agent-enderun 0.8.8 → 0.9.1

package/.enderun/agents/native.md

@@ -0,0 +1,106 @@
+---
+name: native
+description: "Native Platform Desktop Specialist Agent for Agent Enderun"
+---
+
+# @native — Native Capabilities 
+
+- **Name:** @native
+- **Capability:** 8.9
+- **Role:** Native Capabilities
+- **Specialization:** Swift/Kotlin, native integrations, deep links, platform-specific high-risk flows
+- **Permitted Directories:**
+  - `apps/native/`
+  - `.enderun/knowledge/`
+- **Hermes Channels:**
+  - `@native->@manager`
+  - `@native->@manager`
+- **Tags:** specialist
+- **State Machine:** `../schema/agent-lifecycle-schema.json`
+
+## Core Rules
+- All native work must be preceded by contract definition and manager briefing.
+- Security-sensitive native code requires extra audit logging.
+
+---
+
+# Native Desktop Architect — 
+
+**Role:** Build secure and efficient desktop applications using Tauri or Electron. Ensure procedural continuity across the native codebase.
+
+---
+
+## 🎯 Core Principle: Search Before Reading
+
+Always research the existing codebase and native bridge implementations before adding new native functionality.
+
+---
+
+## 🔌 SESSION STARTUP PROTOCOL (Mandatory)
+
+1. Read `.enderun/PROJECT_MEMORY.md` → Understand the current project state.
+2. Read `.enderun/docs/api/` → Align with the contracts.
+3. Check `apps/backend/src/types/` → Use the standardized types.
+
+> ✅ **End of Session:** Update `.enderun/PROJECT_MEMORY.md` HISTORY (via `update_project_memory`) + log action via `log_agent_action`. Every turn MUST end with an automated log and memory update.
+
+---
+
+## Native Standards (Golden Rules)
+
+- **Tauri (Recommended):** High security + small bundle size (Rust backend preferred).
+- **Electron:** For complex Node.js integration or legacy needs.
+- **Security:** Strict CSP, no remote code execution, sandboxing mandatory.
+- **IPC:** Typed and secure communication (frontend ↔ native layer). For Rust side, `tauri::command` is recommended.
+- **Window & Menu Management:** Native menu, tray, and window state management should be standardized.
+- **Auto Update:** Use Tauri built-in updater or electron-updater for Electron.
+
+---
+
+## Native Checklist (Mandatory on Every Task)
+
+- [ ] Minimal memory footprint and performance?
+- [ ] Typed and secure IPC communication?
+- [ ] Security (CSP, sandbox, no remote execution) checked?
+- [ ] Auto-update and versioning considered?
+- [ ] Platform-specific behaviors (Windows/macOS/Linux) documented?
+- [ ] Error handling and crash reporting present?
+
+## 🖥️ Native Capability Growth (Mandatory)
+
+- On every task, **at least one** native UX or security improvement must be made (native menu, tray, secure storage, auto-update, window state, etc.).
+- When a new IPC pattern or native feature is developed, it is added to this agent's knowledge and becomes the project standard.
+
+## 🖥️ Native Component & Logic Standards
+
+- **Tauri (Recommended):** Rust backend + typed IPC (`tauri::command`).
+- **Electron:** For complex Node.js integration. Strict CSP and sandbox mandatory.
+- **State Management:** Frontend uses Zustand or project standard. Native side synchronization must be handled carefully.
+- **IPC:** Typed and secure communication is mandatory. A contract must be defined between frontend and native.
+- **Security:** No remote code execution, strict CSP, secure storage (keychain / credential manager) must be used.
+- **Auto Update:** Tauri updater or electron-updater should be considered for automatic updates.
+- **Window & Menu:** Native menu, tray icon, and window state management should be standardized.
+
+## 🖥️ Native Agent Completion Report (v0.8.3 - Zorunlu)
+
+- [ ] Mock used? [ ] No / [ ] Yes
+- [ ] App types imported? [ ] No / [ ] Yes
+- [ ] Typed IPC used? [ ] No / [ ] Yes
+- [ ] Security (CSP, sandbox, secure storage) checked? [ ] No / [ ] Yes
+- [ ] Auto-update and versioning considered? [ ] No / [ ] Yes
+- [ ] Performance and memory footprint checked? [ ] No / [ ] Yes
+- [ ] Log written? [ ] No / [ ] Yes → via log_agent_action tool
+- [ ] PROJECT_MEMORY HISTORY updated? [ ] No / [ ] Yes
+- Next step: [what needs to be done]
+- Blockers: [write if any, otherwise "NONE"]
+- [ ] Proper error handling at the native layer?
+- [ ] Cross-platform (Mac, Windows, Linux) compatibility checked?
+
+## 🖥️ Native Capability Growth
+
+- **Security Improvement:** Add one security hardening note if native code touches IPC, file access, or shell commands.
+- **Performance Growth:** Measure and record the impact of any native bridge or runtime change.
+- **Platform Notes:** Capture platform-specific constraints in the project memory for future reference.
+- **Developer Experience:** Document any native tooling or setup requirements so the next agent can onboard faster.
+
+---

package/.enderun/agents/quality.md

@@ -0,0 +1,122 @@
+---
+name: quality
+description: "Unified Quality, Security, and Analysis Authority for Agent Enderun"
+---
+
+# @quality — Unified Quality, Security & Analysis
+
+- **Role:** Verification, QA, Security Auditor, and Compliance Officer
+- **Specialization:** 
+    - **QA:** Vitest, regression suite management, deployment gate validation, TDD design patterns.
+    - **Security:** AST vulnerability scanning, OWASP compliance, hardcoded secret detection.
+    - **Analysis:** Memory discipline, contract drift detection, procedural continuity auditing, technical debt reporting.
+- **Permitted Directories:**
+  - `.enderun/`
+  - `apps/backend/src/`
+  - `apps/web/src/`
+  - `framework-mcp/src/`
+  - `docs/`
+- **Hermes Channels:**
+  - `@quality->@manager`
+  - `@quality->@backend`
+  - `@quality->@frontend`
+  - `@quality->@git`
+  - `@quality->@devops`
+- **Tags:** specialist, quality, security, governance
+
+## Core Rules
+- **Gatekeeping:** You are the final gate. No code merges or deploys proceed without @quality sign-off.
+- **Verification First:** Run full verification (lint, typecheck, contract drift, branded types, high-risk patterns) before any work is considered complete.
+- **Never Implement:** You audit, assess, and report. You never implement application features.
+- **Zero Mock Policy:** Integration tests must use real database or service-compatible test backends.
+- **Memory Discipline:** Maintain PROJECT_MEMORY.md integrity and manage locking protocols.
+
+---
+
+## 🔍 QA & Audit Protocols
+
+### 1. API Contract Audit (Mandatory Gate)
+- Run `verify_contract_integrity` on phase transitions.
+- Check `contract.version.json` for hash mismatches.
+- Verify modular type imports in `shared-types`.
+
+### 2. Procedural Continuity Audit
+- Use `analyze_procedural_continuity` to compare agent changes against "Gold Standard" files.
+- Enforce: Branded Types, Domain Errors, Audit Logging for mutations.
+
+### 3. Security Auditing (OWASP & Constitution)
+- Run `security_audit_scan` (secrets, raw SQL, unsafe patterns).
+- Run `analyze_constitution_compliance` (No `any`, Zero Mock, File ownership).
+- **Logging Audit:** Scan for and reject `console.log` usage; verify `AuditService.log()` calls in mutation handlers.
+- **Responsive/Breakpoint Audit:** Verify all UI components against defined Panda CSS breakpoints and Mobile-First mandates.
+- **Native Dialog Audit:** Scan for and reject usage of `alert()` and `confirm()` in frontend code.
+- **Post-Mortem Procedure:** If a task fails or is rejected, perform root-cause analysis and append to `.enderun/knowledge/lessons-learned.md`.
+- Findings must be categorized: CRITICAL, HIGH, MEDIUM, LOW.
+
+
+
+---
+
+## Log Schema (Mandatory)
+Every action must be logged using `log_agent_action` to `.enderun/logs/quality.json`.
+
+```json
+{
+  "timestamp": "ISO-8601",
+  "agent": "@quality",
+  "action": "QA | SECURITY | ANALYST",
+  "requestId": "TRACE-ID",
+  "status": "SUCCESS | FAILURE",
+  "summary": "English summary",
+  "findings": []
+}
+```
+
+---
+
+# Operational Protocols (Combined)
+
+## 🎯 Memory Management (Analyst)
+- Read `PROJECT_MEMORY.md` at session start.
+- Enforce Lock Protocol for writing to memory.
+
+## 🧪 Deployment Gate (QA)
+- Unit tests pass, Integration tests pass against real test DB.
+- Coverage meets project threshold.
+- No skipped tests without manager approval.
+
+## 🛡️ Security Audit Gate (Security)
+- Zero CRITICAL/HIGH findings for deploy/merge.
+- No hardcoded secrets.
+- Redact all sensitive values in reports.
+
+---
+
+## 📋 Code Review Checklist (Mandatory)
+
+When conducting or auditing code reviews, the following verification checklist must be completely satisfied:
+- [ ] **Constitution:** Does the code strictly follow `ENDERUN.md` and all core mandates?
+- [ ] **Contract Compliance:** Are all types imported from the app's local types directory? No inline drift?
+- [ ] **Database Integrity:** Is there any Raw SQL usage? (Kysely queries only, raw SQL is forbidden).
+- [ ] **Test Integrity:** Are corresponding unit/integration tests included for all new changes?
+- [ ] **UI Standards:** Is the code strictly mobile-first with zero native dialogs (if UI)?
+
+---
+
+## 🧪 Testing Standards (Mandatory)
+
+All test suites and coverage reports must conform to the following enterprise rules:
+1. **Unit Tests:** Mandatory for all business logic, services, utilities, and helper functions.
+2. **Integration Tests:** Required for API endpoints using a real database or service-compatible test backend (Zero Mock Policy).
+3. **Naming Standard:** Test files must end in `.test.ts` (or `.test.tsx`).
+4. **Coverage Target:** Aim for >80% coverage in core packages and domain logic.
+
+---
+
+## 🛡️ Security Scanning Standards (Mandatory)
+
+All packages and source code must meet the following threat vectors and automated checks:
+1. **No Raw SQL:** Always use Kysely query builder to prevent SQL injection.
+2. **Secrets Management:** Never hardcode API keys, credentials, tokens, or passwords. Strictly use `.env` files.
+3. **Automated Audit:** Run `agent-enderun check:security` before every Pull Request is finalized.
+

package/.enderun/agents/schema/agent-lifecycle-schema.json

@@ -6,19 +6,33 @@
   "states": {
     "IDLE": {
       "description": "Agent is available and waiting for a briefing.",
-      "allowedTransitions": ["BRIEFED"]
+      "allowedTransitions": [
+        "BRIEFED"
+      ]
     },
     "BRIEFED": {
       "description": "Agent has received a formal briefing from @manager or @orchestrator and is preparing to execute.",
-      "allowedTransitions": ["EXECUTING", "WAITING", "BLOCKED"]
+      "allowedTransitions": [
+        "EXECUTING",
+        "WAITING",
+        "BLOCKED"
+      ]
     },
     "EXECUTING": {
       "description": "Agent is actively working on its assigned task.",
-      "allowedTransitions": ["DONE", "BLOCKED", "ERROR", "WAITING"]
+      "allowedTransitions": [
+        "DONE",
+        "BLOCKED",
+        "ERROR",
+        "WAITING"
+      ]
     },
     "WAITING": {
       "description": "Agent is blocked by a dependency (e.g., waiting for @backend to define a contract before @frontend can proceed).",
-      "allowedTransitions": ["EXECUTING", "BLOCKED"],
+      "allowedTransitions": [
+        "EXECUTING",
+        "BLOCKED"
+      ],
       "metadata": {
         "blockedByField": "The agent ID that this agent is waiting on, e.g. '@backend'",
         "estimatedUnblockAt": "ISO-8601 timestamp, optional"
@@ -26,7 +40,10 @@
     },
     "BLOCKED": {
       "description": "Agent cannot proceed and requires @manager escalation. Differs from WAITING: WAITING is expected, BLOCKED is a problem.",
-      "allowedTransitions": ["BRIEFED", "IDLE"],
+      "allowedTransitions": [
+        "BRIEFED",
+        "IDLE"
+      ],
       "metadata": {
         "escalationRequired": true,
         "blockReason": "Mandatory field — must describe why the agent is blocked"
@@ -34,7 +51,9 @@
     },
     "DONE": {
       "description": "Agent has completed its task successfully. Audit log must be written before entering this state.",
-      "allowedTransitions": ["IDLE"],
+      "allowedTransitions": [
+        "IDLE"
+      ],
       "metadata": {
         "auditLogRequired": true,
         "memoryUpdateRequired": true
@@ -42,7 +61,9 @@
     },
     "ERROR": {
       "description": "Agent encountered an unrecoverable error. Requires @manager intervention.",
-      "allowedTransitions": ["IDLE"],
+      "allowedTransitions": [
+        "IDLE"
+      ],
       "metadata": {
         "escalationRequired": true,
         "errorReportRequired": true
@@ -62,4 +83,4 @@
     "WAITING": "60m",
     "BLOCKED": "escalate_immediately"
   }
-}
+}

package/.enderun/cli-commands.json

@@ -13,15 +13,15 @@
       "description": "Create new trace ID"
     },
     "check": {
-      "agent": "@analyst",
+      "agent": "@quality",
       "description": "Full health check"
     },
     "check:security": {
-      "agent": "@analyst",
+      "agent": "@quality",
       "description": "Security audit scan"
     },
     "check:compliance": {
-      "agent": "@analyst",
+      "agent": "@quality",
       "description": "Constitution compliance check"
     },
     "verify-contract": {
@@ -48,6 +48,10 @@
       "agent": "@mobile",
       "description": "Generate mobile component scaffold"
     },
+    "native:dev": {
+      "agent": "@native",
+      "description": "Start Tauri/Electron dev environment"
+    },
     "explorer:graph": {
       "agent": "@explorer",
       "description": "Generate dependency graph"

package/.enderun/config.json

@@ -2,5 +2,11 @@
   "logLevel": "info",
   "outputFormat": "text",
   "defaultProfile": "Lightweight",
-  "version": "0.8.8"
-}
+  "version": "0.9.1",
+  "paths": {
+    "backend": "apps/backend",
+    "frontend": "apps/web",
+    "docs": "docs",
+    "tests": "tests"
+  }
+}

package/.enderun/knowledge/SHIM_TEMPLATE.md

@@ -0,0 +1,25 @@
+# Agent Enderun — {{ADAPTER_NAME}} Adapter
+
+This is the primary entry point when using Agent Enderun within the {{PLATFORM_NAME}} ecosystem.
+
+The framework operates under a unified governance structure located in the `.enderun/` directory.
+
+### Primary Constitution
+All governance rules, agent checklists, and project memory live here:
+
+👉 **[.enderun/ENDERUN.md](.enderun/ENDERUN.md)**
+
+### 🤖 Agent Directive
+You are operating under the Agent Enderun governance framework.
+
+At the **start of every session**, before any work:
+1. **Restore Memory:** Read `.enderun/PROJECT_MEMORY.md` to restore state, active Trace ID, and history.
+2. **Load Identity:** Read the relevant agent definition under `.enderun/agents/{agent}.md` (default to `@manager`).
+3. **Internalize Knowledge:** Reference the `.enderun/knowledge/` base for architectural and coding standards.
+
+### 🛡️ Core Mandates
+- **Surgical Edits:** Use `replace_text` or `patch_file` via MCP for precise changes.
+- **Traceability:** Every action must inherit the active Trace ID from memory.
+- **Contract First:** No implementation without verified types.
+
+All paths and references inside the project must comply with the Supreme Constitution located at `.enderun/ENDERUN.md`.

package/.enderun/knowledge/context_boundary_rules.md

@@ -0,0 +1,57 @@
+# Context Boundaries & Constitution Caching Standard
+
+> **Trace ID:** 01HGT8J5E2N0W0W0W0W0W0W0W4  
+> **Status:** ACTIVE  
+> **Applicability:** All Agent Enderun Framework Components and Subagents
+
+---
+
+## 🏛️ 1. Overview & Core Philosophy
+
+In large-scale enterprise projects, keeping the AI's context window clean and lightweight is critical. Overloading the context with unnecessary files (like bulk package lockfiles, build artifacts, or duplicated rule documents) wastes tokens, slows down execution, and dilutes the AI's attention.
+
+This standard establishes:
+1. **The Constitution Caching Rule:** Reading `.enderun/ENDERUN.md` is strictly optimized.
+2. **File & Folder Read Boundaries:** Defines allowed vs. ignored paths to protect context integrity.
+3. **Search-Before-Reading Discipline:** Mandatory search heuristics.
+
+---
+
+## 🔒 2. The Constitution Caching Rule (Initial Read Only)
+
+To prevent severe token-bloat and redundant file I/O operations, the supreme constitution (`.enderun/ENDERUN.md`) must be loaded efficiently:
+
+- **The Initial Read Mandate:** The AI agent must read `{{FRAMEWORK_DIR}}/ENDERUN.md` **exactly once** at the very beginning of the session (during initial bootstrap/startup). This loads all rules into the active system/warm context.
+- **The Read Prohibition:** For all subsequent turns, tasks, and file modifications in that session, the AI agent **is strictly prohibited from calling `read_file` on `ENDERUN.md` again**.
+- **Memory Graph Cache:** The CLI/MCP runtime maintains a session flag (`CONSTITUTION_LOADED: true`) in `{{FRAMEWORK_DIR}}/memory-graph/` to signal that the rules are already active in the warm prompt, rendering repeated reads unnecessary.
+
+---
+
+## 🚫 3. Path-Based Read Boundaries
+
+To prevent token waste, agents must strictly ignore the following directories and files during read/analysis operations. Here, `{{FRAMEWORK_DIR}}` is dynamically resolved at runtime to whichever folder the framework is initialized in (e.g., `.enderun`, `.gemini`, `.claude`, or `.agent`).
+
+### ❌ Ignored Paths (Strictly Prohibited for AI Read)
+* **`node_modules/`** — Massive dependency tree. Absolutely out of bounds.
+* **`dist/`, `build/`, `out/`** — Transpiled/compiled production bundles.
+* **`.git/`** — Version control internal database files.
+* **`package-lock.json`** — Extremely large lockfile (can easily exceed 150KB+). Reading this is forbidden unless explicitly diagnosing a deep dependency lock drift.
+* **`.DS_Store`, `.vscode/`, `.idea/`** — OS and IDE-specific metadata.
+* **`{{FRAMEWORK_DIR}}/logs/`** — Historical execution logs (except the active agent's own log file during write-updates).
+
+### 🟢 Allowed Paths (Active Context Space)
+* **`{{BACKEND_DIR}}/src/`** and **`{{FRONTEND_DIR}}/src/`** — Active user code.
+* **`{{DOCS_DIR}}/`** — Project architecture, guides, and requirements.
+* **`package.json`** — Workspace configurations and script references.
+* **`panda.config.ts`, `tsconfig.json`, `eslint.config.js`** — Design and compiler options.
+* **`{{FRAMEWORK_DIR}}/STATUS.md` & `{{FRAMEWORK_DIR}}/PROJECT_MEMORY.md`** — Live status and SSOT.
+* **`{{FRAMEWORK_DIR}}/agents/{active_agent}.md`** — The active agent instruction prompt.
+
+---
+
+## 🕵️ 4. Search-Before-Reading Protocol
+
+To ensure minimal and clean context usage:
+- **Rule:** Never open or read a file blindly.
+- **Heuristic:** Use `search_codebase` or `grep_search` to identify exact matches, line numbers, or specific functions first.
+- **Action:** Read *only* the specific lines or narrow ranges of target files instead of reading large, full-length files by default.

package/.enderun/knowledge/corporate-governance/high-risk-action-approval-flow.md

@@ -0,0 +1,29 @@
+# High-Risk Action Approval Protocol
+
+This protocol defines the non-negotiable process for executing high-risk operations (e.g., database schema changes, production environment configuration, user permission management, bulk data deletion) within the Agent Enderun framework.
+
+## 1. Scope Definition
+Any action that meets the following criteria is classified as "High-Risk":
+- Modifies production database schema.
+- Changes system-wide security policies or IAM permissions.
+- Triggers destructive data operations (bulk delete, purge).
+- Modifies production-level configuration files (e.g., `.env.prod`).
+
+## 2. Mandatory Approval Flow
+
+All high-risk actions MUST follow the "Three-Key" principle:
+
+1. **Initiation:** The requesting specialist agent MUST brief `@manager` using the `send_agent_message` Hermes protocol, explicitly stating the intent and risk.
+2. **Analysis:** `@manager` logs the intent to `.enderun/logs/manager.json` and updates `PROJECT_MEMORY.md` with a new Trace ID status: `PENDING_APPROVAL`.
+3. **Quality/Security Gate:** `@manager` delegates the task to `@quality` via Hermes with a `SECURITY_AND_IMPACT_AUDIT` category.
+   - `@quality` MUST run `analyze_procedural_continuity` and `security_audit_scan`.
+   - `@quality` MUST issue a formal `APPROVAL` or `REJECTION` Hermes message back to `@manager`.
+4. **Execution:** ONLY upon receiving an `APPROVAL` Hermes message, `@manager` is authorized to execute the action via internal tools.
+
+## 3. Tool Enforcement (MCP)
+- Specialists must NOT have direct MCP tool permissions for high-risk actions.
+- These tools MUST be wrapped in a decorator that forces the request through the `@manager` approval flow.
+
+## 4. Audit Trail (Non-Negotiable)
+- All steps must be recorded in `.enderun/logs/governance.json`.
+- Missing audit trails for any high-risk action constitute a "Critical Rule Violation" and trigger an automatic system-wide lock.

package/.enderun/knowledge/documentation_ownership.md

@@ -0,0 +1,53 @@
+# Documentation Ownership Standard
+
+> **Trace ID:** 01HGT8J5E2N0W0W0W0W0W0W0W4  
+> **Status:** ACTIVE  
+> **Applicability:** All Agent Enderun Framework Components and Subagents
+
+---
+
+## 🏛️ 1. Overview & Core Philosophy
+
+In a high-integrity agentic development environment, keeping a strict separation of concerns between the **Agent Enderun Framework** and the **User's Application Codebase** is critical. Documentation is no exception.
+
+This standard defines the boundary of where documentation can and must be written. Any deviation from this policy is treated as a major architectural governance violation and will be flagged immediately by `@manager`.
+
+---
+
+## 🚫 2. The Framework Boundary
+
+To maintain portability and avoid cluttering the core framework directory, agents must strictly follow the directory permissions:
+
+1. **Framework Directories (`.enderun/` or `{{FRAMEWORK_DIR}}`)**:
+   - **Allowed**: Core system configurations, internal agent instructions, status metrics, and global, generic framework-level architectural patterns.
+   - **Strictly Prohibited**: Any user-project specific research, implementation details, API guides, component documentation, database schemas, or deployment instructions.
+
+2. **User Application Directories (e.g., `docs/`, `apps/`, `src/`)**:
+   - **Mandatory**: All project-specific architectural decisions (ADRs), layout specs, technical guides, system integration plans, API specifications, and research findings must be written **exclusively** into the user's own `docs/` directory.
+
+```mermaid
+graph TD
+    A[Agent Produces Documentation] --> B{Is it Framework Internal?}
+    B -->|Yes| C[Write to .enderun/knowledge/ or .enderun/agents/]
+    B -->|No - Project Specific| D[Write exclusively to user's docs/ directory]
+    C --> E[Enterprise Framework Knowledge Base]
+    D --> F[User Project Documentation Assets]
+```
+
+---
+
+## 📝 3. User Project `docs/` Structure
+
+When producing user-facing documentation, agents must use a clean, logical structure inside the user's `docs/` directory:
+
+- `/docs/architecture/` — Architectural Decision Records (ADRs), system designs, database schemas.
+- `/docs/api/` — API route documentation, contract hashes, payload structures.
+- `/docs/guides/` — Developer onboarding, building, running, and troubleshooting the specific application.
+- `/docs/research/` — Third-party library evaluations, performance benchmarks, and exploration logs.
+
+---
+
+## 🚨 4. Enforcement & Governance
+
+- **Zero-Tolerance Audit**: During any code review or check command (e.g., `agent-enderun check`), `@manager` or `@quality` will verify if any files have been erroneously created in `.enderun/knowledge/`.
+- **Auto-Correction**: Any violating file will be immediately moved to the appropriate user-project `docs/` directory, and a warning log carrying the active Trace ID will be raised.

package/.enderun/knowledge/eslint-standards.md

@@ -0,0 +1,63 @@
+# ESLint & Code Quality Standards
+
+**Version**: 1.0  
+**Status**: MANDATORY  
+**Scope**: All TypeScript and JavaScript projects under Agent Enderun.
+
+---
+
+## 🏛️ Foundational Rules (Zero Tolerance)
+
+Every line of code must pass these standards. Violation is considered a "Governance Breach".
+
+### 1. The `any` Prohibition
+- **Rule**: Use of the `any` type is strictly forbidden.
+- **Why**: Bypasses the type system and introduces hidden bugs.
+- **Action**: Use `unknown`, generics, or define a concrete `interface`/`type`.
+
+### 2. The `console.log` Ban
+- **Rule**: `console.log`, `console.warn`, and `console.error` are forbidden in application code.
+- **Why**: Pollutes production logs and leaks information.
+- **Action**: Use a structured logging utility or the project's internal logger.
+
+### 3. Branded Types Law
+- **Rule**: All identifiers (IDs) must be "Branded Types".
+- **Why**: Prevents accidental mixing of different ID types (e.g., passing a UserID where a ProjectID is expected).
+- **Example**: `export type UserID = Brand<string, "UserID">;`
+
+---
+
+## 🏗️ Architectural Compliance
+
+### 1. Contract-First Development
+- All API routes and shared data structures must be defined in the `types/` folder before implementation.
+- `apps/backend/contract.version.json` must be updated on every contract change.
+
+### 2. Domain-Driven Structure
+- Keep logic within its respective domain. Avoid cross-domain leakage.
+- Controllers should only handle routing and validation; business logic belongs in Services/Repositories.
+
+### 3. Async/Await Excellence
+- Always use `try/catch` blocks for asynchronous operations.
+- Never leave a promise unhandled.
+
+---
+
+## 💅 Styling & Naming
+
+- **Naming**: Use camelCase for variables/functions, PascalCase for classes/types, and kebab-case for files.
+- **Comments**: Only comment *why* something is complex. Do not describe *what* the code does (the code should be self-descriptive).
+- **Imports**: Always use explicit file extensions in imports (e.g., `import { foo } from "./foo.js";`) to comply with ESM standards.
+
+---
+
+## 🛠️ Tooling
+
+Agents must run the following command to verify compliance:
+`agent-enderun check:lint`
+
+If a file fails linting, agents are authorized to use `eslint --fix` but must manually review the changes to ensure logic is preserved.
+
+---
+
+**Failure to comply with these standards will result in a PHASE_ROLLBACK.**

package/.enderun/knowledge/frontend_professionalization_guidelines.md

@@ -2,20 +2,20 @@
 
 **Version:** 1.0  
 **Owner:** @manager  
-**Last Updated:** 23 Mayıs 2026
+**Last Updated:** 23 May 2026
 
 ## Purpose
 
-This document defines the official **@frontend Professionalization Program** to close the critical risk item **"@frontend Zayıflığı"** in the Risk Tracking Dashboard.
+This document defines the official **@frontend Professionalization Program** to close the critical risk item **"@frontend Weakness"** in the Risk Tracking Dashboard.
 
 The goal is to elevate the @frontend agent from its current level (6.5) to a true **kurumsal (enterprise) grade** frontend architect (target: 9.0) within 6–8 weeks.
 
-## Current Risk Assessment (23 Mayıs 2026)
+## Current Risk Assessment (23 May 2026)
 
-- **Risk Name:** @frontend Zayıflığı
+- **Risk Name:** @frontend Weakness
 - **Current Level:** 6.5 / 10
 - **Target Level:** 9.0 / 10
-- **Risk Severity:** Kritik / Yüksek Risk
+- **Risk Severity:** Critical / High Risk
 - **Main Weaknesses:**
   - Component architecture and composition patterns exist on paper but are not deeply enforced.
   - Accessibility (WCAG 2.2) is defined but lacks mandatory enforcement and audit mechanisms.
@@ -48,7 +48,7 @@ The goal is to elevate the @frontend agent from its current level (6.5) to a tru
 - Establish formal **Design System Evolution Process** (proposal → @manager review → approval → migration plan).
 - Create @frontend Growth Task system (similar to other agents).
 - Integrate @frontend performance and accessibility metrics into BRAIN_DASHBOARD.md.
-- Close the "@frontend Zayıflığı" risk item in the Risk Tracking Dashboard upon successful demonstration in a reference application.
+- Close the "@frontend Weakness" risk item in the Risk Tracking Dashboard upon successful demonstration in a reference application.
 
 ## Mandatory Requirements (Non-Negotiable)
 
@@ -89,7 +89,7 @@ Any task involving @frontend must satisfy the following:
 
 ## Success Criteria (Risk Closure)
 
-The "@frontend Zayıflığı" risk can be closed when:
+The "@frontend Weakness" risk can be closed when:
 
 - @frontend agent consistently applies compound components, accessibility, and performance patterns in real tasks.
 - A reference application demonstrates professional-grade frontend work (including high-risk admin flows with Hermes).

package/.enderun/knowledge/hermes_live_test_guidelines.md

@@ -2,19 +2,19 @@
 
 **Version:** 1.0  
 **Owner:** @manager  
-**Last Updated:** 23 Mayıs 2026
+**Last Updated:** 23 May 2026
 
 ## Purpose
 
-This document defines the official **Hermes Live Test Program** to close the risk item **"Hermes 'Kağıt Üzerinde'"** in the Risk Tracking Dashboard.
+This document defines the official **Hermes Live Test Program** to close the risk item **"Hermes 'On Paper'"** in the Risk Tracking Dashboard.
 
 Although the Hermes protocol is now technically stateful and mandatory on paper (send_agent_message, read_agent_messages, update_agent_message_status, proper lifecycle), it has not yet been proven in real inter-agent communication cycles.
 
 The goal is to move Hermes from **"defined and mandated"** to **"actually used and verified in live scenarios"**.
 
-## Current Risk Status (23 Mayıs 2026)
+## Current Risk Status (23 May 2026)
 
-- **Risk Name:** Hermes “Kağıt Üzerinde”
+- **Risk Name:** Hermes “On Paper”
 - **Previous Progress:** %70 (protocol made stateful + mandatory in all agents)
 - **Current Gap:** No real, end-to-end live message flows have been executed and verified between agents in a working context.
 - **Risk Severity:** Orta (but blocking full autonomous orchestration claim)
@@ -50,7 +50,7 @@ To consider the Hermes protocol "live and proven", the following scenarios **mus
 
 ## Acceptance Criteria (Risk Closure)
 
-The "Hermes Kağıt Üzerinde" risk can be closed only when **all** of the following are true:
+The "Hermes On Paper" risk can be closed only when **all** of the following are true:
 
 - At least the 4 scenarios above have been executed in a real context (preferably inside the reference application).
 - Every message uses correct `from`, `to`, `traceId`, `category`, `priority`, and proper status transitions.