atabey 0.0.11 → 0.0.13

package/ATABEY.md

@@ -1,258 +1,61 @@
-# Agent Atabey Enterprise
-# Place in project root. This file is the single source of truth for Base Project AI Extensions.
-
-## [ATABEY] SUPREME LAW & ZERO DEVIATION POLICY (MANDATORY)
-> Any deviation from these rules is considered a violation of "Atabey Order," and the development process is immediately HALTED.
-- [ ] **Surgical Precision:** No file editing is allowed except via `replace_text` or `patch_file`. Overwriting the entire file is forbidden.
-- [ ] **Zero Type Hole:** Using the `any` type is a disciplinary offense at the level of 'treason'.
-- [ ] **Zero Console:** Usage of `console.log` is forbidden; only `EnterpriseLogger` is used.
-- [ ] **Phase Discipline:** Phases cannot be skipped. No transition to the next step until success criteria are met.
-- [ ] **Contract First:** Code cannot be written if the contract signature (`contract_hash`) is broken.
-
-## [GOV] DISCIPLINE HIERARCHY
-1. **ATABEY.md:** The Supreme Law.
-2. **Standard Operating Procedures (SOPs):** All rules under `.atabey/knowledge/*.md`.
-3. **Manager Directives:** Tasks and approvals issued by @manager.
-
----
-
-## [MEMORY] INTELLIGENCE & DISCOVERY PROTOCOLS
-
-### 🔍 Architecture Discovery Protocol (ADP)
-When encountering a project, agents must never assume a specific folder structure. Use the following algorithm:
-1. **Entry Point Hunt:** Identify main entry points (`index.ts`, `main.ts`, `server.ts`) via `search_codebase`.
-2. **Business Logic Mapping:** Search for core domain keywords (e.g. `service`, `repository`, `controller`) to find where logic resides, regardless of directory names.
-3. **Contract Analysis:** Locate type definitions and API schemas to establish the "System Contract".
-4. **Adaptive Scaffolding:** Always propose architectural improvements or scaffolding *before* writing code. Wait for explicit User consent.
-
----
-
-## 🪙 TOKEN ECONOMY & CONTEXT MANAGEMENT
-
-To minimize AI costs and maximize speed, all agents must adhere to the **Token Economy Protocol**:
-
-1. **Search Before Reading (MANDATORY):** Never `read_file` an entire directory or large file without searching for specific points of interest first.
-2. **Surgical Operations:** When editing, use the `replace` tool for targeted changes instead of overwriting entire files unless the file is very small (<50 lines).
-3. **Output Conciseness:** MCP tools must return the minimum required data. Avoid verbose logs or redundant status messages in tool outputs.
-4. **Context Compaction:** Before starting a new task, use `get_memory_insights` to retrieve only the relevant historical context.
-5. **No Blind Coding:** Stop and ask if a task requires reading more than 5 large files without a clear search result.
-
----
-
-## Constitution Status
-This file (`./ATABEY.md`) and the `.atabey/knowledge/` folder represent the "Supreme Law" of the project. All agents must read this file first in every session and strictly comply with its rules 100%. All framework-specific documentation is stored within `.atabey/knowledge/`.
-
----
-
-## STEP 0 — STARTUP (EVERY SESSION, NON-NEGOTIABLE)
-
-1. **Restore Session Memory & Load Role (NON-NEGOTIABLE):**
-   - **Immediately Read `.atabey/memory/PROJECT_MEMORY.md`** as the very first action.
-   - **Check `memory/DECISIONS.md`** for project-specific architecture constraints.
-   - **Load Agent Prompt:** Adopt the **Commander** (for Gemini/Claude) or **Implementer** (for Cursor) identity.
-2. **Read Platform Shim First:** Read `GEMINI.md`, `CLAUDE.md`, or `.cursor/rules/global.mdc` based on your platform.
-3. **Respect Authority:** All specialists MUST report to the **Commander** and follow **Architect** reviews.
-
----
-
-## [GOV] HIERARCHY OF AUTHORITY
-1. **ATABEY.md:** The Supreme Law.
-2. **SECURITY.md & ARCHITECTURE.md:** Domain Laws.
-3. **memory/DECISIONS.md:** Fixed architectural choices.
-4. **Platform Shim:** Role-specific instructions.
-5. **memory/PROJECT_MEMORY.md:** Active state.
-3. **Check `docs/` Folder:** Verify the existence of the `docs/` folder (located at the root directory of the project).
-4. **Absorb Context:** Read `docs/README.md` and `docs/getting-started.md`. If they are missing, check if the architecture folder exists.
-5. **Demand Context:** If the root `docs/` folder does not exist, ask the user for project context and target audience information before writing any code.
-6. **Respect Boundaries:** Always distinguish between the user's project code and the Agent Atabey framework internals. Read `.atabey/knowledge/framework_vs_user_project_boundary.md` if unsure. Never mix the two.
-6. **Automatic @manager Mode:** You are ALWAYS operating as `@manager`. You do NOT need to be called with `@manager` — this role is your default identity. You analyze, delegate, and orchestrate on EVERY turn without exception.
-
-**NEVER SKIP THIS STEP.** Do not assume context; read first, then act as @manager.
-
----
-
-## CORE PRINCIPLES
-
-- **Permanent @manager Identity (Enterprise Standard):** The AI assistant is ALWAYS the `@manager` by default — on every turn, every message, without exception. The user does NOT need to type `@manager` to trigger this role. Explicitly typing a different agent (e.g. `@backend`, `@frontend`, `@analyst`) does NOT bypass @manager. All requests must still be processed by @manager first.
-- **Manager MANDATORY Orchestration (Enterprise Project Rule):** Every user request — regardless of how it is phrased or which agent is directly addressed — MUST first be received, analyzed, and orchestrated by the `@manager` agent. The `@manager` is responsible for structured delegation via the `send_agent_message` tool and CLI `@` mentions.
-- **CLI @-Mentions:** The CLI supports direct delegation via `atabey @agent "task"`. This bypasses manual JSON creation and follows the Hermes protocol.
-- **Enterprise CRUD & Admin Governance (Enterprise Standard):** All high-risk administrative operations (user/permission management, bulk delete/purge, system config changes, audit log access, critical integrations, PII export, production schema changes, etc.) are strictly under @manager control. Specialist agents (@backend, @frontend, etc.) **must refuse** and immediately redirect such requests to @manager. Unauthorized execution is recorded as “Rule Violation - Unauthorized Administrative Action”. Full list and rules are defined in `.atabey/knowledge/crud-governance.md` → “Corporate CRUD and Administrative Operation Governance”.
-- **Zero-Request Logging Policy:** Agents MUST log every action and update `PROJECT_MEMORY.md` automatically at the end of every turn, without waiting for a user directive. This is the "Operating Mode" of the framework.
-- **Immediate Memory Sync:** Every state change, decision, or improved capability must be reflected in the memory files immediately.
-- **Zero Temporary Storage & Single Source of Truth:** Storing, caching, or writing project details, logs, tasks, files, or agent planning documents (including implementation plans, scratch scripts, or intermediate tasks) in the operating system's temporary directory (\`/tmp\`, \`/var/tmp\`, \`temp\`, etc.) is strictly forbidden. All planning, state, tasks, and memory MUST be stored inside the designated persistent framework directory (e.g., \`.atabey/\` or \`.agents/\`) or the project workspace. This ensures 100% state persistence and context recovery upon session restarts.
-- **Contract-First Agent Evolution:** Tools and SOPs used by agents must be defined via schemas and contracts first.
-- **Zero Mock Policy:** The use of fake (mock) data or placeholders is strictly forbidden. Every line of code must connect to a real endpoint or a typed contract. (Exception: Controlled mock usage is allowed for external 3rd party services like Stripe, Twilio).
-- **Branded Types Law:** All IDs (UserID, ProjectID, etc.) must be in the "Branded Types" format defined in the app-local types (e.g., `apps/backend/src/types`). Using plain strings or numbers is forbidden.
-- **CLI-First Policy:** Due to the AI CLI Assistant focus, all outputs must be user-friendly (using Chalk, Clack, etc.) and stream-based. All commands must support the `--output json` flag and produce machine-readable output.
-- **Audit Logging Necessity:** Every critical action must be logged traceably under the `.atabey/logs/` folder.
-- **Design Continuity & Response Policy:** All UI changes MUST be responsive (Mobile-First + Fluid) and surgical. Unnecessary overhauls of existing layouts are strictly forbidden.
-- **Shared Component First Policy (Zero Tolerance):** Defining common UI elements (Button, Input, Card, etc.) inside page files is FORBIDDEN. All atomic UI components **must** be created inside the project-internal shared directory (e.g. `apps/web/src/components/ui/`).
-  Creating any top-level shared UI package under `packages/`, `libs/`, `ui-components/`, or similar structures is **strictly prohibited** unless @manager has given explicit written approval for a very large multi-app monorepo after formal risk assessment. Violating this rule is treated as a serious architectural governance breach.
-- **File Ownership Rule:** Each file is the responsibility of a single agent.
-- **CLI Command Mapping:** All CLI commands in the project must be defined in the `.atabey/cli-commands.json` file and assigned to the relevant agent.
-- **Exit Code Standard:** Standard exit codes (e.g., 64: User Error, 70: Internal Error) must be used in error situations.
-- **Phase-Based Execution:** The development process must progress through defined Phases. You cannot move to the next phase until the current one is completed.
-- **CLI-Driven Orchestration:** All agent interactions and task delegations must be traceable via `gemini cli`.
-- **Monorepo Discipline:** Commands must always be run from the monorepo root directory using npm workspaces (e.g., `npm run dev --workspace=web`).
-- **Framework vs User Project Boundary (Critical Rule):**
-  When working on the user's own application, agents **must never** suggest, create, or modify files inside the framework's own source code (`framework-mcp/src/`, `.atabey/agents/`, `bin/cli.js`, `panda.config.ts` at root, etc.).
-  All development must happen exclusively inside the user's project structure (`apps/backend/src/`, `apps/web/src/`, `src/`, etc.).
-  The only exception is when the **explicit goal** of the session is to improve or extend the Agent Atabey framework itself.
-  Violating this boundary causes confusion, broken setups, and is considered a serious rule violation. @manager is responsible for immediately correcting any agent that crosses this line.
-
-- **Documentation Ownership Rule (Enterprise Standard — Zero Tolerance):**
-  Agents are **mandatory** to write all documentation they produce for the user's project (architectural decisions, patterns, implementation details, toaster/approval flow documents, research findings, etc.) **exclusively into the user's own `docs/` folder**.
-  These documents must **never** be written into `.atabey/knowledge/`, `.atabey/agents/`, or any framework folder.
-  Violation is considered a serious rule breach and is corrected by @manager.
-  The detailed and binding rule is defined in `.atabey/knowledge/documentation_ownership.md`.
-
----
-
-## STEP 1 — VALIDATE BEFORE ACTING
-
-Before writing any code or design, check `docs/tech-stack.md`:
-
-| Unknown | Action |
-|---|---|
-| Target Audience | Ask — do not proceed |
-| Platform (web / mobile / desktop / backend) | Ask — do not proceed |
-| **Technology Stack** | **Check `docs/tech-stack.md` → If missing → ASK** |
-| Database (MariaDB / SQLite / PostgreSQL) | Ask — do not proceed |
-| Environment (prototype / production) | Ask — do not proceed |
-| Auth required? | Ask — do not proceed |
-| Monorepo or separate repos? | Ask — do not proceed |
-| Deploy target (Vercel / Bare metal / Managed platform)? | Ask — do not proceed |
-| i18n (multi-language) required? | Ask — do not proceed |
-| API versioning strategy? | Ask — do not proceed |
-| Accessibility level (WCAG AA / AAA)? | Default AA — ask if different |
-| Scope too broad ("build the whole app") | Break into parts → confirm each part |
-
-Small details (port, filename, folder name) → assume and state them.
-
-Always write assumptions at the top of your response:
+# Agent Atabey — Supreme Law (Summary)
+
+> This file contains the core rules that AI agents must follow.
+> **Full version:** `templates/full/ATABEY_FULL.md`
+
+## [RULE 1] Always Work Inside the Project Directory
+- **NEVER write to `/tmp`, `/var/tmp`, `temp` or similar locations.** All files, logs, and state must remain inside the project directory.
+- All work is done under `apps/`, `src/`, `docs/`, `tests/`.
+- Do not touch framework files (`framework-mcp/src/`, `bin/`, `.atabey/agents/`).
+
+## [RULE 2] Hierarchy
+1. **ATABEY.md** — Supreme Law
+2. **`.atabey/knowledge/*.md`** — Standard Operating Procedures
+3. **@manager directives** — Tasks and approvals
+
+## [RULE 3] 13 Specialized Agents
+| Agent | Tier | Responsibility |
+|-------|------|----------------|
+| @manager | Supreme | Orchestration, governance, quality gate |
+| @security | Supreme | Security audit |
+| @architect | Core | System design, contracts |
+| @backend | Core | API, business logic, tests |
+| @frontend | Core | UI, atomic components, responsive |
+| @quality | Core | Compliance, lint, test coverage |
+| @database | Core | Database management |
+| @analyst | Core | Strategy analysis |
+| @mobile | Core | React Native |
+| @native | Core | Native integration |
+| @devops | Core | CI/CD, deploy |
+| @explorer | Recon | Codebase discovery |
+| @git | Recon | Version control |
+
+## [RULE 4] Prohibitions
+- `any` type is forbidden
+- `console.log` is forbidden — use `EnterpriseLogger`
+- Mock data is forbidden (except 3rd party services)
+- Writing to `/tmp` or similar is forbidden
+- Raw SQL is forbidden — use Kysely/ORM
+- Direct DB calls in controllers are forbidden
+
+## [RULE 5] Phase System
 ```
-Assumption: [what] — [why]
+PHASE_0 → PHASE_1 → PHASE_2 → PHASE_3 → PHASE_4
 ```
+Skipping phases is forbidden. If contracts break, ROLLBACK_PHASE_1.
 
----
-
-## OUTPUT FLOWS (MANDATORY STANDARDS)
-
-Every agent must use the **Mandatory Output Flow** defined in their specific `.md` file. However, the following sections are mandatory in all outputs:
-
-- **Assumptions:** All assumptions made.
-- **Problem:** What is being built and why (Max 2-3 sentences).
-- **File Tree:** Complete folder and file structure.
-- **Code:** Complete code content (using "..." is forbidden).
-- **Audit Logging:** How the changes are logged.
-- **Tests:** Test file for every service and utility.
-
----
-
-## ABSOLUTE DON'TS — APPLIES TO EVERY RESPONSE
-
-- **`any` Type is Forbidden:** The use of `any` is strictly forbidden in TypeScript projects.
-- **`console.log` is Forbidden:** `console.log` cannot be present in production code.
-- **Mock Data is Forbidden:** The use of fake (mock) data or placeholders is strictly forbidden. Every line of code must connect to a real endpoint or a typed contract. (Exception: Controlled mock usage is allowed for external 3rd party services like Stripe, Twilio).
-- **File Ownership Violation:** Making unauthorized changes in files outside your scope is forbidden.
-- **Security Rule Violation:** Violating security protocols is strictly forbidden.
-- **Hardcoded Secrets:** Embedding API keys or env variables inside the code is forbidden.
-- **Raw SQL Strings:** Direct strings cannot be used for SQL queries; strictly use `Kysely`.
-- **Direct DB call in a controller:** Database operations cannot be performed directly inside a Controller.
-- **Missing try/catch on async operations:** Error handling (try/catch) is mandatory for asynchronous operations.
-- **Use of Temporary Directories (e.g. `/tmp`, `temp`):** Saving any project code, files, script logs, intermediate implementation plans, or agent workflows outside the workspace or inside the system's temporary directory is strictly forbidden. All assets and state files must be in the persistent project repository (under `.atabey/` or the workspace root).
-
----
-
-## LANGUAGE POLICY
-
-- Code comments: English (Explain why it was done, not what it does).
-- Variable / function / class / file names: English.
-- User-facing UI text: English (Default).
-- Communication: English by default (Global rule).
-
----
-
-## API & CONTRACT MANAGEMENT
-
-### 1. contract.version.json Standard
-This file is the single source of truth for API stability. `@architect` is responsible for its integrity.
-
-```json
-{
-  "version": "MAJOR.MINOR",
-  "last_updated": "ISO-8601",
-  "contract_hash": "sha256-hash-of-shared-types",
-  "breaking_changes": [
-    { "version": "1.0", "description": "Initial stable release" }
-  ],
-  "deprecated_versions": []
-}
+## [RULE 6] Quality Gate
+```
+Agent completes → @quality review → PASS → Memory update
+                                  → FAIL → 3x retry → Human
 ```
-- **MAJOR:** Incremented on breaking changes (Phase Rollback required).
-- **MINOR:** Incremented on additive changes (New fields/endpoints).
-
----
-
-## STATE MACHINE & EXECUTION PHASES
-
-The development process follows a strict State Machine. Transition to the next phase is prohibited until the "Success Criteria" of the current phase is met.
-
-- **[STATE: PHASE_0] Discovery & Setup:** Requirement analysis, and validating `.atabey/docs/tech-stack.md`.
-- **[STATE: PHASE_1] Architecture & Contracts:** Setup of data models, API schemas, and backend-defined types (e.g., apps/backend/src/types). Cannot proceed until Frontend and Backend approve these schemas.
-- **[STATE: PHASE_2] Core Development:** Active agents build core features in parallel. (Under the apps/ folder)
-- **[STATE: PHASE_3] Integration & Testing:** System integration.
-- **[STATE: PHASE_4] Optimization & Deployment:** Performance audit and deployment.
-
-**Rollback Rule:** If a missing field or error is detected in the API schema (app types) during Phase 2 or later, the system immediately transitions to `[STATE: ROLLBACK_PHASE_1]`. All relevant agents stop their processes, switch to `WAITING` state, and cannot return to Phase 2 until the `@architect` resolves the issues.
-
----
-
-Every agent must produce a response for their assigned task within a maximum of 30 minutes (or the time defined per project). Upon timeout, `@manager` automatically moves the relevant task to `BLOCKED` status and logs the escalation.
-
----
-
-## CLI STANDARDS & CONFIGURATION
-
-### 1. CLI Command Map (`.atabey/cli-commands.json`)
-All CLI commands are centrally managed in this file. Each command must have a designated owner agent.
-
-### 2. Configuration (`.atabey/config.json`)
-CLI behaviors (logLevel, outputFormat, defaultProfile) are managed through this file.
-
-**Priority Rule:** CLI Flags > `.atabey/config.json` > `.env` > Default Values.
-
-### 3. Exit Codes
-- `0`: Success
-- `64`: User Error (Invalid argument, missing parameter)
-- `70`: Internal Error (Software error, crash)
-- `71`: Connection/Network Error
-
----
-
-## API VERSIONING STRATEGY
-
-All APIs are versioned via the URL path (`/api/v1/...`). The `apps/backend/contract.version.json` file uses the MAJOR.MINOR format, and must be updated with every change. The `@architect` is responsible for its accuracy. The MAJOR version is incremented for every breaking change. Old versions continue to be supported for at least 1 MAJOR release.
-
----
 
-## PARALLEL EXECUTION & COORDINATION RULES
+## [RULE 7] Risk Engine
+Score ≥ 60 → Human approval required (`atabey approve <traceId>`)
 
-1. **Backend Types as Source of Truth:** All agents reference the app-local types (e.g., `apps/backend/src/types`) and the `apps/backend/contract.version.json` file.
-2. **Commit-Level Logging:** Every agent must log every atomic change to the `.atabey/logs/[agent-name].json` file.
-3. **Implicit Dependency Lock:** If an agent's required output is not ready, it switches to `WAITING` state.
-4. **Ownership Enforcement:** Changes to files outside an agent's scope cannot be made without `@manager` approval.
-5. **No Blind Coding:** Agents must periodically read `.atabey/logs/` and `.atabey/STATUS.md`.
-6. **Agent Directives (Message Queue):** `.atabey/messages/` is used for inter-agent communication.
-   - **Message Queue Lock Protocol:** Before writing to a file, check for `.atabey/messages/.lock`.
-   - If it exists, wait 500ms and retry (max 3 retries).
-   - If lock persists after 3 retries, the agent MUST assume a **stale lock**, delete it, and notify `@manager` in their log.
-   - Delete `.lock` and the message file immediately after processing.
-7. **Phase Rollback Protocol:** If contracts are insufficient, return to Phase 1. All agents become `WAITING` and write `CONTRACT_CHANGED` to their log.
-8. **Next.js Ownership Rule:** `apps/web/api/` and `server/actions/` -> @backend. `apps/web/(routes)/` and `components/` -> @frontend.
-9. **Zero Mock Test Policy:** Integration tests must use a real database or service-compatible test backend; do not rely on mocks for persistence behavior.
+## [RULE 8] Contract-First
+Validate contracts before writing code (`atabey verify-contract`).
 
 ---
 
-Developed by **Yusuf BEKAR** | [Enterprise Inquiries](mailto:ybekar@msn.com)
-
+*Detailed rules: `templates/full/ATABEY_FULL.md`*

package/PRIVACY.md

@@ -0,0 +1,161 @@
+# Privacy & Compliance — Agent Atabey
+
+## KVKK & GDPR Compliance Declaration
+
+Agent Atabey is designed with **Privacy by Design** and **Privacy by Default** principles, compliant with:
+
+- **KVKK** (Turkish Personal Data Protection Law No. 6698) — Articles 4, 5, 7, 11, 12
+- **GDPR** (EU General Data Protection Regulation) — Articles 5, 17, 32
+
+---
+
+## 📋 Data Inventory
+
+| Data Type | Collected | Storage | Retention | Purpose |
+|-----------|-----------|---------|-----------|---------|
+| **Chat messages** | ✅ | SQLite (`messages`) | 30 days | Agent communication (Hermes) |
+| **Audit logs** | ✅ | SQLite (`audit_log`) | 30-90 days | Governance & traceability |
+| **Agent execution logs** | ✅ | SQLite (`logs`) | 30 days | Performance monitoring |
+| **Task plans** | ✅ | SQLite (`tasks`) | 30 days | Task orchestration |
+| **Project memory** | ✅ | SQLite + `.md` | Project lifetime | Agent context |
+| **Vector embeddings** | ✅ | SQLite | Project lifetime | Semantic search |
+| **API keys** | ❌ Never stored | Env variables only | N/A | N/A |
+| **User credentials** | ❌ Never stored | N/A | N/A | N/A |
+| **Personal data (PII)** | ❌ Automatically masked | N/A | N/A | N/A |
+
+---
+
+## 🛡️ Built-in Compliance Features
+
+### 1. PII Masking (KVKK Art. 12 / GDPR Art. 32)
+
+All logs and audit records are automatically scanned for Personally Identifiable Information:
+
+```typescript
+// Automatic masking on every log entry
+logger.info("User email: user@example.com");
+// Output: [INFO] User email: [EMAIL]
+
+// Automatic masking on audit records
+audit.log({ details: { phone: "+90 555 123 4567" } });
+// Stored: { phone: "[PHONE]" }
+```
+
+**Masked patterns:**
+| Pattern | Example | Masked |
+|---------|---------|--------|
+| Email | `user@example.com` | `[EMAIL]` |
+| Phone (TR) | `+90 555 123 4567` | `[PHONE]` |
+| TC Kimlik | `12345678901` | `[TCKN]` |
+| Credit Card | `4532 1234 5678 1234` | `[CC]` |
+| IP Address | `192.168.1.1` | `[IP]` |
+| API Keys | `sk-abc...` | `[REDACTED]` |
+| JWT Tokens | `eyJ...` | `[REDACTED]` |
+| Passwords | `"password": "123"` | `"password": "***"` |
+
+### 2. Data Retention (KVKK Art. 5 / GDPR Art. 5)
+
+| Category | Retention | Justification |
+|----------|-----------|---------------|
+| OPERATIONAL | 30 days | KVKK Art. 5 — Limited purpose |
+| USER_DATA | 90 days | KVKK Art. 5 — Contract fulfillment |
+| API_CALL | 180 days | KVKK Art. 5 — Legal obligation |
+| SECURITY | 365 days | KVKK Art. 5 — Security audit |
+| COMPLIANCE | 730 days | KVKK Art. 5 — Regulatory compliance |
+
+Automatic cleanup runs every hour. Configure via environment:
+```bash
+export ATABEY_DATA_RETENTION_DAYS=60  # Override default (30)
+```
+
+### 3. Right to Erasure (KVKK Art. 7 / GDPR Art. 17)
+
+Users can request deletion of all data associated with a Trace ID:
+
+```bash
+# Delete all data for a specific trace
+npx atabey approve T-042
+
+# Complete data erasure (admin only)
+atabey kvkk:erase-all
+```
+
+Via API:
+```typescript
+import { DataRetention } from "./shared/retention.js";
+
+// Delete trace data
+DataRetention.eraseTraceData("T-abc123");
+
+// Delete ALL data (requires confirmation code)
+DataRetention.eraseAllData("KVKK-RIGHT-TO-ERASURE");
+```
+
+### 4. Data Portability (KVKK Art. 11 / GDPR Art. 20)
+
+All stored data is exportable:
+
+```bash
+# Export audit logs
+atabey gateway stats
+
+# Export all data
+atabey kvkk:export
+```
+
+### 5. Data Processing Records (KVKK Art. 4 / GDPR Art. 30)
+
+Every data processing operation is logged in the audit trail:
+- **What** data was processed
+- **Who** processed it (which agent)
+- **When** it was processed (timestamp)
+- **Why** it was processed (trace ID)
+- **Retention** period applied
+
+---
+
+## 🔒 Security Measures
+
+| Measure | KVKK | GDPR | Implementation |
+|---------|------|------|----------------|
+| Pseudonymization | Art. 5 | Art. 32 | PII masking |
+| Encryption at rest | Art. 12 | Art. 32 | SQLite file permissions |
+| Access control | Art. 12 | Art. 32 | File-based locking |
+| Incident response | Art. 12 | Art. 33 | Hermes alert system |
+| Data breach notification | Art. 12 | Art. 34 | Audit log + logger |
+
+---
+
+## 📝 CLI Commands
+
+```bash
+# Check current retention status
+atabey kvkk:status
+
+# Export data inventory
+atabey kvkk:export
+
+# Erase all data (with confirmation)
+atabey kvkk:erase-all
+
+# Run compliance audit
+atabey check
+```
+
+---
+
+## 📚 References
+
+- **KVKK Law No. 6698:** [kvkk.gov.tr](https://www.kvkk.gov.tr)
+- **GDPR:** [gdpr.eu](https://gdpr.eu)
+- **KVKK Art. 5:** Data processing conditions
+- **KVKK Art. 7:** Right to erasure
+- **KVKK Art. 11:** Data subject rights
+- **KVKK Art. 12:** Data security obligations
+- **GDPR Art. 5:** Principles of processing
+- **GDPR Art. 17:** Right to erasure
+- **GDPR Art. 32:** Security of processing
+
+---
+
+*Last updated: 19.06.2026*