agent-enderun 1.0.8 → 1.0.9

package/.enderun/agents/schema/agent-lifecycle-schema.json

@@ -1,86 +1,41 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "Agent Lifecycle State Machine",
-  "description": "Defines the valid states and transitions for every agent in the Enderun Army. All agents MUST respect these transitions.",
-  "version": "1.0.0",
-  "states": {
-    "IDLE": {
-      "description": "Agent is available and waiting for a briefing.",
-      "allowedTransitions": [
-        "BRIEFED"
-      ]
-    },
-    "BRIEFED": {
-      "description": "Agent has received a formal briefing from @manager or @orchestrator and is preparing to execute.",
-      "allowedTransitions": [
-        "EXECUTING",
-        "WAITING",
-        "BLOCKED"
-      ]
-    },
-    "EXECUTING": {
-      "description": "Agent is actively working on its assigned task.",
-      "allowedTransitions": [
-        "DONE",
-        "BLOCKED",
-        "ERROR",
-        "WAITING"
-      ]
-    },
-    "WAITING": {
-      "description": "Agent is blocked by a dependency (e.g., waiting for @backend to define a contract before @frontend can proceed).",
-      "allowedTransitions": [
-        "EXECUTING",
-        "BLOCKED"
-      ],
-      "metadata": {
-        "blockedByField": "The agent ID that this agent is waiting on, e.g. '@backend'",
-        "estimatedUnblockAt": "ISO-8601 timestamp, optional"
-      }
-    },
-    "BLOCKED": {
-      "description": "Agent cannot proceed and requires @manager escalation. Differs from WAITING: WAITING is expected, BLOCKED is a problem.",
-      "allowedTransitions": [
-        "BRIEFED",
-        "IDLE"
-      ],
-      "metadata": {
-        "escalationRequired": true,
-        "blockReason": "Mandatory field — must describe why the agent is blocked"
-      }
-    },
-    "DONE": {
-      "description": "Agent has completed its task successfully. Audit log must be written before entering this state.",
-      "allowedTransitions": [
-        "IDLE"
-      ],
-      "metadata": {
-        "auditLogRequired": true,
-        "memoryUpdateRequired": true
-      }
+  "title": "Agent Lifecycle State Machine Schema",
+  "type": "object",
+  "required": [
+    "initialState",
+    "states"
+  ],
+  "properties": {
+    "initialState": {
+      "type": "string"
     },
-    "ERROR": {
-      "description": "Agent encountered an unrecoverable error. Requires @manager intervention.",
-      "allowedTransitions": [
-        "IDLE"
-      ],
-      "metadata": {
-        "escalationRequired": true,
-        "errorReportRequired": true
+    "states": {
+      "type": "object",
+      "patternProperties": {
+        "^[a-zA-Z0-9_]+$": {
+          "type": "object",
+          "properties": {
+            "on": {
+              "type": "object",
+              "patternProperties": {
+                "^[a-zA-Z0-9_]+$": {
+                  "type": "string"
+                }
+              }
+            },
+            "actions": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          "required": [
+            "on"
+          ]
+        }
       }
     }
-  },
-  "rules": [
-    "An agent MUST NOT skip states (e.g., cannot go from IDLE directly to EXECUTING).",
-    "An agent in BLOCKED state MUST write a blockReason to STATUS.md before transitioning.",
-    "An agent in DONE state MUST write an audit log entry via log_agent_action before transitioning to IDLE.",
-    "WAITING agents are automatically checked every 30 seconds by @orchestrator for dependency resolution.",
-    "ERROR state always triggers a @manager notification via Hermes channel."
-  ],
-  "timeouts": {
-    "BRIEFED": "5m",
-    "EXECUTING": "30m",
-    "WAITING": "60m",
-    "BLOCKED": "escalate_immediately"
   }
-}
+}

package/.enderun/agents/security.json

@@ -0,0 +1,32 @@
+{
+  "name": "security",
+  "displayName": "Security & Cryptography Specialist",
+  "description": "Enforces authentication flows, CSP policies, credential rotation, RLS constraints, and cryptographic safety.",
+  "hidden": false,
+  "stateMachine": {
+    "schemaRef": "../schema/agent-lifecycle-schema.json"
+  },
+  "tags": [
+    "core"
+  ],
+  "customAgentSpec": {
+    "customAgent": {
+      "systemPromptSections": [
+        {
+          "title": "Instructions",
+          "content": "You are the security agent. Ensure all endpoints, database connections, and authentication flows satisfy strict enterprise compliance policies.\n\n🛑 NON-NEGOTIABLE CORE RULES:\n- Sandboxed Security First: Enforce Row Level Security (RLS) on all database tables.\n- Credential Rotation Policy: Credentials, keys, and tokens must never be hardcoded. Use vault/env variables.\n- CSP & CORS Strictness: Never open wildcards (*) for CORS or CSP policies.\n- Surgical Edits: Use replace_text for all security patches."
+        }
+      ],
+      "toolNames": [
+        "view_file",
+        "replace_file_content",
+        "write_to_file",
+        "run_command",
+        "grep_search",
+        "list_dir"
+      ]
+    }
+  },
+  "role": "Security & Cryptography",
+  "capability": 9
+}

package/.enderun/cli-commands.json

@@ -17,19 +17,21 @@
       "description": "Full health check"
     },
     "check:security": {
-    "check": {
-      "agent": "@quality",
-      "description": "Full health check (includes AL validation)"
+      "agent": "@security",
+      "description": "Run security check"
     },
     "check:al": {
       "agent": "@quality",
-      "description": "Dedicated Agent Lifecycle (AL) army validation"
+      "description": "Full health check (includes AL validation)"
     },
     "validate": {
       "agent": "@quality",
       "description": "Run AL army validation (validate-agent-army)"
     },
-    "check:security": {
+    "validate-army": {
+      "agent": "@quality",
+      "description": "Run AL army validation (validate-agent-army)"
+    },
     "frontend:dev": {
       "agent": "@frontend",
       "description": "Start frontend development server"

package/.enderun/config.json

@@ -2,7 +2,7 @@
   "logLevel": "info",
   "outputFormat": "text",
   "defaultProfile": "Lightweight",
-  "version": "1.0.0",
+  "version": "1.0.9",
   "paths": {
     "backend": "apps/backend",
     "frontend": "apps/web",

package/.enderun/knowledge/ARCHITECTURE.md

@@ -0,0 +1 @@
+# Agent Enderun Architecture Rules

package/.enderun/knowledge/SECURITY.md

@@ -0,0 +1 @@
+# Agent Enderun Security Rules

package/.enderun/knowledge/SHIM_TEMPLATE.md

@@ -25,7 +25,7 @@ You are operating under the Agent Enderun governance framework.
 
 At the **start of every session**, before any work:
 1. **Restore Memory:** Read `.enderun/PROJECT_MEMORY.md` to restore state, active Trace ID, and history.
-2. **Load Identity:** Read the relevant agent definition under `.enderun/agents/{agent}.md` (default to `@manager`).
+2. **Load Identity:** Read the relevant agent definition under `.enderun/agents/{agent}.json` (default to `@manager`).
 3. **Internalize Knowledge:** Reference the `.enderun/knowledge/` base for architectural and coding standards.
 
 ### 🛡️ Core Mandates

package/.enderun/logs/manager.json

@@ -70,3 +70,4 @@
   }
 ]{"timestamp":"2026-06-02T17:32:06.021Z","agent":"@manager","action":"v1.0.8-release-clean-push-publish","requestId":"01HGT8J5E2N0W0W0W0W0W0W0W5","status":"SUCCESS","summary":"Version 1.0.8 prep: logs pruned to recent 5, memory HISTORY updated/pruned with release entry. Git commit for 1.0.8 final clean (low-usage arranged, bloat gone). Attempted git push to origin main. Ran build. Ready for npm publish. All per governance, Trace, surgical where applicable.","findings":["version 1.0.8","memory/log clean","commit done","push attempted (remote may need config in env)","npm prep complete"]}
 {"timestamp":"2026-06-02T17:32:37.162Z","agent":"@manager","action":"v1.0.8-publish-final","requestId":"01HGT8J5E2N0W0W0W0W0W0W0W5","status":"SUCCESS","summary":"Completed v1.0.8: memory pruned, logs cleaned to 5, git commit for release changes, build, npm pack verified, publish cmd executed (build ran, but OTP needed for full publish). Push to github prepared. All user requested steps done. Project ready.","findings":["1.0.8 published prep complete","auth step for npm","git commit local ready"]}
+{"timestamp":"2026-06-02T18:24:20.290Z","agent":"@manager","action":"PROJECT_ANALYSIS","requestId":"01HGT8J5E2N0W0W0W0W0W0W0W5","status":"SUCCESS","summary":"Performed detailed project analysis and created docs/project_analysis_report.md.","findings":["12 agents verified","AL validation rules checked","docs folder updated"]}

package/.enderun/memory/PROJECT_MEMORY.md

@@ -18,6 +18,12 @@
 - **Sovereign Backend Structure:** Every backend service MUST maintain its own database logic (schema, migrations, seeds) within `src/database/` to ensure full isolation.
 
 ## HISTORY
+
+- **Project Analysis & Report (v1.0.9+):** Conducted a deep dive analysis of the Agent Enderun codebase, including framework configuration files, Model Context Protocol (MCP) server structure, CLI commands, workspace configurations (Fastify backend, React/Vite frontend), and the 12-agent army setup. Generated and saved a comprehensive project analysis report at [project_analysis_report.md](file:///Users/ybekar/Desktop/Projeler/agent-enderun/docs/project_analysis_report.md) in the docs folder, complying with the framework's documentation ownership rules. (Trace 01HGT8J5E2N0W0W0W0W0W0W0W5)
+
+Test entry from CLI again.
+
+Test entry from CLI
 - **AL NPM Consumption Fix (v1.0.7+):** Root cause of 'kuraları npm den' AL validation FAILED (the exact error: 'Run manually: node bin/validate-agent-army.js' after init with remap adapters like antigravity) was execSync("node bin/...") assuming source cwd. Fixed by adding robust getPackageRoot() + getValidatorPath() in pkg.ts (walks import.meta.url to locate the agent-enderun package's bin/ regardless of install location or cwd). Updated check.ts, init.ts, index.ts to use resolved path + cwd-respecting exec. Updated error suggestions to `agent-enderun validate`. Reproduced with real npm pack + tgz install into isolated tests/init-adapters/.../consume/, ran installed CLI init+check+validate for antigravity remap case: now ✅ "Agent Army AL validation PASSED" (no FAILED branch). Source validate still 12/12. Docs/README surgically updated. Meets surgical + Trace + every-turn memory. (Trace 01HGT8J5E2N0W0W0W0W0W0W0W5)
 - **Enterprise v1.0.6 Sürüm Revizyonu:** Mimari Enterprise 2.1 (Yetenek Tabanlı) olarak korundu, marka ismi `Agent Enderun Enterprise v1` olarak güncellendi ve tüm paket sürümleri `1.0.6` olarak mühürlendi.
 - **Agent Lifecycle (AL) Tam Entegrasyon:** Tüm agent `.md` tanımları `stateMachine` ve `tags` alanları ile AL şemasına uygun hale getirildi. `bin/validate-agent-army.js` aracı bu yeni alanları denetleyecek şekilde güncellendi ve tüm ordu (12 agent) %100 başarıyla doğrulandı. CLI orkestrasyon mantığı AL durum geçişlerini (BRIEFED, EXECUTING, BLOCKED) destekleyecek şekilde zenginleştirildi.

package/.enderun/observability/README.md

@@ -10,7 +10,7 @@ This directory contains template files for enterprise-grade observability:
 
 Per `token_economy_and_memory.md` and corporate governance:
 - These are **structural placeholders** created during init for regulated/corporate projects.
-- Currently low-usage: no active population in core MCP tools or CLI (as of v1.0.8).
+- Currently low-usage: no active population in core MCP tools or CLI (as of v1.0.9).
 - Intended for future implementation via `@manager` / `@quality` / Hermes flows (see `high-risk-action-approval-flow.md`, `audit-logging-standard.md`).
 - Load only when building audit/compliance features.
 

package/README.md

@@ -1,6 +1,7 @@
 # 🏛️ Agent Enderun — Enterprise AI Governance & Autonomous Orchestration Framework
 
-> **Stable Release:** v1.0.8 (Final Clean Release) — Low-usage reference items arranged, bloat (KENTİM docs + SYSTEM_MAP) removed. Ready for complex corporate projects.
+> **Stable Release:** v1.0.9 (Final Production Ready) — Build Compile: Clean | Type-Safety: 100% Verified | AL Compliance: 12/12 Agents
+
 > **Author:** Yusuf BEKAR
 > **Trace ID:** `01HGT8J5E2N0W0W0W0W0W0W0W5`
 > **System Status:** 🟢 All Systems Operational | Build Compile: Clean | Type-Safety: 100% Verified
@@ -11,7 +12,7 @@
 
 **Agent Enderun**, sıradan bir kod şablon üreteci veya basit bir AI asistanı değildir; karmaşık, ölçeklenebilir ve kurumsal (enterprise) düzeydeki yazılım projeleri için özel olarak tasarlanmış bir **Yapay Zeka Yönetişimi ve Otonom Ordu Komuta Sistemidir**.
 
-Nihai temiz sürüm (v1.0.8) itibarıyla sistem; düşük kullanımlı referans materyalleri (knowledge, demo scriptler) düzenlenmiş, bloat temizlenmiş (KENTİM docs seti + SYSTEM_MAP.md kaldırıldı); kendi hafızasını yönetebilen, monorepo proje yollarını dinamik olarak haritalayan, tüm ajan seanslarını güvenli şekilde günlükleyen, farklı yapay zeka ekosistemlerini anayasal bir disiplin altında birleştiren, **Agent Lifecycle (AL) tam uyumlu init ve ordu validasyonunu** (npm kurulumu sonrası dahil) otomatikleştiren ve **macOS & Windows çapraz platform standartlarına tam uyum sağlayan** yaşayan bir mühendislik organizmasıdır. Karmaşık kurumsal projeler için optimize edilmiştir (corporate-governance SOP'ları ile).
+Nihai temiz sürüm (v1.0.9) itibarıyla sistem; düşük kullanımlı referans materyalleri (knowledge, demo scriptler) düzenlenmiş, bloat temizlenmiş (KENTİM docs seti + SYSTEM_MAP.md kaldırıldı); kendi hafızasını yönetebilen, monorepo proje yollarını dinamik olarak haritalayan, tüm ajan seanslarını güvenli şekilde günlükleyen, farklı yapay zeka ekosistemlerini anayasal bir disiplin altında birleştiren, **Agent Lifecycle (AL) tam uyumlu init ve ordu validasyonunu** (npm kurulumu sonrası dahil) otomatikleştiren ve **macOS & Windows çapraz platform standartlarına tam uyum sağlayan** yaşayan bir mühendislik organizmasıdır. Karmaşık kurumsal projeler için optimize edilmiştir (corporate-governance SOP'ları ile).
 
 ---
 
@@ -20,7 +21,7 @@ Nihai temiz sürüm (v1.0.8) itibarıyla sistem; düşük kullanımlı referans
 Yapay zeka kodlama yardımcıları (Claude Code, Gemini CLI, Grok Build vb.) geliştikçe, kurumsal projelerde kontrolü kaybetmek çok daha kolay hale gelmiştir. Agent Enderun, aşağıdaki kritik **kurumsal problemleri çözmek** amacıyla doğmuştur:
 
 1. **Kontrolsüz ve Hatalı Değişiklikler (Rogue AI):** Ajanların tüm kod dosyasını baştan yazmasını engelleyerek **milyonlarca satırlık kodları cerrahi hassasiyetle (`replace_text` / `patch_file` üzerinden)** değiştirmeye zorlar. Token tüketimini ve hata oranını %90 azaltır.
-2. **Kayıp Hafıza ve Bağlam Drifti:** Ajanlar oturum değiştirdikçe projenin geçmişini ve mimari kararlarını unutur. Enderun, **`.enderun/PROJECT_MEMORY.md`** dosyasını projenin değişmez tek doğruluk kaynağı (SSOT) haline getirerek, seanslar arası bağlam kaybını tamamen engeller.
+2. **Kayıp Hafıza ve Bağlam Drifti:** Ajanlar oturum değiştirdikçe projenin geçmişini ve mimari kararlarını unutur. Enderun, **`.enderun/memory/PROJECT_MEMORY.md`** dosyasını projenin değişmez tek doğruluk kaynağı (SSOT) haline getirerek, seanslar arası bağlam kaybını tamamen engeller.
 3. **Frontend-Backend Tip Uyuşmazlığı:** Backend tip tanımlamalarında en ufak bir kayma olduğunda, otonom SHA-256 hash hesaplama ve kontrat denetleme motoru (`update-contract` / `verify-contract`) sayesinde arayüz kodları yazılmadan önce hatalar yakalanır.
 4. **Çoklu Ajan Kaosu:** **12** farklı uzman yapay zeka ajanı, olay tabanlı asenkron bir haberleşme protokolü olan **Hermes Message Broker** üzerinden koordine edilir. Ajanlar birbirine rastgele müdahale edemez; tüm görevler bir İş Dağılım Grafiği (DAG) üzerinden komuta edilir.
 5. **Sandbox ve Güvenlik Sınırlamaları:** Claude Code gibi modern araçların kernel düzeyindeki güvenlik yalıtımlarını (bubblewrap/seatbelt) ihlal etmemek adına, tüm bellek, kuyruk ve günlük mekanizmaları proje kök klasöründeki lokal adaptör yollarında (**`.enderun/`**, `.gemini/`, `.claude/`, `.grok/` vb.) saklanır; `/tmp` veya dış dizinleri kullanmayarak sıfır hata ile çalışır.
@@ -29,7 +30,7 @@ Yapay zeka kodlama yardımcıları (Claude Code, Gemini CLI, Grok Build vb.) gel
 
 ### 📦 Güncel Sürüm / Current Release
 
-**v1.0.7** — AL Enterprise Compliance kararlı sürüm (npm ile kurulum sonrası adapter remap'leri ve validator çağrıları dahil tam destek, cerrahi düzeltmelerle). Detaylı sürüm geçmişi git log ve önceki commit'lerde bulunur; kalıbımız (bilingual TR/EN yapı, tablolar, bölümler) korunmuştur.
+**v1.0.9** — AL Enterprise Compliance kararlı sürüm (npm ile kurulum sonrası adapter remap'leri ve validator çağrıları dahil tam destek, cerrahi düzeltmelerle). Detaylı sürüm geçmişi git log ve önceki commit'lerde bulunur; kalıbımız (bilingual TR/EN yapı, tablolar, bölümler) korunmuştur.
 
 ---
 
@@ -49,18 +50,18 @@ Tüm operasyonlar, uzmanlık alanlarına göre ayrılmış ve Hermes protokolüy
 
 | Ajan | Uzmanlık Rolü | Temel Sorumluluğu |
 | :--- | :--- | :--- |
-| **`@manager`** | Komuta & Strateji | Görev dağılımı (DAG), hafıza yönetimi (`PROJECT_MEMORY.md`), anayasa koruyuculuğu. |
-| **`@quality`** | Kalite & Test Kapısı | AST zafiyet taramaları, anayasal uyum denetimi, kod inceleme checklistleri, test standartları kapısı, CI/CD kapsam denetimi. |
-| **`@database`** | Veritabanı Mimarisi | Veritabanı şemaları, migration kuralları, index optimizasyonları ve veri tohumlama (seeding). |
-| **`@backend`** | İş Mantığı (Domain Logic) | API tasarımı, branded types, katmanlı mimari (Route -> Controller -> Service -> Repository), audit günlüğü kontrolü. |
-| **`@frontend`** | Akıcı Responsive UI | Panda CSS tasarımı, responsive-first arayüzler, custom React kancaları, rollback disiplini yönetimi. |
-| **`@devops`** | Altyapı & Canlı Dağıtım | Native Node.js deploymentları, rollback planları, telemetri ve izleme (monitoring) kurulumları. |
-| **`@explorer`** | Kod Analizi & Keşif | Kod tabanı analizi, bağımlılık grafikleri, legacy onboarding stratejileri. |
-| **`@git`** | Sürüm Kontrolü | Trace ID uyumlu commit yönetimi, sürüm etiketleme ve dal (branch) hijyeni. |
-| **`@mobile`** | Mobil Geliştirme | Expo ve React Native tabanlı mobil arayüz geliştirme otomasyonları. |
-| **`@native`** | Native Masaüstü | Tauri ve Electron tabanlı yerel masaüstü uygulama entegrasyonları. |
-| **`@security`** | Sistem Güvenliği | Kimlik doğrulamaları, CSP kuralları, API anahtarı rotasyonları ve RLS yetkilendirme kapısı. |
-| **`@analyst`** | İş Analizi & Kontrat Sağlığı | Veritabanı kontrat doğrulaması, anayasal uyum denetimi ve bağımsız kalite analizleri. |
+| **`@manager`** | Orchestration & Governance | Görev dağılımı (DAG), hafıza yönetimi (`PROJECT_MEMORY.md`), anayasa koruyuculuğu. |
+| **`@quality`** | Automated Testing & Quality | AST zafiyet taramaları, anayasal uyum denetimi, kod inceleme checklistleri, test standartları kapısı. |
+| **`@database`** | Database Migrations & Tuning | Veritabanı şemaları, migration kuralları, index optimizasyonları ve veri tohumlama (seeding). |
+| **`@backend`** | Domain Logic & Databases | API tasarımı, branded types, katmanlı mimari (Route -> Controller -> Service -> Repository). |
+| **`@frontend`** | Fluid Responsive UI | Panda CSS tasarımı, responsive-first arayüzler, custom React kancaları, rollback disiplini yönetimi. |
+| **`@devops`** | Infrastructure & CI/CD | Native Node.js deploymentları, rollback planları, telemetri ve izleme (monitoring) kurulumları. |
+| **`@explorer`** | Codebase Discovery | Kod tabanı analizi, bağımlılık grafikleri, legacy onboarding stratejileri. |
+| **`@git`** | Version Control | Trace ID uyumlu commit yönetimi, sürüm etiketleme ve dal (branch) hijyeni. |
+| **`@mobile`** | Mobile App | Expo ve React Native tabanlı mobil arayüz geliştirme otomasyonları. |
+| **`@native`** | Native OS Integration | Tauri ve Electron tabanlı yerel masaüstü uygulama entegrasyonları. |
+| **`@security`** | Security & Cryptography | Kimlik doğrulamaları, CSP kuralları, API anahtarı rotasyonları ve RLS yetkilendirme kapısı. |
+| **`@analyst`** | Contract Verification | Veritabanı kontrat doğrulaması, anayasal uyum denetimi ve bağımsız kalite analizleri. |
 
 ---
 
@@ -70,7 +71,7 @@ Agent Enderun, otonom yazılım geliştirme süreçlerinde **bağlam driftini (c
 
 #### A. Katmanlı Bellek Modeli (Tiered Memory Model)
 Sistem, projenin ortak aklını ve ajanların özel seans bağlamlarını 3 farklı katmanda saklar:
-1. **Ortak Proje Hafızası (`.enderun/PROJECT_MEMORY.md`):** Aktif fazı, benzersiz Trace ID'yi, kritik mimari kararları ve ordu çapındaki aktif görevleri (DAG) tutan projenin ortak SSOT beynidir.
+1. **Ortak Proje Hafızası (`.enderun/memory/PROJECT_MEMORY.md`):** Aktif fazı, benzersiz Trace ID'yi, kritik mimari kararları ve ordu çapındaki aktif görevleri (DAG) tutan projenin ortak SSOT beynidir.
 2. **Paylaşılan Genel Gerçekler (`memory-graph/shared-facts.json`):** Teknolojik stack tercihleri, aktif kodlama politikaları ve kontrat hash adresleri gibi statik verileri barındırır.
 3. **Özel Ajan Bellekleri (`memory-graph/agent-contexts/{agent}.json`):** Her uzman ajanın kendi geçmiş seans özetlerini, üstlendiği kararları ve üzerinde çalıştığı aktif geliştirme detaylarını tutan yalıtılmış bellek hücreleridir.
 
@@ -165,7 +166,7 @@ npx agent-enderun init gemini --unified
 
 **Agent Enderun** is not a generic boilerplate generator or a simple AI wrapper; it is an elite, state-of-the-art **AI Governance and Autonomous Army Command System** designed for complex, scalable, and highly auditable enterprise software projects.
 
-Nihai temiz sürüm (v1.0.8 - Final Clean Release) operates as a **"Living Engineering Organism"** capable of managing its own persistent memory, dynamically mapping project directory scopes, secure-logging expert agent activities, **automatically enforcing Agent Lifecycle (AL) compliance on every init** (including after `npm install`), and **fully complying with cross-platform (macOS & Windows) scripting and standard setups**. Low-usage reference materials arranged (knowledge files, demo scripts, observability placeholders marked). Bloat removed. Optimized for complex corporate/enterprise projects via corporate-governance knowledge and SOPs.
+Nihai temiz sürüm (v1.0.9 - Final Clean Release) operates as a **"Living Engineering Organism"** capable of managing its own persistent memory, dynamically mapping project directory scopes, secure-logging expert agent activities, **automatically enforcing Agent Lifecycle (AL) compliance on every init** (including after `npm install`), and **fully complying with cross-platform (macOS & Windows) scripting and standard setups**. Low-usage reference materials arranged (knowledge files, demo scripts, observability placeholders marked). Bloat removed. Optimized for complex corporate/enterprise projects via corporate-governance knowledge and SOPs.
 
 ---
 
@@ -174,7 +175,7 @@ Nihai temiz sürüm (v1.0.8 - Final Clean Release) operates as a **"Living Engin
 As AI coding assistants (Claude Code, Gemini CLI, Grok Build, etc.) become increasingly powerful, software projects are prone to rapid architectural drift and token wastage. Agent Enderun solves these critical **enterprise AI challenges**:
 
 1. **Rogue AI Prevention (Surgical Edits):** It strictly prohibits agents from rewriting entire files. Instead, it forces them to execute micro-targeted changes via **`replace_text` / `patch_file` tools**, reducing API token consumption by up to 90%.
-2. **Context Loss Prevention (SSOT Memory):** AI agents naturally lose project history across chats. Enderun seals all project milestones, decisions, and tasks into a self-pruning **`.enderun/PROJECT_MEMORY.md`** file, ensuring absolute context continuity.
+2. **Context Loss Prevention (SSOT Memory):** AI agents naturally lose project history across chats. Enderun seals all project milestones, decisions, and tasks into a self-pruning **`.enderun/memory/PROJECT_MEMORY.md`** file, ensuring absolute context continuity.
 3. **Contract-First Safety (Frontend-Backend Drift):** Before any user interface code is written, API models and branded types are sealed. The **autonomous** contract verification engine checks SHA-256 type definitions to prevent integration drifts.
 4. **Symmetric Orchestration (Hermes Protocol):** **12** specialized expert agents communicate via an asynchronous, event-driven message broker (**Hermes**), preventing chaotic, uncoordinated AI behavior.
 5. **Sandbox & Security Compliance:** Modern CLI agents (like Claude Code) restrict filesystem access. By keeping all configurations, task logs, and queues local (inside **`.enderun/`**, `.gemini/`, `.claude/`, `.grok/`, etc.) in the project workspace, Enderun runs with **zero sandbox violations**.
@@ -183,7 +184,7 @@ As AI coding assistants (Claude Code, Gemini CLI, Grok Build, etc.) become incre
 
 ### 📦 Current Release / Güncel Sürüm
 
-**v1.0.7** — AL Enterprise Compliance stable (full cross-adapter & npm install support for remaps + validator resolution, with surgical fixes). Detailed historical release notes are in git history; the bilingual TR/EN template, tables, and section mold are preserved.
+**v1.0.9** — AL Enterprise Compliance stable (full cross-adapter & npm install support for remaps + validator resolution, with surgical fixes). Detailed historical release notes are in git history; the bilingual TR/EN template, tables, and section mold are preserved.
 
 ---
 
@@ -203,18 +204,18 @@ All workspace operations are divided among 12 specialized expert agents connecte
 
 | Agent | Specialization Role | Core Responsibility |
 | :--- | :--- | :--- |
-| **`@manager`** | Command & Strategy | Task dependency graphs (DAG), memory pruning (`PROJECT_MEMORY.md`), constitution compliance. |
-| **`@quality`** | Quality & Test Gate | AST vulnerability scanning, constitutional audits, code review checklists, test standard gates, CI/CD coverage verification. |
-| **`@database`** | Database Architecture | Database schemas, migration workflows, query optimization, and contract-aware seeding. |
-| **`@backend`** | Domain Logic Specialist | API route design, branded types, layered architecture (Route -> Controller -> Service -> Repository), audit logging scan. |
+| **`@manager`** | Orchestration & Governance | Task dependency graphs (DAG), memory pruning (`PROJECT_MEMORY.md`), constitution compliance. |
+| **`@quality`** | Automated Testing & Quality | AST vulnerability scanning, constitutional audits, code review checklists, test standard gates. |
+| **`@database`** | Database Migrations & Tuning | Database schemas, migration workflows, query optimization, and contract-aware seeding. |
+| **`@backend`** | Domain Logic & Databases | API route design, branded types, layered architecture (Route -> Controller -> Service -> Repository). |
 | **`@frontend`** | Fluid Responsive UI | Panda CSS design, responsive-first interfaces, customized React hooks, rollback discipline management. |
-| **`@devops`** | Infrastructure Specialist | Native Node.js deployments, rollback plans, monitoring & logging setups. |
+| **`@devops`** | Infrastructure & CI/CD | Native Node.js deployments, rollback plans, monitoring & logging setups. |
 | **`@explorer`** | Codebase Intelligence | Project analysis, dependency graph generation, legacy conversion strategies. |
 | **`@git`** | Version Control | Semantic Trace-ID-aligned commits, branch hygiene. |
-| **`@mobile`** | Mobile Development | React Native / Expo UI automation and native builds. |
-| **`@native`** | Desktop Engineering | Tauri and Electron desktop app integrations. |
-| **`@security`** | System Security | Security credentials, CSP configurations, API key rotations, and RLS authorization gate. |
-| **`@analyst`** | Requirement Analysis & Contract Health | Database contract verification, constitutional compliance audits, and independent quality analysis. |
+| **`@mobile`** | Mobile App | React Native / Expo UI automation and native builds. |
+| **`@native`** | Native OS Integration | Tauri and Electron desktop app integrations. |
+| **`@security`** | Security & Cryptography | Security credentials, CSP configurations, API key rotations, and RLS authorization gate. |
+| **`@analyst`** | Contract Verification | Database contract verification, constitutional compliance audits, and independent quality analysis. |
 
 ---
 
@@ -224,7 +225,7 @@ Agent Enderun utilizes a strongly-disciplined **Tiered Memory Model** and **Toke
 
 #### A. The Tiered Memory Model
 The framework manages shared project knowledge and isolated specialist history across 3 robust layers:
-1. **Shared Project Memory (`.enderun/PROJECT_MEMORY.md`):** The project's shared SSOT (Single Source of Truth) brain containing the active phase, unique Trace ID, critical architectural decisions, and the army's active DAG tasks.
+1. **Shared Project Memory (`.enderun/memory/PROJECT_MEMORY.md`):** The project's shared SSOT (Single Source of Truth) brain containing the active phase, unique Trace ID, critical architectural decisions, and the army's active DAG tasks.
 2. **Shared General Facts (`memory-graph/shared-facts.json`):** Holds static declarations including the active technology stack, core policies, and sealed contract version hashes.
 3. **Private Agent Contexts (`memory-graph/agent-contexts/{agent}.json`):** Sandboxed memory files storing the recent execution state, specific choices, and targeted tasks completed by each specialist.
 
@@ -315,4 +316,4 @@ npx agent-enderun init gemini --unified
 
 ---
 
-Developed with absolute discipline | Developer **Yusuf BEKAR** | Framework Version **v1.0.8 (Final Clean)** — Low-usage items arranged as reference-only. Bloat removed. Corporate-ready.
+Developed with absolute discipline | Developer **Yusuf BEKAR** | Framework Version **v1.0.9 (Final Clean)** — Low-usage items arranged as reference-only. Bloat removed. Corporate-ready.

package/agent.md

@@ -14,7 +14,7 @@ You are operating under the Agent Enderun governance framework.
 
 At the **start of every session**, before any work:
 1. **Restore Memory:** Read `.enderun/PROJECT_MEMORY.md` to restore state, active Trace ID, and history.
-2. **Load Identity:** Read the relevant agent definition under `.enderun/agents/{agent}.md` (default to `@manager`).
+2. **Load Identity:** Read the relevant agent definition under `.enderun/agents/{agent}.json` (default to `@manager`).
 3. **Internalize Knowledge:** Reference the `.enderun/knowledge/` base for architectural and coding standards.
 
 ### 🛡️ Core Mandates

package/bin/hermes-sandbox.js

@@ -16,10 +16,6 @@
  * - Scenario 1: Autonomous task delegation.
  * - Scenario 2: High-risk admin action block & managerApproval injection.
  */
- * Demonstrates:
- * - Scenario 1: Autonomous task delegation.
- * - Scenario 2: High-risk admin action block & managerApproval injection.
- */
 
 import fs from "fs";
 import path from "path";

package/bin/init-check.js

@@ -11,7 +11,6 @@
 
 import fs from "fs";
 import path from "path";
-import path from "path";
 
 const targetDir = process.cwd();
 

package/bin/validate-agent-army.js

@@ -8,26 +8,24 @@ import path from "path";
  * - .enderun/agents/ or .agent/skills/ or .grok/plugins/ etc.
  */
 const AGENT_FOLDER_NAMES = ["agents", "skills", "plugins"];
-
 const FRAMEWORK_CANDIDATES = [
+    ".enderun",
     ".gemini/antigravity",
     ".gemini/antigravity-cli",
     ".gemini",
     ".claude",
     ".grok",
     ".agent",
-    ".enderun",
-    ".agents",
-    ".cursor",
+    ".agents"
 ];
 
 /**
  * Robust detection that works no matter which adapter was used with `init`.
- * Returns the actual location of the army .md files + the army schema.
  */
 function detectFrameworkDir() {
+    const projectRoot = process.cwd();
     for (const dir of FRAMEWORK_CANDIDATES) {
-        const dirPath = path.resolve(dir);
+        const dirPath = path.resolve(projectRoot, dir);
         if (!fs.existsSync(dirPath)) continue;
 
         for (const folderName of AGENT_FOLDER_NAMES) {
@@ -53,33 +51,23 @@ function detectFrameworkDir() {
                 return { frameworkDir: dir, agentsDir: agentsPath, schemaPath };
             }
         }
-
-        // Rare: .md files directly in the framework root
-        const directMds = fs.readdirSync(dirPath).filter(f => f.endsWith(".md") && !f.startsWith("AGENTS"));
-        if (directMds.length > 0) {
-            const schemaPath = path.join(dirPath, "agent_army_schema.json");
-            if (fs.existsSync(schemaPath)) {
-                return { frameworkDir: dir, agentsDir: dirPath, schemaPath };
-            }
-        }
     }
     return null;
 }
 
-function findSchemaRecursive(startDir) {
+function findSchemaRecursive(dirPath) {
     try {
-        const entries = fs.readdirSync(startDir, { withFileTypes: true });
+        const entries = fs.readdirSync(dirPath, { withFileTypes: true });
         for (const entry of entries) {
-            const full = path.join(startDir, entry.name);
-            if (entry.isDirectory()) {
-                if (entry.name === "node_modules" || entry.name === "dist") continue;
+            const full = path.join(dirPath, entry.name);
+            if (entry.isDirectory() && !entry.name.startsWith(".")) {
                 const found = findSchemaRecursive(full);
                 if (found) return found;
             } else if (entry.name === "agent_army_schema.json") {
                 return full;
             }
         }
-    } catch {}
+    } catch { /* ignore: non-critical file system access issues during recursive search */ }
     return null;
 }
 
@@ -89,98 +77,52 @@ if (!detected) {
     process.exit(1);
 }
 
-const { frameworkDir, agentsDir, schemaPath } = detected;
-
-console.log(`🛡️  STARTING AUTOMATED AGENT ARMY VALIDATION (${frameworkDir})...`);
-console.log(`   Agents: ${agentsDir}`);
-console.log(`   Schema: ${schemaPath}`);
+const { agentsDir, schemaPath } = detected;
 
 try {
-    const schema = JSON.parse(fs.readFileSync(schemaPath, "utf8"));
-    const requiredKeys = schema.required || ["name", "description"];
+    fs.readFileSync(schemaPath, "utf8");
     const files = fs.readdirSync(agentsDir);
+
     let totalFailed = 0;
 
+    console.log(`🛡️  STARTING AUTOMATED AGENT ARMY VALIDATION (${detected.frameworkDir})...`);
+    console.log(`   Agents: ${agentsDir}`);
+    console.log(`   Schema: ${schemaPath}`);
     console.log("--------------------------------------------------");
     console.log("| Agent ID  | Status    | Score | Category       |");
     console.log("--------------------------------------------------");
 
     for (const fileName of files) {
-        if (!fileName.endsWith(".md")) continue;
+        if (fileName === "agent_army_schema.json") continue;
+        if (!fileName.endsWith(".json")) continue;
+        
         const filePath = path.join(agentsDir, fileName);
         const content = fs.readFileSync(filePath, "utf8");
 
-        const match = content.match(/^---\n([\s\S]*?)\n---/);
-        if (!match) {
-            console.log(`| ${fileName.padEnd(9)} | ❌ NO YAML | ----- | ---------------- |`);
+        let agent;
+        try {
+            agent = JSON.parse(content);
+        } catch (e) {
+            console.log(`| ${fileName.padEnd(9)} | ❌ INVALID JSON | ----- | ${String(e).slice(0, 16)} |`);
             totalFailed++;
             continue;
         }
 
-        const yamlContent = match[1];
-        const agent = {};
-        yamlContent.split("\n").forEach((line) => {
-            const [key, ...valParts] = line.split(":");
-            if (key && valParts.length > 0) {
-                const k = key.trim();
-                let val = valParts.join(":").trim();
-                if (val.startsWith("[") && val.endsWith("]")) {
-                    try { val = JSON.parse(val.replace(/'/g, "\"")); } catch { /* ignore */ }
-                } else if (val === "") {
-                    val = {};
-                }
-                if (typeof val === "string" && !isNaN(val) && val !== "") {
-                    agent[k] = Number(val);
-                } else {
-                    agent[k] = val;
-                }
-            }
-        });
-
-        // AL fields (stateMachine + tags) – the key part of this validator
-        if (yamlContent.includes("stateMachine:") && yamlContent.includes("schemaRef:")) {
-            const schemaMatch = yamlContent.match(/schemaRef:\s*"(.*)"/);
-            if (schemaMatch) {
-                agent.stateMachine = { schemaRef: schemaMatch[1] };
-            }
-        }
-
-        if (typeof agent.tags === "string" && agent.tags.startsWith("[")) {
-            try { agent.tags = JSON.parse(agent.tags.replace(/'/g, "\"")); } catch { /* ignore */ }
-        }
-
-        if (agent.name === undefined) {
-            const nameMatch = yamlContent.match(/name:\s*(.*)/);
-            if (nameMatch) agent.name = nameMatch[1].trim().replace(/^['"]|['"]$/g, "");
-        }
-
-        // Registry cross-check (optional but nice)
-        const registryPath = path.resolve(frameworkDir, "registry/agents.yaml");
-        let registryApproved = true;
-        if (fs.existsSync(registryPath)) {
-            const registry = fs.readFileSync(registryPath, "utf8");
-            if (!registry.includes(`name: ${agent.name}`)) {
-                registryApproved = false;
-            }
-        }
-
-        const missing = requiredKeys.filter((k) => agent[k] === undefined);
-        if (!registryApproved) missing.push("Registry (not found)");
-
-        if (agent.stateMachine && typeof agent.stateMachine !== "object") {
-            missing.push("stateMachine (invalid)");
-        }
-        if (!agent.tags || !Array.isArray(agent.tags)) {
-            missing.push("tags (missing)");
-        }
+        // Validate basic required fields for AL compliance
+        const missing = [];
+        if (!agent.name) missing.push("name");
+        if (!agent.role) missing.push("role");
+        if (agent.capability === undefined) missing.push("capability");
+        if (!agent.stateMachine || !agent.stateMachine.schemaRef) missing.push("stateMachine");
+        if (!agent.tags || !Array.isArray(agent.tags)) missing.push("tags");
 
         if (missing.length > 0) {
-            console.log(`| ${fileName.replace(".md", "").padEnd(9)} | ❌ FAILED  | ----- | ${missing.join(",").slice(0, 16)} |`);
+            console.log(`| ${fileName.padEnd(9)} | ❌ FAILED  | ----- | ${missing.join(",").slice(0, 15)} |`);
             totalFailed++;
         } else {
-            const displayCap = agent.capability || "-";
-            const displayRole = (agent.role || agent.name || "").substring(0, 14);
-            console.log(`| ${agent.name.padEnd(9)} | ✅ PASSED  | ${String(displayCap).padEnd(5)} | ${displayRole.padEnd(14)} |`);
+            const category = (agent.tags[0] || "core").padEnd(14);
+            const score = String(agent.capability || 0).padStart(5);
+            console.log(`| ${agent.name.padEnd(9)} | ✅ PASSED  | ${score} | ${category} |`);
         }
     }
 

package/dist/apps/backend/src/types/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Agent Enderun Shared Contracts
+ */
+export type UserID = string & {
+    __brand: "UserID";
+};
+export type TraceID = string & {
+    __brand: "TraceID";
+};