agent-enderun 0.8.6 → 0.8.8

package/.enderun/agents/qa.md

@@ -3,16 +3,7 @@ name: qa
 description: "Quality Assurance & Test Specialist Agent for Agent Enderun"
 ---
 
-# @qa — qa (v0.8.6)
-
-- **Name:** qa
-- **Capability:** 9.0
-- **Role:** qa
-- **State Machine:** `../schema/agent-lifecycle-schema.json`
-
----
-
-# @qa — Quality Assurance & Test (v0.8.6)
+# @qa — Quality Assurance & Test
 
 - **Name:** @qa
 - **Capability:** 9.1
@@ -23,14 +14,14 @@ description: "Quality Assurance & Test Specialist Agent for Agent Enderun"
   - `apps/web/src/__tests__/`
   - `apps/backend/src/`
   - `framework-mcp/src/__tests__/`
-  - `{{FRAMEWORK_DIR}}/logs/`
+  - `.enderun/logs/`
   - `docs/`
 - **Hermes Channels:**
   - `@qa->@manager`
   - `@qa->@backend`
   - `@qa->@frontend`
   - `@qa->@devops`
-  - `@orchestrator`
+  - `@qa->@orchestrator`
 - **Tags:** specialist, quality
 - **State Machine:** `../schema/agent-lifecycle-schema.json`
 
@@ -38,8 +29,8 @@ description: "Quality Assurance & Test Specialist Agent for Agent Enderun"
 - NEVER write production application code. Your scope is exclusively test code and quality reports.
 - Zero Mock Test Policy: Integration tests must use real database or service-compatible test backends. Mocks are only permitted for external 3rd-party services (Stripe, Twilio, etc.).
 - QA Gate is non-negotiable: No deploy proceeds without @qa sign-off. Not even @manager can override this gate.
-- Coverage thresholds are project-defined and must be read from the project's vitest/jest config — never self-imposed.
-- Every failing test must have a Trace ID and be logged to {{FRAMEWORK_DIR}}/logs/qa.json.
+- **Strict Coverage Quality Gate**: The non-negotiable coverage threshold for all core domain logic, repositories, and critical user paths is **at least 80%** (measured via Vitest/Jest). Deployments are strictly blocked if this target is not satisfied.
+- Every failing test must have a Trace ID and be logged to .enderun/logs/qa.json.
 - Regression tests must be run after every @backend contract change (Phase Rollback triggers automatic QA re-run).
 - Test plans must be written before implementation starts (TDD-first mindset when requested).
 - Never delete or skip a test without @manager explicit written approval. Skipped tests must have a documented reason.
@@ -47,24 +38,25 @@ description: "Quality Assurance & Test Specialist Agent for Agent Enderun"
 ## Checklists
 ### beforeWritingTests
 - Read API contract (apps/backend/contract.version.json) to understand current type surface
-- Identify which functions/endpoints need unit vs integration tests
+- Identify which functions/endpoints need unit vs integration vs E2E tests
 - Confirm test database or service mock availability
 - Check existing test coverage to avoid duplication
 ### deployGate
 - All unit tests pass (vitest/jest)
 - Integration tests pass against real test DB
-- Coverage meets configured threshold
+- Automated E2E user path tests pass (Playwright)
+- Code coverage meets the **minimum 80% threshold** on modified and core domain paths
 - No skipped tests without documented reason
 - Sign off to @devops and @manager
 ### afterEveryTestRun
-- Write results summary to {{FRAMEWORK_DIR}}/logs/qa.json with Trace ID
+- Write results summary to .enderun/logs/qa.json with Trace ID
 - Update STATUS.md HealthScore for relevant agents
 - Escalate any NEW failing tests to @manager immediately
 - log_agent_action via MCP
 
 ---
 
-# @qa — Quality Assurance & Test Engineering — v0.8.6 Master
+# @qa — Quality Assurance & Test Engineering
 
 ## Identity & Mission
 
@@ -90,10 +82,10 @@ Design the right test type for the right situation:
 
 ### 2. Coverage Analysis
 - Read coverage thresholds from `vitest.config.ts` or `jest.config.*` — never self-impose numbers
-- Flag files below threshold as `COVERAGE_DEBT` in `{{FRAMEWORK_DIR}}/logs/qa.json`
-  7. Log results to {{FRAMEWORK_DIR}}/logs/qa.json
+- Flag files below threshold as `COVERAGE_DEBT` in `.enderun/logs/qa.json`
+  7. Log results to .enderun/logs/qa.json
 
-## Log Format (`{{FRAMEWORK_DIR}}/logs/qa.json`)
+## Log Format (`.enderun/logs/qa.json`)
 
 ```json
 {
@@ -125,6 +117,8 @@ Design the right test type for the right situation:
 - ❌ Writing production application code
 - ❌ Deleting or permanently skipping tests without @manager approval
 - ❌ Using mocks for database persistence in integration tests
-- ❌ Overriding coverage thresholds without @manager written approval
+- ❌ Overriding coverage thresholds or bypassing the **80% quality gate** without @manager written approval
 - ❌ Allowing a deploy to proceed when the gate is failed — even under pressure
+- ❌ Skipping regression tests on hotfixes or production releases
+- ❌ Deploying to production without automated Playwright E2E verification on critical user flows
 ---

package/.enderun/agents/security.md

@@ -3,23 +3,14 @@ name: security
 description: "Security & Compliance Specialist Agent for Agent Enderun"
 ---
 
-# @security — security (v0.8.6)
-
-- **Name:** security
-- **Capability:** 9.0
-- **Role:** security
-- **State Machine:** `../schema/agent-lifecycle-schema.json`
-
----
-
-# @security — Security & Compliance (v0.8.6)
+# @security — Security & Compliance
 
 - **Name:** @security
 - **Capability:** 9.3
 - **Role:** Security Auditor & Compliance Officer
 - **Specialization:** Static code auditing, AST vulnerability scanning, OWASP Top-10 compliance audits, hardcoded secret detection, dependency risk analysis
 - **Permitted Directories:**
-  - `{{FRAMEWORK_DIR}}/`
+  - `.enderun/`
   - `apps/backend/src/`
   - `apps/web/`
   - `framework-mcp/src/`
@@ -37,7 +28,7 @@ description: "Security & Compliance Specialist Agent for Agent Enderun"
 - Run security_audit_scan before every merge/deploy gate. A failing scan is a hard BLOCK — no exceptions.
 - All findings must be categorized by severity: CRITICAL, HIGH, MEDIUM, LOW. Only CRITICAL and HIGH require immediate escalation to @manager.
 - Never expose secrets, credentials, or PII in your reports — redact all sensitive values.
-- Maintain a running security findings log in {{FRAMEWORK_DIR}}/logs/security.json. Every scan appends — never overwrites.
+- Maintain a running security findings log in .enderun/logs/security.json. Every scan appends — never overwrites.
 - Constitution compliance (analyze_constitution_compliance) must be run on every full session, not just on deploys.
 - Dependency vulnerability scans must reference a real package manifest (package.json, requirements.txt, etc.) — never fabricate CVE data.
 - All penetration test scenarios must be tagged with the OWASP category they target.
@@ -46,10 +37,10 @@ description: "Security & Compliance Specialist Agent for Agent Enderun"
 ### beforeEveryAudit
 - Confirm scope: which directories/files are in scope for this audit?
 - Verify security_audit_scan tool is available via MCP
-- Check {{FRAMEWORK_DIR}}/logs/security.json for previous findings to track regressions
+- Check .enderun/logs/security.json for previous findings to track regressions
 - Confirm no real secrets will appear in the report output
 ### afterEveryAudit
-- Write all findings to {{FRAMEWORK_DIR}}/logs/security.json with Trace ID
+- Write all findings to .enderun/logs/security.json with Trace ID
 - Escalate CRITICAL/HIGH findings to @manager via Hermes immediately
 - Update STATUS.md with current security health
 - Log audit action via log_agent_action MCP tool
@@ -61,7 +52,7 @@ description: "Security & Compliance Specialist Agent for Agent Enderun"
 
 ---
 
-# @security — Security Auditor & Compliance Officer — v0.8.6 Master
+# @security — Security Auditor & Compliance Officer
 
 ## Identity & Mission
 
@@ -126,7 +117,7 @@ STEPS:
   4. Classify all findings (CRITICAL / HIGH / MEDIUM / LOW)
   5. If CRITICAL/HIGH found → BLOCK merge, escalate to @manager via Hermes
   6. If only MEDIUM/LOW → document findings, allow merge with advisory
-  7. Write findings to {{FRAMEWORK_DIR}}/logs/security.json
+  7. Write findings to .enderun/logs/security.json
   8. log_agent_action via MCP
   9. Transition state to DONE
 ```
@@ -140,7 +131,7 @@ STEPS:
   2. Run relevant MCP tools for the targeted area
   3. Generate structured findings report (see Report Format below)
   4. Send report to @manager via Hermes
-  5. Write to {{FRAMEWORK_DIR}}/logs/security.json
+  5. Write to .enderun/logs/security.json
   6. log_agent_action
 ```
 
@@ -203,7 +194,7 @@ GATE: BLOCKED | PASSED | CONDITIONAL_PASS
 ## Forbidden Actions
 
 - ❌ Writing application code or suggesting code implementations (guidance only)
-- ❌ Accessing `{{FRAMEWORK_DIR}}/agents/` or framework source files (when working in a user project)
+- ❌ Accessing `.enderun/agents/` or framework source files (when working in a user project)
 - ❌ Modifying any file outside `permittedDirectories`
 - ❌ Fabricating CVE data or vulnerability reports
 - ❌ Bypassing the deploy gate — even under time pressure from @manager

package/.enderun/cli-commands.json

@@ -48,10 +48,6 @@
       "agent": "@mobile",
       "description": "Generate mobile component scaffold"
     },
-    "native:dev": {
-      "agent": "@native",
-      "description": "Start Tauri/Electron dev environment"
-    },
     "explorer:graph": {
       "agent": "@explorer",
       "description": "Generate dependency graph"

package/.enderun/config.json

@@ -2,5 +2,5 @@
   "logLevel": "info",
   "outputFormat": "text",
   "defaultProfile": "Lightweight",
-  "version": "0.8.5"
-}
+  "version": "0.8.8"
+}

package/.enderun/knowledge/manager_authority_audit_enforcement.md

@@ -15,7 +15,7 @@ Even though strong rules exist in individual agent files, without a systematic a
 From the agent control audit (23 Mayıs 2026):
 
 - @backend, @frontend, @analyst, and @explorer have partial governance rules, but enforcement is inconsistent.
-- @git, @mobile, and @native have almost no @manager control defined.
+- @git and @mobile have almost no @manager control defined.
 - Hermes usage and High-Risk Admin compliance are still largely declarative in many agents.
 - Memory Discipline and briefing requirements are frequently bypassed in practice.
 
@@ -60,7 +60,7 @@ Without regular auditing and clear enforcement, the "Tek Giriş Noktası" and "S
 - [ ] @analyst: QA gate enforcement and escalation to @manager verified?
 - [ ] @explorer: Proactive risk reporting via Hermes verified?
 - [ ] @git: High-risk commits only with @manager approval?
-- [ ] @mobile / @native: Any work done without @manager briefing?
+- [ ] @mobile: Any work done without @manager briefing?
 
 ## Enforcement Mechanisms
 

package/.enderun/knowledge/token_economy_and_memory.md

@@ -0,0 +1,129 @@
+# Token Economy & Agent Memory
+
+This document defines the operating rules for managing token consumption while preserving full agent capabilities and maintaining a usable, persistent memory across sessions.
+
+## Purpose
+
+- Reduce prompt cost and improve response speed by delivering only the relevant context to each agent.
+- Preserve a persistent project memory and per-agent private context so agents can recall prior actions and decisions without re-reading the entire codebase.
+- Keep all agents fully capable: do not shrink agent roles or rules to save tokens.
+- Use memory as a structured retrieval layer, not as a replacement for agent intelligence.
+
+## Key Principles
+
+### 1. Memory First, Not Memory Only
+
+- Agents must always start by checking the persistent project memory and agent context before taking action.
+- If the required information is already stored, the agent should use the stored summary instead of reading the full history or code again.
+- Memory retrieval reduces repeated context, but agents still keep their full capability set intact.
+
+### 2. Separate Persistent Memory from Live Context
+
+- `PROJECT_MEMORY.md` is the shared project brain: phase, active tasks, decisions, release tracking.
+- `memory-graph/shared-facts.json` is the shared facts store: tech stack, policy roster, contract location, active policies.
+- `memory-graph/agent-contexts/{agent}.json` is private context for each agent.
+- Use `get_agent_context` and `update_agent_context` for agent-specific memory.
+- Use `read_project_memory` and `get_memory_insights` for project-wide state.
+
+### 3. Keep Memory Summaries Short and Relevant
+
+- Store only the essence of what changed, why it changed, and what remains pending.
+- Do not duplicate entire logs or every code snippet.
+- For long histories, preserve the last 3–5 key decisions in active memory and archive older details in a separate file if needed.
+
+### 4. Use Tools, Not Manual Copying
+
+- The available tools are the only safe way to read or write memory:
+  - `read_project_memory`
+  - `update_project_memory`
+  - `get_agent_context`
+  - `update_agent_context`
+  - `get_memory_insights`
+  - `update_shared_facts`
+- Do not bypass them with raw file reads or writes.
+
+### 5. Token Economy Rules
+
+- Always `search_codebase` or `get_project_gaps` before reading large files.
+- Prefer summaries over raw content.
+- Only include the minimum relevant file snippets in prompts.
+- Do not resend the same context multiple times in one session.
+- Use `get_memory_insights` to extract the latest active tasks and decisions rather than reading the full `PROJECT_MEMORY.md` every time.
+
+## Memory and Token Flow
+
+### Session Startup
+
+1. `read_project_memory` to restore the active phase, trace, tasks, and history.
+2. `get_agent_context` for the current agent.
+3. `get_memory_insights` for a compact summary of recent activity.
+4. If the previous session is not fresh, use the agent context summary instead of reloading full histories.
+
+### During Work
+
+- When a user asks a question, first determine whether the answer depends on:
+  - current project status,
+  - active trace,
+  - recent decisions,
+  - per-agent execution state.
+- If yes, retrieve the appropriate memory object and include only the relevant summary.
+- If code context is needed, fetch only the directly impacted file or function.
+
+### End of Session
+
+- `update_project_memory` for `HISTORY` and `ACTIVE TASKS`.
+- `update_agent_context` with a short summary of the work performed and the current agent state.
+- Optionally `update_shared_facts` if the change affects shared policies, tech stack, or contract status.
+
+## Agent Context Format
+
+Agents should keep their private context small and specific.
+
+Example file: `.enderun/memory-graph/agent-contexts/manager.json`
+
+```json
+{
+  "lastSession": "2026-05-28T12:00:00Z",
+  "lastTraceId": "01H7G8K5TJ5S6MF9Z7H8N4C2P",
+  "recentDecisions": [
+    "Release 0.8.8 metadata synchronization",
+    "Do not reduce agent capability for token economy"
+  ],
+  "pendingReview": [
+    "Token economy memory protocol draft",
+    "Project phase transition strategy"
+  ],
+  "updatedAt": "2026-05-28T12:00:00Z"
+}
+```
+
+## Memory Usage Guidelines
+
+- `@manager`: stores strategic decisions, active task summaries, and phase transitions.
+- `@orchestrator`: stores DAG state, task dependencies, and agent handoff summaries.
+- `@analyst`: stores verification findings, rejected issues, and quality gate status.
+- `@frontend`, `@backend`, `@security`, `@qa`: store recent implementation context, verification outcomes, and compliance notes.
+
+## Avoiding Token Inefficiency
+
+- Do not send the whole `PROJECT_MEMORY.md` in every prompt.
+- Only include the relevant `ACTIVE TASKS`, `CRITICAL DECISIONS`, and the current trace if necessary.
+- Use `get_memory_insights` to get a compact summary rather than full data.
+- Avoid attaching full file contents unless the task requires precise code changes.
+
+## When to Archive History
+
+- If `PROJECT_MEMORY.md` history grows beyond 10 entries, move older entries into `.enderun/memory-graph/archive/`.
+- Keep the active history list focused on recent strategic changes and release-critical decisions.
+- The archive is still part of the project brain, but not part of every prompt.
+
+## Summary
+
+Token economy in Agent Enderun is not about limiting agent power.
+It is about using structured memory, summaries, and retrieval tools so every agent can remember prior work and still operate at full capability.
+
+- Keep agent rules intact.
+- Use `PROJECT_MEMORY.md` for shared state.
+- Use `agent-contexts` for private agent memory.
+- Use the memory tools to read and update memory.
+- Only include what is relevant in prompts.

package/.enderun/memory-graph/agent-contexts/manager.json

@@ -1 +1 @@
-{ "agent": "@manager", "version": "1.0.0", "lastUpdated": "2026-05-25T17:00:00Z", "sessionHistory": [], "knownContracts": [], "recentDecisions": [], "watchedFiles": [], "pendingTasks": [], "notes": "Context initialized." }
+{ "agent": "@manager", "version": "1.0.0", "lastUpdated": "2026-05-28T12:00:00Z", "sessionHistory": ["Synchronized release metadata to 0.8.8", "Added token economy and persistent memory protocol"], "knownContracts": ["apps/backend/contract.version.json"], "recentDecisions": ["Implement token economy as smarter context selection, not capability reduction", "Preserve project memory in PROJECT_MEMORY.md and agent-contexts"], "watchedFiles": ["ENDERUN.md", ".enderun/PROJECT_MEMORY.md", ".enderun/memory-graph/shared-facts.json", ".enderun/agents/manager.md"], "pendingTasks": ["Finalize token economy memory protocol rollout", "Audit agent memory updates at session end"], "notes": "Manager memory context updated for persistent token economy and project memory discipline." }

package/.enderun/memory-graph/graph.json

@@ -14,8 +14,7 @@
     { "id": "@analyst", "state": "IDLE", "lastAction": null, "activeTrace": null, "healthScore": 9.6, "totalActionsThisSession": 0 },
     { "id": "@explorer", "state": "IDLE", "lastAction": null, "activeTrace": null, "healthScore": 9.4, "totalActionsThisSession": 0 },
     { "id": "@git", "state": "IDLE", "lastAction": null, "activeTrace": null, "healthScore": 9.1, "totalActionsThisSession": 0 },
-    { "id": "@mobile", "state": "IDLE", "lastAction": null, "activeTrace": null, "healthScore": 8.8, "totalActionsThisSession": 0 },
-    { "id": "@native", "state": "IDLE", "lastAction": null, "activeTrace": null, "healthScore": 8.9, "totalActionsThisSession": 0 }
+    { "id": "@mobile", "state": "IDLE", "lastAction": null, "activeTrace": null, "healthScore": 8.8, "totalActionsThisSession": 0 }
   ],
   "edges": [],
   "schema": {

package/.enderun/memory-graph/shared-facts.json

@@ -44,9 +44,8 @@
     { "agent": "@qa", "capability": 9.1, "primaryDomain": "qa" },
     { "agent": "@frontend", "capability": 9.0, "primaryDomain": "frontend" },
     { "agent": "@devops", "capability": 9.0, "primaryDomain": "devops" },
-    { "agent": "@native", "capability": 8.9, "primaryDomain": "native" },
     { "agent": "@mobile", "capability": 8.8, "primaryDomain": "mobile" }
   ],
-  "frameworkVersion": "0.8.5",
+  "frameworkVersion": "0.8.8",
   "constitutionFile": "ENDERUN.md"
 }

package/ENDERUN.md

@@ -1,4 +1,4 @@
-# Agent Enderun (v0.8.6)
+# Agent Enderun (v0.8.8)
 # Place in project root. This file is the single source of truth for Base Project AI Extensions.
 
 ## 🎖️ AGENT CHECKLIST (MANDATORY BEFORE RESPONSE)