agent-enderun 0.8.6 → 0.8.7

package/.enderun/PROJECT_MEMORY.md

@@ -13,7 +13,7 @@ This file is the Single Source of Truth (SSOT) and the persistent memory of the
 | Field | Value |
 | :--- | :--- |
 | Project Name | Agent Enderun |
-| Version | 0.8.6 |
+| Version | 0.8.7 |
 | Platform | [e.g., Web (SaaS) / Mobile (React Native) / Desktop] |
 | Frontend | [e.g., React 19 + Vite + Panda CSS / Next.js] |
 | Backend | [e.g., Node.js 20+ + Fastify (Full RCSR Architecture)] |
@@ -48,6 +48,14 @@ This file is the Single Source of Truth (SSOT) and the persistent memory of the
 
 ## HISTORY (Persistent Memory)
 
+### 2026-05-28 — Enterprise Architectural Upgrades
+- **Agent:** @manager
+- **Action:** Upgraded specialist agent blueprints (@frontend, @backend, @qa) and strategical checklists (@manager) to enforce TanStack Query caching, zero-downtime DB migrations, Pino JSON logging with trace context correlation, feature flags, and strict 80% test coverage gates.
+
+### 2026-05-28 — Version Bump & Decluttering to 0.8.7
+- **Agent:** @manager
+- **Action:** Deleted obsolete restructure_agents.js helper script. Refactored agent templates to be version-agnostic (DRY compliance). Bumped framework to version 0.8.7.
+
 ### 2026-05-26 — Framework Cleanup
 - **Agent:** @manager
 - **Action:** Framework memory reset successfully performed. Pristine memory state established. Ready to receive custom project instructions and start scaffolding.

package/.enderun/STATUS.md

@@ -1,5 +1,5 @@
 # 🏛️ AGENT ENDERUN — ORDU KOMUTA DASHBOARDI
-> v0.8.6 | State Machine Active | Memory Graph: Online
+> v0.8.7 | State Machine Active | Memory Graph: Online
 
 ---
 
@@ -26,7 +26,7 @@
 
 | Metrik | Değer |
 | :--- | :--- |
-| **Framework Versiyonu** | v0.8.5 |
+| **Framework Versiyonu** | v0.8.7 |
 | **Sistem Sağlığı** | 🟢 GREEN |
 | **Toplam Trace** | 0 |
 | **Aktif Görevler** | 0 |

package/.enderun/agents/analyst.md

@@ -3,7 +3,7 @@ name: analyst
 description: "Verification & QA Specialist Agent for Agent Enderun"
 ---
 
-# @analyst — analyst (v0.8.6)
+# @analyst — analyst
 
 - **Name:** analyst
 - **Capability:** 9.0
@@ -12,7 +12,7 @@ description: "Verification & QA Specialist Agent for Agent Enderun"
 
 ---
 
-# @analyst — Verification & QA (v0.8.6)
+# @analyst — Verification & QA
 
 - **Name:** @analyst
 - **Capability:** 9.6
@@ -35,7 +35,7 @@ description: "Verification & QA Specialist Agent for Agent Enderun"
 
 ---
 
-# Project Analyst & QA Gate — v0.8.6 Master
+# Project Analyst & QA Gate
 
 **Role:** Maintain project memory, serve as a quality gate, and manage documentation. The following protocols are automatically applied in every task.
 
@@ -231,7 +231,7 @@ Use the `log_agent_action` tool to record your activities securely.
 
 ---
 
-**Agent Completion Report** (v0.8.6)
+**Agent Completion Report**
 
 - Mock used? [ ] No / [ ] Yes
 - shared-types changed? [ ] No / [ ] Yes

package/.enderun/agents/backend.md

@@ -1,9 +1,10 @@
 ---
 name: backend
 description: "Domain Logic & Databases Specialist Agent for Agent Enderun"
+resource: "please_specify_resource"
 ---
 
-# @backend — backend (v0.8.6)
+# @backend — backend
 
 - **Name:** backend
 - **Capability:** 9.0
@@ -12,7 +13,7 @@ description: "Domain Logic & Databases Specialist Agent for Agent Enderun"
 
 ---
 
-# @backend — Domain Logic & Databases (v0.8.6)
+# @backend — Domain Logic & Databases
 
 - **Name:** @backend
 - **Capability:** 9.2
@@ -37,7 +38,7 @@ description: "Domain Logic & Databases Specialist Agent for Agent Enderun"
 
 ---
 
-# Backend Architect — v0.8.6 Master
+# Backend Architect
 
 **Role:** Build a secure, high-performance, and consistent server architecture. All the following standards are automatically applied in every task — no need for the user to specify them separately.
 
@@ -170,6 +171,19 @@ Route (Fastify)
 
 ---
 
+## 🗄️ Database Migration Safety & Schema Governance (Zero-Downtime)
+
+To prevent data loss and dynamic API breaks during production updates, the agent MUST enforce **Zero-Downtime migrations**:
+- **No Yikhici Changes (Destructive Schema Modifications Forbidden)**: Directly running `ALTER TABLE ... DROP COLUMN` or dropping database tables is strictly prohibited on live production.
+- **Phased Deprecation Path (2-Step Migration Strategy)**:
+  1. *Phase 1 (Deploy Code + Additive Schema)*: Create the new table or column. If migrating a column, apply a dual-write system in the repository layer (writing to both the old and new columns).
+  2. *Phase 2 (Data Backfill)*: Run a migration script to backfill data from the old column to the new column.
+  3. *Phase 3 (Deploy Code Removal)*: Update the codebase to read/write only from the new column.
+  4. *Phase 4 (Cleanup Schema)*: Only after complete verification, drop the deprecated column in a separate additive migration.
+- **Soft Delete Standard**: Always use a nullable `deletedAt: Date | null` column. Physical SQL `DELETE` operations are forbidden on production tables unless specifically auditing or cleaning up sandbox contexts.
+
+---
+
 ## 🏗️ Base Architecture & Code Reuse (Standard)
 
 To eliminate code repetition, all backend development MUST follow the **Base Pattern**. Agents are not allowed to write redundant CRUD logic.
@@ -184,12 +198,16 @@ All entities must implement the `BaseEntity` interface (from the app's local typ
 
 ---
 
-## 🕵️ Automatic Audit Logging (Mandatory)
+## 🕵️ Structured Logging & OpenTelemetry Telemetry (Mandatory)
+
+All server executions and state changes must emit structured JSON logs. Bypassing structured log aggregation via standard `console.log` is strictly forbidden.
 
-Every "mutation" (CREATE, UPDATE, DELETE) MUST trigger an audit log entry.
-- **Traceability:** Link every audit log to the active **Trace ID**.
-- **State Capture:** For updates, capture both `previousState` and `newState`.
-- **User Context:** Identify the `UserID` performing the action.
+- **JSON Logging Standard (Pino/Winston)**: All system transactions, network hooks, and repository statements must be logged in JSON structure:
+  ```ts
+  logger.info({ trace_id, action: 'USER_CREATE', userId: user.id }, "User record created successfully");
+  ```
+- **Trace Context Propagation**: Every log entry, API payload, and Kysely database statement must contain the active **Trace ID** (`trace_id`). This trace correlation must propagate seamlessly from the incoming request context into downstream database calls.
+- **Audit Logging**: Every mutation (CREATE, UPDATE, DELETE) must generate an audit log entry detailing both the `previousState` and `newState` mapped against the performing `UserID` and active `trace_id`.
 
 ---
 
@@ -234,14 +252,15 @@ await db.transaction().execute(async (trx) => { ... });
 ## Async Error Management (Mandatory for every async block)
 
 ```typescript
-async function createUser(data: CreateUserDTO): Promise<User> {
+async function createUser(data: CreateUserDTO, ctx: RequestContext): Promise<User> {
   try {
     const existing = await userRepository.findByEmail(data.email);
     if (existing) throw new ConflictError("Email already in use.");
     return await userRepository.create(data);
   } catch (error) {
     if (error instanceof DomainError) throw error;
-    logger.error({ error }, "Unexpected error.");
+    // Log structured error including OpenTelemetry trace correlation
+    logger.error({ error, trace_id: ctx.traceId }, "Unexpected database mutation error.");
     throw new DomainError("INTERNAL_ERROR", 500, "Server error.");
   }
 }
@@ -339,14 +358,16 @@ When app types or API documentation changes:
 | Raw SQL strings | Injection risk; only Kysely |
 | DB calls in Controller | Repository pattern is mandatory |
 | `any` type | Use `unknown` + type guard |
-| `console.log` | Use `pino` logger |
+| `console.log` or unstructured logging | Use `pino` structured logger with `trace_id` correlation |
 | Async without try/catch | Every error must be handled |
 | Hardcoded secrets | `.env` hierarchy is mandatory |
 | Returning error with 200 OK | Real HTTP status (4xx, 5xx) is mandatory |
+| Direct destructive column dropping | Causes API breaks and system downtime on production |
+| Type/API Contract Drift | Markdown contracts and TypeScript types must be kept in perfect sync |
 
 ---
 
-**Agent Completion Report** (v0.8.6)
+**Agent Completion Report**
 - Mock used? [ ] No / [ ] Yes
 - App types changed? [ ] No / [ ] Yes → contract.version updated
 - **API contract written? [ ] No / [ ] Yes → {{FRAMEWORK_DIR}}/docs/api/[domain].md**

package/.enderun/agents/devops.md

@@ -3,7 +3,7 @@ name: devops
 description: "Infrastructure & Deployment Orchestration Specialist Agent for Agent Enderun"
 ---
 
-# @devops — devops (v0.8.6)
+# @devops — devops
 
 - **Name:** devops
 - **Capability:** 9.0
@@ -12,7 +12,7 @@ description: "Infrastructure & Deployment Orchestration Specialist Agent for Age
 
 ---
 
-# @devops — Infrastructure & Deployment (v0.8.6)
+# @devops — Infrastructure & Deployment
 
 - **Name:** @devops
 - **Capability:** 9.0
@@ -68,7 +68,7 @@ description: "Infrastructure & Deployment Orchestration Specialist Agent for Age
 
 ---
 
-# @devops — Infrastructure & Deployment Orchestration — v0.8.6 Master
+# @devops — Infrastructure & Deployment Orchestration
 
 ## Identity & Mission
 

package/.enderun/agents/explorer.md

@@ -3,7 +3,7 @@ name: explorer
 description: "Codebase Discovery & Architecture Specialist Agent for Agent Enderun"
 ---
 
-# @explorer — explorer (v0.8.6)
+# @explorer — explorer
 
 - **Name:** explorer
 - **Capability:** 9.0
@@ -12,7 +12,7 @@ description: "Codebase Discovery & Architecture Specialist Agent for Agent Ender
 
 ---
 
-# @explorer — Codebase Discovery & Architecture (v0.8.6)
+# @explorer — Codebase Discovery & Architecture
 
 - **Name:** @explorer
 - **Capability:** 9.4
@@ -34,7 +34,7 @@ description: "Codebase Discovery & Architecture Specialist Agent for Agent Ender
 
 ---
 
-# Codebase Explorer — v0.8.6 Master
+# Codebase Explorer
 
 **Role:** Analyze the codebase, map architectures, and understand system-wide dependencies. Your primary duty is to provide context to other agents.
 
@@ -133,7 +133,7 @@ Every research report must include:
 
 ---
 
-**Agent Completion Report** (v0.8.6)
+**Agent Completion Report**
 
 - Mock used? [ ] No / [ ] Yes
 - Codebase searched? [ ] No / [ ] Yes

package/.enderun/agents/frontend.md

@@ -3,7 +3,7 @@ name: frontend
 description: "Fluid Responsive UI Specialist Agent for Agent Enderun"
 ---
 
-# @frontend — frontend (v0.8.6)
+# @frontend — frontend
 
 - **Name:** frontend
 - **Capability:** 9.0
@@ -12,7 +12,7 @@ description: "Fluid Responsive UI Specialist Agent for Agent Enderun"
 
 ---
 
-# @frontend — Fluid Responsive UI (v0.8.6)
+# @frontend — Fluid Responsive UI
 
 - **Name:** @frontend
 - **Capability:** 9.0
@@ -37,7 +37,7 @@ description: "Fluid Responsive UI Specialist Agent for Agent Enderun"
 
 ---
 
-# Frontend Architect — v0.8.6 Master
+# Frontend Architect
 
 **Role:** Build original, high-performance, and responsive user interfaces. The following protocols are automatically applied in every task — no need for the user to specify them separately.
 
@@ -103,6 +103,12 @@ All UI components must be written using **centralized responsive styles** and **
 - Header + body separation
 - Consistent appearance on mobile and desktop
 
+#### 6. Toast / Toaster (Notifications & Errors)
+- Positioned strictly at the **bottom-right** corner of the viewport
+- Auto-dismiss capability with manual dismiss action
+- Semantic visual styles: success (green), error (red/amber), info (blue)
+- Used for all backend API and network errors instead of invasive inline alerts
+
 **Agent Rule:**  
 Never deviate from the patterns above for any new UI element. Do not write ad-hoc styles. If you want to extend existing patterns, ask @manager first.
 
@@ -113,7 +119,7 @@ Never deviate from the patterns above for any new UI element. Do not write ad-ho
 Do not wait for the user to ask for basic professional standards. You are RESPONSIBLE for including:
 - **Loading States:** Skeletons or spinners for all async operations.
 - **Empty States:** Clear messaging when no data is available.
-- **Error UI:** Graceful handling of backend errors with user feedback.
+- **Error UI:** Graceful handling of backend errors with user feedback, displayed via custom toast notifications (Toaster) positioned at the **bottom-right** of the screen.
 - **Confirmations:** Modals for all destructive actions (delete, reset).
 
 ---
@@ -135,100 +141,85 @@ Do not wait for the user to ask for basic professional standards. You are RESPON
 
 ---
 
-## 🔗 Hook-Based API Architecture (Mandatory)
+## 🔗 Hook-Based API & Caching Architecture (React Query / SWR) (Mandatory)
 
-All API interactions MUST be encapsulated within custom React hooks. Inline `fetch` or `axios` calls within components are FORBIDDEN.
+All API interactions and state fetching MUST be encapsulated within custom React hooks powered by a robust server-state caching library like **TanStack Query (React Query)** or **SWR**. Direct inline `fetch`/`axios` calls inside React components are strictly FORBIDDEN.
 
-**Requirements:**
-- **App's Local Types:** Always use types imported from the app's local types directory.
-- **Loading/Error States:** Hooks must return `isLoading` and `error` states.
-- **Consistency:** Use a consistent API client or fetch wrapper defined in the project.
+**Enterprise Architecture Requirements:**
+- **Request Deduplication & Caching**: All query hooks must utilize Query Keys (e.g., `['users', 'list', params]`) to avoid redundant API hits and enforce data caching.
+- **Cache Invalidation on Mutation**: All mutations (create, update, delete) must define an `onSuccess` callback to invalidate query keys, guaranteeing data freshness.
+- **App's Local Types**: Always use domain types imported from `apps/web/src/types`.
+- **Feature Flag Governance**: Any critical feature must be toggled programmatically via `features.isEnabled('feature-name')` to ensure safe deployment.
 
-### Golden Standard Page Hook Patterns (v0.8.6)
+### Golden Standard Page Hook Patterns (TanStack Query Standard)
 
-#### 1. useListPage (For List Pages)
-- Pagination, search, and filter support
-- Helper functions: `setPage`, `setLimit`, `setSearch`, `setParams`
-- CRUD placeholders (`createItem`, `updateItem`, `deleteItem`)
-- Flexible usage via generic `<T>` type
+#### 1. useListPage (For Paginated/Searchable Lists)
+- Built on top of `useQuery` with dynamic Query Keys: `['domain', 'list', params]`.
+- Implements request deduplication, loading states, and pagination helpers (`setPage`, `setSearch`).
 
 **Usage Example:**
 ```ts
-const { data, loading, error, pagination, setSearch, setPage } = useListPage<User>({
-  fetchFn: async (params) => fetch(`/api/users?${new URLSearchParams(params)}`).then(r => r.json()),
-  initialParams: { page: 1, limit: 10 }
-});
+export const useUserList = (params: UserListParams) => {
+  return useQuery({
+    queryKey: ['users', 'list', params],
+    queryFn: () => api.get<User[]>('/api/users', { params }),
+    staleTime: 5000, // 5 seconds fresh state
+  });
+};
 ```
 
-#### 2. useDetailPage (For Detail Pages)
-Standard hook for detail pages.
-
-**Mandatory Features:**
-- Fetch single record by ID (`fetchFn`)
-- Update (`updateFn`) and Delete (`deleteFn`) supported optionally
-- Helper functions: `refetch`, `setId`, `update`, `remove`
-- Show meaningful message to the user on error
+#### 2. useDetailPage (For Detail & Mutations)
+- Employs `useQuery` for fetching single entities by ID, and `useMutation` for CRUD updates/deletes.
+- **Cache invalidation is mandatory**: Must invalidate lists upon modifications.
 
 **Usage Example:**
 ```ts
-const { data, loading, error, update, remove, refetch } = useDetailPage<User>({
-  fetchFn: (id) => fetch(`/api/users/${id}`).then(r => r.json()),
-  updateFn: (id, data) => fetch(`/api/users/${id}`, {
-    method: 'PUT',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(data)
-  }).then(r => r.json()),
-  deleteFn: (id) => fetch(`/api/users/${id}`, { method: 'DELETE' }),
-  initialId: userId
-});
+export const useUserDetail = (id: UserID) => {
+  const queryClient = useQueryClient();
+
+  const query = useQuery({
+    queryKey: ['users', 'detail', id],
+    queryFn: () => api.get<User>(`/api/users/${id}`),
+  });
+
+  const updateMutation = useMutation({
+    mutationFn: (data: UpdateUserDTO) => api.put(`/api/users/${id}`, data),
+    onSuccess: () => {
+      // Invalidate both detail and lists to trigger dynamic re-fetch
+      queryClient.invalidateQueries({ queryKey: ['users', 'detail', id] });
+      queryClient.invalidateQueries({ queryKey: ['users', 'list'] });
+    }
+  });
+
+  return { ...query, update: updateMutation.mutate, isUpdating: updateMutation.isPending };
+};
 ```
 
 **Agent Rule:** 
-- Never perform direct fetch on detail pages. Always use `useDetailPage`.
-- Loading + error states must be managed for update and delete operations.
-- If optimistic updates are used, a rollback mechanism must be added on error.
-
-#### 3. useFormPage (For Form Pages)
-Standard hook for form pages and modal forms.
+- Never perform a direct fetch without query key association.
+- Always implement cache invalidation for list views when mutating detail screens.
 
-**Mandatory Features:**
-- Form state management
-- Validation function support (client-side)
-- Helpers: `setValue`, `setValues`, `handleSubmit`, `resetForm`
-- Success/error message management after submit
+#### 3. useFormPage (For Forms and Validations)
+- Integrates form state validation with mutation handlers.
+- Manages optimistic UI updates or rollback mechanisms on backend failures.
 
 **Usage Example:**
 ```ts
-const {
-  values,
-  errors,
-  isSubmitting,
-  isSuccess,
-  handleSubmit,
-  setValue,
-  resetForm
-} = useFormPage<UserForm>({
-  initialValues: { name: '', email: '' },
-  validate: (values) => {
-    const errs: any = {};
-    if (!values.name) errs.name = 'Ad zorunlu';
-    if (!values.email?.includes('@')) errs.email = 'Please enter a valid email';
-    return errs;
-  },
-  onSubmit: async (values) => {
-    await fetch('/api/users', {
-      method: 'POST',
-      body: JSON.stringify(values)
-    });
-  }
-});
+export const useUserForm = () => {
+  const queryClient = useQueryClient();
+  
+  return useMutation({
+    mutationFn: (data: CreateUserDTO) => api.post('/api/users', data),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['users', 'list'] });
+    }
+  });
+};
 ```
 
 **Agent Rule:**
-- `useFormPage` must be used on every page that contains a form.
-- Inline form state management (manual useState) is forbidden.
-- Validation must always be done client-side, and backend error messages must also be captured.
-- Loading + success/error states must be managed after submit.
+- Form components must go through the mutation hook layout.
+- Loading, error, and dynamic validation parameters must be rendered.
 
 **Agent Rule:**  
 For every new page, you must use the appropriate one of these three patterns. Do not make inline API calls. Always go through a hook.
@@ -334,10 +325,12 @@ Frontend never creates its own types for backend data. Instead, it uses the type
 | `any` type | Use `unknown` or proper interfaces |
 | Hardcoded colors/spacing | Design System tokens must be used |
 | Non-responsive layout | Mobile-first and ultra-wide support are mandatory |
+| Manual fetch without caching (React Query) | Bypassing caching layer causes request duplicate bloat |
+| Deploying critical features without feature flags | Higher risk of breaking production workflows |
 
 ---
 
-**Agent Completion Report** (v0.8.6)
+**Agent Completion Report**
 
 - Mock used? [ ] No / [ ] Yes
 - App types imported? [ ] No / [ ] Yes

package/.enderun/agents/git.md

@@ -3,7 +3,7 @@ name: git
 description: "Version Control Specialist Agent for Agent Enderun"
 ---
 
-# @git — git (v0.8.6)
+# @git — git
 
 - **Name:** git
 - **Capability:** 9.0
@@ -12,7 +12,7 @@ description: "Version Control Specialist Agent for Agent Enderun"
 
 ---
 
-# @git — Version Control (v0.8.6)
+# @git — Version Control
 
 - **Name:** @git
 - **Capability:** 9.1
@@ -34,7 +34,7 @@ description: "Version Control Specialist Agent for Agent Enderun"
 
 ---
 
-# Version Control Specialist (@git) — v0.8.6 Master
+# Version Control Specialist (@git)
 
 You are the @git agent, responsible for the professional management of the project's repository. Your primary goal is to ensure a clean, atomic, and traceable history using Git and the AI-Enderun protocols.
 
@@ -119,7 +119,7 @@ If conflicts arise during integration, @git is responsible for performing a clea
 
 ---
 
-**Agent Completion Report** (v0.8.6)
+**Agent Completion Report**
 - Trace ID: [ULID]
 - Atomic Commits made? [ ] No / [ ] Yes
 - Phase Snapshot created? [ ] No / [ ] Yes

package/.enderun/agents/manager.md

@@ -3,7 +3,7 @@ name: manager
 description: "Orchestration & Governance (Team-Lead) Agent for Agent Enderun"
 ---
 
-# @manager — manager (v0.8.6)
+# @manager — manager
 
 - **Name:** manager
 - **Capability:** 9.0
@@ -12,7 +12,7 @@ description: "Orchestration & Governance (Team-Lead) Agent for Agent Enderun"
 
 ---
 
-# @manager — Orchestration & Governance (Team-Lead) (v0.8.6)
+# @manager — Orchestration & Governance (Team-Lead)
 
 - **Name:** @manager
 - **Capability:** 9.5
@@ -67,7 +67,7 @@ description: "Orchestration & Governance (Team-Lead) Agent for Agent Enderun"
 
 ---
 
-# Manager (CTO & Controller) — v0.8.6 Master (Agent Army)
+# Manager (CTO & Controller) — Master (Agent Army)
 
 **Role:** Enforce all framework rules without compromise and direct agents to the correct tasks. The following protocols are automatically activated in every session.
 
@@ -226,17 +226,24 @@ Trace ID: 01H... (26-character ULID)
 - [ ] `shared-types` approved.
 - [ ] `contract.version.json` created, hash verified.
 - [ ] OpenAPI schema documented under `{{FRAMEWORK_DIR}}/docs/api/`.
+- [ ] API type-sync and contract auto-sync verified (no contract drift).
 
 **PHASE_2 → PHASE_3:**
 
 - [ ] Core features delivered with unit tests.
 - [ ] Procedural Continuity verified across all modified files.
 - [ ] Log schema applied for all active agents.
+- [ ] Pino structured JSON logger and trace correlation propagation verified in all backend layers.
+- [ ] Feature flags documented and setup in environment configs.
 - [ ] No `any` or `console.log` violations.
 
 **PHASE_3 → PHASE_4:**
 
 - [ ] Integration tests passed with real DB.
+- [ ] Automated E2E user path tests verified (Playwright).
+- [ ] Non-negotiable **80% minimum unit/integration test coverage** checked and verified by @qa.
+- [ ] TanStack Query (React Query) request deduplication and cache invalidation verified.
+- [ ] Zero-Downtime Database migration safety verified (destructive schema edits blocked).
 - [ ] Zero Mock Policy verified.
 - [ ] **Zero UI Library Policy** verified (Confirmed no external UI libraries used).
 - [ ] **Panda CSS** configuration and type-safe token usage checked.
@@ -272,7 +279,7 @@ Trace ID: 01H... (26-character ULID)
 
 ---
 
-**Agent Completion Report** (v0.8.6)
+**Agent Completion Report**
 
 - Mock used? [ ] No / [ ] Yes
 - App types changed? [ ] No / [ ] Yes

package/.enderun/agents/mobile.md

@@ -3,7 +3,7 @@ name: mobile
 description: "Cross-Platform Mobile Specialist Agent for Agent Enderun"
 ---
 
-# @mobile — mobile (v0.8.6)
+# @mobile — mobile
 
 - **Name:** mobile
 - **Capability:** 9.0
@@ -12,7 +12,7 @@ description: "Cross-Platform Mobile Specialist Agent for Agent Enderun"
 
 ---
 
-# @mobile — Cross-Platform Mobile (v0.8.6)
+# @mobile — Cross-Platform Mobile
 
 - **Name:** @mobile
 - **Capability:** 8.8
@@ -33,7 +33,7 @@ description: "Cross-Platform Mobile Specialist Agent for Agent Enderun"
 
 ---
 
-# Mobile Architect — v0.8.6 Master
+# Mobile Architect
 
 **Role:** Build high-performance mobile applications using React Native. Maintain structural and stylistic continuity with the existing mobile codebase. All the following standards are automatically applied in every task.
 
@@ -93,7 +93,7 @@ Never start coding before understanding the current state of the components and
 - **Responsive & Safe Area:** SafeAreaView + Platform.OS check is mandatory on every screen.
 - **Accessibility:** Font scaling, contrast, and screen reader support must be considered in every component.
 
-## 📱 Mobile Agent Completion Report (v0.8.6 - Zorunlu)
+## 📱 Mobile Agent Completion Report (Zorunlu)
 
 - [ ] Mock used? [ ] No / [ ] Yes
 - [ ] App types imported? [ ] No / [ ] Yes

package/.enderun/agents/native.md

@@ -3,7 +3,7 @@ name: native
 description: "Native Platform Desktop Specialist Agent for Agent Enderun"
 ---
 
-# @native — native (v0.8.6)
+# @native — native
 
 - **Name:** native
 - **Capability:** 9.0
@@ -12,7 +12,7 @@ description: "Native Platform Desktop Specialist Agent for Agent Enderun"
 
 ---
 
-# @native — Native Capabilities (v0.8.6)
+# @native — Native Capabilities
 
 - **Name:** @native
 - **Capability:** 8.9
@@ -33,7 +33,7 @@ description: "Native Platform Desktop Specialist Agent for Agent Enderun"
 
 ---
 
-# Native Desktop Architect — v0.8.6 Master
+# Native Desktop Architect
 
 **Role:** Build secure and efficient desktop applications using Tauri or Electron. Ensure procedural continuity across the native codebase.
 
@@ -90,7 +90,7 @@ Always research the existing codebase and native bridge implementations before a
 - **Auto Update:** Tauri updater or electron-updater should be considered for automatic updates.
 - **Window & Menu:** Native menu, tray icon, and window state management should be standardized.
 
-## 🖥️ Native Agent Completion Report (v0.8.6 - Zorunlu)
+## 🖥️ Native Agent Completion Report (Zorunlu)
 
 - [ ] Mock used? [ ] No / [ ] Yes
 - [ ] App types imported? [ ] No / [ ] Yes

package/.enderun/agents/orchestrator.md

@@ -3,7 +3,7 @@ name: orchestrator
 description: "Task Queue & Parallel Execution Specialist Agent for Agent Enderun"
 ---
 
-# @orchestrator — orchestrator (v0.8.6)
+# @orchestrator — orchestrator
 
 - **Name:** orchestrator
 - **Capability:** 9.0
@@ -12,7 +12,7 @@ description: "Task Queue & Parallel Execution Specialist Agent for Agent Enderun
 
 ---
 
-# @orchestrator — Task Queue & Parallel Execution (v0.8.6)
+# @orchestrator — Task Queue & Parallel Execution
 
 - **Name:** @orchestrator
 - **Capability:** 9.8
@@ -60,7 +60,7 @@ description: "Task Queue & Parallel Execution Specialist Agent for Agent Enderun
 
 ---
 
-# @orchestrator — Task Queue & Parallel Execution Engine — v0.8.6 Master
+# @orchestrator — Task Queue & Parallel Execution Engine
 
 ## Identity & Mission
 

package/.enderun/agents/qa.md

@@ -3,7 +3,7 @@ name: qa
 description: "Quality Assurance & Test Specialist Agent for Agent Enderun"
 ---
 
-# @qa — qa (v0.8.6)
+# @qa — qa
 
 - **Name:** qa
 - **Capability:** 9.0
@@ -12,7 +12,7 @@ description: "Quality Assurance & Test Specialist Agent for Agent Enderun"
 
 ---
 
-# @qa — Quality Assurance & Test (v0.8.6)
+# @qa — Quality Assurance & Test
 
 - **Name:** @qa
 - **Capability:** 9.1
@@ -38,7 +38,7 @@ description: "Quality Assurance & Test Specialist Agent for Agent Enderun"
 - NEVER write production application code. Your scope is exclusively test code and quality reports.
 - Zero Mock Test Policy: Integration tests must use real database or service-compatible test backends. Mocks are only permitted for external 3rd-party services (Stripe, Twilio, etc.).
 - QA Gate is non-negotiable: No deploy proceeds without @qa sign-off. Not even @manager can override this gate.
-- Coverage thresholds are project-defined and must be read from the project's vitest/jest config — never self-imposed.
+- **Strict Coverage Quality Gate**: The non-negotiable coverage threshold for all core domain logic, repositories, and critical user paths is **at least 80%** (measured via Vitest/Jest). Deployments are strictly blocked if this target is not satisfied.
 - Every failing test must have a Trace ID and be logged to {{FRAMEWORK_DIR}}/logs/qa.json.
 - Regression tests must be run after every @backend contract change (Phase Rollback triggers automatic QA re-run).
 - Test plans must be written before implementation starts (TDD-first mindset when requested).
@@ -47,13 +47,14 @@ description: "Quality Assurance & Test Specialist Agent for Agent Enderun"
 ## Checklists
 ### beforeWritingTests
 - Read API contract (apps/backend/contract.version.json) to understand current type surface
-- Identify which functions/endpoints need unit vs integration tests
+- Identify which functions/endpoints need unit vs integration vs E2E tests
 - Confirm test database or service mock availability
 - Check existing test coverage to avoid duplication
 ### deployGate
 - All unit tests pass (vitest/jest)
 - Integration tests pass against real test DB
-- Coverage meets configured threshold
+- Automated E2E user path tests pass (Playwright)
+- Code coverage meets the **minimum 80% threshold** on modified and core domain paths
 - No skipped tests without documented reason
 - Sign off to @devops and @manager
 ### afterEveryTestRun
@@ -64,7 +65,7 @@ description: "Quality Assurance & Test Specialist Agent for Agent Enderun"
 
 ---
 
-# @qa — Quality Assurance & Test Engineering — v0.8.6 Master
+# @qa — Quality Assurance & Test Engineering
 
 ## Identity & Mission
 
@@ -125,6 +126,8 @@ Design the right test type for the right situation:
 - ❌ Writing production application code
 - ❌ Deleting or permanently skipping tests without @manager approval
 - ❌ Using mocks for database persistence in integration tests
-- ❌ Overriding coverage thresholds without @manager written approval
+- ❌ Overriding coverage thresholds or bypassing the **80% quality gate** without @manager written approval
 - ❌ Allowing a deploy to proceed when the gate is failed — even under pressure
+- ❌ Skipping regression tests on hotfixes or production releases
+- ❌ Deploying to production without automated Playwright E2E verification on critical user flows
 ---

package/.enderun/agents/security.md

@@ -3,7 +3,7 @@ name: security
 description: "Security & Compliance Specialist Agent for Agent Enderun"
 ---
 
-# @security — security (v0.8.6)
+# @security — security
 
 - **Name:** security
 - **Capability:** 9.0
@@ -12,7 +12,7 @@ description: "Security & Compliance Specialist Agent for Agent Enderun"
 
 ---
 
-# @security — Security & Compliance (v0.8.6)
+# @security — Security & Compliance
 
 - **Name:** @security
 - **Capability:** 9.3
@@ -61,7 +61,7 @@ description: "Security & Compliance Specialist Agent for Agent Enderun"
 
 ---
 
-# @security — Security Auditor & Compliance Officer — v0.8.6 Master
+# @security — Security Auditor & Compliance Officer
 
 ## Identity & Mission
 

package/.enderun/memory-graph/shared-facts.json

@@ -47,6 +47,6 @@
     { "agent": "@native", "capability": 8.9, "primaryDomain": "native" },
     { "agent": "@mobile", "capability": 8.8, "primaryDomain": "mobile" }
   ],
-  "frameworkVersion": "0.8.5",
+  "frameworkVersion": "0.8.7",
   "constitutionFile": "ENDERUN.md"
 }

package/ENDERUN.md

@@ -1,4 +1,4 @@
-# Agent Enderun (v0.8.6)
+# Agent Enderun (v0.8.7)
 # Place in project root. This file is the single source of truth for Base Project AI Extensions.
 
 ## 🎖️ AGENT CHECKLIST (MANDATORY BEFORE RESPONSE)

package/README.md

@@ -1,9 +1,9 @@
-# 🏛️ Agent Enderun (v0.8.6) — The Supreme AI Governance & Orchestration Framework
+# 🏛️ Agent Enderun (v0.8.7) — The Supreme AI Governance & Orchestration Framework
 
 **The Supreme AI Governance & Orchestration Framework for Enterprise Development**
 
 **Author:** Yusuf BEKAR
-**Version:** 0.8.6
+**Version:** 0.8.7
 **License:** MIT
 
 [English](#english) | [Türkçe](#türkçe)
@@ -86,6 +86,19 @@ The Agent Enderun framework organizes agent actions and runtime intelligence thr
 
 ---
 
+### 🏛️ Enterprise-Grade Architecture Standards (v0.8.7 Upgrades)
+
+Agent Enderun is armored out-of-the-box with six advanced, high-scale engineering gates required by corporate and enterprise-level production platforms:
+
+1. **⚡ Server-State Caching (TanStack Query / SWR)**: Enforces Query-Key-based caching, request deduplication, and automatic invalidation on mutations natively inside `@frontend`.
+2. **🗄️ Zero-Downtime Database Migrations**: Strictly forbids destructive raw SQL changes on live production database environments. Mandates a 4-step dual-write soft deprecation pattern in `@backend` to prevent migration downtime.
+3. **📊 Telemetry & JSON Logging**: Mandates structured Pino JSON logs and automatic **OpenTelemetry trace context propagation** (`trace_id` correlation) from API requests down through downstream database layers in `@backend`.
+4. **🧪 Strict 80% Coverage Quality Gate**: Imposes a non-negotiable **80% minimum unit/integration test coverage gate** on core domain repositories and critical paths, verified by `@qa`.
+5. **🛡️ Playwright E2E Integration**: Standards for automated End-to-End user journey test runs are enforced before deploy approvals.
+6. **🔗 Feature Flag Toggles & Type-Sync**: Enforces feature toggles (`features.isEnabled(...)`) to gate complex developments, and automates OpenAPI-to-TypeScript type sync to prevent API contract drift.
+
+---
+
 ## ⚡ Quick Start & Workflow
 
 ### 1. Installation
@@ -219,7 +232,7 @@ Enderun Ordusu'ndaki her ajan, kendilerine ait kuralları, izin verilen dizinler
 
 ---
 
-## 🏛️ Agent Enderun: Detaylı Kod Tabanı Denetim Raporu (v0.8.6)
+## 🏛️ Agent Enderun: Detaylı Kod Tabanı Denetim Raporu (v0.8.7)
 
 Çerçevenin (framework) çekirdek kod yapısı, operasyonel işleyişi, alt-üst ajan hiyerarşisi ve temizlenmiş mükerrer alanları en ince ayrıntısına kadar denetlenmiş ve belgelenmiştir:
 

package/framework-mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-enderun-mcp",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "Enterprise-grade MCP Server for AI Agent Framework",
   "author": "Yusuf BEKAR",
   "license": "MIT",

package/framework-mcp/src/tools/memory.ts

@@ -83,12 +83,27 @@ export const memoryHandlers = {
         const lockPath = memoryPath + ".lock";
         const lockOwner = `lock-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
         try {
-            if (fs.existsSync(lockPath)) {
-                const stats = fs.statSync(lockPath);
-                if (Date.now() - stats.mtimeMs > 120000) fs.unlinkSync(lockPath);
-                else return { content: [{ type: "text", text: "Memory is locked. Try again later." }] };
+            try {
+                // Atomic write using 'wx' flag to prevent TOCTOU race conditions
+                fs.writeFileSync(lockPath, JSON.stringify({ owner: lockOwner, createdAt: new Date().toISOString() }), { flag: "wx" });
+            } catch (error: any) {
+                if (error.code === "EEXIST") {
+                    const stats = fs.statSync(lockPath);
+                    if (Date.now() - stats.mtimeMs > 120000) {
+                        try {
+                            fs.unlinkSync(lockPath);
+                            // Retry atomic write once after unlinking stale lock
+                            fs.writeFileSync(lockPath, JSON.stringify({ owner: lockOwner, createdAt: new Date().toISOString() }), { flag: "wx" });
+                        } catch {
+                            return { content: [{ type: "text", text: "Memory is locked. Try again later." }] };
+                        }
+                    } else {
+                        return { content: [{ type: "text", text: "Memory is locked. Try again later." }] };
+                    }
+                } else {
+                    throw error;
+                }
             }
-            fs.writeFileSync(lockPath, JSON.stringify({ owner: lockOwner, createdAt: new Date().toISOString() }));
             let memoryContent = fs.readFileSync(memoryPath, "utf-8");
             if (section === "HISTORY") {
                 let updated = false;

package/framework-mcp/src/tools/monitoring.ts

@@ -113,7 +113,7 @@ export const monitoringHandlers: Record<
     }
 
     // Read queue depths
-    const queueBase = path.join(projectRoot, ".enderun", "queue");
+    const queueBase = path.join(projectRoot, getFrameworkDir(projectRoot), "queue");
     for (const subdir of ["pending", "processing", "completed", "failed"] as const) {
       try {
         const files = await fs.readdir(path.join(queueBase, subdir));
@@ -124,7 +124,7 @@ export const monitoringHandlers: Record<
     }
 
     // Read orchestrator log for recent blockages and broadcasts
-    const logPath = path.join(projectRoot, ".enderun", "logs", "orchestrator.json");
+    const logPath = path.join(projectRoot, getFrameworkDir(projectRoot), "logs", "orchestrator.json");
     try {
       const logContent = await fs.readFile(logPath, "utf-8");
       const log = JSON.parse(logContent) as {
@@ -152,7 +152,7 @@ export const monitoringHandlers: Record<
     const { agentName, lastN } = args as { agentName: string; lastN?: number };
     const n = lastN ?? 20;
     const logName = agentName.replace("@", "") + ".json";
-    const logPath = path.join(projectRoot, ".enderun", "logs", logName);
+    const logPath = path.join(projectRoot, getFrameworkDir(projectRoot), "logs", logName);
 
     try {
       const content = await fs.readFile(logPath, "utf-8");
@@ -206,7 +206,7 @@ export const monitoringHandlers: Record<
     const { thresholdMinutes } = args as { thresholdMinutes?: number };
     const threshold = thresholdMinutes ?? 30;
 
-    const statusPath = path.join(projectRoot, ".enderun", "STATUS.md");
+    const statusPath = path.join(projectRoot, getFrameworkDir(projectRoot), "STATUS.md");
     const bottlenecks: Array<{ agent: string; reason: string; state: string; severity: string }> = [];
 
     try {
@@ -308,7 +308,7 @@ export const monitoringHandlers: Record<
     }
 
     // Queue snapshot
-    const queueBase = path.join(projectRoot, ".enderun", "queue");
+    const queueBase = path.join(projectRoot, getFrameworkDir(projectRoot), "queue");
     const snapshot: Record<string, number> = {};
     for (const dir of ["pending", "processing", "completed", "failed"]) {
       try {
@@ -321,7 +321,7 @@ export const monitoringHandlers: Record<
     report.queueSnapshot = snapshot;
 
     // Recent blockages
-    const logPath = path.join(projectRoot, ".enderun", "logs", "orchestrator.json");
+    const logPath = path.join(projectRoot, getFrameworkDir(projectRoot), "logs", "orchestrator.json");
     try {
       const logContent = await fs.readFile(logPath, "utf-8");
       const log = JSON.parse(logContent) as { blockages?: unknown[] };

package/framework-mcp/src/tools/orchestration.ts

@@ -1,6 +1,7 @@
 import { Tool } from "@modelcontextprotocol/sdk/types.js";
 import { promises as fs } from "fs";
 import path from "path";
+import { getFrameworkDir } from "../utils.js";
 
 // ─── Tool Definitions ─────────────────────────────────────────────────────────
 
@@ -208,7 +209,7 @@ export const orchestrationHandlers: Record<
     };
 
     // Persist to queue
-    const queueDir = path.join(projectRoot, ".enderun", "queue", "pending");
+    const queueDir = path.join(projectRoot, getFrameworkDir(projectRoot), "queue", "pending");
     await fs.mkdir(queueDir, { recursive: true });
     await fs.writeFile(
       path.join(queueDir, `${traceId}-dag.json`),
@@ -230,7 +231,7 @@ export const orchestrationHandlers: Record<
     // Try to load capability roster from shared-facts.json (dynamic — fixes KRITIK-3)
     let agentCapabilityRoster: Array<{ agent: string; primaryDomain: string; capability: number }> = [];
     try {
-      const sharedFactsPath = path.join(projectRoot, ".enderun", "memory-graph", "shared-facts.json");
+      const sharedFactsPath = path.join(projectRoot, getFrameworkDir(projectRoot), "memory-graph", "shared-facts.json");
       const content = await fs.readFile(sharedFactsPath, "utf-8");
       const facts = JSON.parse(content) as { agentCapabilityRoster?: typeof agentCapabilityRoster };
       agentCapabilityRoster = facts.agentCapabilityRoster ?? [];
@@ -294,7 +295,7 @@ export const orchestrationHandlers: Record<
     };
 
     // Write assignment log
-    const logPath = path.join(projectRoot, ".enderun", "logs", "orchestrator.json");
+    const logPath = path.join(projectRoot, getFrameworkDir(projectRoot), "logs", "orchestrator.json");
     let log: { assignments: unknown[] } = { assignments: [] };
     try {
       const existing = await fs.readFile(logPath, "utf-8");
@@ -310,7 +311,7 @@ export const orchestrationHandlers: Record<
   },
 
   async get_agent_workload(_args, projectRoot) {
-    const statusPath = path.join(projectRoot, ".enderun", "STATUS.md");
+    const statusPath = path.join(projectRoot, getFrameworkDir(projectRoot), "STATUS.md");
     let statusContent: string;
     try {
       statusContent = await fs.readFile(statusPath, "utf-8");
@@ -356,7 +357,7 @@ export const orchestrationHandlers: Record<
     };
 
     // Log blockage
-    const logPath = path.join(projectRoot, ".enderun", "logs", "orchestrator.json");
+    const logPath = path.join(projectRoot, getFrameworkDir(projectRoot), "logs", "orchestrator.json");
     let log: { assignments: unknown[]; blockages: unknown[] } = { assignments: [], blockages: [] };
     try {
       const existing = await fs.readFile(logPath, "utf-8");
@@ -370,7 +371,7 @@ export const orchestrationHandlers: Record<
     await fs.writeFile(logPath, JSON.stringify(log, null, 2), "utf-8");
 
     // Write a message to @manager's inbox via messages folder
-    const messagesDir = path.join(projectRoot, ".enderun", "messages");
+    const messagesDir = path.join(projectRoot, getFrameworkDir(projectRoot), "messages");
     await fs.mkdir(messagesDir, { recursive: true });
     const messageFile = path.join(messagesDir, `BLOCKAGE-${traceId}-${Date.now()}.json`);
     await fs.writeFile(
@@ -409,7 +410,7 @@ export const orchestrationHandlers: Record<
     };
 
     // Write to messages folder for all agents
-    const messagesDir = path.join(projectRoot, ".enderun", "messages");
+    const messagesDir = path.join(projectRoot, getFrameworkDir(projectRoot), "messages");
     await fs.mkdir(messagesDir, { recursive: true });
     await fs.writeFile(
       path.join(messagesDir, `${broadcast.id}.json`),
@@ -418,7 +419,7 @@ export const orchestrationHandlers: Record<
     );
 
     // Log broadcast
-    const logPath = path.join(projectRoot, ".enderun", "logs", "orchestrator.json");
+    const logPath = path.join(projectRoot, getFrameworkDir(projectRoot), "logs", "orchestrator.json");
     let log: { assignments: unknown[]; blockages: unknown[]; broadcasts: unknown[] } = {
       assignments: [],
       blockages: [],

package/framework-mcp/src/utils.ts

@@ -10,12 +10,12 @@ const getPackageVersion = (): string => {
         const pkgPath = path.join(__dirname, "../package.json");
         if (fs.existsSync(pkgPath)) {
             const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
-            return pkg.version || "0.8.5";
+            return pkg.version || "0.8.7";
         }
     } catch {
         // fallback
     }
-    return "0.8.5";
+    return "0.8.7";
 };
 
 export const FRAMEWORK_VERSION = getPackageVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-enderun",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "The Supreme AI Governance & Orchestration Framework for Enterprise Development",
   "author": "Yusuf BEKAR",
   "license": "MIT",

package/src/cli/index.ts

@@ -998,16 +998,44 @@ function complianceCheckCommand(targetPath) {
   console.warn(`📜 Checking Constitution Compliance: ${targetPath}...`);
   const violations = [];
   const forbidden = ["@shadcn", "mui", "@chakra-ui", "tailwindcss"];
+
+  // 1. package.json scan (Blind Spot 5)
+  const pkgJsonPath = path.join(targetDir, "package.json");
+  if (fs.existsSync(pkgJsonPath)) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, "utf8"));
+      const allDeps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+      forbidden.forEach(lib => {
+        if (allDeps[lib] || Object.keys(allDeps).some(d => d.toLowerCase().includes(lib.toLowerCase()))) {
+          violations.push(`package.json: Forbidden library dependency '${lib}' found in package.json.`);
+        }
+      });
+    } catch {
+      // ignore
+    }
+  }
+
+  // 2. Source files scan
   const files = collectFiles(path.join(targetDir, targetPath), [".ts", ".tsx", ".js", ".jsx", ".md"]);
   files.forEach(f => {
+    const isTypesFile = f.includes("brands.ts") || f.includes("brands.js") || f.includes("brands.tsx") || f.includes("src/types/brands");
+
     const content = fs.readFileSync(f, "utf8");
     forbidden.forEach(lib => {
       if (content.includes(lib)) violations.push(`${path.relative(targetDir, f)}: Forbidden library '${lib}' found.`);
     });
-    if (f.endsWith(".ts") && content.includes("interface") && content.match(/ID\s*:\s*string/)) {
-      violations.push(`${path.relative(targetDir, f)}: Potential Branded Types violation (ID typed as string).`);
+
+    // Robust Branded Types validation (Blind Spot 4)
+    if ((f.endsWith(".ts") || f.endsWith(".tsx")) && !isTypesFile && content.includes("interface")) {
+      const plainIdMatches = content.match(/\b\w*(?:id|Id|ID)\??\s*:\s*(?:string|number)\b/g);
+      if (plainIdMatches) {
+        plainIdMatches.forEach(match => {
+          violations.push(`${path.relative(targetDir, f)}: Potential Branded Types violation (plain identifier '${match.trim()}' found inside interface).`);
+        });
+      }
     }
   });
+
   if (violations.length === 0) {
     console.warn("✅ All systems compliant with ENDERUN.md.");
   } else {