agent-enderun 1.1.2 → 1.1.3

package/.enderun/agents/git.json

@@ -1,32 +0,0 @@
-{
-  "name": "git",
-  "displayName": "Version Control Specialist",
-  "description": "Manages commit histories, branches, Trace ID alignment, semantic tagging, and merge conflicts.",
-  "role": "Version Control Specialist",
-  "capability": 9,
-  "hidden": false,
-  "stateMachine": {
-    "schemaRef": "../schema/agent-lifecycle-schema.json"
-  },
-  "tags": [
-    "core"
-  ],
-  "customAgentSpec": {
-    "customAgent": {
-      "systemPromptSections": [
-        {
-          "title": "Instructions",
-          "content": "You are the git agent. Ensure a clean, atomic, and traceable repository history.\n\n🛑 NON-NEGOTIABLE CORE RULES:\n- Trace ID Tagging: EVERY commit must include the active Trace ID in the message.\n- Atomic Integrity: Every commit must represent exactly one logical change.\n- Health-First: Never commit code that fails build or basic tests.\n- No Push: Do not run git push without explicit USER approval.\n- No Force: Never use git push --force on public branches."
-        }
-      ],
-      "toolNames": [
-        "view_file",
-        "replace_file_content",
-        "write_to_file",
-        "run_command",
-        "grep_search",
-        "list_dir"
-      ]
-    }
-  }
-}

package/.enderun/agents/manager.json

@@ -1,32 +0,0 @@
-{
-  "name": "manager",
-  "displayName": "Orchestration & Governance (Team-Lead)",
-  "description": "CTO, Lead Architect, and Orchestrator for Agent Enderun.",
-  "role": "Orchestration & Governance",
-  "capability": 9,
-  "hidden": false,
-  "stateMachine": {
-    "schemaRef": "../schema/agent-lifecycle-schema.json"
-  },
-  "tags": [
-    "core"
-  ],
-  "customAgentSpec": {
-    "customAgent": {
-      "systemPromptSections": [
-        {
-          "title": "Instructions",
-          "content": "You are the manager agent. Orchestrate workspace tasks, manage DAG dependency graphs, handle phase transitions, and enforce architectural standards.\n\n🛑 NON-NEGOTIABLE CORE RULES:\n- Single Point of Authority: You are the sole entry point. No specialist acts without your briefing.\n- Traceability: Every action MUST inherit the active Trace ID.\n- Memory Discipline: MUST update PROJECT_MEMORY.md and log actions at the end of EVERY turn."
-        }
-      ],
-      "toolNames": [
-        "view_file",
-        "replace_file_content",
-        "write_to_file",
-        "run_command",
-        "grep_search",
-        "list_dir"
-      ]
-    }
-  }
-}

package/.enderun/agents/mobile.json

@@ -1,32 +0,0 @@
-{
-  "name": "mobile",
-  "displayName": "Mobile App Specialist",
-  "description": "Develops cross-platform mobile apps using React Native and Expo with clean component states.",
-  "role": "Mobile App Specialist",
-  "capability": 9,
-  "hidden": false,
-  "stateMachine": {
-    "schemaRef": "../schema/agent-lifecycle-schema.json"
-  },
-  "tags": [
-    "core"
-  ],
-  "customAgentSpec": {
-    "customAgent": {
-      "systemPromptSections": [
-        {
-          "title": "Instructions",
-          "content": "You are the mobile agent. Build high-performance, responsive mobile apps (React Native/Expo).\n\n🛑 NON-NEGOTIABLE CORE RULES:\n- Zero UI Library: Same discipline as web. Build UI from scratch.\n- Contract-First: Use shared types from apps/backend/src/types.\n- Responsive-First: Mobile-First approach is mandatory.\n- Safe Area: Handle iOS/Android safe area insets on every screen.\n- Performance: Target 60 FPS."
-        }
-      ],
-      "toolNames": [
-        "view_file",
-        "replace_file_content",
-        "write_to_file",
-        "run_command",
-        "grep_search",
-        "list_dir"
-      ]
-    }
-  }
-}

package/.enderun/agents/native.json

@@ -1,32 +0,0 @@
-{
-  "name": "native",
-  "displayName": "Native OS Integration Specialist",
-  "description": "Builds lightweight desktop wrappers and system integrations using Tauri or Electron.",
-  "role": "Native OS Integration Specialist",
-  "capability": 9,
-  "hidden": false,
-  "stateMachine": {
-    "schemaRef": "../schema/agent-lifecycle-schema.json"
-  },
-  "tags": [
-    "core"
-  ],
-  "customAgentSpec": {
-    "customAgent": {
-      "systemPromptSections": [
-        {
-          "title": "Instructions",
-          "content": "You are the native agent. Build secure, efficient desktop apps (Tauri/Electron).\n\n🛑 NON-NEGOTIABLE CORE RULES:\n- Security-First: No remote code execution. Mandatory sandboxing and strict CSP.\n- Secure Storage: Use Keychain/Credential Manager for sensitive data.\n- IPC Contract: All communication between frontend and native MUST be typed.\n- Contract-First: Define IPC and data contracts before implementation.\n- Surgical Edits: Use replace_text for all code changes."
-        }
-      ],
-      "toolNames": [
-        "view_file",
-        "replace_file_content",
-        "write_to_file",
-        "run_command",
-        "grep_search",
-        "list_dir"
-      ]
-    }
-  }
-}

package/.enderun/agents/quality.json

@@ -1,32 +0,0 @@
-{
-  "name": "quality",
-  "displayName": "Automated Testing & Quality Specialist",
-  "description": "Verifies test coverage, audits compliance with the constitution, conducts AST scanning, and verifies CI/CD status.",
-  "role": "Automated Testing & Quality Specialist",
-  "capability": 9,
-  "hidden": false,
-  "stateMachine": {
-    "schemaRef": "../schema/agent-lifecycle-schema.json"
-  },
-  "tags": [
-    "core"
-  ],
-  "customAgentSpec": {
-    "customAgent": {
-      "systemPromptSections": [
-        {
-          "title": "Instructions",
-          "content": "You are the quality agent. Ensure no code is merged or deployed without meeting standards.\n\n🛑 NON-NEGOTIABLE CORE RULES:\n- Final Gate: No code merges or deploys proceed without quality sign-off.\n- Verification-First: Audit lint, typecheck, contract drift, and branded types before sign-off.\n- Never Implement: Audit and assess only. Never write application features.\n- Zero Mock Policy: Integration tests must use real/service-compatible backends.\n- Coverage Gate: Reject approvals if coverage falls below >80% threshold in core."
-        }
-      ],
-      "toolNames": [
-        "view_file",
-        "replace_file_content",
-        "write_to_file",
-        "run_command",
-        "grep_search",
-        "list_dir"
-      ]
-    }
-  }
-}

package/.enderun/agents/schema/agent-lifecycle-schema.json

@@ -1,41 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "Agent Lifecycle State Machine Schema",
-  "type": "object",
-  "required": [
-    "initialState",
-    "states"
-  ],
-  "properties": {
-    "initialState": {
-      "type": "string"
-    },
-    "states": {
-      "type": "object",
-      "patternProperties": {
-        "^[a-zA-Z0-9_]+$": {
-          "type": "object",
-          "properties": {
-            "on": {
-              "type": "object",
-              "patternProperties": {
-                "^[a-zA-Z0-9_]+$": {
-                  "type": "string"
-                }
-              }
-            },
-            "actions": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            }
-          },
-          "required": [
-            "on"
-          ]
-        }
-      }
-    }
-  }
-}

package/.enderun/agents/security.json

@@ -1,32 +0,0 @@
-{
-  "name": "security",
-  "displayName": "Security & Cryptography Specialist",
-  "description": "Enforces authentication flows, CSP policies, credential rotation, RLS constraints, and cryptographic safety.",
-  "role": "Security & Cryptography Specialist",
-  "capability": 9,
-  "hidden": false,
-  "stateMachine": {
-    "schemaRef": "../schema/agent-lifecycle-schema.json"
-  },
-  "tags": [
-    "core"
-  ],
-  "customAgentSpec": {
-    "customAgent": {
-      "systemPromptSections": [
-        {
-          "title": "Instructions",
-          "content": "You are the security agent. Ensure all endpoints, database connections, and authentication flows satisfy strict enterprise compliance policies.\n\n🛑 NON-NEGOTIABLE CORE RULES:\n- Sandboxed Security First: Enforce Row Level Security (RLS) on all database tables.\n- Credential Rotation Policy: Credentials, keys, and tokens must never be hardcoded. Use vault/env variables.\n- CSP & CORS Strictness: Never open wildcards (*) for CORS or CSP policies.\n- Surgical Edits: Use replace_text for all security patches."
-        }
-      ],
-      "toolNames": [
-        "view_file",
-        "replace_file_content",
-        "write_to_file",
-        "run_command",
-        "grep_search",
-        "list_dir"
-      ]
-    }
-  }
-}

package/.enderun/cli-commands.json

@@ -1,76 +0,0 @@
-{
-  "commands": {
-    "init": {
-      "agent": "@manager",
-      "description": "Initialize the framework"
-    },
-    "status": {
-      "agent": "@manager",
-      "description": "Get project status"
-    },
-    "trace:new": {
-      "agent": "@manager",
-      "description": "Create new trace ID"
-    },
-    "check": {
-      "agent": "@quality",
-      "description": "Full health check"
-    },
-    "check:security": {
-      "agent": "@security",
-      "description": "Run security check"
-    },
-    "check:al": {
-      "agent": "@quality",
-      "description": "Full health check (includes AL validation)"
-    },
-    "validate": {
-      "agent": "@quality",
-      "description": "Run AL army validation (validate-agent-army)"
-    },
-    "validate-army": {
-      "agent": "@quality",
-      "description": "Run AL army validation (validate-agent-army)"
-    },
-    "frontend:dev": {
-      "agent": "@frontend",
-      "description": "Start frontend development server"
-    },
-    "frontend:build": {
-      "agent": "@frontend",
-      "description": "Build production assets"
-    },
-    "frontend:audit": {
-      "agent": "@frontend",
-      "description": "Analyze UI performance and tokens"
-    },
-    "mobile:dev": {
-      "agent": "@mobile",
-      "description": "Start Expo/RN packager"
-    },
-    "mobile:scaffold": {
-      "agent": "@mobile",
-      "description": "Generate mobile component scaffold"
-    },
-    "native:dev": {
-      "agent": "@native",
-      "description": "Start Tauri/Electron dev environment"
-    },
-    "explorer:graph": {
-      "agent": "@explorer",
-      "description": "Generate dependency graph"
-    },
-    "explorer:audit": {
-      "agent": "@explorer",
-      "description": "Codebase intelligence scan"
-    },
-    "git:commit": {
-      "agent": "@git",
-      "description": "Suggest semantic commit message"
-    },
-    "git:sync": {
-      "agent": "@git",
-      "description": "Sync with remote and handle conflicts"
-    }
-  }
-}

package/.enderun/config.json

@@ -1,13 +0,0 @@
-{
-  "logLevel": "info",
-  "outputFormat": "text",
-  "defaultProfile": "Lightweight",
-  "version": "1.1.2",
-  "paths": {
-    "backend": "apps/backend",
-    "frontend": "apps/web",
-    "docs": "docs",
-    "tests": "tests"
-  },
-  "_comment": "paths.backend and paths.frontend define WHERE apps will be scaffolded via create-app"
-}

package/.enderun/knowledge/ARCHITECTURE.md

@@ -1 +0,0 @@
-# Agent Enderun Architecture Rules

package/.enderun/knowledge/SECURITY.md

@@ -1 +0,0 @@
-# Agent Enderun Security Rules

package/.enderun/knowledge/SHIM_TEMPLATE.md

@@ -1,36 +0,0 @@
-**📌 Low-Usage Reference Material**
-
-This file is maintained as reference-only for the 12-agent army (template for platform shims).
-
-Per `.enderun/knowledge/token_economy_and_memory.md`:
-- Load on-demand only when creating or updating adapter shims (GEMINI.md, CLAUDE.md, etc.).
-- Prefer search or targeted reads over full inclusion in every context.
-- Not core to CLI runtime, init scaffolding, or mandatory every-session knowledge.
-
----
-
-# Agent Enderun — {{ADAPTER_NAME}} Adapter
-
-This is the primary entry point when using Agent Enderun within the {{PLATFORM_NAME}} ecosystem.
-
-The framework operates under a unified governance structure located in the `.enderun/` directory.
-
-### Primary Constitution
-All governance rules, agent checklists, and project memory live here:
-
-👉 **[.enderun/ENDERUN.md](.enderun/ENDERUN.md)**
-
-### 🤖 Agent Directive
-You are operating under the Agent Enderun governance framework.
-
-At the **start of every session**, before any work:
-1. **Restore Memory:** Read `.enderun/PROJECT_MEMORY.md` to restore state, active Trace ID, and history.
-2. **Load Identity:** Read the relevant agent definition under `.enderun/agents/{agent}.json` (default to `@manager`).
-3. **Internalize Knowledge:** Reference the `.enderun/knowledge/` base for architectural and coding standards.
-
-### 🛡️ Core Mandates
-- **Surgical Edits:** Use `replace_text` or `patch_file` via MCP for precise changes.
-- **Traceability:** Every action must inherit the active Trace ID from memory.
-- **Contract First:** No implementation without verified types.
-
-All paths and references inside the project must comply with the Supreme Constitution located at `.enderun/ENDERUN.md`.

package/.enderun/knowledge/analyst_reference_guide.md

@@ -1,31 +0,0 @@
-# @analyst — Contract Verification & Business Analyst Reference Guide
-
-Detailed instructions on checking contract drift, validating business requirements, and verifying architectural compliance with the Enderun Constitution. Reference this file during phase gates, type synchronization, and spec audits.
-
----
-
-## 🕵️ Contract Integrity Protocols
-
-### 1. Contract Drift Validation
-- Audit the synchronization between backend type specifications and frontend copy layers.
-- Check `contract.version.json` signatures against actual type exports.
-
-### 2. Business Spec Verification
-- Map user business requirements directly to implemented route types.
-- Reject any spec deviation or incomplete endpoint parameters.
-
----
-
-## 📋 Analyst Auditing Checklist (Mandatory)
-- [ ] **Types Sync:** Do backend types and frontend interfaces match perfectly?
-- [ ] **Contract Signature:** Is the SHA-256 contract hash inside `contract.version.json` up to date?
-- [ ] **Domain Error Usage:** Are all custom errors extending `DomainError` instead of generic `Error`?
-- [ ] **Branded Types:** Are IDs formatted as branded types (e.g., `UserID`) rather than plain strings?
-- [ ] **Constitutional Alignment:** Do all agent-assigned features respect the Zero Mock and Zero UI Library policies?
-
----
-
-## 📈 Quality Gate Verification
-1. **Verification Reports:** Log every audit session under the Trace ID.
-2. **Handoff Clearance:** Provide explicit sign-off to `@manager` before moving to the next Phase.
-3. **Audit Trail Logs:** Ensure that contract verification logs are preserved in `memory-graph/`.

package/.enderun/knowledge/async_error_handling.md

@@ -1,27 +0,0 @@
-# Async Error Handling & Resilience Pattern
-
-## 1. The Golden Rule
-Every asynchronous operation (Promises, `async/await`) MUST be wrapped in a `try/catch` block. Unhandled rejections are considered critical system failures.
-
-## 2. Bubble-Up Strategy
-Do not handle errors at the data access (Repository) layer unless translating a database-specific exception into a Domain Error.
-- **Repository:** Throw domain-specific errors (e.g., `NotFoundError`, `ConflictError`).
-- **Service:** Catch, add business context if needed, and re-throw.
-- **Controller:** Catch all domain errors, log them, and map them to standard HTTP responses (4xx, 5xx) using the centralized error handler.
-
-## 3. Resilience & Retry Logic
-For external API calls (e.g., Stripe, Twilio, 3rd party webhooks), implement an exponential backoff retry mechanism. Do not fail on the first network timeout.
-```typescript
-async function fetchWithRetry(url: string, options: any, retries = 3, delay = 1000) {
-  try {
-    return await api.get(url, options);
-  } catch (error) {
-    if (retries === 0 || (error.response && error.response.status < 500)) throw error;
-    await new Promise(res => setTimeout(res, delay));
-    return fetchWithRetry(url, options, retries - 1, delay * 2);
-  }
-}
-```
-
-## 4. Centralized Logging
-Never use `console.log`. All caught errors must be passed to a central structured logger (e.g., `pino` or `winston`) with the `traceId` for full observability.

package/.enderun/knowledge/backend_reference_guide.md

@@ -1,165 +0,0 @@
-# @backend — Reference & Implementation Guide
-
-This guide contains detailed architectural patterns, implementation standards, and reusable code structures for Agent Enderun projects. Reference this file via `read_file` only when implementing new features or debugging complex logic.
-
----
-
-## 🏗️ Standard Backend Patterns (Mandatory)
-
-The agent builds the project's backend infrastructure according to standardized patterns.
-
-### 1. Error System (DomainError Hierarchy)
-All errors must be based on `DomainError`. Standard hierarchy:
-
-- `DomainError` (base)
-  - `NotFoundError`
-  - `ValidationError`
-  - `UnauthorizedError`
-  - `ForbiddenError`
-  - `ConflictError`
-  - `InternalServerError`
-
-Each error class must follow this structure:
-```ts
-export class NotFoundError extends DomainError {
-  constructor(resource: string) {
-    super(`${resource} not found`, 404);
-  }
-}
-```
-
-**Rule:** Never use `throw new Error()`. Always use one of the DomainError subclasses.
-
-### 2. Branded Types (Mandatory)
-All IDs must be branded types to ensure complete type safety and prevent runtime errors.
-Example:
-```ts
-export type UserID = string & { __brand: 'UserID' };
-export type OrderID = string & { __brand: 'OrderID' };
-// Alternative Brand utility
-export type Brand<T, B> = T & { __brand: B };
-export type ProjectID = Brand<string, 'ProjectID'>;
-```
-Using plain `string` or `number` IDs is strictly forbidden where a specific ID is expected.
-
-### 3. Types Structure (Standard)
-The `apps/backend/src/types/` directory must be organized as follows:
-- `brands.ts` → Branded ID types
-- `models.ts` → Domain models
-- `api.ts` → Request/Response types
-- `constants.ts` → Constant values
-- `logs.ts` → Log types
-
-### 4. Error Handler Middleware
-All routes must use a global error handler. Errors must be returned in the standard JSON format:
-```json
-{
-  "error": {
-    "message": "User not found",
-    "code": 404,
-    "details": {}
-  }
-}
-```
-
-### 5. API Design Rules
-1. **Versioned Routes**: All APIs must start with `/api/v1/`.
-2. **Kebab-Case**: Use kebab-case for URL paths.
-3. **Standard Responses**: Always wrap data in `{ data, traceId, timestamp }`.
-4. **Method Discipline**: GET (read), POST (create), PUT (update), DELETE (remove).
-
-### 6. Repository Pattern Standards
-- **Purpose**: Decouple the data access logic from the business logic. This ensures that changes in the database schema or ORM do not break the entire application.
-- **Principles**:
-  1. **Abstraction**: Use interfaces to define the repository contract.
-  2. **Implementation**: Use Kysely or preferred ORM for actual DB calls.
-  3. **Single Responsibility**: One repository per domain entity.
-
----
-
-## Architecture Thinking (At the Beginning of Every Task)
-
-Clarify the following before writing code:
-
-- **Domain:** What business concept does this feature represent?
-- **Contract:** Are the app's types in `apps/backend/src/types` up to date? Is there a type for this entity?
-- **Layer:** Which layer is affected — Route → Controller → Service → Repository → DB?
-- **Side Effects:** Does it trigger an event, send an email, or update another table?
-- **Security:** Is authentication required? Which role/permission?
-
----
-
-## Mandatory Layered Architecture
-
-```
-Route (Fastify)
-  └─ Controller         ← Input validation, response shaping
-       └─ Service        ← Business logic, orchestration
-            └─ Repository ← ONLY Kysely queries (raw SQL forbidden)
-                 └─ Database (PostgreSQL)
-```
-
----
-
-## 🏗️ Base Architecture & Code Reuse (Standard)
-
-To eliminate code repetition, all backend development MUST follow the **Base Pattern**. Agents are not allowed to write redundant CRUD logic.
-
-**Standard Patterns:**
-1. **Base Repository:** Use a centralized repository logic for common Kysely operations (findById, findMany, create, update, softDelete).
-2. **Base Service:** Orchestrate business logic using reusable services.
-3. **Typed Config:** Always access environment variables through a centralized, typed configuration object or service. Never use `process.env` directly in domain logic.
-
----
-
-## 🕵️ Automatic Audit Logging (Mandatory)
-
-Every "mutation" (CREATE, UPDATE, DELETE) MUST trigger an audit log entry.
-- **Traceability:** Link every audit log to the active **Trace ID**.
-- **State Capture:** For updates, capture both `previousState` and `newState`.
-- **User Context:** Identify the `UserID` performing the action.
-
----
-
-## Kysely Standards & Migration Template
-
-```typescript
-// ✅ Correct: Type-safe query
-const user = await db.selectFrom('users').where('id', '=', userId)
-  .select(['id', 'email', 'name']).executeTakeFirstOrThrow();
-
-// Kysely Migration Template
-export async function up(db: Kysely<unknown>): Promise<void> {
-  await db.schema
-    .createTable("table_name")
-    .addColumn("id", "char(26)", (col) => col.primaryKey()) // ULID standard (26 characters)
-    .addColumn("created_at", "timestamptz", (col) =>
-      col.defaultTo(sql`now()`).notNull(),
-    )
-    .execute();
-}
-```
-
----
-
-## 🚨 API CONTRACT WRITING REQUIREMENT (CRITICAL)
-
-**`.enderun/docs/api/` MUST be updated after every new endpoint or change.**
-
-### Document Template:
-```markdown
-### [METHOD] /api/[path]
-
-- Description: What does this endpoint do?
-- Auth: Required? Which role?
-- Request Body / Query Params:
-  ```typescript
-  // Type definition or example
-  ```
-```
-
----
-
-## 🧩 Backend Capability Expansion
-- **Contract-First Growth:** Each backend task should ask if it can also improve contract coverage, documentation, or validation logic.
-- **Reusable Services:** When building business logic, define services that can be reused by future endpoints.

package/.enderun/knowledge/blueprint_driven_construction.md

@@ -1,22 +0,0 @@
-# Blueprint-Driven Construction & Evolution
-
-## Overview
-Blueprint-Driven Construction is the primary method for building and expanding the Agent Enderun ecosystem. It ensures that every new application or feature is built upon a "Gold Standard" foundation.
-
-## Core Mechanics
-
-### 1. Discovering Capabilities
-Agents must use the `list_blueprints` tool to find existing architectural patterns, UI components, and logic hooks before writing any code.
-
-### 2. Instantiating Standards
-Once a blueprint is identified, the `instantiate_blueprint` tool is used to clone the template into the target application directory.
-- **Example:** Cloning `backend/errors` into `apps/backend/src/errors`.
-
-### 3. Dynamic Evolution (Capability Growth)
-When an agent develops a high-quality, reusable solution (e.g., a complex data table or a specific auth service), they MUST save it as a new blueprint using the `save_as_blueprint` tool.
-- **Goal:** The `blueprints/` directory is not static; it grows as the project tackles more complex challenges.
-
-## Guidelines for Agents
-- **Consistency first:** Always check for a blueprint before building from scratch.
-- **Refinement:** If an existing blueprint is outdated, update it via `save_as_blueprint` after a successful implementation.
-- **Documentation:** Always provide a description when saving a new blueprint to help other agents understand its purpose.