agent-enderun 1.10.2 → 1.11.0

package/templates/standards/github-actions-standards.md

@@ -0,0 +1,43 @@
+# CI/CD Pipeline Standards (GitHub Actions)
+
+> Automated quality gates and deployment pipelines.
+
+## Overview
+
+GitHub Actions CI/CD pipeline for automated testing, type-checking, and quality assurance.
+
+## Pipeline Structure
+
+```yaml
+name: CI/CD Pipeline
+on: [push, pull_request]
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: '22' }
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm test
+```
+
+## Quality Gates
+
+1. **TypeScript Check**: Zero type errors (`tsc --noEmit`)
+2. **Lint Check**: ESLint must pass with zero warnings
+3. **Unit Tests**: All tests must pass
+4. **Coverage**: Minimum 80% line coverage
+
+## Best Practices
+
+1. Run tests on every push and pull request
+2. Cache node_modules for faster builds
+3. Use matrix builds for multi-version testing
+4. Never deploy without passing quality gates
+5. Keep pipeline runs under 10 minutes
+
+> **Note**: Deployment is managed by the development team, not automated by this pipeline.

package/templates/standards/i18n-standards.md

@@ -0,0 +1,17 @@
+# 🌐 Corporate Multi-Language (i18n) Standards
+
+This document defines the localization and multi-language management rules for projects managed by Agent Enderun.
+
+## 1. Centralized Management
+- **Hardcoded Forbidden:** No text visible to the user shall be written directly into the code (JSX/HTML/TS).
+- **Locales Directory:** All languages are stored as JSON files under `apps/web/public/locales/` or `apps/web/src/locales/`.
+- **Key-Value Standard:** Meaningful and hierarchical keys are used (e.g., `common.buttons.save`, `errors.auth.invalid_password`).
+
+## 2. Technical Implementation
+- **i18next:** The `next-i18next` or `react-i18next` library is standard in projects.
+- **Dynamic Content:** i18n interpolation (`{{name}}`) must be used for text containing variables.
+- **Pluralization:** Singular/plural cases must be managed using the i18n library's own rules.
+
+## 3. Auditing
+- When the `@frontend` agent creates a new UI component, it automatically moves texts to the relevant JSON files.
+- Missing translation key (missing key) checks are performed by `@quality`.

package/templates/standards/kysely-standards.md

@@ -0,0 +1,47 @@
+# Kysely ORM Standards
+
+> Type-safe SQL query builder for TypeScript. Use for database operations.
+
+## Setup
+
+```typescript
+import { Kysely, SqliteDialect } from 'kysely';
+import Database from 'better-sqlite3';
+import type { DB } from './types';
+
+const dialect = new SqliteDialect({
+  database: new Database(process.env.DATABASE_PATH || './dev.db'),
+});
+
+export const db = new Kysely<DB>({ dialect });
+```
+
+## Table Definitions
+
+Define types in `src/database/kysely/types.ts`:
+
+```typescript
+export interface UsersTable {
+  id: string;
+  email: string;
+  full_name: string;
+  role: string;
+  password_hash: string;
+  created_at: string;
+  updated_at: string;
+  deleted_at: string | null;
+}
+
+export interface DB {
+  users: UsersTable;
+  customers: CustomersTable;
+}
+```
+
+## Best Practices
+
+1. Always use `where("deleted_at", "is", null)` for soft-delete
+2. Use `returningAll()` after insert/update
+3. Use `db.fn.countAll()` for pagination
+4. Keep types in sync with actual schema
+5. Use transactions for multi-step operations

package/templates/standards/llm-governance.md

@@ -0,0 +1,15 @@
+# 🤖 LLM Governance and Data Protection
+
+This document outlines the security and discipline rules for interacting with Large Language Models within Enderun-managed projects.
+
+## 1. Trust Zone
+- **Input Sanitization:** All user-provided data must be sanitized before being sent to an LLM context to prevent Prompt Injection attacks.
+- **PII Protection:** Absolutely no Personally Identifiable Information (PII) or customer-sensitive credentials should ever be included in prompts.
+
+## 2. Token Discipline
+- **Context Pruning:** Agents must proactively clear unnecessary context and follow the memory pruning protocol (`.enderun/memory/archive/`) to maintain prompt efficiency.
+- **Prompt Scoping:** Prompts should be scoped to the minimum required knowledge to prevent "Context Drift".
+
+## 3. Autonomous Behavior
+- **Human-in-the-Loop:** Any action marked as `ACTION` category requiring state mutation must trigger an approval flow.
+- **Escalation:** If an agent encounters an ambiguity that exceeds its capability (capability < 9), it must stop and escalate to `@manager`.

package/templates/standards/logging-and-secrets.md

@@ -0,0 +1,34 @@
+# 🪵 Corporate Logging and Secret Management (.env) Standards
+
+This document defines the logging discipline and sensitive data (secret) management rules for projects managed by the Agent Enderun army.
+
+## 1. Logging Discipline (Zero Console Policy)
+- **console.log Forbidden:** The use of `console.log`, `console.warn`, or `console.error` in production code is strictly forbidden.
+- **Enterprise Logger Usage:** All logging operations must be performed via the project's central logger system (`src/shared/logger.ts`).
+  ```typescript
+  import { logger } from "@/shared/logger";
+  
+  logger.info("User logged in", { userId: "..." });
+  logger.error("Database connection error", { error: "..." });
+  ```
+- **Log Levels:**
+  - `DEBUG`: Detailed technical information during development.
+  - `INFO`: Normal system flow (e.g., service started, task completed).
+  - `WARN`: Situations that are not errors but require attention.
+  - `ERROR`: Errors that do not break system operation but require investigation.
+  - `FATAL`: Critical errors that cause system crashes.
+
+## 2. Secret Management and .env Discipline
+- **Sensitive Data (Secrets):** API keys, database passwords, JWT secrets, and private keys are NEVER hardcoded into the code.
+- **.env Usage:** All sensitive data and environment-specific settings are managed via the `.env` file.
+- **.env.example:** An up-to-date `.env.example` file must always exist in the root directory of the project. This file should contain only the keys, not the actual values.
+- **Dynamic Checks:** Agents must verify the absence of a value in the `.env` file before application runtime.
+
+## 3. Security and PII (Personally Identifiable Information) Discipline
+- **Git Ignored:** The `.env` file must always be included in `.gitignore` and never committed to the source control system.
+- **Secret Masking:** Sensitive technical data such as passwords, credit card numbers, or API keys must never be written clearly in logs (they must be masked using `***` or similar).
+- **PII Governance (GDPR/KVKK):**
+    - Real user data (Emails, Phone Numbers, Full Names, National IDs) must NEVER be logged or stored in agent memories.
+    - If a task requires processing PII, use anonymized placeholders or unique hashes in logs.
+    - **@security** agent must audit any new log entry for potential PII leakage.
+- **Zero-Trust Memory:** Ajan hafızaları (PROJECT_MEMORY.md) asla gerçek müşteri verisi içermemelidir; sadece teknik meta-data ve mimari kararlar saklanmalıdır.

package/templates/standards/mobile-standards.md

@@ -0,0 +1,23 @@
+# 📱 Corporate Mobile Development Standards (React Native / Expo)
+
+This document defines the strict rules and performance standards in mobile application development processes.
+
+## 1. Technology Stack and Structure
+- **Framework:** Expo (Managed Workflow) and React Native.
+- **Styling:** `react-native-reanimated` and type-safe style objects or Tailwind (NativeWind).
+- **Navigation:** Expo Router (File-based navigation) and Safe Link structures.
+
+## 2. Design for Every Screen (Responsive Mobile Layout)
+- **Screen Resolution Independence:** Fixed `px` widths and heights should never be used. Instead, flexbox ratios, percentage widths, and dynamic values from the `useWindowDimensions` hook should be used.
+- **SafeArea Security:** All screen structures must be wrapped with `SafeAreaProvider` and `SafeAreaView` (or dynamic `insets` object) from `react-native-safe-area-context` to prevent collision with notched screens, status bars, and home indicators.
+- **Font Sizes and Accessibility:** To prevent text truncation or overflow when system font sizes are changed (Accessibility Font Scaling), `numberOfLines` / `ellipsizeMode` should be used in `Text` components or containers providing dynamic height should be designed.
+- **Orientation Adaptation:** Interfaces should be adaptable to both portrait and landscape usage scenarios; especially on tablets, double-column (Master-Detail) or Grid layouts should be adjusted based on dynamic screen aspect ratios.
+
+## 3. Performance and Fluidity
+- **Performant Lists:** To maintain performance in large data lists, `FlashList` (Shopify) must be used instead of `ScrollView` or `FlatList`.
+- **Image Resources:** Images should be cached with `expo-image`, WebP formats should be preferred for fast loading, and aspect ratios (`contentFit`) should be preserved when scaling.
+- **Touch Targets:** All touch interaction areas must be at least `44dp x 44dp`.
+
+## 4. Hardware and Offline Operation
+- **Permissions:** Sensitive permissions (location, camera, notifications) should only be requested when the feature is used, and the reason should be clearly shown to the user.
+- **Offline First:** Network requests should be cached with `React Query`; MMKV (or SQLite) should be used for local persistent storage.

package/templates/standards/observability-standards.md

@@ -0,0 +1,15 @@
+# 📊 Observability and Monitoring Standards
+
+This document defines the requirements for logging, tracing, and observability within Enderun-managed projects.
+
+## 1. Traceability
+- **Trace ID Enforcement:** Every single request, message, or task delegated between agents must include the active `Trace ID` in its metadata.
+- **Context Logging:** Logs must be structured in JSON format where possible, containing at least: `timestamp`, `level`, `agentName`, `traceId`, `action`, and `message`.
+
+## 2. Audit Trail
+- **High-Risk Actions:** All administrative or high-risk actions (e.g., DB changes, User role updates) must be recorded in `observability/audit_log.md` with a timestamp, actor agent, and outcome.
+- **Immutable Logs:** Audit logs should be appended only and never modified or deleted.
+
+## 3. Monitoring
+- **Health Checks:** Ajanlar periyodik olarak `get_system_health` aracını çağırmalıdır.
+- **Alerting:** Critical errors or timeouts must immediately trigger an `ALERT` message to the `@manager` agent for escalation.

package/templates/standards/performance-standards.md

@@ -0,0 +1,15 @@
+# 📈 Performance Monitoring Standards
+
+This document defines the metrics and monitoring requirements to ensure the Enderun Army operates at peak efficiency.
+
+## 1. Core Metrics
+- **Task Latency (Completion Time):** Time from task delegation (`PENDING`) to completion (`SUCCESS`) must be tracked.
+- **Token Consumption:** The total LLM tokens used per `Trace ID` must be logged and analyzed to identify inefficient prompts.
+- **Agent Error Rates:** The frequency of `FAILED` or `RETRY` statuses per agent must be monitored.
+
+## 2. Telemetry Implementation
+- **Standardized Logging:** Every task completion event must include the `Trace ID`, the duration (in milliseconds), and the tool/agent interaction summary.
+- **Performance Budgeting:** Each agent role has an estimated token budget. Budget overflows must be reported by the `@analyst` agent.
+
+## 3. Bottleneck Identification
+- **Critical Path Analysis:** Agents identified as bottlenecking the orchestration loop (frequent `WAITING` or `BLOCKED` states) must be reviewed for logic optimization.

package/templates/standards/pino-standards.md

@@ -0,0 +1,46 @@
+# Logging Standards
+
+> Structured logging with Pino for Node.js applications.
+
+## Overview
+
+Pino is a fast, low-overhead structured logger. All logs must be in JSON format for production.
+
+## Setup
+
+```bash
+npm install pino
+npm install -D pino-pretty
+```
+
+## Configuration
+
+```typescript
+import { pino } from "pino";
+
+const logger = pino({
+    transport: process.env.NODE_ENV === "development"
+        ? { target: "pino-pretty", options: { colorize: true, translateTime: "HH:MM:ss Z" } }
+        : undefined,
+    level: process.env.LOG_LEVEL || "info",
+});
+
+export { logger };
+```
+
+## Usage
+
+```typescript
+logger.info("Server started on port 4000");
+logger.error({ err }, "Failed to connect to database");
+logger.warn({ userId, action: "rate_limit" }, "Rate limit exceeded");
+logger.debug({ query, params }, "Executing database query");
+```
+
+## Best Practices
+
+1. Always pass Error objects as first argument: `logger.error({ err }, "msg")`
+2. Use structured context objects instead of string interpolation
+3. Never log sensitive data (passwords, tokens, PII)
+4. Use child loggers for request-scoped logging
+5. Set appropriate log levels (debug for dev, info for prod)

package/templates/standards/playwright-standards.md

@@ -0,0 +1,54 @@
+# E2E Testing Standards (Playwright)
+
+> End-to-end testing for web applications.
+
+## Overview
+
+Playwright provides cross-browser E2E testing with auto-waiting and network interception.
+
+## Setup
+
+```bash
+npm install -D @playwright/test
+npx playwright install
+```
+
+## Test Structure
+
+```
+e2e/
+├── auth.spec.ts          # Login/logout flows
+├── customers.spec.ts     # Customer CRUD flows
+├── navigation.spec.ts    # Navigation & routing
+└── fixtures/
+    └── auth.fixture.ts   # Authenticated test context
+```
+
+## Example Test
+
+```typescript
+import { test, expect } from "@playwright/test";
+
+test("user can login and see dashboard", async ({ page }) => {
+    await page.goto("/login");
+    await page.fill("[name=email]", "admin@example.com");
+    await page.fill("[name=password]", "password123");
+    await page.click("button[type=submit]");
+    await expect(page.locator("text=Dashboard")).toBeVisible();
+});
+
+test("admin can view customers list", async ({ page }) => {
+    await page.goto("/customers");
+    await expect(page.locator("table")).toBeVisible();
+    await expect(page.locator("text=Northwind")).toBeVisible();
+});
+```
+
+## Best Practices
+
+1. Test critical user flows (login, CRUD, navigation)
+2. Use page objects for reusable test actions
+3. Run tests in CI pipeline on every push
+4. Use fixtures for authenticated test contexts
+5. Keep tests independent — no shared state
+6. Use data-testid attributes for reliable selectors

package/templates/standards/quality-standards.md

@@ -0,0 +1,31 @@
+# ⚖️ Corporate Code Quality and Discipline (Linting & Standards)
+
+This document defines the technical discipline rules that all code produced by the Agent Enderun army must comply with. The goal is zero errors, maximum readability, and sustainability.
+
+## 1. TypeScript Discipline
+- **Strict Mode:** `strict: true` is mandatory in all projects.
+- **No Explicit Any:** The use of `any` is strictly forbidden. `unknown` should be used for uncertain types and verified with type guards.
+- **Exhaustive Checks:** All cases must be checked (exhaustive) in `switch-case` structures, or safety must be provided with the `never` type.
+
+## 2. ESLint and Static Analysis
+- **Zero Warnings:** No ESLint warnings or errors can exist in the codebase.
+- **Naming Conventions:**
+  - Variables and functions: `camelCase`
+  - Classes and Types: `PascalCase`
+  - Constants: `UPPER_SNAKE_CASE`
+  - File names: `kebab-case`
+- **Imports:** Unused imports should be automatically cleaned, and the import order should be regular.
+
+## 3. Formatting (Prettier)
+- **Consistency:** Uniform formatting is mandatory in all files.
+- **Indentation:** 4 spaces.
+- **Quotes:** Use of double quotes (`"`).
+- **Semicolons:** Each statement must end with a semicolon (`;`).
+
+## 4. Error Handling
+- **No Silent Failures:** Empty `catch` blocks are forbidden. Every error must at least be logged or passed to the upper layer.
+- **Custom Errors:** Project-specific `AppError` classes should be used for business logic errors.
+
+## 5. Audit Loop
+- **Pre-commit:** `npm run lint` and `npm run type-check` must be run before code is committed.
+- **@quality Audit:** All changes are audited by the `@quality` agent according to these standards.

package/templates/standards/react-query-standards.md

@@ -0,0 +1,72 @@
+# React Query (TanStack Query) Standards
+
+> Server state management for React applications.
+
+## Overview
+
+React Query handles server state: caching, background refetching, optimistic updates, and pagination.
+
+## Setup
+
+```bash
+npm install @tanstack/react-query
+```
+
+## Provider Setup
+
+```tsx
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+
+const queryClient = new QueryClient({
+    defaultOptions: {
+        queries: {
+            staleTime: 1000 * 60 * 5,
+            retry: 2,
+            refetchOnWindowFocus: false,
+        },
+    },
+});
+
+export function Providers({ children }: { children: React.ReactNode }) {
+    return (
+        <QueryClientProvider client={queryClient}>
+            {children}
+        </QueryClientProvider>
+    );
+}
+```
+
+## Hook Pattern
+
+```tsx
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+
+// Fetch
+export function useCustomers(page = 1) {
+    return useQuery({
+        queryKey: ["customers", { page }],
+        queryFn: () => fetch(`/api/v1/customers?page=${page}`).then(r => r.json()),
+    });
+}
+
+// Mutation with cache invalidation
+export function useCreateCustomer() {
+    const queryClient = useQueryClient();
+    return useMutation({
+        mutationFn: (data) => fetch("/api/v1/customers", {
+            method: "POST",
+            body: JSON.stringify(data),
+        }).then(r => r.json()),
+        onSuccess: () => queryClient.invalidateQueries({ queryKey: ["customers"] }),
+    });
+}
+```
+
+## Best Practices
+
+1. Use query keys as arrays: `["resource", params]`
+2. Set appropriate stale times based on data volatility
+3. Use `onMutate` for optimistic updates
+4. Keep API calls in dedicated hooks
+5. Use `enabled` option for dependent queries
+6. Implement error boundaries for query errors

package/templates/standards/react-router-standards.md

@@ -0,0 +1,62 @@
+# React Router Standards
+
+> Client-side routing for React applications.
+
+## Overview
+
+React Router v7 provides declarative routing with nested layouts, loaders, and actions.
+
+## Setup
+
+```bash
+npm install react-router-dom
+```
+
+## Basic Setup
+
+```tsx
+import { createBrowserRouter, RouterProvider } from "react-router-dom";
+
+const router = createBrowserRouter([
+    {
+        path: "/",
+        element: <Layout />,
+        children: [
+            { index: true, element: <Dashboard /> },
+            { path: "customers", element: <Customers /> },
+            { path: "customers/:id", element: <CustomerDetail /> },
+            { path: "users", element: <Users /> },
+            { path: "settings", element: <Settings /> },
+        ],
+    },
+]);
+
+export function App() {
+    return <RouterProvider router={router} />;
+}
+```
+
+## Protected Routes
+
+```tsx
+function ProtectedRoute({ children, roles }: { children: React.ReactNode; roles?: string[] }) {
+    const { user } = useAuth();
+
+    if (!user) return <Navigate to="/login" replace />;
+    if (roles && !roles.includes(user.role)) return <Navigate to="/" replace />;
+
+    return <>{children}</>;
+}
+
+// Usage in router
+{ path: "admin", element: <ProtectedRoute roles={["ADMIN"]}><AdminPanel /></ProtectedRoute> }
+```
+
+## Best Practices
+
+1. Use nested routes for consistent layouts
+2. Implement lazy loading with `React.lazy()` for route splitting
+3. Use route loaders for data fetching
+4. Protect admin routes with role-based guards
+5. Keep routes organized in a single configuration
+6. Use `useNavigate` for programmatic navigation

package/templates/standards/security-audit-standards.md

@@ -0,0 +1,16 @@
+# 🛡️ Security Audit Standards
+
+This document defines the security audit procedures required for all Agent Enderun-managed projects to ensure a "Defense-in-Depth" posture.
+
+## 1. Automated Vulnerability Scanning
+- **Dependency Audit:** All projects must execute `npm audit` within the CI/CD pipeline. Any high/critical vulnerability must block deployment.
+- **Static Analysis (SAST):** Use `eslint-plugin-security` to detect potential vulnerabilities (e.g., insecure crypto, command injection risks) in the codebase.
+
+## 2. Agent Governance (Prompt Security)
+- **Prompt Sanitization:** All user-provided inputs must pass through `src/cli/utils/string.ts` sanitizers before being injected into system prompts.
+- **Tool Allowlist:** Agents must only have access to a strictly defined, minimal toolset required for their role.
+- **Approval Flow:** Any agent requesting an action that modifies persistent state (File write, DB mutation) must be routed through the `@manager` approval gate.
+
+## 3. Secret Management
+- **Environment Isolation:** No secrets in code. Use `.env` files exclusively.
+- **CI/CD Secrets:** Production secrets must be managed via GitHub Secrets/Action Variables, never committed to the repository.

package/templates/standards/security-standards.md

@@ -0,0 +1,21 @@
+# 🛡️ Corporate Security and Data Protection Standards
+
+This document defines the security protocols and data protection standards for projects managed by Agent Enderun.
+
+## 1. Database Security (RLS)
+- **Row Level Security (RLS):** All user data must be protected with RLS policies. A user cannot access another user's data except through a permission protocol approved by `@manager`.
+- **SQL Injection:** Raw SQL queries are strictly forbidden (Kysely mandatory).
+- **Encryption at Rest:** Sensitive data (PII) must be stored encrypted in the database.
+
+## 2. Authentication and Authorization
+- **JWT / Session:** Only secure authentication methods approved by the `@security` agent are used.
+- **Role Based Access Control (RBAC):** Authorization schemes must be managed centrally under `apps/backend/src/security/roles.ts`.
+
+## 3. API Security
+- **CORS:** Only allowed domains can access the API.
+- **Rate Limiting:** Rate limiting must be applied for all API endpoints.
+- **Input Validation:** All inputs (request body, params) must be strictly validated with Zod or a similar library.
+
+## 4. Secret Management
+- **No Hardcoded Secrets:** API keys, passwords, or secret keys can never be stored in the code.
+- **.env Discipline:** All secret variables must be managed via the `.env` file, and this file must never be pushed to git.

package/templates/standards/swagger-standards.md

@@ -0,0 +1,50 @@
+# API Documentation Standards
+
+> OpenAPI/Swagger documentation for Fastify APIs.
+
+## Overview
+
+Auto-generated API documentation using @fastify/swagger and @fastify/swagger-ui.
+
+## Setup
+
+```bash
+npm install @fastify/swagger @fastify/swagger-ui
+```
+
+## Configuration
+
+```typescript
+import swagger from "@fastify/swagger";
+import swaggerUi from "@fastify/swagger-ui";
+
+await app.register(swagger, {
+    openapi: {
+        info: {
+            title: "API Name",
+            version: "1.0.0",
+            description: "Enterprise API documentation",
+        },
+        servers: [{ url: process.env.API_URL || "http://localhost:4000" }],
+        components: {
+            securitySchemes: {
+                bearerAuth: {
+                    type: "http",
+                    scheme: "bearer",
+                    bearerFormat: "JWT",
+                },
+            },
+        },
+    },
+});
+
+await app.register(swaggerUi, { routePrefix: "/docs" });
+```
+
+## Best Practices
+
+1. Define all request/response schemas using Zod or TypeBox
+2. Group routes by tags (Users, Customers, Reports)
+3. Include error responses in schema definitions
+4. Version your API (e.g., /api/v1/, /api/v2/)
+5. Keep documentation up to date with code changes

package/templates/standards/tailwind-standards.md

@@ -0,0 +1,20 @@
+# 🌊 Corporate Tailwind CSS Standards
+
+This document defines the rules required to maintain code quality and design discipline in projects using Tailwind CSS.
+
+## 1. Design Discipline and Constraints
+- **No Arbitrary Values:** The use of arbitrary values like `h-[123px]` or `bg-[#fafafa]` is forbidden. All values must be fed from the theme in `tailwind.config.ts`.
+- **Utility-First, Not Utility-Only:** Class structures that become too complex should be managed with `@apply` or by dividing them into components (Atomic Design).
+- **Prettier Plugin:** `prettier-plugin-tailwindcss` must be used for class ordering.
+
+## 2. Responsive and Mobile-First
+- **Mobile-First:** Styles should be written for mobile first, then expanded with `sm:`, `md:`, and `lg:` prefixes.
+- **Consistency:** Consistent breakpoint usage across the project (standard Tailwind breakpoints) is mandatory.
+
+## 3. Clean Code and Organization
+- **Clean Templates:** If there are more than 10 Tailwind classes in HTML/JSX, these classes should be organized with tools like `cva` (Class Variance Authority) or `clsx`/`tailwind-merge`.
+- **Component Isolation:** UI components must be collected under `apps/web/src/components/ui/`, and each component must contain its own Tailwind classes.
+
+## 4. Performance and Accessibility
+- **JIT Mode:** Just-in-Time mode should always be used.
+- **Contrast:** WCAG AA standards must be complied with when choosing theme colors.

package/templates/standards/testing-standards.md

@@ -0,0 +1,31 @@
+# 🧪 Corporate Testing Standards
+
+This document defines the testing discipline and scope rules for projects managed by Agent Enderun. Code quality must be ensured with automated tests.
+
+## 1. Test Pyramid and Strategy
+- **Unit Tests:** Written for the smallest parts of business logic. Must be fast and isolated.
+- **Integration Tests:** Audits the compatibility of services with the database or external APIs.
+- **E2E Tests:** Simulates critical user flows (Login, Checkout, etc.) in a real browser environment.
+
+## 2. Writing Rules and Naming
+- **Framework:** Vitest (Unit/Integration) and Playwright (E2E) are standard.
+- **File Naming:** The `[module-name].test.ts` format is used.
+- **Pattern (Given-When-Then):**
+  ```typescript
+  it("should create a user when valid data is provided", async () => {
+    // Given
+    const userData = { ... };
+    // When
+    const result = await userService.create(userData);
+    // Then
+    expect(result.id).toBeDefined();
+  });
+  ```
+
+## 3. Scope and Success Criteria
+- **Critical Path Coverage:** Auth, Payment, and Data Mutation processes must have 100% test coverage.
+- **Zero Mock Policy (Internal):** Real contracts and test databases should be used between internal project services instead of mocks. External services (Stripe, Twilio, etc.) can be mocked.
+
+## 4. Auditing
+- The `@quality` agent verifies that the relevant test file is updated in each new function.
+- Code that does not pass tests (`npm run test`) is never approved.