agent-enderun 1.10.2 → 1.11.0

package/src/shared/constants.ts

@@ -0,0 +1,212 @@
+/**
+ * Agent Enderun — Single Source of Truth for framework constants.
+ * Import from here instead of hardcoding paths, phases, or directory names.
+ */
+
+// ─── Framework identity ───────────────────────────────────────────────────────
+
+export const FRAMEWORK = {
+    NAME: "Agent Enderun",
+    CORE_DIR: ".enderun",
+    UNIFIED_HUB_DIR: ".agents",
+    CONSTITUTION_FILE: "ENDERUN.md",
+    DEFAULT_TRACE_ID: "T-000",
+    DEFAULT_PHASE: "PHASE_0",
+    DEFAULT_MANAGER_STATE: "ACTIVE",
+} as const;
+
+export const PROJECT_PHASES = [
+    "PHASE_0",
+    "PHASE_1",
+    "PHASE_2",
+    "PHASE_3",
+    "PHASE_4",
+] as const;
+
+// ─── Adapter platform directories (native / legacy) ───────────────────────────
+
+export const ADAPTER_DIRS = {
+    GEMINI: ".gemini",
+    CLAUDE: ".claude",
+    GROK: ".grok",
+    CURSOR: ".cursor",
+    CODEX: ".agents",
+    ANTIGRAVITY: ".antigravity",
+    LEGACY_AGENT: ".agent",
+} as const;
+
+/** Priority order for framework directory resolution (CLI + MCP). */
+export const FRAMEWORK_DIR_CANDIDATES = [
+    FRAMEWORK.CORE_DIR,
+    ADAPTER_DIRS.CODEX,
+    ADAPTER_DIRS.CLAUDE,
+    ADAPTER_DIRS.GEMINI,
+    ADAPTER_DIRS.GROK,
+    ADAPTER_DIRS.CURSOR,
+    ADAPTER_DIRS.ANTIGRAVITY,
+] as const;
+
+/** Slug under `.agents/{slug}/` for each adapter in unified mode. */
+export const UNIFIED_ADAPTER_SLUG = {
+    gemini: "gemini",
+    claude: "claude",
+    grok: "grok",
+    cursor: "cursor",
+    codex: "codex",
+    "antigravity-cli": "antigravity",
+} as const;
+
+export type UnifiedAdapterSlug = keyof typeof UNIFIED_ADAPTER_SLUG;
+
+// ─── Native agent instruction paths (legacy tool compatibility) ───────────────
+
+export const NATIVE_AGENT_PATHS = {
+    gemini: pathJoin(ADAPTER_DIRS.GEMINI, "agents"),
+    claude: pathJoin(ADAPTER_DIRS.CLAUDE, "agents"),
+    grok: pathJoin(ADAPTER_DIRS.GROK, "agents"),
+    cursor: pathJoin(ADAPTER_DIRS.CURSOR, "rules"),
+    codex: pathJoin(ADAPTER_DIRS.CODEX, "instructions"),
+    "antigravity-cli": pathJoin(ADAPTER_DIRS.ANTIGRAVITY, "agents"),
+} as const;
+
+/** Legacy layout bases used by `check` and discovery (non-unified installs). */
+export const LEGACY_AGENT_LAYOUT_BASES = [
+    NATIVE_AGENT_PATHS.gemini,
+    NATIVE_AGENT_PATHS.claude,
+    NATIVE_AGENT_PATHS.cursor,
+    NATIVE_AGENT_PATHS.grok,
+    NATIVE_AGENT_PATHS.codex,
+    NATIVE_AGENT_PATHS["antigravity-cli"],
+] as const;
+
+// ─── Framework internal subdirectories (under `.enderun/`) ──────────────────
+
+export const FRAMEWORK_SUBDIRS = {
+    AGENTS: "agents",
+    SKILLS: "skills",
+    KNOWLEDGE: "knowledge",
+    PROMPTS: "prompts",
+    MEMORY: "memory",
+    ROUTER: "router",
+    REGISTRY: "registry",
+    OBSERVABILITY: "observability",
+    RULES: "rules",
+    MESSAGES: "messages",
+    LOGS: "logs",
+    MEMORY_GRAPH: "memory-graph",
+} as const;
+
+export const CORE_SCAFFOLD_SUBDIRS = [
+    FRAMEWORK_SUBDIRS.KNOWLEDGE,
+    FRAMEWORK_SUBDIRS.PROMPTS,
+    FRAMEWORK_SUBDIRS.MEMORY,
+    FRAMEWORK_SUBDIRS.ROUTER,
+    FRAMEWORK_SUBDIRS.REGISTRY,
+    FRAMEWORK_SUBDIRS.OBSERVABILITY,
+    FRAMEWORK_SUBDIRS.RULES,
+] as const;
+
+export const RUNTIME_SUBDIRS = [
+    FRAMEWORK_SUBDIRS.MESSAGES,
+    FRAMEWORK_SUBDIRS.LOGS,
+    FRAMEWORK_SUBDIRS.MEMORY_GRAPH,
+] as const;
+
+export const MEMORY_SUBDIRS = {
+    TASKS: "tasks",
+    HISTORY: "history",
+} as const;
+
+export const MEMORY_FILES = {
+    STATE: "state.json",
+    STATUS: "status.json",
+    PROJECT_MEMORY: "PROJECT_MEMORY.md",
+    SHARED_FACTS: "shared-facts.json",
+} as const;
+
+// ─── Monorepo default paths ───────────────────────────────────────────────────
+
+export const DEFAULT_MONOREPO_PATHS = {
+    backend: "apps/backend",
+    frontend: "apps/web",
+    mobile: "apps/mobile",
+    docs: "docs",
+    tests: "tests",
+} as const;
+
+/** Cursor rule globs per agent role (monorepo layout). */
+export const CURSOR_AGENT_GLOBS: Record<string, string> = {
+    backend: `${DEFAULT_MONOREPO_PATHS.backend}/**/*`,
+    frontend: `${DEFAULT_MONOREPO_PATHS.frontend}/**/*`,
+    database: `${DEFAULT_MONOREPO_PATHS.backend}/src/database/**/*`,
+    mobile: `${DEFAULT_MONOREPO_PATHS.mobile}/**/*`,
+    native: "apps/native/**/*",
+    quality: "*",
+    security: "*",
+    devops: "*",
+    explorer: "*",
+    git: "*",
+    analyst: "*",
+    manager: "*",
+};
+
+// ─── MCP & environment ──────────────────────────────────────────────────────
+
+export const MCP = {
+    SERVER_NAME: "agent-enderun",
+    ROOT_CONFIG_FILE: "mcp.json",
+    PROJECT_ROOT_ENV: "ENDERUN_PROJECT_ROOT",
+    TEST_DIR_ENV: "ENDERUN_TEST_DIR",
+} as const;
+
+export const ROOT_CONFIG_FILES = {
+    MCP: MCP.ROOT_CONFIG_FILE,
+    DOT_MCP: ".mcp.json",
+    ENV_EXAMPLE: ".env.example",
+    VSCODE_MCP: ".vscode/mcp.json",
+} as const;
+
+// ─── Shim template placeholders ───────────────────────────────────────────────
+
+export const TEMPLATE_PLACEHOLDERS = {
+    FRAMEWORK_DIR: "{{FRAMEWORK_DIR}}",
+    ADAPTER: "{{ADAPTER}}",
+    BACKEND_DIR: "{{BACKEND_DIR}}",
+    FRONTEND_DIR: "{{FRONTEND_DIR}}",
+    DOCS_DIR: "{{DOCS_DIR}}",
+    TESTS_DIR: "{{TESTS_DIR}}",
+} as const;
+
+// ─── File extensions ─────────────────────────────────────────────────────────
+
+export const AGENT_FILE_EXT = {
+    MARKDOWN: ".md",
+    CURSOR_RULE: ".mdc",
+} as const;
+
+// ─── Path helpers ─────────────────────────────────────────────────────────────
+
+export function pathJoin(...segments: string[]): string {
+    return segments.filter(Boolean).join("/");
+}
+
+export function corePath(...segments: string[]): string {
+    return pathJoin(FRAMEWORK.CORE_DIR, ...segments);
+}
+
+export function unifiedHubPath(...segments: string[]): string {
+    return pathJoin(FRAMEWORK.UNIFIED_HUB_DIR, ...segments);
+}
+
+export function unifiedAdapterPath(slug: string, ...segments: string[]): string {
+    return unifiedHubPath(slug, ...segments);
+}
+
+export function knowledgePath(filename: string): string {
+    return corePath(FRAMEWORK_SUBDIRS.KNOWLEDGE, filename);
+}
+
+/** Backward-compatible aliases */
+export const CORE_FRAMEWORK_DIR = FRAMEWORK.CORE_DIR;
+export const UNIFIED_HUB_DIR = FRAMEWORK.UNIFIED_HUB_DIR;
+export const SKILLS_HUB_PATH = pathJoin(UNIFIED_HUB_DIR, FRAMEWORK_SUBDIRS.SKILLS);

package/templates/prompts/bug-fix-recipe.md

@@ -0,0 +1,20 @@
+# 🐞 Scientific Debugging (Bug-Fix) Recipe
+
+This recipe defines how to autonomously detect and permanently resolve a bug.
+
+## 1. Reproduction
+- Analyze the logs (`audit_log.md`) that reported the error.
+- Write the smallest test case (failing test) that triggers the error.
+
+## 2. Root Cause Analysis
+- Check system resources with `get_system_health`.
+- Verify the status of services with `check_active_ports`.
+- Examine relevant code blocks line by line using `read_file`.
+
+## 3. Surgical Fix
+- Perform only the surgical intervention that will fix the error.
+- Check if there is a missing variable in ".env".
+
+## 4. Permanent Solution
+- Verify that the test you wrote passes.
+- If `quality-standards.md` needs to be updated to prevent similar errors, submit a proposal.

package/templates/prompts/contract-design-recipe.md

@@ -0,0 +1,21 @@
+# 📜 Engineering Recipe: Contract-First Design
+
+This recipe governs the @architect agent's protocol for creating type-safe agreements between system layers.
+
+## 🏁 Phase 1: Requirement Alignment
+1.  **Analysis:** Read user requirements and Business Analyst (@analyst) reports.
+2.  **Scope Discovery:** Identify the domain objects, actions, and events required for the feature.
+
+## 📐 Phase 2: Technical Modeling
+1.  **Branded Types:** Define semantic IDs in `src/types/brands.ts` (e.g., `OrderId`, `ProductSKU`).
+2.  **Domain Models:** Create or update interfaces in `src/types/models.ts`. Ensure they extend `BaseEntity`.
+3.  **Constants:** Update `src/types/constants.ts` for enums and fixed state values.
+
+## 🔏 Phase 3: Hash Sealing
+1.  **Integrity Check:** Run `agent-enderun verify-contract` to check existing state.
+2.  **Commitment:** Run `agent-enderun update-contract` to generate new SHA-256 signatures for the updated types.
+3.  **Audit:** Verify that `contract.version.json` accurately reflects the new architecture.
+
+## 📡 Phase 4: Synchronization
+1.  **Distribution:** Ensure the updated `src/types` directory is correctly linked or copied to both Frontend and Backend projects.
+2.  **Verification:** Trigger @backend and @frontend agents to read the new contract and plan their implementations.

package/templates/prompts/db-management-recipe.md

@@ -0,0 +1,25 @@
+# 🗄️ Engineering Recipe: Database Management & Migrations
+
+This recipe governs the @database agent's protocol for schema creation, table modifications, and data integrity.
+
+## 📐 Phase 1: Contract-First Definition
+1.  **Type Mapping:** Define the new table or column in `src/types/models.ts` using Branded Types for IDs.
+2.  **Validation:** Ensure the interface extends `BaseEntity` (id, createdAt, updatedAt).
+
+## 🚀 Phase 2: Migration Generation
+1.  **Scripting:** Write a reversible migration (up/down) using the project's migration tool (e.g., Kysely or SQL).
+2.  **Atomic Changes:** One migration per logical feature. Never bundle unrelated schema changes.
+3.  **Naming:** Use timestamp-prefixed naming (e.g., `20240101_add_customers_table.ts`).
+
+## 🧱 Phase 3: Infrastructure Setup (If New DB)
+1.  **Initialization:** Verify the connection string in `.env`.
+2.  **Health Check:** Run `check_active_ports` to ensure the DB engine is reachable.
+
+## 🛠️ Phase 4: Implementation & Repository Update
+1.  **Repo Layer:** Create or update the Repository class to include the new query logic.
+2.  **Strict Mode:** Ensure no raw SQL is used; leverage the query builder exclusively.
+
+## ✅ Phase 5: Verification & Zero-Downtime Audit
+1.  **Dry Run:** If supported, dry-run the migration to check for locking issues.
+2.  **Validation:** Run `agent-enderun verify-contract` to ensure code and schema are synced.
+3.  **Handoff:** Update `PROJECT_MEMORY.md` with the new schema version.

package/templates/prompts/deployment-recipe.md

@@ -0,0 +1,23 @@
+# 🚀 Engineering Recipe: Infrastructure Deployment
+
+This recipe governs the @devops agent's protocol for safe, traceable, and reversible system rollouts.
+
+## 🏁 Phase 1: Pre-Deployment Environment Audit
+1.  **Integrity Check:** Run `agent-enderun check` to ensure all discipline rules are met.
+2.  **Health Scan:** Execute `get_system_health` and `check_active_ports` on the target environment.
+3.  **Config Sync:** Verify that all keys in `.env.example` are present in the target environment's secrets manager.
+
+## 🧱 Phase 2: Build & Validation
+1.  **Compilation:** Run `npm run build` and capture any stderr.
+2.  **Contract Verify:** Run `agent-enderun verify-contract` to ensure FE/BE synchronization.
+3.  **Test Suite:** Execute the full test battery. Failure in a single test blocks deployment.
+
+## 📡 Phase 3: Controlled Rollout
+1.  **Atomic Swap:** Deploy the new bundle/service using the project's orchestration scripts.
+2.  **Database Sync:** If migrations are pending, follow the `db-management-recipe.md` first.
+3.  **Log Monitoring:** Tail `logs/manager.json` for immediate post-deploy spikes in errors.
+
+## ✅ Phase 4: Post-Deploy & Rollback Readiness
+1.  **Observability:** Verify system metrics stabilize within 5 minutes.
+2.  **Traceability:** Record the deployment Trace ID and commit hash in `PROJECT_MEMORY.md`.
+3.  **Rollback Check:** Ensure the previous stable version is tagged and reachable in Git.

package/templates/prompts/new-feature-recipe.md

@@ -0,0 +1,19 @@
+# ✨ New Feature Development Recipe
+
+The "Nizam-ı Enderun" steps to follow when adding a new module or feature.
+
+## 1. Contract Design (Phase 1)
+- First, update the `contract.version.json` file and the relevant TypeScript types.
+- Do not start writing code without getting approval from `@architect`.
+
+## 2. Mock-Free Development (Phase 2)
+- Add the new feature to the correct directory under `apps/backend` or `apps/web`.
+- If database changes are required, coordinate with the `@database` agent.
+
+## 3. Responsive & i18n (Phase 3)
+- Use `{ base: '...', md: '...' }` responsive syntax in frontend developments.
+- Move all texts to the `locales/` directory immediately.
+
+## 4. Completion (Phase 4)
+- Ensure no TODOs remain using `get_project_gaps`.
+- Verify that you haven't created any new package pollution with `audit_dependencies`.

package/templates/prompts/performance-optimization-recipe.md

@@ -0,0 +1,23 @@
+# ⚡ Engineering Recipe: Performance Optimization
+
+This recipe governs the protocol for identifying and resolving system bottlenecks (Frontend, Backend, or Database).
+
+## 📊 Phase 1: Profiling & Bottleneck Identification
+1.  **Metric Collection:** Read `observability/metrics.json` or run `get_system_health`.
+2.  **Log Audit:** Scan `logs/manager.json` for slow actions or timeouts.
+3.  **Trace Analysis:** Use `TraceID` to follow a slow request through all layers.
+
+## 🧠 Phase 2: Root Cause Analysis
+1.  **SQL Audit:** Check for N+1 query patterns or missing indexes in `repository/` files.
+2.  **Algorithm Audit:** Scan for O(n²) loops or heavy synchronous operations.
+3.  **Frontend Audit:** Check for unnecessary re-renders or massive bundle sizes.
+
+## 🛠️ Phase 3: Surgical Optimization
+1.  **DB Level:** Add missing indexes or refactor complex joins.
+2.  **Logic Level:** Implement caching (e.g., Redis or in-memory) for frequent read operations.
+3.  **UI Level:** Apply memoization, virtualization (FlashList), or code-splitting.
+
+## ✅ Phase 4: Validation & Comparison
+1.  **Benchmarking:** Re-run the action and compare new metrics with the baseline.
+2.  **Regression Check:** Run `agent-enderun check` and existing tests to ensure logic is intact.
+3.  **Knowledge Update:** Record the optimization strategy in `knowledge/performance-history.md`.

package/templates/prompts/pull-request-template.md

@@ -0,0 +1,21 @@
+# 📦 Pull Request Title: [TRC-{TraceId}] Brief Description
+
+## 📝 Summary
+<!-- What did you change and why? -->
+
+## 🔗 Related Tasks
+- **Trace ID:** [Link to Trace/Task or ID]
+- **Issue:** [Link to issue if applicable]
+
+## 🛡️ Governance & Compliance Checklist
+- [ ] Code passes `npm run enderun:test`.
+- [ ] Code passes `npm run enderun:check` (Compliance Scanner).
+- [ ] No `any` type usage added.
+- [ ] No secrets or hardcoded API keys.
+- [ ] New functionality is registered in `src/modules/agents/definitions.ts` (if applicable).
+
+## 🧪 Testing Notes
+<!-- How did you verify the fix? -->
+
+## 🛠️ Risk Assessment
+<!-- Any potential side effects? -->

package/templates/prompts/refactoring-recipe.md

@@ -0,0 +1,21 @@
+# 🛠️ Surgical Refactoring Recipe
+
+This recipe defines how to modernize existing code without breaking other parts of the project.
+
+## 1. Reconnaissance
+- Use `grep_search` to find all references to the function to be refactored.
+- Understand the module's dependency graph with `get_project_map`.
+- Verify the baseline by running existing tests (`run_tests`).
+
+## 2. Planning (Strategy)
+- Break the change into small, atomic steps.
+- Define new types and interfaces first.
+
+## 3. Surgical Execution
+- **RULE:** Never delete a file completely. Only use `replace_text` or `batch_surgical_edit`.
+- Maintain type safety (ban on `any`) at every step.
+- Update `PROJECT_MEMORY.md` after every major change.
+
+## 4. Validation
+- Ensure no regressions occurred using `run_tests`.
+- Audit code quality with the `@quality` agent.

package/templates/prompts/security-audit-recipe.md

@@ -0,0 +1,20 @@
+# 🛡️ Engineering Recipe: Advanced Security Audit
+
+This recipe governs the @security agent's protocol for identifying and mitigating vulnerabilities within the Agent Enderun framework.
+
+## 🏁 Phase 1: Automated Reconnaissance
+1.  **Secret Scan:** Run `grep_search` for keywords: `apiKey`, `secret`, `password`, `token`, `private_key`.
+2.  **SQL Injection Audit:** Scan for `raw SQL` or template literals bypassing the query builder.
+3.  **Auth Check:** Verify that all sensitive routes have active `auth` guards and Role-Based Access Control (RBAC).
+
+## 🧠 Phase 2: Contextual Analysis
+1.  **Impact Mapping:** For every identified risk, read the surrounding code to determine if it's exposed to the public internet.
+2.  **Configuration Check:** Verify `.env.example` contains all required keys and no real secrets are committed to Git.
+
+## 🛠️ Phase 3: Surgical Mitigation
+1.  **Fix:** Use `replace_text` to move hardcoded secrets to `.env` or refactor raw SQL to Kysely.
+2.  **Sanitization:** Apply input validation using Zod schemas for all external data.
+
+## ✅ Phase 4: Verification & Logging
+1.  **Discipline Check:** Run `agent-enderun check` to ensure no new violations were introduced.
+2.  **Action Log:** Execute `log_agent_action` with a summary of found vs. fixed vulnerabilities.

package/templates/standards/architecture-standards.md

@@ -0,0 +1,23 @@
+# 📐 Corporate Architecture Standards (AL Framework)
+
+This project is developed in accordance with the "Nizam-ı Mimari" (Architectural Order) rules defined by Agent Enderun.
+
+## 1. Directory Structure (Monorepo Standard)
+- `apps/backend/`: Business logic, API, and database layers.
+- `apps/web/`: Frontend (React/Next.js) layer.
+- `packages/shared/`: Type definitions and helpers shared between Backend and Frontend.
+
+## 2. Layered Architecture
+All business logic must follow this hierarchy:
+1. **Routes/Controllers:** API entry points and request validation.
+2. **Services:** Where business logic is coordinated.
+3. **Repositories/Models:** Database access and raw data mutations.
+
+## 3. Type Safety and Contracts
+- The hash in the `contract.version.json` file must always match the active code.
+- The use of the `any` type is strictly forbidden.
+- All asynchronous operations must be wrapped in `try-catch` blocks and proper error management (ErrorHandler).
+
+## 4. AL (Agent Lifecycle) Phase Discipline
+- Development progresses sequentially from Phase 0 to Phase 4.
+- Application code (Phase 2) cannot be written before contracts are approved (Phase 1).

package/templates/standards/auth-standards.md

@@ -0,0 +1,125 @@
+# Authentication & Authorization Standards
+
+> JWT + bcrypt authentication and role-based access control for Fastify APIs.
+
+## Overview
+
+Enterprise-grade authentication system using JSON Web Tokens (JWT) for stateless authentication and bcrypt for secure password hashing.
+
+## Setup
+
+```bash
+# Required dependencies
+npm install bcrypt jsonwebtoken
+npm install -D @types/bcrypt @types/jsonwebtoken
+```
+
+## Token Management
+
+```typescript
+import jwt from "jsonwebtoken";
+
+const JWT_SECRET = process.env.JWT_SECRET || "change-me-in-production";
+const JWT_EXPIRES_IN = process.env.JWT_EXPIRES_IN || "24h";
+
+interface AuthPayload {
+  sub: string;     // User ID
+  email: string;   // User email
+  role: string;    // User role (ADMIN, DEVELOPER, VIEWER)
+  iat?: number;    // Issued at
+  exp?: number;    // Expires at
+}
+
+export function generateToken(payload: AuthPayload): string {
+    return jwt.sign(payload, JWT_SECRET, { expiresIn: JWT_EXPIRES_IN });
+}
+
+export function verifyToken(token: string): AuthPayload {
+    return jwt.verify(token, JWT_SECRET) as AuthPayload;
+}
+```
+
+## Middleware
+
+```typescript
+import type { FastifyRequest, FastifyReply } from "fastify";
+
+export async function authenticate(
+    request: FastifyRequest,
+    reply: FastifyReply,
+): Promise<void> {
+    const authHeader = request.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+        throw new UnauthorizedError("Missing authorization header");
+    }
+    const token = authHeader.slice(7);
+    const payload = verifyToken(token);
+    (request as any).user = payload;
+}
+
+export function requireRole(...roles: string[]) {
+    return async (request: FastifyRequest, reply: FastifyReply) => {
+        const user = (request as any).user as AuthPayload;
+        if (!user || !roles.includes(user.role)) {
+            throw new ForbiddenError("Insufficient permissions");
+        }
+    };
+}
+```
+
+## Password Security
+
+```typescript
+import bcrypt from "bcrypt";
+
+const SALT_ROUNDS = 12;
+
+// Hash password for storage
+export async function hashPassword(password: string): Promise<string> {
+    return bcrypt.hash(password, SALT_ROUNDS);
+}
+
+// Verify password against hash
+export async function verifyPassword(
+    password: string,
+    hash: string,
+): Promise<boolean> {
+    return bcrypt.compare(password, hash);
+}
+```
+
+## CRUD Governance Integration
+
+Admin-level mutations (user creation, role changes, schema modifications) **MUST** follow the CRUD Governance protocol:
+- Route through `@manager` for approval
+- Require human sign-off via `agent-enderun approve <traceId>`
+- Log all authorization decisions
+
+## API Endpoints
+
+| Method | Path | Auth Required | Role Required | Description |
+|--------|------|:------------:|:------------:|-------------|
+| POST | `/api/v1/auth/register` | No | No | Create new user |
+| POST | `/api/v1/auth/login` | No | No | Login & get token |
+| GET | `/api/v1/auth/me` | Yes | No | Get current user |
+| PUT | `/api/v1/auth/password` | Yes | No | Change password |
+
+## Environment Variables
+
+```bash
+JWT_SECRET=your-secret-key-at-least-32-chars-long
+JWT_EXPIRES_IN=24h
+```
+
+## Best Practices
+
+1. **Password Hashing**: Always use bcrypt with minimum 12 salt rounds
+2. **Token Expiry**: Use short-lived tokens (24h max). Implement refresh tokens for longer sessions
+3. **Secret Rotation**: Rotate JWT_SECRET periodically in production
+4. **Rate Limiting**: Apply rate limiting on login/register endpoints to prevent brute force
+5. **HTTPS Only**: Never transmit tokens over unencrypted connections
+6. **Password Strength**: Enforce minimum password requirements (8+ chars, mixed case, numbers)
+7. **Audit Logging**: Log all authentication attempts (success/failure) for security monitoring
+8. **No Plain Text**: Never log or store passwords in plain text
+9. **Token Storage**: Store tokens securely (httpOnly cookies for web, secure storage for mobile)
+10. **Role Hierarchy**: ADMIN > MANAGER > DEVELOPER > VIEWER — validate permissions at each level

package/templates/standards/crud-governance.md

@@ -0,0 +1,21 @@
+# 🏛️ Corporate CRUD and Governance Standards
+
+This document defines the strict rules applicable to data mutation and administrative operations in projects managed by the Agent Enderun army.
+
+## 1. High-Risk Operations
+The following operations are considered "High-Risk" and cannot be performed autonomously by specialist agents (@backend, @database, etc.):
+- Database schema changes (DDL).
+- Bulk data deletion or purging (Bulk Delete/Purge).
+- User authorization and role assignment systems.
+- Payment system (Billing) integrations.
+- PII (Personal Data) export.
+
+## 2. Approval Flow
+- When a specialist agent receives a high-risk operation request, they must reject the operation and report the status to `@manager`.
+- `@manager` analyzes the request and creates a task awaiting `managerApproval`.
+- The operation is held until a human overseer (Human-in-the-Loop) grants approval via the `agent-enderun approve [TraceID]` command.
+
+## 3. Data Discipline
+- **Branded Types:** All IDs (UserID, OrderID, etc.) must strictly follow the branded types format.
+- **Kysely Only:** Raw SQL queries are forbidden. Only the type-safe Kysely query builder may be used.
+- **Repository Pattern:** Database operations cannot be performed directly within controllers; they must pass through the service and repository layers.

package/templates/standards/deployment-standards.md

@@ -0,0 +1,21 @@
+# 🚀 Deployment and Release Standards
+
+This document outlines the protocols for deploying, updating, and rolling back services managed by Agent Enderun.
+
+## 1. Release Strategy
+- **Version Control:** All releases must follow Semantic Versioning (SemVer) and be tagged in Git with the format `vX.Y.Z`.
+- **Atomic Commits:** Each deployment must be linked to a specific Git commit, which itself must contain a `Trace ID` in the commit message.
+
+## 2. Deployment Workflow
+- **CI/CD Integration:** Every deployment must pass the `npm run enderun:test` and `npm run enderun:check` pipeline.
+- **Environment Isolation:** Deployments must use environment-specific configurations (.env.{env}) and never cross-pollinate variables.
+
+## 3. Rollback Procedures (The Hermes Safety Valve)
+- **Immediate Rollback:** If a deployment causes an escalation alert from an agent or a production failure, a rollback must be initiated within 5 minutes.
+- **Git Revert Strategy:** 
+    - Rollbacks are executed by checking out the previous stable tag (e.g., `git checkout v1.0.9`).
+    - A "Fix-Forward" approach is only allowed for P0 security patches; otherwise, "Revert-First" is the law.
+- **Database Safety:** 
+    - Every Migration script must strictly include a corresponding `down()` or `revert()` path.
+    - Database rollbacks must be tested in the staging environment before production execution.
+- **Post-Mortem Requirement:** Every rollback triggers an automatic `@manager` task to create a `docs/post-mortems/TRACE_ID.md` report.

package/templates/standards/frontend-standards.md

@@ -0,0 +1,37 @@
+# 🎨 Corporate Frontend and Responsive Standards
+
+This document defines the UI/UX standards for projects managed by Agent Enderun. All interfaces must comply with "Mobile-First", "Fluid Responsive", and "Cross-Device Adaptive" principles.
+
+## 1. Design System: Panda CSS & Tailwind Integration
+- **Zero UI Library:** Heavy external UI libraries like Ant Design or MUI are not used. All styles are written with type-safe **Panda CSS** or structured **Tailwind CSS**.
+- **Token Usage:** Colors, spacing, and font sizes must be managed via the `token()` function or standard CSS variables.
+- **Responsive Syntax:** Object-based responsive syntax is mandatory:
+  ```typescript
+  css({
+    width: { base: '100%', md: '50%', lg: '33.33%' },
+    padding: { base: '4', md: '8' }
+  })
+  ```
+
+## 2. Mobile-First and Fluid Design
+- **Mobile-First Approach:** Styles must always be written for the smallest screen size (`base`), then expanded to larger screens using `sm`, `md`, `lg`, `xl`, and `2xl` breakpoints.
+- **Fluid Grid & Flexbox:** Layouts should not be restricted by fixed widths. `flex-wrap` and CSS Grid (`grid-template-columns: repeat(auto-fit, minmax(280px, 1fr))`) are preferred.
+- **Fluid Typography:** Font sizes should scale dynamically based on screen width:
+  ```css
+  font-size: clamp(1rem, 2vw + 0.5rem, 2rem);
+  ```
+- **Container Bounds:** The main body of the page must have responsive padding and a maximum width limit (standard of `1280px` or `1440px`).
+
+## 3. Viewport Safety
+- **Overflow Guard:** Horizontal scrollbars are strictly forbidden. `box-sizing: border-box` must be applied to all elements, and widths must be restricted with `max-width: 100%`.
+- **Dynamic Viewport Units:** To avoid issues with mobile browser address bars, use `dvh` (Dynamic Viewport Height) and `dvw` instead of `vh` and `vw`.
+- **Touch Targets:** Clickable elements (buttons, links, inputs) on mobile devices must have a minimum size of `44px x 44px`.
+
+## 4. Component Governance
+- **Atomic Design:** UI components must be collected under `apps/web/src/components/ui/`.
+- **Page Isolation:** Reusable atomic components should be preferred over defining styles within page files.
+- **Image Optimization:** Use the `picture` tag or `srcset` for responsive images, and support `@2x` resolutions for retina displays. SVGs must always be scalable via `viewBox`.
+
+## 5. Accessibility and Performance
+- **WCAG AA:** All color contrasts and keyboard navigation structures must comply with WCAG AA standards.
+- **Lighthouse Score:** A score of 90+ for performance, accessibility, and SEO should be targeted for all pages.