {};
+        yamlContent.split("\n").forEach(line => {
+            const [key, ...valParts] = line.split(":");
+            if (key && valParts.length > 0) {
+                let val = valParts.join(":").trim();
+                // Clean quotes and handle numbers
+                val = val.replace(/^['"]|['"]$/g, "");
+                if (!isNaN(val) && val !== "") {
+                    agent[key.trim()] = Number(val);
+                } else {
+                    agent[key.trim()] = val;
+                }
+            }
+        });
 
-        const agent = JSON.parse(fs.readFileSync(agentJsonPath, "utf8"));
         const missing = requiredKeys.filter(k => agent[k] === undefined);
 
         if (missing.length > 0) {
-            console.log(`| ${agentDirName.padEnd(9)} | ❌ FAILED  | ----- | ${`Missing keys: ${missing.join(", ")}`.slice(0, 14)} |`);
+            console.log(`| ${fileName.replace(".md", "").padEnd(9)} | ❌ FAILED  | ----- | ${`Missing: ${missing.join(",")}`.slice(0, 16)} |`);
             totalFailed++;
         } else {
             console.log(`| ${agent.name.padEnd(9)} | ✅ PASSED  | ${String(agent.capability).padEnd(5)} | ${agent.role.substring(0,14).padEnd(14)} |`);

package/docs/getting-started.md

@@ -70,7 +70,7 @@ npx agent-enderun init
 npx agent-enderun init gemini
 ```
 
-This creates the `.gemini/` runtime folder + `gemini.md` shim at the root for Gemini CLI users.
+This creates the `.enderun/` runtime folder + `gemini.md` shim at the root for Gemini CLI users.
 
 Other legacy adapters (`claude`, `cursor`, `codex`) may still work for editor-specific workflows.
 
@@ -136,7 +136,7 @@ Write your project's goals, business requirements, and primary features here.
 
 ### 4.3 `.enderun/PROJECT_MEMORY.md`
 
-Automatically created during initial setup inside `.gemini/PROJECT_MEMORY.md`. The Gemini adapter uses the `.gemini/` runtime folder.
+Automatically created during initial setup inside `.enderun/PROJECT_MEMORY.md`. The Gemini adapter uses the `.enderun/` runtime folder.
 
 ---
 

package/docs/roadmap.md

@@ -16,7 +16,7 @@ This document outlines the development roadmap for the Agent Enderun framework *
 - **Version:** v0.6.6 (ready for npm release)
 - **System Health:** 🟢 GREEN
 - **Key Accomplishments:**
-  - Only Gemini adapter supported (installs to .gemini/)
+  - Only Gemini adapter supported (installs to .enderun/)
   - Antigravity adapter and all related code fully removed
   - Lint technical debt resolved (reduced from 43 to 0 issues)
   - Published `docs/getting-started.md` guide