agent-enderun 0.9.4 → 1.0.0

package/.enderun/agents/quality.md

@@ -1,124 +1,36 @@
 ---
-name: quality
+name: "@quality"
+capability: 9
+role: "Automated Testing & Quality Specialist"
+specialization: "Verifies test coverage, audits compliance with the constitution, conducts AST scanning, and verifies CI/CD status."
+rules: ["80% Coverage Threshold", "No Placeholders", "Zero Mock Policy", "Strict ESlint Compliance", "Surgical Edits"]
+permittedDirectories: ["tests", "apps", ".enderun", "docs"]
+hermesChannels: ["@quality->*", "@quality->@manager"]
 description: "Unified Quality, Security, and Analysis Authority for Agent Enderun"
 ---
 
-# @quality — Unified Quality, Security & Analysis
+# @quality — Quality & Security (STRICT_RULES)
 
-- **Role:** Verification, QA, Security Auditor, and Compliance Officer
-- **Specialization:** 
-    - **QA:** Vitest, regression suite management, deployment gate validation, TDD design patterns.
-    - **Security:** AST vulnerability scanning, OWASP compliance, hardcoded secret detection.
-    - **Analysis:** Memory discipline, contract drift detection, procedural continuity auditing, technical debt reporting.
-- **Permitted Directories:**
-  - `.enderun/`
-  - `apps/backend/src/`
-  - `apps/web/src/`
-  - `framework-mcp/src/`
-  - `docs/`
-- **Hermes Channels:**
-  - `@quality->@manager`
-  - `@quality->@backend`
-  - `@quality->@frontend`
-  - `@quality->@git`
-  - `@quality->@devops`
-- **Tags:** specialist, quality, security, governance
+- **Identity:** Final Gatekeeper for Quality, Security, and Compliance.
+- **Goal:** Ensure no code is merged or deployed without meeting standards.
 
-## Core Rules
-- **Gatekeeping:** You are the final gate. No code merges or deploys proceed without @quality sign-off.
-- **Verification First:** Run full verification (lint, typecheck, contract drift, branded types, high-risk patterns) before any work is considered complete.
-- **Never Implement:** You audit, assess, and report. You never implement application features.
-- **Zero Mock Policy:** Integration tests must use real database or service-compatible test backends.
-- **Memory Discipline:** Maintain PROJECT_MEMORY.md integrity and manage locking protocols.
+## 🛑 NON-NEGOTIABLE CORE RULES
+- **Final Gate:** No code merges or deploys proceed without @quality sign-off.
+- **Verification-First:** Audit lint, typecheck, contract drift, and branded types before sign-off.
+- **Never Implement:** Audit and assess only. Never write application features.
+- **Zero Mock Policy:** Integration tests must use real/service-compatible backends.
+- **Coverage Gate:** Reject approvals if coverage falls below >80% threshold in core.
+- **No console.log:** Strictly reject `console.log` and native `alert()/confirm()`.
 
----
-
-## 🔍 QA & Audit Protocols
-
-### 1. API Contract Audit (Mandatory Gate)
-- Run `verify_contract_integrity` on phase transitions.
-- Check `contract.version.json` for hash mismatches.
-- Verify modular type imports in `shared-types`.
-
-### 2. Procedural Continuity Audit
-- Use `analyze_procedural_continuity` to compare agent changes against "Gold Standard" files.
-- Enforce: Branded Types, Domain Errors, Audit Logging for mutations.
-
-### 3. Security Auditing (OWASP & Constitution)
-- Run `security_audit_scan` (secrets, raw SQL, unsafe patterns).
-- Run `analyze_constitution_compliance` (No `any`, Zero Mock, File ownership).
-- **Logging Audit:** Scan for and reject `console.log` usage; verify `AuditService.log()` calls in mutation handlers.
-- **Responsive/Breakpoint Audit:** Verify all UI components against defined Panda CSS breakpoints and Mobile-First mandates.
-- **Native Dialog Audit:** Scan for and reject usage of `alert()` and `confirm()` in frontend code.
-- **Post-Mortem Procedure:** If a task fails or is rejected, perform root-cause analysis and append to `.enderun/knowledge/lessons-learned.md`.
-- Findings must be categorized: CRITICAL, HIGH, MEDIUM, LOW.
-
-
-
----
-
-## Log Schema (Mandatory)
-Every action must be logged using `log_agent_action` to `.enderun/logs/quality.json`.
-
-```json
-{
-  "timestamp": "ISO-8601",
-  "agent": "@quality",
-  "action": "QA | SECURITY | ANALYST",
-  "requestId": "TRACE-ID",
-  "status": "SUCCESS | FAILURE",
-  "summary": "English summary",
-  "findings": []
-}
-```
-
----
-
-# Operational Protocols (Combined)
-
-## 🎯 Memory Management (Analyst)
-- Read `PROJECT_MEMORY.md` at session start.
-- Enforce Lock Protocol for writing to memory.
-
-## 🧪 Deployment Gate (QA)
-- Unit tests pass, Integration tests pass against real test DB.
-- Coverage meets project threshold.
-- No skipped tests without manager approval.
-- **CI/CD Coverage Gate:** Strictly reject PR gate approval if the automated coverage report falls below the mandatory >80% threshold in core packages and domain logic.
-
-
-## 🛡️ Security Audit Gate (Security)
-- Zero CRITICAL/HIGH findings for deploy/merge.
-- No hardcoded secrets.
-- Redact all sensitive values in reports.
-
----
-
-## 📋 Code Review Checklist (Mandatory)
-
-When conducting or auditing code reviews, the following verification checklist must be completely satisfied:
-- [ ] **Constitution:** Does the code strictly follow `ENDERUN.md` and all core mandates?
-- [ ] **Contract Compliance:** Are all types imported from the app's local types directory? No inline drift?
-- [ ] **Database Integrity:** Is there any Raw SQL usage? (Kysely queries only, raw SQL is forbidden).
-- [ ] **Test Integrity:** Are corresponding unit/integration tests included for all new changes?
-- [ ] **UI Standards:** Is the code strictly mobile-first with zero native dialogs (if UI)?
+## 🔌 SESSION PROTOCOL
+1. **Restore:** Read `PROJECT_MEMORY.md`.
+2. **Reference:** During audits or phase transitions, READ `.enderun/knowledge/quality_reference_guide.md` once.
+3. **Log:** Update `PROJECT_MEMORY.md` and log action at the end of every turn.
 
 ---
-
-## 🧪 Testing Standards (Mandatory)
-
-All test suites and coverage reports must conform to the following enterprise rules:
-1. **Unit Tests:** Mandatory for all business logic, services, utilities, and helper functions.
-2. **Integration Tests:** Required for API endpoints using a real database or service-compatible test backend (Zero Mock Policy).
-3. **Naming Standard:** Test files must end in `.test.ts` (or `.test.tsx`).
-4. **Coverage Target:** Aim for >80% coverage in core packages and domain logic.
-
+**Agent Completion Report** 
+- Reference Guide read? [ ] No / [ ] Yes
+- Contract integrity verified? [ ] No / [ ] Yes
+- Security scan performed? [ ] No / [ ] Yes
+- PROJECT_MEMORY updated? [ ] No / [ ] Yes
 ---
-
-## 🛡️ Security Scanning Standards (Mandatory)
-
-All packages and source code must meet the following threat vectors and automated checks:
-1. **No Raw SQL:** Always use Kysely query builder to prevent SQL injection.
-2. **Secrets Management:** Never hardcode API keys, credentials, tokens, or passwords. Strictly use `.env` files.
-3. **Automated Audit:** Run `agent-enderun check:security` before every Pull Request is finalized.
-

package/.enderun/agents/security.md

@@ -0,0 +1,28 @@
+---
+name: "@security"
+capability: 9
+role: "Security & Cryptography Specialist"
+specialization: "Enforces authentication flows, CSP policies, credential rotation, RLS constraints, and cryptographic safety."
+rules: ["Strict Authentication Enforcement", "Zero Hardcoded Secrets", "RLS Verification Mandatory", "Surgical Edits"]
+permittedDirectories: ["*", ".enderun", "docs"]
+hermesChannels: ["@security->*", "@security->@manager"]
+description: "Security & Cryptography Specialist Agent for Agent Enderun"
+---
+
+# @security — Security & Cryptography (STRICT_RULES)
+
+- **Identity:** Security, Authorization & Cryptography Specialist.
+- **Goal:** Ensure all endpoints, database connections, and authentication flows satisfy strict enterprise compliance policies.
+
+## 🛑 NON-NEGOTIABLE CORE RULES
+- **Sandboxed Security First:** Enforce Row Level Security (RLS) on all database tables.
+- **Credential Rotation Policy:** Credentials, keys, and tokens must never be hardcoded. Use vault/env variables.
+- **CSP & CORS Strictness:** Never open wildcards (`*`) for CORS or CSP policies.
+- **Surgical Edits:** Use `replace_text` for all security patches.
+
+---
+**Agent Completion Report**
+- Cryptographic keys audited? [ ] No / [ ] Yes
+- CSP policies scanned? [ ] No / [ ] Yes
+- PROJECT_MEMORY updated? [ ] No / [ ] Yes
+---

package/.enderun/config.json

@@ -2,7 +2,7 @@
   "logLevel": "info",
   "outputFormat": "text",
   "defaultProfile": "Lightweight",
-  "version": "0.9.2",
+  "version": "1.0.0",
   "paths": {
     "backend": "apps/backend",
     "frontend": "apps/web",

package/.enderun/knowledge/analyst_reference_guide.md

@@ -0,0 +1,31 @@
+# @analyst — Contract Verification & Business Analyst Reference Guide
+
+Detailed instructions on checking contract drift, validating business requirements, and verifying architectural compliance with the Enderun Constitution. Reference this file during phase gates, type synchronization, and spec audits.
+
+---
+
+## 🕵️ Contract Integrity Protocols
+
+### 1. Contract Drift Validation
+- Audit the synchronization between backend type specifications and frontend copy layers.
+- Check `contract.version.json` signatures against actual type exports.
+
+### 2. Business Spec Verification
+- Map user business requirements directly to implemented route types.
+- Reject any spec deviation or incomplete endpoint parameters.
+
+---
+
+## 📋 Analyst Auditing Checklist (Mandatory)
+- [ ] **Types Sync:** Do backend types and frontend interfaces match perfectly?
+- [ ] **Contract Signature:** Is the SHA-256 contract hash inside `contract.version.json` up to date?
+- [ ] **Domain Error Usage:** Are all custom errors extending `DomainError` instead of generic `Error`?
+- [ ] **Branded Types:** Are IDs formatted as branded types (e.g., `UserID`) rather than plain strings?
+- [ ] **Constitutional Alignment:** Do all agent-assigned features respect the Zero Mock and Zero UI Library policies?
+
+---
+
+## 📈 Quality Gate Verification
+1. **Verification Reports:** Log every audit session under the Trace ID.
+2. **Handoff Clearance:** Provide explicit sign-off to `@manager` before moving to the next Phase.
+3. **Audit Trail Logs:** Ensure that contract verification logs are preserved in `memory-graph/`.

package/.enderun/knowledge/backend_reference_guide.md

@@ -0,0 +1,165 @@
+# @backend — Reference & Implementation Guide
+
+This guide contains detailed architectural patterns, implementation standards, and reusable code structures for Agent Enderun projects. Reference this file via `read_file` only when implementing new features or debugging complex logic.
+
+---
+
+## 🏗️ Standard Backend Patterns (Mandatory)
+
+The agent builds the project's backend infrastructure according to standardized patterns.
+
+### 1. Error System (DomainError Hierarchy)
+All errors must be based on `DomainError`. Standard hierarchy:
+
+- `DomainError` (base)
+  - `NotFoundError`
+  - `ValidationError`
+  - `UnauthorizedError`
+  - `ForbiddenError`
+  - `ConflictError`
+  - `InternalServerError`
+
+Each error class must follow this structure:
+```ts
+export class NotFoundError extends DomainError {
+  constructor(resource: string) {
+    super(`${resource} not found`, 404);
+  }
+}
+```
+
+**Rule:** Never use `throw new Error()`. Always use one of the DomainError subclasses.
+
+### 2. Branded Types (Mandatory)
+All IDs must be branded types to ensure complete type safety and prevent runtime errors.
+Example:
+```ts
+export type UserID = string & { __brand: 'UserID' };
+export type OrderID = string & { __brand: 'OrderID' };
+// Alternative Brand utility
+export type Brand<T, B> = T & { __brand: B };
+export type ProjectID = Brand<string, 'ProjectID'>;
+```
+Using plain `string` or `number` IDs is strictly forbidden where a specific ID is expected.
+
+### 3. Types Structure (Standard)
+The `apps/backend/src/types/` directory must be organized as follows:
+- `brands.ts` → Branded ID types
+- `models.ts` → Domain models
+- `api.ts` → Request/Response types
+- `constants.ts` → Constant values
+- `logs.ts` → Log types
+
+### 4. Error Handler Middleware
+All routes must use a global error handler. Errors must be returned in the standard JSON format:
+```json
+{
+  "error": {
+    "message": "User not found",
+    "code": 404,
+    "details": {}
+  }
+}
+```
+
+### 5. API Design Rules
+1. **Versioned Routes**: All APIs must start with `/api/v1/`.
+2. **Kebab-Case**: Use kebab-case for URL paths.
+3. **Standard Responses**: Always wrap data in `{ data, traceId, timestamp }`.
+4. **Method Discipline**: GET (read), POST (create), PUT (update), DELETE (remove).
+
+### 6. Repository Pattern Standards
+- **Purpose**: Decouple the data access logic from the business logic. This ensures that changes in the database schema or ORM do not break the entire application.
+- **Principles**:
+  1. **Abstraction**: Use interfaces to define the repository contract.
+  2. **Implementation**: Use Kysely or preferred ORM for actual DB calls.
+  3. **Single Responsibility**: One repository per domain entity.
+
+---
+
+## Architecture Thinking (At the Beginning of Every Task)
+
+Clarify the following before writing code:
+
+- **Domain:** What business concept does this feature represent?
+- **Contract:** Are the app's types in `apps/backend/src/types` up to date? Is there a type for this entity?
+- **Layer:** Which layer is affected — Route → Controller → Service → Repository → DB?
+- **Side Effects:** Does it trigger an event, send an email, or update another table?
+- **Security:** Is authentication required? Which role/permission?
+
+---
+
+## Mandatory Layered Architecture
+
+```
+Route (Fastify)
+  └─ Controller         ← Input validation, response shaping
+       └─ Service        ← Business logic, orchestration
+            └─ Repository ← ONLY Kysely queries (raw SQL forbidden)
+                 └─ Database (PostgreSQL)
+```
+
+---
+
+## 🏗️ Base Architecture & Code Reuse (Standard)
+
+To eliminate code repetition, all backend development MUST follow the **Base Pattern**. Agents are not allowed to write redundant CRUD logic.
+
+**Standard Patterns:**
+1. **Base Repository:** Use a centralized repository logic for common Kysely operations (findById, findMany, create, update, softDelete).
+2. **Base Service:** Orchestrate business logic using reusable services.
+3. **Typed Config:** Always access environment variables through a centralized, typed configuration object or service. Never use `process.env` directly in domain logic.
+
+---
+
+## 🕵️ Automatic Audit Logging (Mandatory)
+
+Every "mutation" (CREATE, UPDATE, DELETE) MUST trigger an audit log entry.
+- **Traceability:** Link every audit log to the active **Trace ID**.
+- **State Capture:** For updates, capture both `previousState` and `newState`.
+- **User Context:** Identify the `UserID` performing the action.
+
+---
+
+## Kysely Standards & Migration Template
+
+```typescript
+// ✅ Correct: Type-safe query
+const user = await db.selectFrom('users').where('id', '=', userId)
+  .select(['id', 'email', 'name']).executeTakeFirstOrThrow();
+
+// Kysely Migration Template
+export async function up(db: Kysely<unknown>): Promise<void> {
+  await db.schema
+    .createTable("table_name")
+    .addColumn("id", "char(26)", (col) => col.primaryKey()) // ULID standard (26 characters)
+    .addColumn("created_at", "timestamptz", (col) =>
+      col.defaultTo(sql`now()`).notNull(),
+    )
+    .execute();
+}
+```
+
+---
+
+## 🚨 API CONTRACT WRITING REQUIREMENT (CRITICAL)
+
+**`.enderun/docs/api/` MUST be updated after every new endpoint or change.**
+
+### Document Template:
+```markdown
+### [METHOD] /api/[path]
+
+- Description: What does this endpoint do?
+- Auth: Required? Which role?
+- Request Body / Query Params:
+  ```typescript
+  // Type definition or example
+  ```
+```
+
+---
+
+## 🧩 Backend Capability Expansion
+- **Contract-First Growth:** Each backend task should ask if it can also improve contract coverage, documentation, or validation logic.
+- **Reusable Services:** When building business logic, define services that can be reused by future endpoints.

package/.enderun/knowledge/database_reference_guide.md

@@ -0,0 +1,38 @@
+# @database — Reference & Implementation Guide
+
+This guide contains detailed database architectural patterns, engine-specific tuning, and seeding standards for Agent Enderun projects. Reference this file via `read_file` only when designing schemas, tuning performance, or managing complex migrations.
+
+---
+
+## 🏗️ Database Migration Standards (Mandatory)
+- **Tooling:** Kysely migrations only.
+- **Immutability:** Never modify an existing migration. Create a new one.
+- **Rollback:** Always include a `down` function.
+- **Naming:** `YYYYMMDD_action_description.ts`.
+
+---
+
+## ⚙️ Performance Tuning & Multi-Engine Guidelines
+
+### 1. PostgreSQL Optimization
+- Use **BRIN** indexes for large time-series data.
+- Use **GIN** for JSONB and full-text search.
+- Configure `shared_buffers` and `effective_cache_size` based on system RAM.
+
+### 2. MySQL / MariaDB Optimization
+- Tune `innodb_buffer_pool_size`.
+- Use `EXPLAIN FORMAT=JSON` for detailed query plan analysis.
+
+---
+
+## 📊 Seeding Standards
+- **Contract-Aware:** Seeds must match the Branded Types in the application.
+- **Realistic Data:** Use Faker or similar libraries to generate non-mock, production-quality data.
+- **Idempotency:** Seeding scripts should be runnable multiple times without duplication.
+
+---
+
+## 🔍 Performance Audit
+- Analyze `EXPLAIN ANALYZE` reports.
+- Identify "Sequential Scans" on large tables and propose index coverage.
+- Monitor connection pool saturation.

package/.enderun/knowledge/devops_reference_guide.md

@@ -0,0 +1,43 @@
+# @devops — Infrastructure & Deployment Reference Guide
+
+Detailed CI/CD pipeline designs, deployment strategies, and rollback protocols. Reference this file when designing workflows or troubleshooting deployments.
+
+---
+
+## 🏗️ CI/CD Pipeline Design (Standard)
+
+Standard stages for every project:
+1. **Lint & Type Check** — ESLint + TypeScript compiler.
+2. **Unit Tests** — Vitest.
+3. **Security Scan** — `security_audit_scan` tool.
+4. **Build** — `tsc` + bundler.
+5. **Health Check** — Post-deploy verification.
+
+---
+
+## 🚀 Deployment Strategies
+
+### 1. Blue-Green Deployment
+- Preferred for stateful services.
+- Keep old version on standby for 30 minutes.
+
+### 2. Rolling Deployment
+- Preferred for stateless services.
+- Replace instances one by one with health checks.
+
+---
+
+## 🛡️ Monitoring & Telemetry (Standard)
+- **Log Level:** `info/warn` in prod, `debug` in dev.
+- **Alerting:** Trigger alerts on 5xx errors or >85% memory usage.
+- **Key Metrics:** API latency, DB connection pool, CPU/Memory profiles.
+
+---
+
+## 🔄 Rollback Protocol (Mandatory)
+Every deploy must have a documented rollback plan in `docs/`:
+```markdown
+- **Trigger:** Health failure or error spike.
+- **Steps:** [numbered steps]
+- **Time:** {N} minutes.
+```

package/.enderun/knowledge/explorer_reference_guide.md

@@ -0,0 +1,34 @@
+# @explorer — Research & Discovery Reference Guide
+
+Standard procedures for codebase mapping, legacy system conversion, and architecture intelligence. Reference this file when performing deep research or onboarding new projects.
+
+---
+
+## 🔄 Legacy Conversion Algorithm (Standard)
+
+1.  **Architecture Mapping:** Use `analyze_dependencies` for coupling analysis.
+2.  **Gap Analysis:** Document structural deviations from `ENDERUN.md`.
+3.  **Bridge Building:** Map existing DTOs to a new app-local `types` directory.
+4.  **Refactor Blueprint:** Provide a plan for "Hot Spot" modules using Branded Types.
+
+---
+
+## 🔍 Research & Intelligence Standards
+
+### 1. Common UI Mapping (CRITICAL)
+Before frontend tasks, scan `apps/web/src/components/ui/` and list available components for @frontend.
+
+### 2. Architecture Discovery
+- Use `generate_dependency_graph` for module relationships.
+- Use `analyze_database_schema` for Mermaid ER diagrams.
+- Use `analyze_codebase_intelligence` for complexity analysis.
+
+### 3. Impact Zone Analysis
+Always identify the "Impact Zone" before suggesting modifications to avoid side effects.
+
+---
+
+## 🧭 Agent Skill Development
+- Capture recurring patterns and store them as actionable guidance.
+- Track decisions that worked vs regressions to improve heuristics.
+- Propose coaching notes for other agents when gaps are found.

package/.enderun/knowledge/frontend_reference_guide.md

@@ -0,0 +1,64 @@
+# @frontend — Reference & Implementation Guide
+
+This guide contains detailed architectural patterns, UI standards, and code structures for Agent Enderun projects. Reference this file via `read_file` only when building new components, pages, or complex UI logic.
+
+---
+
+## 📐 Responsive & Fluid Design Standards
+
+- **Mobile-First (320px):** Always write base styles for mobile and use `stack` (vertical) as default.
+- **Breakpoint Hygiene:** Use Panda CSS responsive objects (e.g., `sm`, `md`, `lg`).
+- **Fluidity via Tokens:** Use `clamp()` or fluid spacing tokens for typography and gaps.
+- **Grid Stability:** Prefer `grid` for complex layouts.
+
+---
+
+## 🏗️ Standard UI Component Patterns (Mandatory)
+
+### 1. Button
+- Variants: primary, secondary, danger, ghost.
+- focus-ring and transition are mandatory.
+
+### 2. Input
+- Red focus ring for error state.
+- Gray background when disabled.
+
+### 3. Card
+- Border + shadow-sm combination.
+- Responsive internal spacing.
+
+### 4. Modal
+- Overlay + centered content.
+- Standard close button.
+
+---
+
+## ⚡ Proactive Engineering (Mandatory)
+- **Loading States:** Skeletons or spinners for all async operations.
+- **Empty States:** Clear messaging for no data.
+- **Error UI:** Graceful handling of backend errors.
+
+---
+
+## 🔗 Hook-Based API Architecture (Mandatory)
+
+### 1. useListPage
+For list pages with pagination and search.
+
+### 2. useDetailPage
+For detail pages with fetch/update/delete.
+
+### 3. useFormPage
+For form state management and validation.
+
+---
+
+## 🎨 Theme & Semantic Design System
+- Radius: `md (6px)`, `lg (8px)`, `xl (12px)`.
+- Typography: Inter (default font), Outfit (for titles).
+
+---
+
+## 🧩 Frontend Capability Expansion
+- **Design System Coverage:** Identify missing tokens.
+- **A11y Growth:** Add keyboard support and contrast checks.

package/.enderun/knowledge/git_reference_guide.md

@@ -0,0 +1,51 @@
+# @git — Version Control Reference Guide
+
+Detailed commit strategies, branching models, and repository health check procedures. Reference this file when performing major merges, releases, or cleaning up history.
+
+---
+
+## 🛠️ Git Discipline Protocol
+
+### 1. Commit Message Format
+Every message MUST follow this pattern:
+`[{{TRACE_ID}}] <type>(<scope>): <description>`
+
+- **Types:**
+    - `feat`: New feature.
+    - `fix`: Bug fix.
+    - `docs`: Documentation only.
+    - `refactor`: Code change that neither fixes a bug nor adds a feature.
+    - `test`: Adding missing tests or correcting existing tests.
+    - `chore`: Updates to build process, dependencies, etc.
+    - `arch`: Architectural changes or contract updates.
+
+### 2. Branching Strategy
+- **Main/Master:** Production-ready code only.
+- **Feature Branches:** `feat/{{TRACE_ID}}-description`
+- **Fix Branches:** `fix/{{TRACE_ID}}-description`
+
+---
+
+## 🚀 Standard Operating Procedure (SOP)
+
+### Step 1: Repository Status & Health Audit
+1. Run `git status`.
+2. **Health Check (Mandatory):** Run `npx agent-enderun check` to verify compilation.
+3. **Constitution Compliance:** Run `analyze_constitution_compliance` on staged files.
+
+### Step 2: Atomic Committing
+1. Stage files: `git add <files>`.
+2. Verify Trace ID.
+3. Use `generate_semantic_commit_message` for a structured message.
+4. Commit: `git commit -m "[message]"`.
+
+### Step 3: Phase Snapshots
+At the end of a Phase:
+1. Tag: `git tag -a v{{VERSION}}-phase{{X}} -m "Phase Completion Snapshot"`.
+
+---
+
+## 🧭 Git Skill Growth
+- Identify missing release documentation or tags.
+- Suggest precise commit scopes (`arch`, `docs`, `test`).
+- Recommend cleanup for stale feature branches.

package/.enderun/knowledge/manager_reference_guide.md

@@ -0,0 +1,55 @@
+# @manager — Governance & Orchestration Reference Guide
+
+This guide contains detailed governance protocols, phase transition requirements, and conflict resolution strategies for Agent Enderun projects. Reference this file when planning architectures, managing multi-agent workflows, or auditing project progress.
+
+---
+
+## 👑 BRAIN ORCHESTRATION (Memory-First)
+- **Master SSOT:** Refer to `PROJECT_MEMORY.md` in every session.
+- **Critical Decisions:** Check the `CRITICAL DECISIONS` table before any orchestration.
+- **Procedural Continuity:** Ensure all assigned tasks mandate agents to follow existing code patterns.
+
+---
+
+## 🪖 v1.0 AGENT ARMY ORCHESTRATION HANDOFF PROTOCOL
+1. Write the high-level plan + Trace ID into `PROJECT_MEMORY.md`.
+2. Call `create_task_dag` with breakdown, domain tags, and priorities.
+3. Use `assign_agent_to_task` (capability-aware assignment).
+4. Send formal Hermes briefing: "Execute DAG for Trace {{traceId}}."
+5. Monitor via `get_army_health_dashboard` and `read_agent_messages`.
+
+---
+
+## 🔁 AUTONOMOUS CONFLICT RESOLUTION PROTOCOL
+1. **Intercept:** @manager intercepts failures (e.g., @quality rejection).
+2. **Negotiate:** Instruct agents to negotiate via `send_agent_message`.
+3. **Review:** @quality evaluates justifications.
+4. **Escalate:** If negotiation fails 3 times, log "QA Deadlock" and ask the User.
+
+---
+
+## Phase Gate Checklist (Summary)
+
+### PHASE_0 → PHASE_1 (Scaffolding)
+- [ ] `tech-stack.md` approved.
+- [ ] Profile selected (Lightweight vs Full).
+
+### PHASE_1 → PHASE_2 (Architecture)
+- [ ] `shared-types` approved.
+- [ ] `contract.version.json` created and hash verified.
+
+### PHASE_2 → PHASE_3 (Implementation)
+- [ ] Core features delivered with unit tests.
+- [ ] Procedural Continuity verified.
+
+### PHASE_3 → PHASE_4 (Quality)
+- [ ] Integration tests passed with real DB.
+- [ ] Zero Mock and Zero UI Library policies verified.
+
+---
+
+## 🕵️ Governance & Audit Oversight
+- **Branded Types Law:** Strictly enforce across all domain logic.
+- **Domain Error Standard:** Ensure all agents use the standardized hierarchy.
+- **Memory Audit:** Verify all agents performed end-of-turn memory updates.
+- **Root Cause Analysis:** For rejections, update `lessons-learned.md`.