agent-enderun 0.9.0 → 0.9.2

package/.enderun/agents/quality.md

@@ -0,0 +1,122 @@
+---
+name: quality
+description: "Unified Quality, Security, and Analysis Authority for Agent Enderun"
+---
+
+# @quality — Unified Quality, Security & Analysis
+
+- **Role:** Verification, QA, Security Auditor, and Compliance Officer
+- **Specialization:** 
+    - **QA:** Vitest, regression suite management, deployment gate validation, TDD design patterns.
+    - **Security:** AST vulnerability scanning, OWASP compliance, hardcoded secret detection.
+    - **Analysis:** Memory discipline, contract drift detection, procedural continuity auditing, technical debt reporting.
+- **Permitted Directories:**
+  - `.enderun/`
+  - `apps/backend/src/`
+  - `apps/web/src/`
+  - `framework-mcp/src/`
+  - `docs/`
+- **Hermes Channels:**
+  - `@quality->@manager`
+  - `@quality->@backend`
+  - `@quality->@frontend`
+  - `@quality->@git`
+  - `@quality->@devops`
+- **Tags:** specialist, quality, security, governance
+
+## Core Rules
+- **Gatekeeping:** You are the final gate. No code merges or deploys proceed without @quality sign-off.
+- **Verification First:** Run full verification (lint, typecheck, contract drift, branded types, high-risk patterns) before any work is considered complete.
+- **Never Implement:** You audit, assess, and report. You never implement application features.
+- **Zero Mock Policy:** Integration tests must use real database or service-compatible test backends.
+- **Memory Discipline:** Maintain PROJECT_MEMORY.md integrity and manage locking protocols.
+
+---
+
+## 🔍 QA & Audit Protocols
+
+### 1. API Contract Audit (Mandatory Gate)
+- Run `verify_contract_integrity` on phase transitions.
+- Check `contract.version.json` for hash mismatches.
+- Verify modular type imports in `shared-types`.
+
+### 2. Procedural Continuity Audit
+- Use `analyze_procedural_continuity` to compare agent changes against "Gold Standard" files.
+- Enforce: Branded Types, Domain Errors, Audit Logging for mutations.
+
+### 3. Security Auditing (OWASP & Constitution)
+- Run `security_audit_scan` (secrets, raw SQL, unsafe patterns).
+- Run `analyze_constitution_compliance` (No `any`, Zero Mock, File ownership).
+- **Logging Audit:** Scan for and reject `console.log` usage; verify `AuditService.log()` calls in mutation handlers.
+- **Responsive/Breakpoint Audit:** Verify all UI components against defined Panda CSS breakpoints and Mobile-First mandates.
+- **Native Dialog Audit:** Scan for and reject usage of `alert()` and `confirm()` in frontend code.
+- **Post-Mortem Procedure:** If a task fails or is rejected, perform root-cause analysis and append to `.enderun/knowledge/lessons-learned.md`.
+- Findings must be categorized: CRITICAL, HIGH, MEDIUM, LOW.
+
+
+
+---
+
+## Log Schema (Mandatory)
+Every action must be logged using `log_agent_action` to `.enderun/logs/quality.json`.
+
+```json
+{
+  "timestamp": "ISO-8601",
+  "agent": "@quality",
+  "action": "QA | SECURITY | ANALYST",
+  "requestId": "TRACE-ID",
+  "status": "SUCCESS | FAILURE",
+  "summary": "English summary",
+  "findings": []
+}
+```
+
+---
+
+# Operational Protocols (Combined)
+
+## 🎯 Memory Management (Analyst)
+- Read `PROJECT_MEMORY.md` at session start.
+- Enforce Lock Protocol for writing to memory.
+
+## 🧪 Deployment Gate (QA)
+- Unit tests pass, Integration tests pass against real test DB.
+- Coverage meets project threshold.
+- No skipped tests without manager approval.
+
+## 🛡️ Security Audit Gate (Security)
+- Zero CRITICAL/HIGH findings for deploy/merge.
+- No hardcoded secrets.
+- Redact all sensitive values in reports.
+
+---
+
+## 📋 Code Review Checklist (Mandatory)
+
+When conducting or auditing code reviews, the following verification checklist must be completely satisfied:
+- [ ] **Constitution:** Does the code strictly follow `ENDERUN.md` and all core mandates?
+- [ ] **Contract Compliance:** Are all types imported from the app's local types directory? No inline drift?
+- [ ] **Database Integrity:** Is there any Raw SQL usage? (Kysely queries only, raw SQL is forbidden).
+- [ ] **Test Integrity:** Are corresponding unit/integration tests included for all new changes?
+- [ ] **UI Standards:** Is the code strictly mobile-first with zero native dialogs (if UI)?
+
+---
+
+## 🧪 Testing Standards (Mandatory)
+
+All test suites and coverage reports must conform to the following enterprise rules:
+1. **Unit Tests:** Mandatory for all business logic, services, utilities, and helper functions.
+2. **Integration Tests:** Required for API endpoints using a real database or service-compatible test backend (Zero Mock Policy).
+3. **Naming Standard:** Test files must end in `.test.ts` (or `.test.tsx`).
+4. **Coverage Target:** Aim for >80% coverage in core packages and domain logic.
+
+---
+
+## 🛡️ Security Scanning Standards (Mandatory)
+
+All packages and source code must meet the following threat vectors and automated checks:
+1. **No Raw SQL:** Always use Kysely query builder to prevent SQL injection.
+2. **Secrets Management:** Never hardcode API keys, credentials, tokens, or passwords. Strictly use `.env` files.
+3. **Automated Audit:** Run `agent-enderun check:security` before every Pull Request is finalized.
+

package/.enderun/cli-commands.json

@@ -13,15 +13,15 @@
       "description": "Create new trace ID"
     },
     "check": {
-      "agent": "@analyst",
+      "agent": "@quality",
       "description": "Full health check"
     },
     "check:security": {
-      "agent": "@analyst",
+      "agent": "@quality",
       "description": "Security audit scan"
     },
     "check:compliance": {
-      "agent": "@analyst",
+      "agent": "@quality",
       "description": "Constitution compliance check"
     },
     "verify-contract": {

package/.enderun/config.json

@@ -2,5 +2,11 @@
   "logLevel": "info",
   "outputFormat": "text",
   "defaultProfile": "Lightweight",
-  "version": "0.0.9"
+  "version": "0.9.2",
+  "paths": {
+    "backend": "apps/backend",
+    "frontend": "apps/web",
+    "docs": "docs",
+    "tests": "tests"
+  }
 }

package/.enderun/knowledge/context_boundary_rules.md

@@ -0,0 +1,57 @@
+# Context Boundaries & Constitution Caching Standard
+
+> **Trace ID:** 01HGT8J5E2N0W0W0W0W0W0W0W4  
+> **Status:** ACTIVE  
+> **Applicability:** All Agent Enderun Framework Components and Subagents
+
+---
+
+## 🏛️ 1. Overview & Core Philosophy
+
+In large-scale enterprise projects, keeping the AI's context window clean and lightweight is critical. Overloading the context with unnecessary files (like bulk package lockfiles, build artifacts, or duplicated rule documents) wastes tokens, slows down execution, and dilutes the AI's attention.
+
+This standard establishes:
+1. **The Constitution Caching Rule:** Reading `.enderun/ENDERUN.md` is strictly optimized.
+2. **File & Folder Read Boundaries:** Defines allowed vs. ignored paths to protect context integrity.
+3. **Search-Before-Reading Discipline:** Mandatory search heuristics.
+
+---
+
+## 🔒 2. The Constitution Caching Rule (Initial Read Only)
+
+To prevent severe token-bloat and redundant file I/O operations, the supreme constitution (`.enderun/ENDERUN.md`) must be loaded efficiently:
+
+- **The Initial Read Mandate:** The AI agent must read `{{FRAMEWORK_DIR}}/ENDERUN.md` **exactly once** at the very beginning of the session (during initial bootstrap/startup). This loads all rules into the active system/warm context.
+- **The Read Prohibition:** For all subsequent turns, tasks, and file modifications in that session, the AI agent **is strictly prohibited from calling `read_file` on `ENDERUN.md` again**.
+- **Memory Graph Cache:** The CLI/MCP runtime maintains a session flag (`CONSTITUTION_LOADED: true`) in `{{FRAMEWORK_DIR}}/memory-graph/` to signal that the rules are already active in the warm prompt, rendering repeated reads unnecessary.
+
+---
+
+## 🚫 3. Path-Based Read Boundaries
+
+To prevent token waste, agents must strictly ignore the following directories and files during read/analysis operations. Here, `{{FRAMEWORK_DIR}}` is dynamically resolved at runtime to whichever folder the framework is initialized in (e.g., `.enderun`, `.gemini`, `.claude`, or `.agent`).
+
+### ❌ Ignored Paths (Strictly Prohibited for AI Read)
+* **`node_modules/`** — Massive dependency tree. Absolutely out of bounds.
+* **`dist/`, `build/`, `out/`** — Transpiled/compiled production bundles.
+* **`.git/`** — Version control internal database files.
+* **`package-lock.json`** — Extremely large lockfile (can easily exceed 150KB+). Reading this is forbidden unless explicitly diagnosing a deep dependency lock drift.
+* **`.DS_Store`, `.vscode/`, `.idea/`** — OS and IDE-specific metadata.
+* **`{{FRAMEWORK_DIR}}/logs/`** — Historical execution logs (except the active agent's own log file during write-updates).
+
+### 🟢 Allowed Paths (Active Context Space)
+* **`{{BACKEND_DIR}}/src/`** and **`{{FRONTEND_DIR}}/src/`** — Active user code.
+* **`{{DOCS_DIR}}/`** — Project architecture, guides, and requirements.
+* **`package.json`** — Workspace configurations and script references.
+* **`panda.config.ts`, `tsconfig.json`, `eslint.config.js`** — Design and compiler options.
+* **`{{FRAMEWORK_DIR}}/STATUS.md` & `{{FRAMEWORK_DIR}}/PROJECT_MEMORY.md`** — Live status and SSOT.
+* **`{{FRAMEWORK_DIR}}/agents/{active_agent}.md`** — The active agent instruction prompt.
+
+---
+
+## 🕵️ 4. Search-Before-Reading Protocol
+
+To ensure minimal and clean context usage:
+- **Rule:** Never open or read a file blindly.
+- **Heuristic:** Use `search_codebase` or `grep_search` to identify exact matches, line numbers, or specific functions first.
+- **Action:** Read *only* the specific lines or narrow ranges of target files instead of reading large, full-length files by default.

package/.enderun/knowledge/corporate-governance/high-risk-action-approval-flow.md

@@ -0,0 +1,29 @@
+# High-Risk Action Approval Protocol
+
+This protocol defines the non-negotiable process for executing high-risk operations (e.g., database schema changes, production environment configuration, user permission management, bulk data deletion) within the Agent Enderun framework.
+
+## 1. Scope Definition
+Any action that meets the following criteria is classified as "High-Risk":
+- Modifies production database schema.
+- Changes system-wide security policies or IAM permissions.
+- Triggers destructive data operations (bulk delete, purge).
+- Modifies production-level configuration files (e.g., `.env.prod`).
+
+## 2. Mandatory Approval Flow
+
+All high-risk actions MUST follow the "Three-Key" principle:
+
+1. **Initiation:** The requesting specialist agent MUST brief `@manager` using the `send_agent_message` Hermes protocol, explicitly stating the intent and risk.
+2. **Analysis:** `@manager` logs the intent to `.enderun/logs/manager.json` and updates `PROJECT_MEMORY.md` with a new Trace ID status: `PENDING_APPROVAL`.
+3. **Quality/Security Gate:** `@manager` delegates the task to `@quality` via Hermes with a `SECURITY_AND_IMPACT_AUDIT` category.
+   - `@quality` MUST run `analyze_procedural_continuity` and `security_audit_scan`.
+   - `@quality` MUST issue a formal `APPROVAL` or `REJECTION` Hermes message back to `@manager`.
+4. **Execution:** ONLY upon receiving an `APPROVAL` Hermes message, `@manager` is authorized to execute the action via internal tools.
+
+## 3. Tool Enforcement (MCP)
+- Specialists must NOT have direct MCP tool permissions for high-risk actions.
+- These tools MUST be wrapped in a decorator that forces the request through the `@manager` approval flow.
+
+## 4. Audit Trail (Non-Negotiable)
+- All steps must be recorded in `.enderun/logs/governance.json`.
+- Missing audit trails for any high-risk action constitute a "Critical Rule Violation" and trigger an automatic system-wide lock.

package/.enderun/knowledge/documentation_ownership.md

@@ -0,0 +1,53 @@
+# Documentation Ownership Standard
+
+> **Trace ID:** 01HGT8J5E2N0W0W0W0W0W0W0W4  
+> **Status:** ACTIVE  
+> **Applicability:** All Agent Enderun Framework Components and Subagents
+
+---
+
+## 🏛️ 1. Overview & Core Philosophy
+
+In a high-integrity agentic development environment, keeping a strict separation of concerns between the **Agent Enderun Framework** and the **User's Application Codebase** is critical. Documentation is no exception.
+
+This standard defines the boundary of where documentation can and must be written. Any deviation from this policy is treated as a major architectural governance violation and will be flagged immediately by `@manager`.
+
+---
+
+## 🚫 2. The Framework Boundary
+
+To maintain portability and avoid cluttering the core framework directory, agents must strictly follow the directory permissions:
+
+1. **Framework Directories (`.enderun/` or `{{FRAMEWORK_DIR}}`)**:
+   - **Allowed**: Core system configurations, internal agent instructions, status metrics, and global, generic framework-level architectural patterns.
+   - **Strictly Prohibited**: Any user-project specific research, implementation details, API guides, component documentation, database schemas, or deployment instructions.
+
+2. **User Application Directories (e.g., `docs/`, `apps/`, `src/`)**:
+   - **Mandatory**: All project-specific architectural decisions (ADRs), layout specs, technical guides, system integration plans, API specifications, and research findings must be written **exclusively** into the user's own `docs/` directory.
+
+```mermaid
+graph TD
+    A[Agent Produces Documentation] --> B{Is it Framework Internal?}
+    B -->|Yes| C[Write to .enderun/knowledge/ or .enderun/agents/]
+    B -->|No - Project Specific| D[Write exclusively to user's docs/ directory]
+    C --> E[Enterprise Framework Knowledge Base]
+    D --> F[User Project Documentation Assets]
+```
+
+---
+
+## 📝 3. User Project `docs/` Structure
+
+When producing user-facing documentation, agents must use a clean, logical structure inside the user's `docs/` directory:
+
+- `/docs/architecture/` — Architectural Decision Records (ADRs), system designs, database schemas.
+- `/docs/api/` — API route documentation, contract hashes, payload structures.
+- `/docs/guides/` — Developer onboarding, building, running, and troubleshooting the specific application.
+- `/docs/research/` — Third-party library evaluations, performance benchmarks, and exploration logs.
+
+---
+
+## 🚨 4. Enforcement & Governance
+
+- **Zero-Tolerance Audit**: During any code review or check command (e.g., `agent-enderun check`), `@manager` or `@quality` will verify if any files have been erroneously created in `.enderun/knowledge/`.
+- **Auto-Correction**: Any violating file will be immediately moved to the appropriate user-project `docs/` directory, and a warning log carrying the active Trace ID will be raised.

package/.enderun/knowledge/frontend_professionalization_guidelines.md

@@ -2,20 +2,20 @@
 
 **Version:** 1.0  
 **Owner:** @manager  
-**Last Updated:** 23 Mayıs 2026
+**Last Updated:** 23 May 2026
 
 ## Purpose
 
-This document defines the official **@frontend Professionalization Program** to close the critical risk item **"@frontend Zayıflığı"** in the Risk Tracking Dashboard.
+This document defines the official **@frontend Professionalization Program** to close the critical risk item **"@frontend Weakness"** in the Risk Tracking Dashboard.
 
 The goal is to elevate the @frontend agent from its current level (6.5) to a true **kurumsal (enterprise) grade** frontend architect (target: 9.0) within 6–8 weeks.
 
-## Current Risk Assessment (23 Mayıs 2026)
+## Current Risk Assessment (23 May 2026)
 
-- **Risk Name:** @frontend Zayıflığı
+- **Risk Name:** @frontend Weakness
 - **Current Level:** 6.5 / 10
 - **Target Level:** 9.0 / 10
-- **Risk Severity:** Kritik / Yüksek Risk
+- **Risk Severity:** Critical / High Risk
 - **Main Weaknesses:**
   - Component architecture and composition patterns exist on paper but are not deeply enforced.
   - Accessibility (WCAG 2.2) is defined but lacks mandatory enforcement and audit mechanisms.
@@ -48,7 +48,7 @@ The goal is to elevate the @frontend agent from its current level (6.5) to a tru
 - Establish formal **Design System Evolution Process** (proposal → @manager review → approval → migration plan).
 - Create @frontend Growth Task system (similar to other agents).
 - Integrate @frontend performance and accessibility metrics into BRAIN_DASHBOARD.md.
-- Close the "@frontend Zayıflığı" risk item in the Risk Tracking Dashboard upon successful demonstration in a reference application.
+- Close the "@frontend Weakness" risk item in the Risk Tracking Dashboard upon successful demonstration in a reference application.
 
 ## Mandatory Requirements (Non-Negotiable)
 
@@ -89,7 +89,7 @@ Any task involving @frontend must satisfy the following:
 
 ## Success Criteria (Risk Closure)
 
-The "@frontend Zayıflığı" risk can be closed when:
+The "@frontend Weakness" risk can be closed when:
 
 - @frontend agent consistently applies compound components, accessibility, and performance patterns in real tasks.
 - A reference application demonstrates professional-grade frontend work (including high-risk admin flows with Hermes).

package/.enderun/knowledge/hermes_live_test_guidelines.md

@@ -2,19 +2,19 @@
 
 **Version:** 1.0  
 **Owner:** @manager  
-**Last Updated:** 23 Mayıs 2026
+**Last Updated:** 23 May 2026
 
 ## Purpose
 
-This document defines the official **Hermes Live Test Program** to close the risk item **"Hermes 'Kağıt Üzerinde'"** in the Risk Tracking Dashboard.
+This document defines the official **Hermes Live Test Program** to close the risk item **"Hermes 'On Paper'"** in the Risk Tracking Dashboard.
 
 Although the Hermes protocol is now technically stateful and mandatory on paper (send_agent_message, read_agent_messages, update_agent_message_status, proper lifecycle), it has not yet been proven in real inter-agent communication cycles.
 
 The goal is to move Hermes from **"defined and mandated"** to **"actually used and verified in live scenarios"**.
 
-## Current Risk Status (23 Mayıs 2026)
+## Current Risk Status (23 May 2026)
 
-- **Risk Name:** Hermes “Kağıt Üzerinde”
+- **Risk Name:** Hermes “On Paper”
 - **Previous Progress:** %70 (protocol made stateful + mandatory in all agents)
 - **Current Gap:** No real, end-to-end live message flows have been executed and verified between agents in a working context.
 - **Risk Severity:** Orta (but blocking full autonomous orchestration claim)
@@ -50,7 +50,7 @@ To consider the Hermes protocol "live and proven", the following scenarios **mus
 
 ## Acceptance Criteria (Risk Closure)
 
-The "Hermes Kağıt Üzerinde" risk can be closed only when **all** of the following are true:
+The "Hermes On Paper" risk can be closed only when **all** of the following are true:
 
 - At least the 4 scenarios above have been executed in a real context (preferably inside the reference application).
 - Every message uses correct `from`, `to`, `traceId`, `category`, `priority`, and proper status transitions.

package/.enderun/knowledge/lessons-learned.md

@@ -0,0 +1,14 @@
+# Lessons Learned - Agent Enderun
+
+This repository stores the collective intelligence of the Agent Army. Every failure is analyzed, and a corresponding "Prevention Rule" is established here.
+
+## Structure of a Lesson
+- **Trace ID:** The original task chain ID.
+- **Agent:** The agent responsible for the failure.
+- **Root Cause:** Deep analysis of why the failure occurred.
+- **Solution:** How the failure was resolved.
+- **Prevention Rule:** A mandatory rule added to the agent's Core Rules or `ENDERUN.md` to prevent recurrence.
+
+## Archive
+
+*(No lessons learned yet. System is in pristine state.)*

package/.enderun/knowledge/manager_authority_audit_enforcement.md

@@ -2,7 +2,7 @@
 
 **Version:** 1.0  
 **Owner:** @manager  
-**Last Updated:** 23 Mayıs 2026
+**Last Updated:** 23 May 2026
 
 ## Purpose
 
@@ -12,14 +12,14 @@ Even though strong rules exist in individual agent files, without a systematic a
 
 ## Why This Is Necessary
 
-From the agent control audit (23 Mayıs 2026):
+From the agent control audit (23 May 2026):
 
 - @backend, @frontend, @analyst, and @explorer have partial governance rules, but enforcement is inconsistent.
 - @git, @mobile, and @native have almost no @manager control defined.
 - Hermes usage and High-Risk Admin compliance are still largely declarative in many agents.
 - Memory Discipline and briefing requirements are frequently bypassed in practice.
 
-Without regular auditing and clear enforcement, the "Tek Giriş Noktası" and "Sıfır Tolerans" principles lose effectiveness.
+Without regular auditing and clear enforcement, the "Single Point of Authority" and "Zero Tolerance" principles lose effectiveness.
 
 ## Core Principles
 
@@ -77,10 +77,10 @@ When a violation is detected, @manager must apply the following in order:
 
 This authority system directly supports the closure of multiple risks:
 
-- Referans Uygulama Yokluğu
-- @frontend Zayıflığı
-- Hermes “Kağıt Üzerinde”
-- Gerçek Kullanım Eksikliği
+- Lack of Reference Application
+- @frontend Weakness
+- Hermes “On Paper”
+- Lack of Real-world Usage
 
 Every time a reference application or major task is executed, @manager must run an Authority Audit and record findings.
 
@@ -92,7 +92,7 @@ Every time a reference application or major task is executed, @manager must run
 
 ## Related Documents
 
-- `.enderun/agents/manager.md` → Kurumsal Proje İçin @manager Zorunlu Davranış Kuralları + Hermes Communication Mandate
+- `.enderun/agents/manager.md` → Mandatory @manager Behavioral Rules for Enterprise Projects + Hermes Communication Mandate
 - `.enderun/knowledge/hermes_live_test_guidelines.md`
 - `.enderun/knowledge/frontend_professionalization_guidelines.md`
 - `.enderun/knowledge/reference_application_guidelines.md`

package/.enderun/knowledge/project_scaffold_guidelines.md

@@ -2,7 +2,7 @@
 
 **Version:** 1.0  
 **Owner:** @manager  
-**Last Updated:** 23 Mayıs 2026
+**Last Updated:** 23 May 2026
 
 ## Purpose
 
@@ -14,8 +14,8 @@ The goal is to move from "empty `apps/` folder" to a **minimal but meaningful pr
 
 @manager should initiate a project scaffold in the following cases:
 
-- The Risk Tracking Dashboard shows **"Referans Uygulama Yokluğu"** as a top-priority open risk.
-- The team needs a concrete starting point to validate governance rules (especially Kurumsal CRUD Yönetişimi and Hermes).
+- The Risk Tracking Dashboard shows **"Lack of Reference Application"** as a top-priority open risk.
+- The team needs a concrete starting point to validate governance rules (especially Corporate CRUD Governance and Hermes).
 - A new major capability needs to be proven before being used in client projects.
 - During the early stages of Phase 1 or Phase 2 when moving from theory to real implementation.
 
@@ -74,7 +74,7 @@ Any project scaffold created with Agent Enderun **must** include at least the fo
 - The scaffold must respect the **Framework vs User Project Boundary** (only work inside `apps/`).
 - The scaffold is **temporary and educational** — it is meant to prove concepts, not to become a full product.
 - All high-risk operations in the scaffold must follow the `managerApproval` + Hermes + audit pattern.
-- After successful completion, update the Risk Tracking Dashboard to reflect progress on "Referans Uygulama Yokluğu".
+- After successful completion, update the Risk Tracking Dashboard to reflect progress on "Lack of Reference Application".
 
 ## Success Criteria
 

package/.enderun/knowledge/reference_application_guidelines.md

@@ -2,7 +2,7 @@
 
 **Version:** 1.0  
 **Owner:** @manager  
-**Last Updated:** 23 Mayıs 2026
+**Last Updated:** 23 May 2026
 
 ## Purpose
 
@@ -14,8 +14,8 @@ The goal of a reference application is to **prove** that Agent Enderun’s gover
 
 @manager should initiate a reference application in the following situations:
 
-- The Risk Tracking Dashboard shows **"Referans Uygulama Yokluğu"** as a top-priority open risk.
-- The team needs to validate that new governance rules (especially Kurumsal CRUD Yönetişimi and Hermes) work end-to-end.
+- The Risk Tracking Dashboard shows **"Lack of Reference Application"** as a top-priority open risk.
+- The team needs to validate that new governance rules (especially Corporate CRUD Governance and Hermes) work end-to-end.
 - A new major capability (e.g., advanced Hermes flows, complex admin patterns) needs to be demonstrated before being trusted in client projects.
 - During Phase 1 or early Phase 2 when moving from theory to practice.
 
@@ -38,7 +38,7 @@ Any reference application **must** demonstrate the following:
    - At least one real inter-agent message flow (e.g., @backend → @analyst or @manager → @backend)
    - Proper use of `send_agent_message` + `update_agent_message_status`
 
-5. **Kurumsal Yönetişim Compliance**
+5. **Corporate Governance Compliance**
    - All high-risk actions must go through @manager briefing and approval
    - Full audit logging with Trace ID, previousState/newState, and actor
 
@@ -73,7 +73,7 @@ This scope is small enough to build quickly but rich enough to prove the most cr
 
 - Never create a reference application without an explicit @manager briefing.
 - The reference app is **temporary and educational** — it is not a product.
-- After the reference application successfully closes the "Referans Uygulama Yokluğu" risk, it may be archived or replaced with a cleaner example.
+- After the reference application successfully closes the "Lack of Reference Application" risk, it may be archived or replaced with a cleaner example.
 - All work must be logged in HISTORY and the Risk Tracking Dashboard must be updated.
 
 ## Updating Risk Status
@@ -81,7 +81,7 @@ This scope is small enough to build quickly but rich enough to prove the most cr
 When a reference application is completed and accepted:
 
 1. Update the Risk Tracking Dashboard in both `docs/roadmap.md` and `PROJECT_MEMORY.md`
-2. Mark "Referans Uygulama Yokluğu" as **Closed**
+2. Mark "Lack of Reference Application" as **Closed**
 3. Record the achievement in the HISTORY section of PROJECT_MEMORY.md
 4. Optionally create a short "Reference Application Walkthrough" under `docs/`
 

package/.enderun/memory-graph/agent-contexts/quality.json

@@ -0,0 +1 @@
+{"agent": "quality", "version": "0.9.0", "lastUpdated": "2026-05-29T15:41:37Z", "sessionHistory": [], "notes": "Merged from analyst, qa, and security agents."}

package/.enderun/queue/README.md

@@ -1,18 +1,18 @@
-# .enderun/queue — Agent Görev Kuyruğu
+# .enderun/queue — Agent Task Queue
 
-Bu dizin, Agent Enderun Army'nin file-based asenkron görev kuyruğunu içerir.
+This directory contains the file-based asynchronous task queue for the Agent Enderun Army.
 
-## Alt Dizinler
+## Alt Directoryler
 
-| Dizin | İçerik |
+| Directory | Content |
 |---|---|
-| `pending/` | Atanmış ama henüz başlatılmamış görevler (`{traceId}.json`) |
-| `processing/` | Aktif olarak yürütülen görevler |
-| `completed/` | Başarıyla tamamlanan görevler (arşiv) |
-| `failed/` | Başarısız görevler (retry logic ile yönetilir) |
-| `pipelines/` | `create_execution_pipeline` MCP tool tarafından oluşturulan pipeline JSON dosyaları |
+| `pending/` | Assigned but not yet started tasks (`{traceId}.json`) |
+| `processing/` | Tasks currently being executed |
+| `completed/` | Successfully completed tasks (archive) |
+| `failed/` | Failed tasks (managed by retry logic) |
+| `pipelines/` | `create_execution_pipeline` MCP tool pipeline JSON files generated by |
 
-## Görev Dosyası Formatı
+## Task File Format
 
 ```json
 {
@@ -29,8 +29,8 @@ Bu dizin, Agent Enderun Army'nin file-based asenkron görev kuyruğunu içerir.
 }
 ```
 
-## Kilitleme Protokolü
+## Locking Protocol
 
-Bir dosyaya yazmadan önce `.lock` dosyasını kontrol et.
+Before writing to a file `.lock` check the
 Varsa 500ms bekle, max 3 retry.
-3 retry sonrası stale lock sayılır ve @manager'a bildirilir.
+After 3 retries, it is considered a stale lock and reported to @manager.