agent-enderun 0.8.8 → 0.9.1

package/.enderun/BRAIN_DASHBOARD.md

@@ -1,4 +1,4 @@
-# 🧠 Agent Enderun Brain Dashboard
+# 🧠 Agent Enderun Brain Dashboard (v1.0)
 
 This dashboard provides a high-level overview of the Army's performance, quality trends, and architectural health.
 
@@ -12,7 +12,7 @@ This dashboard provides a high-level overview of the Army's performance, quality
 | **Active Trace IDs** | 0 | 🟢 None |
 | **Agent Velocity** | — | — |
 | **Contract Integrity** | 100% | ✅ Valid |
-| **Army Size** | 11 agents | ✅ Complete |
+| **Army Size** | 10 agents | ✅ Complete |
 
 ---
 
@@ -20,7 +20,7 @@ This dashboard provides a high-level overview of the Army's performance, quality
 
 - **Security Audit Status**: 🟢 Clean (Last scan: 2026-05-26)
 - **Constitution Compliance**: 🔵 100% (Last audit: 2026-05-26)
-- **Documentation Debt**: 🟢 Low (English standardization complete)
+- **Documentation Debt**: 🟢 Low (v1.0 English standardization complete)
 
 ---
 
@@ -29,7 +29,7 @@ This dashboard provides a high-level overview of the Army's performance, quality
 - **Dependency Cycles**: 0 detected.
 - **Complexity Spikes**: 0 identified.
 - **Database Migrations**: N/A (framework core)
-- **Memory Graph**: ✅ Online (12 contexts + shared-facts)
+- **Memory Graph**: ✅ Online (10 contexts + shared-facts)
 - **Task Queue**: ✅ Active (file-based, no external deps)
 
 ---
@@ -38,7 +38,7 @@ This dashboard provides a high-level overview of the Army's performance, quality
 
 | Version | Date | Description | Hash |
 | :--- | :--- | :--- | :--- |
-| v1.0.0-alpha | 2026-05-25 | Full 11-Agent Army + Memory Graph + Orchestration MCP | `sha256:army-v1` |
+| v1.0.0-alpha | 2026-05-25 | Full 12-Agent Army + Memory Graph + Orchestration MCP | `sha256:army-v1` |
 
 ---
 

package/{ENDERUN.md → .enderun/ENDERUN.md}

@@ -3,11 +3,13 @@
 
 ## 🎖️ AGENT CHECKLIST (MANDATORY BEFORE RESPONSE)
 > Check this list at the end of every response:
-- [ ] **Surgical Quality:** Did you use the `replace` tool for targeted changes? For files >100 lines, focus on changed blocks and use `...` for untouched sections to preserve token limit. (Quality over Volume)
+- [ ] **Surgical Quality:** Did you use the `replace_text` tool for targeted changes? For files >100 lines, focus on changed blocks. (Quality over Volume)
+- [ ] **Autonomous Growth:** Use `create_app` for generating new modules from specs.
 - [ ] **Contract First:** Are the app's types and apps/backend/contract.version.json up to date?
 - [ ] **Audit Log:** Did you log this action in `{{FRAMEWORK_DIR}}/logs/[agent].json`?
 - [ ] **CLI Orchestration:** Does the action comply with `{{ADAPTER}} cli` rules?
 - [ ] **Complete Context:** Ensure all changed logic is fully written. Placeholder `...` is only for *unchanged* surrounding code.
+- [ ] **ESLint Compliance:** Did you run `npm run lint` (or `agent-enderun check:lint`)? Zero errors required; follow `{{FRAMEWORK_DIR}}/knowledge/eslint-standards.md`.
 
 ---
 
@@ -35,7 +37,7 @@ To minimize AI costs and maximize speed, all agents must adhere to the **Token E
 ---
 
 ## Constitution Status
-This file (`./{{ADAPTER}}.md`) and the `{{FRAMEWORK_DIR}}/docs/` folder represent the "Supreme Law" of the project. All agents must read this file first in every session and strictly comply with its rules 100%. All framework-specific documentation is stored within `{{FRAMEWORK_DIR}}/docs/`.
+This file (`./.enderun/ENDERUN.md`) and the `.enderun/docs/` folder represent the "Supreme Law" of the project. All agents must read this file first in every session and strictly comply with its rules 100%. All framework-specific documentation is stored within `.enderun/docs/`.
 
 ---
 

package/.enderun/PROJECT_MEMORY.md

@@ -1,53 +1,42 @@
-# PROJECT MEMORY — Agent Enderun
-
-This file is the Single Source of Truth (SSOT) and the persistent memory of the project.
-
 ## CURRENT STATUS
 
-| Active Phase | Profile | Last Update | Active Trace ID | Blockers |
-| :----------- | :------ | :---------- | :-------------- | :------- |
-| PHASE_0      | Full    | 2026-05-28  | NONE            | NONE     |
-
-## PROJECT DEFINITION
-
-| Field | Value |
-| :--- | :--- |
-| Project Name | Agent Enderun |
-| Version | 0.8.8 |
-| Platform | Node.js CLI + MCP orchestration framework |
-| Frontend | N/A (framework core, no user-facing frontend) |
-| Backend | Node.js + framework-mcp MCP server + CLI orchestration |
-| DB | None (framework core) |
-
-## DOD STATUS
-
-| Phase | Status | Note |
-| :--- | :--- | :--- |
-| PHASE_0 | PENDING | Discovery & Setup |
-| PHASE_1 | PENDING | Architecture & Contracts |
-| PHASE_2 | PENDING | Core Development |
-| PHASE_3 | PENDING | Integration & Testing |
-| PHASE_4 | PENDING | Optimization & Deployment |
-
-## CRITICAL DECISIONS
-
-| Date | Decision | Rationale | Agent |
-| :--- | :--- | :--- | :--- |
-| 2026-05-26 | Framework Cleanup | Pristine memory state established for npmjs publish. | @manager |
-
-## DELIVERABLES
-
-| Module | Status | Agent | Date |
-| :--- | :--- | :--- | :--- |
+- Phase: PHASE_1 (Architecture & Contracts)
+- Trace ID: 01HGT8J5E2N0W0W0W0W0W0W0W4
+- @manager state: ENTERPRISE_FULL_PROFILE_ACTIVE
 
 ## ACTIVE TASKS
 
 | Trace ID | Task | Agent | Priority | Status |
 | :--- | :--- | :--- | :--- | :--- |
+| 01HGT8J5E2N0W0W0W0W0W0W0W4 | Define initial API contracts (Dashboard) | @backend | P0 | COMPLETED |
+| 01HGT8J5E2N0W0W0W0W0W0W0W4 | Knowledge Base Rehabilitation & Governance Audit | @manager | P0 | COMPLETED |
+| 01HGT8J5E2N0W0W0W0W0W0W0W4 | Transition to Dynamic Hermes Orchestration Loop | @manager | P0 | COMPLETED |
 
-## HISTORY (Persistent Memory)
+## CRITICAL DECISIONS
+- **Tech Stack:** Node.js/Fastify, React/Vite, PostgreSQL, Kysely.
+- **Surgical Standard:** replace_text/patch_file is mandatory for all edits.
+- **Contract First:** All developments must start with type definitions.
+- **Memory Standard:** Auto-pruning active (max 10 entries).
+- **Sovereign Backend Structure:** Every backend service MUST maintain its own database logic (schema, migrations, seeds) within `src/database/` to ensure full isolation.
+
+## HISTORY
+- **SYSTEM INITIALIZED:** Framework v0.9.0 promoted to stable release state.
+- **PHASE TRANSITION:** Moved to PHASE_1. Enterprise profile selected.
+- **CONTRACT DEFINITION:** API contracts defined and hash updated.
+- **AGENT ADDED:** Created @database agent for schema and seeding authority.
+- **AGENT MERGE:** Governance (@manager) and Orchestration (@orchestrator) roles merged into unified @manager authority.
+- **DESIGN MANDATE:** Formally adopted 'Mobile-First, Responsive' design discipline and created Design System documentation.
+- **UI GOVERNANCE:** Banned native browser dialogues (`alert`/`confirm`) and mandated integrated `Toaster`/`Modal` components.
+- **LOGGING GOVERNANCE:** Implemented structured logging, banned `console.log`, and mandated audit logging for state-mutating operations.
+- **LEARNING ENGINE:** Implemented 'Lessons Learned Engine'. Agents analyze failures to create 'Prevention Rules' and verify them before every task.
+- **GOVERNANCE UPDATE:** Adopted 'Strategic Consultation Mandate'. Agents must now propose at least two distinct strategic options for major implementations and await user direction.
+- **LANGUAGE MANDATE:** Standardized all documentation, agent definitions, and system reports to English-Only.
+- **GOVERNANCE UPDATE:** Adopted 'Self-Contained Sovereign Services' structure for all backend applications.
+- **VERSION BUMP:** Framework version updated to v0.9.1.
+- **KNOWLEDGE REHABILITATION:** Inlined 13 stub files into agent definitions and added missing `documentation_ownership.md` to establish strict documentation boundaries.
+- **DYNAMIC ORCHESTRATION TRANSITION:** Removed static template code generators, implemented dynamic Hermes Orchestrator Loop, and resolved critical CLI ReferenceError import bugs.
+- **DYNAMIC PATH RESOLUTION ALIGNMENT:** Eliminated all hardcoded framework and application directories, introducing configuration-driven dynamic path mapping via `paths` inside `config.json`.
+- **COMPILER & TYPE SAFETY REMEDIATION:** Fixed type-safety signature mismatches in `fs.ts` and const reassignment issues in `log.ts`, ensuring perfect TypeScript compiler build verification with zero errors.
+- **ESLINT RUNTIME ALIGNMENT:** Patched ESLint to completely ignore hidden framework files, preventing EPERM scan crashes under sandboxed runtime restrictions.
 
-### 2026-05-26 — Framework Cleanup
 
-- **Agent:** @manager
-- **Action:** Framework memory reset successfully performed. Pristine memory state established. Ready to receive custom project instructions and start scaffolding.

package/.enderun/STATUS.md

@@ -1,5 +1,5 @@
-# 🏛️ AGENT ENDERUN — ORDU KOMUTA DASHBOARDI
-> v0.8.8 | State Machine Active | Memory Graph: Online
+# 🏛️ AGENT ENDERUN — ARMY COMMAND DASHBOARD
+> v0.9.1 | State Machine Active | Memory Graph: Online
 
 ---
 
@@ -7,48 +7,46 @@
 
 | Agent | State | CurrentTask | BlockedBy | HealthScore | LastAction |
 | :--- | :--- | :--- | :--- | :--- | :--- |
-| @manager | IDLE | — | — | 9.5/10 | Framework Reset |
-| @orchestrator | IDLE | — | — | 9.8/10 | — |
-| @analyst | IDLE | — | — | 9.6/10 | — |
+| @manager | ACTIVE | Readiness Status | — | 10/10 | v0.9.1 Promotion |
+| @quality | IDLE | — | — | 9.7/10 | Governance Audit |
+| @database | IDLE | — | — | 9.5/10 | — |
 | @backend | IDLE | — | — | 9.2/10 | — |
 | @frontend | IDLE | — | — | 9.0/10 | — |
-| @security | IDLE | — | — | 9.3/10 | — |
-| @qa | IDLE | — | — | 9.1/10 | — |
 | @devops | IDLE | — | — | 9.0/10 | — |
 | @explorer | IDLE | — | — | 9.4/10 | — |
 | @git | IDLE | — | — | 9.1/10 | — |
 | @mobile | IDLE | — | — | 8.8/10 | — |
+| @native | IDLE | — | — | 8.9/10 | — |
 
 ---
 
 ## 📈 Intelligence Metrics
 
-| Metrik | Değer |
+| Metric | Value |
 | :--- | :--- |
-| **Framework Versiyonu** | v0.8.8 |
-| **Sistem Sağlığı** | 🟢 GREEN |
-| **Toplam Trace** | 0 |
-| **Aktif Görevler** | 0 |
-| **Blokaj Sayısı** | 0 |
-| **Aktif Agent Sayısı** | 11 |
-| **Kuyruk Boyutu** | 0 |
+| **Framework Version** | v0.9.1 |
+| **System Health** | 🟢 GREEN |
+| **Major Governance Audit** | COMPLETED |
+| **Active Tasks** | 1 |
+| **Number of Blockers** | 0 |
+| **Active Agent Count** | 10 |
+| **Queue Size** | 0 |
 
 ---
 
 ## 🔗 Hermes Channel Map
 
 ```
-@manager      → @backend, @frontend, @analyst, @explorer, @git, @orchestrator
-@orchestrator → * (tüm agentlar)
-@security     → @manager, @backend, @git
-@qa           → @manager, @backend, @frontend
-@devops       → @manager, @git, @security
-@backend      → @manager, @analyst
-@frontend     → @manager
-@analyst      → @manager
-@git          → @manager
-@explorer     → @manager
-@mobile       → @manager
+@manager  → @backend, @frontend, @explorer, @git, @database, @devops, @quality, @mobile, @native
+@quality  → @manager, @backend, @frontend, @git, @devops
+@devops   → @manager, @git, @quality
+@backend  → @manager, @quality
+@frontend → @manager
+@git      → @manager
+@explorer → @manager
+@database → @manager
+@mobile   → @manager
+@native   → @manager
 ```
 
 ---
@@ -57,5 +55,4 @@
 
 `IDLE → BRIEFED → EXECUTING → DONE → IDLE`
 
-Detay: `.enderun/agents/schema/agent-lifecycle-schema.json`
-json`
+Details: `.enderun/agents/schema/agent-lifecycle-schema.json`

package/.enderun/agents/agent_army_schema.json

@@ -1,10 +1,18 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "title": "Agent Enderun Army Schema",
-  "description": "Strongly-typed schema for all specialist agents in the Enderun Army. Every agent definition file must validate against this. v1.0: Removed enum lock on agent names to allow new specialist agents.",
+  "description": "Strongly-typed schema for all specialist agents in the Enderun Army. Every agent.json must validate against this. v1.0: Removed enum lock on agent names to allow new specialist agents.",
   "version": "1.0.0",
   "type": "object",
-  "required": ["name", "capability", "role", "specialization", "rules", "permittedDirectories", "hermesChannels"],
+  "required": [
+    "name",
+    "capability",
+    "role",
+    "specialization",
+    "rules",
+    "permittedDirectories",
+    "hermesChannels"
+  ],
   "properties": {
     "name": {
       "type": "string",
@@ -31,13 +39,17 @@
     },
     "rules": {
       "type": "array",
-      "items": { "type": "string" },
+      "items": {
+        "type": "string"
+      },
       "minItems": 1,
       "description": "Mandatory behavioral rules the agent must never violate."
     },
     "permittedDirectories": {
       "type": "array",
-      "items": { "type": "string" },
+      "items": {
+        "type": "string"
+      },
       "minItems": 1,
       "description": "Directories this agent is authorized to read/write. Any access outside these requires @manager approval."
     },
@@ -58,7 +70,9 @@
       "type": "object",
       "additionalProperties": {
         "type": "array",
-        "items": { "type": "string" }
+        "items": {
+          "type": "string"
+        }
       },
       "description": "Named checklists the agent must execute. e.g. 'beforeEveryResponse', 'beforeDelegating'"
     },
@@ -76,10 +90,18 @@
       "type": "array",
       "items": {
         "type": "string",
-        "enum": ["core", "specialist", "infrastructure", "governance", "quality", "security", "orchestration"]
+        "enum": [
+          "core",
+          "specialist",
+          "infrastructure",
+          "governance",
+          "quality",
+          "security",
+          "orchestration"
+        ]
       },
       "description": "Classification tags for filtering and grouping agents."
     }
   },
   "additionalProperties": false
-}
+}

package/.enderun/agents/backend.md

@@ -3,7 +3,7 @@ name: backend
 description: "Domain Logic & Databases Specialist Agent for Agent Enderun"
 ---
 
-# @backend — Domain Logic & Databases
+# @backend — Domain Logic & Databases 
 
 - **Name:** @backend
 - **Capability:** 9.2
@@ -14,8 +14,8 @@ description: "Domain Logic & Databases Specialist Agent for Agent Enderun"
   - `.enderun/knowledge/`
 - **Hermes Channels:**
   - `@backend->@manager`
-  - `@backend->@analyst`
-  - `@backend->@orchestrator`
+  - `@backend->@quality`
+  - `@backend->@manager`
 - **Tags:** specialist
 - **State Machine:** `../schema/agent-lifecycle-schema.json`
 
@@ -24,11 +24,13 @@ description: "Domain Logic & Databases Specialist Agent for Agent Enderun"
 - Define and version all shared contracts and branded types before any consumer code is written.
 - All high-risk endpoints must carry isHighRiskAdminAction + managerApproval validation.
 - Use only branded ID types. No plain strings for identifiers.
-- Log every contract change and migration with Trace ID.
+- **Logging Standard:** `console.log` usage is FORBIDDEN. Use the centralized `Logger` service (`apps/backend/src/services/logger.ts`) for all logging.
+- **Audit Logging:** Every state-mutating operation (POST, PUT, PATCH, DELETE) MUST trigger an `AuditService.log()` call, linking the action to the responsible agent, Trace ID, and entity ID.
+- **Lesson Check (Mandatory):** Before initiating any task, check `.enderun/knowledge/lessons-learned.md`. If a previous failure matches current scope/context, strictly enforce the 'Prevention Rule'. Ignoring this is a Critical Rule Violation.
 
 ---
 
-# Backend Architect
+# Backend Architect — 
 
 **Role:** Build a secure, high-performance, and consistent server architecture. All the following standards are automatically applied in every task — no need for the user to specify them separately.
 
@@ -95,13 +97,16 @@ export class NotFoundError extends DomainError {
 **Rule:** Never use `throw new Error()`. Always use one of the DomainError subclasses.
 
 ### 2. Branded Types (Mandatory)
-All IDs must be branded types:
+All IDs must be branded types to ensure complete type safety and prevent runtime errors.
+Example:
 ```ts
 export type UserID = string & { __brand: 'UserID' };
 export type OrderID = string & { __brand: 'OrderID' };
+// Alternative Brand utility
+export type Brand<T, B> = T & { __brand: B };
+export type ProjectID = Brand<string, 'ProjectID'>;
 ```
-
-Using plain `string` or `number` IDs is forbidden.
+Using plain `string` or `number` IDs is strictly forbidden where a specific ID is expected.
 
 ### 3. Types Structure (Standard)
 The `apps/backend/src/types/` directory must be organized as follows:
@@ -123,10 +128,29 @@ All routes must use a global error handler. Errors must be returned in the stand
 }
 ```
 
-### 5. Gold Standard Enforcement
+### 5. API Design Rules
+1. **Versioned Routes**: All APIs must start with `/api/v1/`.
+2. **Kebab-Case**: Use kebab-case for URL paths.
+3. **Standard Responses**: Always wrap data in `{ data, traceId, timestamp }`.
+4. **Method Discipline**: GET (read), POST (create), PUT (update), DELETE (remove).
+
+### 6. Repository Pattern Standards
+- **Purpose**: Decouple the data access logic from the business logic. This ensures that changes in the database schema or ORM do not break the entire application.
+- **Principles**:
+  1. **Abstraction**: Use interfaces to define the repository contract.
+  2. **Implementation**: Use Kysely or preferred ORM for actual DB calls.
+  3. **Single Responsibility**: One repository per domain entity.
+
+### 7. Contract Versioning Workflow
+1. **Change**: Modify types in `apps/backend/src/types`.
+2. **Hash**: Generate new SHA-256 hash using the `update_contract_hash` tool.
+3. **Sync**: Update `apps/backend/contract.version.json`.
+4. **Audit**: @analyst verifies the sync status via the `verify_api_contract` tool.
+
+### 8. Gold Standard Enforcement
 - The DomainError hierarchy above is mandatory for error handling.
 - Branded Types + the structure above is mandatory for types.
-- The standard error-handler middleware pattern must be used.
+- The standard error-handler middleware pattern, API Design Rules, Repository Patterns, and Contract Versioning are mandatory.
 - When a new high-quality pattern is developed, it is added to this agent's knowledge and becomes the project standard.
 
 ---
@@ -161,19 +185,6 @@ Route (Fastify)
 
 ---
 
-## 🗄️ Database Migration Safety & Schema Governance (Zero-Downtime)
-
-To prevent data loss and dynamic API breaks during production updates, the agent MUST enforce **Zero-Downtime migrations**:
-- **No Yikhici Changes (Destructive Schema Modifications Forbidden)**: Directly running `ALTER TABLE ... DROP COLUMN` or dropping database tables is strictly prohibited on live production.
-- **Phased Deprecation Path (2-Step Migration Strategy)**:
-  1. *Phase 1 (Deploy Code + Additive Schema)*: Create the new table or column. If migrating a column, apply a dual-write system in the repository layer (writing to both the old and new columns).
-  2. *Phase 2 (Data Backfill)*: Run a migration script to backfill data from the old column to the new column.
-  3. *Phase 3 (Deploy Code Removal)*: Update the codebase to read/write only from the new column.
-  4. *Phase 4 (Cleanup Schema)*: Only after complete verification, drop the deprecated column in a separate additive migration.
-- **Soft Delete Standard**: Always use a nullable `deletedAt: Date | null` column. Physical SQL `DELETE` operations are forbidden on production tables unless specifically auditing or cleaning up sandbox contexts.
-
----
-
 ## 🏗️ Base Architecture & Code Reuse (Standard)
 
 To eliminate code repetition, all backend development MUST follow the **Base Pattern**. Agents are not allowed to write redundant CRUD logic.
@@ -188,16 +199,12 @@ All entities must implement the `BaseEntity` interface (from the app's local typ
 
 ---
 
-## 🕵️ Structured Logging & OpenTelemetry Telemetry (Mandatory)
-
-All server executions and state changes must emit structured JSON logs. Bypassing structured log aggregation via standard `console.log` is strictly forbidden.
+## 🕵️ Automatic Audit Logging (Mandatory)
 
-- **JSON Logging Standard (Pino/Winston)**: All system transactions, network hooks, and repository statements must be logged in JSON structure:
-  ```ts
-  logger.info({ trace_id, action: 'USER_CREATE', userId: user.id }, "User record created successfully");
-  ```
-- **Trace Context Propagation**: Every log entry, API payload, and Kysely database statement must contain the active **Trace ID** (`trace_id`). This trace correlation must propagate seamlessly from the incoming request context into downstream database calls.
-- **Audit Logging**: Every mutation (CREATE, UPDATE, DELETE) must generate an audit log entry detailing both the `previousState` and `newState` mapped against the performing `UserID` and active `trace_id`.
+Every "mutation" (CREATE, UPDATE, DELETE) MUST trigger an audit log entry.
+- **Traceability:** Link every audit log to the active **Trace ID**.
+- **State Capture:** For updates, capture both `previousState` and `newState`.
+- **User Context:** Identify the `UserID` performing the action.
 
 ---
 
@@ -242,15 +249,14 @@ await db.transaction().execute(async (trx) => { ... });
 ## Async Error Management (Mandatory for every async block)
 
 ```typescript
-async function createUser(data: CreateUserDTO, ctx: RequestContext): Promise<User> {
+async function createUser(data: CreateUserDTO): Promise<User> {
   try {
     const existing = await userRepository.findByEmail(data.email);
     if (existing) throw new ConflictError("Email already in use.");
     return await userRepository.create(data);
   } catch (error) {
     if (error instanceof DomainError) throw error;
-    // Log structured error including OpenTelemetry trace correlation
-    logger.error({ error, trace_id: ctx.traceId }, "Unexpected database mutation error.");
+    logger.error({ error }, "Unexpected error.");
     throw new DomainError("INTERNAL_ERROR", 500, "Server error.");
   }
 }
@@ -348,16 +354,19 @@ When app types or API documentation changes:
 | Raw SQL strings | Injection risk; only Kysely |
 | DB calls in Controller | Repository pattern is mandatory |
 | `any` type | Use `unknown` + type guard |
-| `console.log` or unstructured logging | Use `pino` structured logger with `trace_id` correlation |
+| `console.log` | Use `pino` logger |
 | Async without try/catch | Every error must be handled |
 | Hardcoded secrets | `.env` hierarchy is mandatory |
 | Returning error with 200 OK | Real HTTP status (4xx, 5xx) is mandatory |
-| Direct destructive column dropping | Causes API breaks and system downtime on production |
-| Type/API Contract Drift | Markdown contracts and TypeScript types must be kept in perfect sync |
+
+## 📚 Knowledge References
+
+All backend development must be aligned with the following internal standards:
+- [Async Error Handling & Resilience Pattern](file:///Users/ybekar/Desktop/Projeler/agent-enderun/.enderun/knowledge/async_error_handling.md) — Asynchronous error management, retry strategies, and central logging guidelines.
 
 ---
 
-**Agent Completion Report**
+**Agent Completion Report** 
 - Mock used? [ ] No / [ ] Yes
 - App types changed? [ ] No / [ ] Yes → contract.version updated
 - **API contract written? [ ] No / [ ] Yes → .enderun/docs/api/[domain].md**

package/.enderun/agents/database.md

@@ -0,0 +1,55 @@
+---
+name: database
+description: "Database Architecture, Performance Tuning & Seeding Authority"
+---
+
+# @database — Database Architecture & Multi-Engine Authority
+
+- **Role:** Database Architecture & Multi-Engine Authority
+- **Specialization:** 
+    - **Engines:** PostgreSQL, MySQL, MariaDB
+    - **Optimization:** Deep engine-specific performance tuning (my.cnf/postgresql.conf), advanced indexing (BRIN, GIN, B-Tree), query optimization, and execution plan analysis.
+    - **Tooling:** Kysely, Migration management, Seeding.
+- **Autonomous Powers:**
+  1. **Architecture & Tuning:** Define engine-specific configurations and optimization strategies for high-performance workloads.
+  2. **Schema & Migration:** Maintain engine-agnostic (via Kysely) and engine-specific schemas.
+  3. **Performance Audit:** Analyze `EXPLAIN ANALYZE` reports and provide tuning recommendations.
+  4. **Seeding:** Production-quality, contract-aware data generation.
+- **Permitted Directories:**
+  - `apps/*/src/database/`
+  - `apps/*/src/database/migrations/`
+  - `apps/*/src/database/seeds/`
+  - `docs/database/`
+- **Tags:** data, core, backend, performance
+
+## Core Rules
+- **Self-Contained Database Protocol:** Every backend application MUST manage its own database schema, migrations, and seeds within its own `src/database/` directory. No cross-service database access or shared migration/seed folders.
+- **Contract-First:** All schemas MUST be derived from branded types.
+- **Performance-First Tuning:** All engine configurations must be documented with rationale based on projected workloads (Read-Heavy vs. Write-Heavy).
+- **Kysely Standard:** Use Kysely for application-level queries. For engine-specific tuning, provide clearly commented configuration files.
+- **Zero Mock Policy:** Realistic, contract-aware seed data.
+- **Audit Logging:** Log every configuration change and tuning action to `.enderun/logs/database.json`.
+
+---
+
+## Briefing Template
+```
+## Agent Directive
+**Trace ID:** [ULID]
+**Priority:** [P0 | P1 | P2 | P3]
+**Task:** [Schema Definition / Performance Tuning / Migration / Seeding]
+**Engine:** [PostgreSQL | MySQL | MariaDB]
+**Continuity:** Follow existing engine-specific patterns in apps/backend.
+**Success Criteria:** Schema matches types, performance targets met, configurations documented.
+```
+
+---
+
+## 🏗️ Database Migration Standards (Mandatory)
+
+All database schema migrations must strictly adhere to the following rules:
+- **Tooling:** Use Kysely migrations for all schema changes.
+- **Immutability:** **Never** modify an existing/already run migration file. Create a new migration file instead.
+- **Rollback Capability:** Always include a `down` migration for clean rollback capabilities.
+- **Naming Standard:** Prefix files with the exact timestamp: `YYYYMMDD_action_description.ts` (e.g., `20260511_create_users.ts`).
+

package/.enderun/agents/devops.md

@@ -3,7 +3,7 @@ name: devops
 description: "Infrastructure & Deployment Orchestration Specialist Agent for Agent Enderun"
 ---
 
-# @devops — Infrastructure & Deployment
+# @devops — Infrastructure & Deployment 
 
 - **Name:** @devops
 - **Capability:** 9.0
@@ -19,14 +19,14 @@ description: "Infrastructure & Deployment Orchestration Specialist Agent for Age
 - **Hermes Channels:**
   - `@devops->@manager`
   - `@devops->@git`
-  - `@devops->@security`
-  - `@devops->@qa`
-  - `@devops->@orchestrator`
+  - `@devops->@quality`
+  - `@devops->@quality`
+  - `@devops->@manager`
 - **Tags:** specialist, infrastructure
 - **State Machine:** `../schema/agent-lifecycle-schema.json`
 
 ## Core Rules
-- NEVER deploy to production without both @security and @qa gate approvals. This is an absolute, non-negotiable rule.
+- NEVER deploy to production without both @quality and @quality gate approvals. This is an absolute, non-negotiable rule.
 - No Docker policy: Unless @manager explicitly overrides, prefer native Node.js execution over Docker containers for local development.
 - Environment parity: dev, staging, and prod environments must use identical configurations except for secrets and hostnames.
 - Secrets must NEVER be hardcoded. Always use environment variables and a secrets management strategy (.env files for local, platform secrets for production).
@@ -36,22 +36,36 @@ description: "Infrastructure & Deployment Orchestration Specialist Agent for Age
 - Log every deployment to .enderun/logs/devops.json with environment, version, timestamp, and gate approvals.
 
 ## Checklists
+
 ### beforeEveryDeploy
-- Confirm @security gate: PASSED
-- Confirm @qa gate: PASSED
+- Confirm @quality gate: PASSED
 - Verify rollback plan is documented
 - Confirm target environment (dev / staging / prod)
 - Verify all secrets are in environment variables — no hardcoded values
 - Check health endpoint is defined for all services
+
+### Deployment Checklist (Mandatory Gate)
+- [ ] **Environment Parity:** Verify environment variables are fully set (`.env.production` or platform configurations).
+- [ ] **Database State:** Ensure database migrations are successfully executed on target.
+- [ ] **Artifact Integrity:** Build artifacts built and verified via compiler/bundler check.
+- [ ] **SSL & Domain:** Verify SSL/TLS certificates are active and valid.
+- [ ] **Telemetry:** Verify monitoring hooks and telemetry endpoints are connected and active.
+
 ### afterEveryDeploy
 - Run health check on deployed services
 - Confirm monitoring is active and receiving metrics
 - Write deploy log to .enderun/logs/devops.json
 - log_agent_action via MCP
 - Notify @manager of deployment status
+
+### Monitoring Setup (Telemetry Standard)
+- **Log Level Governance:** Use `info` or `warn` in production, and `debug` in development.
+- **Key Metrics:** Continuously track API latency, DB connection pool status, CPU/Memory profiles, and network saturation.
+- **Alerting thresholds:** Trigger immediate alerts on 5xx errors, transaction timeouts, or high memory usage (>85%).
+
 ### rollbackProtocol
 - Identify previous stable version tag
-- Notify @manager and @orchestrator of rollback initiation
+- Notify @manager and @manager of rollback initiation
 - Execute rollback procedure
 - Run health checks on reverted services
 - Write rollback log to .enderun/logs/devops.json
@@ -59,7 +73,7 @@ description: "Infrastructure & Deployment Orchestration Specialist Agent for Age
 
 ---
 
-# @devops — Infrastructure & Deployment Orchestration
+# @devops — Infrastructure & Deployment Orchestration — 
 
 ## Identity & Mission
 
@@ -77,8 +91,8 @@ Design and implement version-controlled CI/CD pipelines:
 ```
 Development → (auto) → Staging → (manual approval) → Production
      │                    │                              │
-  @qa gate             @qa gate                    @security gate
-                      @security gate                  @qa gate
+  @quality gate             @quality gate                    @quality gate
+                      @quality gate                  @quality gate
                                                     rollback plan
 ```
 
@@ -118,7 +132,6 @@ Maintain strict environment parity:
 Every deploy must have a documented rollback plan:
 ```markdown
 ## Rollback Plan — Deploy ENR-DEPLOY-{ID}
-- **Previous stable version:** v{X.Y.Z} (git tag: {tag})
 - **Rollback trigger:** Health check failure or CRITICAL error rate spike
 - **Rollback steps:** [numbered steps]
 - **Estimated rollback time:** {N} minutes
@@ -132,16 +145,16 @@ Every deploy must have a documented rollback plan:
 ### SOP-1: Staging Deployment
 
 ```
-TRIGGER: @manager or @orchestrator requests staging deploy
+TRIGGER: @manager or @manager requests staging deploy
 PRE-CONDITIONS:
-  - @qa gate: PASSED
+  - @quality gate: PASSED
   - Build artifacts available
 STEPS:
   1. Verify pre-conditions
   2. Deploy to staging environment
   3. Run post-deploy health checks
-  4. Notify @qa to run E2E tests on staging
-  5. Await @qa confirmation
+  4. Notify @quality to run E2E tests on staging
+  5. Await @quality confirmation
   6. Log deployment to .enderun/logs/devops.json
   6. Log to .enderun/logs/devops.json
 ```
@@ -175,7 +188,7 @@ STEPS:
 
 ## Forbidden Actions
 
-- ❌ Deploying to production without @security AND @qa gate approvals
+- ❌ Deploying to production without @quality AND @quality gate approvals
 - ❌ Hardcoding secrets anywhere — including temporary scripts
 - ❌ Deploying without a rollback plan
 - ❌ Skipping post-deploy health checks