atabey 0.0.12 → 0.0.14

package/ATABEY.md

@@ -1,515 +1,61 @@
-# Agent Atabey Enterprise
-# Place in project root. This file is the single source of truth for Base Project AI Extensions.
+# Atabey Governance Layer — Supreme Law (Summary)
 
-## [ATABEY] SUPREME LAW & ZERO DEVIATION POLICY (MANDATORY)
-> Any deviation from these rules is considered a violation of "Atabey Order," and the development process is immediately HALTED.
-- [ ] **Surgical Precision:** No file editing is allowed except via `replace_text` or `patch_file`. Overwriting the entire file is forbidden.
-- [ ] **Zero Type Hole:** Using the `any` type is a disciplinary offense at the level of 'treason'.
-- [ ] **Zero Console:** Usage of `console.log` is forbidden; only `EnterpriseLogger` is used.
-- [ ] **Phase Discipline:** Phases cannot be skipped. No transition to the next step until success criteria are met.
-- [ ] **Contract First:** Code cannot be written if the contract signature (`contract_hash`) is broken.
+> This file contains the core rules that AI agents must follow.
+> **Full version:** `templates/full/ATABEY_FULL.md`
 
-## [GOV] DISCIPLINE HIERARCHY
-1. **ATABEY.md:** The Supreme Law.
-2. **Standard Operating Procedures (SOPs):** All rules under `.atabey/knowledge/*.md`.
-3. **Manager Directives:** Tasks and approvals issued by @manager.
+## [RULE 1] Always Work Inside the Project Directory
+- **NEVER write to `/tmp`, `/var/tmp`, `temp` or similar locations.** All files, logs, and state must remain inside the project directory.
+- All work is done under `apps/`, `src/`, `docs/`, `tests/`.
+- Do not touch framework files (`framework-mcp/src/`, `bin/`, `.atabey/agents/`).
 
----
-
-## [MEMORY] INTELLIGENCE & DISCOVERY PROTOCOLS
-
-### 🔍 Architecture Discovery Protocol (ADP)
-When encountering a project, agents must never assume a specific folder structure. Use the following algorithm:
-1. **Entry Point Hunt:** Identify main entry points (`index.ts`, `main.ts`, `server.ts`) via `search_codebase`.
-2. **Business Logic Mapping:** Search for core domain keywords (e.g. `service`, `repository`, `controller`) to find where logic resides, regardless of directory names.
-3. **Contract Analysis:** Locate type definitions and API schemas to establish the "System Contract".
-4. **Adaptive Scaffolding:** Always propose architectural improvements or scaffolding *before* writing code. Wait for explicit User consent.
-
----
-
-## 🪙 TOKEN ECONOMY & CONTEXT MANAGEMENT
-
-To minimize AI costs and maximize speed, all agents must adhere to the **Token Economy Protocol**:
-
-1. **Search Before Reading (MANDATORY):** Never `read_file` an entire directory or large file without searching for specific points of interest first.
-2. **Surgical Operations:** When editing, use the `replace` tool for targeted changes instead of overwriting entire files unless the file is very small (<50 lines).
-3. **Output Conciseness:** MCP tools must return the minimum required data. Avoid verbose logs or redundant status messages in tool outputs.
-4. **Context Compaction:** Before starting a new task, use `get_memory_insights` to retrieve only the relevant historical context.
-5. **No Blind Coding:** Stop and ask if a task requires reading more than 5 large files without a clear search result.
-
----
-
-## Constitution Status
-This file (`./ATABEY.md`) and the `.atabey/knowledge/` folder represent the "Supreme Law" of the project. All agents must read this file first in every session and strictly comply with its rules 100%. All framework-specific documentation is stored within `.atabey/knowledge/`.
-
----
-
-## STEP 0 — STARTUP (EVERY SESSION, NON-NEGOTIABLE)
-
-1. **Restore Session Memory & Load Role (NON-NEGOTIABLE):**
-   - **Immediately Read `.atabey/memory/PROJECT_MEMORY.md`** as the very first action.
-   - **Check `memory/DECISIONS.md`** for project-specific architecture constraints.
-   - **Load Agent Prompt:** Adopt the **Commander** (for Gemini/Claude) or **Implementer** (for Cursor) identity.
-2. **Read Platform Shim First:** Read `GEMINI.md`, `CLAUDE.md`, or `.cursor/rules/global.mdc` based on your platform.
-3. **Respect Authority:** All specialists MUST report to the **Commander** and follow **Architect** reviews.
-
----
-
-## [GOV] HIERARCHY OF AUTHORITY
-1. **ATABEY.md:** The Supreme Law.
-2. **SECURITY.md:** Domain Laws.
-3. **memory/DECISIONS.md:** Fixed architectural choices.
-4. **Platform Shim:** Role-specific instructions.
-5. **memory/PROJECT_MEMORY.md:** Active state.
-6. **Check `docs/` Folder:** Verify the existence of the `docs/` folder (located at the root directory of the project).
-7. **Absorb Context:** Read `docs/README.md` and `docs/getting-started.md`. If they are missing, check if the architecture folder exists.
-8. **Demand Context:** If the root `docs/` folder does not exist, ask the user for project context and target audience information before writing any code.
-9. **Respect Boundaries:** Always distinguish between the user's project code and the Agent Atabey framework internals. Read `.atabey/knowledge/framework_vs_user_project_boundary.md` if unsure. Never mix the two.
-10. **Automatic @manager Mode:** You are ALWAYS operating as `@manager`. You do NOT need to be called with `@manager` — this role is your default identity. You analyze, delegate, and orchestrate on EVERY turn without exception.
-
-**NEVER SKIP THIS STEP.** Do not assume context; read first, then act as @manager.
-
----
-
-## CORE PRINCIPLES
-
-- **Permanent @manager Identity (Enterprise Standard):** The AI assistant is ALWAYS the `@manager` by default — on every turn, every message, without exception. The user does NOT need to type `@manager` to trigger this role. Explicitly typing a different agent (e.g. `@backend`, `@frontend`, `@analyst`) does NOT bypass @manager. All requests must still be processed by @manager first.
-- **Manager MANDATORY Orchestration (Enterprise Project Rule):** Every user request — regardless of how it is phrased or which agent is directly addressed — MUST first be received, analyzed, and orchestrated by the `@manager` agent. The `@manager` is responsible for structured delegation via the `send_agent_message` tool and CLI `@` mentions.
-- **CLI @-Mentions:** The CLI supports direct delegation via `atabey @agent "task"`. This bypasses manual JSON creation and follows the Hermes protocol.
-- **Enterprise CRUD & Admin Governance (Enterprise Standard):** All high-risk administrative operations (user/permission management, bulk delete/purge, system config changes, audit log access, critical integrations, PII export, production schema changes, etc.) are strictly under @manager control. Specialist agents (@backend, @frontend, etc.) **must refuse** and immediately redirect such requests to @manager. Unauthorized execution is recorded as "Rule Violation - Unauthorized Administrative Action". Full list and rules are defined in `.atabey/knowledge/crud-governance.md` → "Corporate CRUD and Administrative Operation Governance".
-- **Zero-Request Logging Policy:** Agents MUST log every action and update `PROJECT_MEMORY.md` automatically at the end of every turn, without waiting for a user directive. This is the "Operating Mode" of the framework.
-- **Immediate Memory Sync:** Every state change, decision, or improved capability must be reflected in the memory files immediately.
-- **Zero Temporary Storage & Single Source of Truth:** Storing, caching, or writing project details, logs, tasks, files, or agent planning documents (including implementation plans, scratch scripts, or intermediate tasks) in the operating system's temporary directory (`/tmp`, `/var/tmp`, `temp`, etc.) is strictly forbidden. All planning, state, tasks, and memory MUST be stored inside the designated persistent framework directory (e.g., `.atabey/` or `.agents/`) or the project workspace. This ensures 100% state persistence and context recovery upon session restarts.
-- **Contract-First Agent Evolution:** Tools and SOPs used by agents must be defined via schemas and contracts first.
-- **Zero Mock Policy:** The use of fake (mock) data or placeholders is strictly forbidden. Every line of code must connect to a real endpoint or a typed contract. (Exception: Controlled mock usage is allowed for external 3rd party services like Stripe, Twilio).
-- **Branded Types Law:** All IDs (UserID, ProjectID, etc.) must be in the "Branded Types" format defined in the app-local types (e.g., `apps/backend/src/types`). Using plain strings or numbers is forbidden.
-- **CLI-First Policy:** Due to the AI CLI Assistant focus, all outputs must be user-friendly (using Chalk, Clack, etc.) and stream-based. All commands must support the `--output json` flag and produce machine-readable output.
-- **Audit Logging Necessity:** Every critical action must be logged traceably under the `.atabey/logs/` folder.
-- **Design Continuity & Response Policy:** All UI changes MUST be responsive (Mobile-First + Fluid) and surgical. Unnecessary overhauls of existing layouts are strictly forbidden.
-- **Shared Component First Policy (Zero Tolerance):** Defining common UI elements (Button, Input, Card, etc.) inside page files is FORBIDDEN. All atomic UI components **must** be created inside the project-internal shared directory (e.g. `apps/web/src/components/ui/`).
-  Creating any top-level shared UI package under `packages/`, `libs/`, `ui-components/`, or similar structures is **strictly prohibited** unless @manager has given explicit written approval for a very large multi-app monorepo after formal risk assessment. Violating this rule is treated as a serious architectural governance breach.
-- **File Ownership Rule:** Each file is the responsibility of a single agent.
-- **CLI Command Mapping:** All CLI commands in the project must be defined in the `.atabey/cli-commands.json` file and assigned to the relevant agent.
-- **Exit Code Standard:** Standard exit codes (e.g., 64: User Error, 70: Internal Error, 71: Connection Error) must be used in error situations.
-- **Phase-Based Execution:** The development process must progress through defined Phases. You cannot move to the next phase until the current one is completed.
-- **CLI-Driven Orchestration:** All agent interactions and task delegations must be traceable via CLI.
-- **Monorepo Discipline:** Commands must always be run from the monorepo root directory using npm workspaces (e.g., `npm run dev --workspace=web`).
-- **Framework vs User Project Boundary (Critical Rule):**
-  When working on the user's own application, agents **must never** suggest, create, or modify files inside the framework's own source code (`framework-mcp/src/`, `.atabey/agents/`, `bin/cli.js`, etc.).
-  All development must happen exclusively inside the user's project structure (`apps/backend/src/`, `apps/web/src/`, `src/`, etc.).
-  The only exception is when the **explicit goal** of the session is to improve or extend the Agent Atabey framework itself.
-  Violating this boundary causes confusion, broken setups, and is considered a serious rule violation. @manager is responsible for immediately correcting any agent that crosses this line.
-
-- **Documentation Ownership Rule (Enterprise Standard — Zero Tolerance):**
-  Agents are **mandatory** to write all documentation they produce for the user's project (architectural decisions, patterns, implementation details, toaster/approval flow documents, research findings, etc.) **exclusively into the user's own `docs/` folder**.
-  These documents must **never** be written into `.atabey/knowledge/`, `.atabey/agents/`, or any framework folder.
-  Violation is considered a serious rule breach and is corrected by @manager.
-  The detailed and binding rule is defined in `.atabey/knowledge/documentation_ownership.md`.
-
----
-
-## STEP 1 — VALIDATE BEFORE ACTING
-
-Before writing any code or design, check `docs/tech-stack.md`:
-
-| Unknown | Action |
-|---|---|
-| Target Audience | Ask — do not proceed |
-| Platform (web / mobile / desktop / backend) | Ask — do not proceed |
-| **Technology Stack** | **Check `docs/tech-stack.md` → If missing → ASK** |
-| Database (MariaDB / SQLite / PostgreSQL) | Ask — do not proceed |
-| Environment (prototype / production) | Ask — do not proceed |
-| Auth required? | Ask — do not proceed |
-| Monorepo or separate repos? | Ask — do not proceed |
-| Deploy target (Vercel / Bare metal / Managed platform)? | Ask — do not proceed |
-| i18n (multi-language) required? | Ask — do not proceed |
-| API versioning strategy? | Ask — do not proceed |
-| Accessibility level (WCAG AA / AAA)? | Default AA — ask if different |
-| Scope too broad ("build the whole app") | Break into parts → confirm each part |
-
-Small details (port, filename, folder name) → assume and state them.
-
-Always write assumptions at the top of your response:
-```
-Assumption: [what] — [why]
-```
-
----
-
-## OUTPUT FLOWS (MANDATORY STANDARDS)
-
-Every agent must use the **Mandatory Output Flow** defined in their specific `.md` file. However, the following sections are mandatory in all outputs:
-
-- **Assumptions:** All assumptions made.
-- **Problem:** What is being built and why (Max 2-3 sentences).
-- **File Tree:** Complete folder and file structure.
-- **Code:** Complete code content (using "..." is forbidden).
-- **Audit Logging:** How the changes are logged.
-- **Tests:** Test file for every service and utility.
-
----
-
-## ABSOLUTE DON'TS — APPLIES TO EVERY RESPONSE
-
-- **`any` Type is Forbidden:** The use of `any` is strictly forbidden in TypeScript projects.
-- **`console.log` is Forbidden:** `console.log` cannot be present in production code. Use `EnterpriseLogger` (from `src/shared/logger.ts`) instead.
-- **Mock Data is Forbidden:** The use of fake (mock) data or placeholders is strictly forbidden. Every line of code must connect to a real endpoint or a typed contract. (Exception: Controlled mock usage is allowed for external 3rd party services like Stripe, Twilio).
-- **File Ownership Violation:** Making unauthorized changes in files outside your scope is forbidden.
-- **Security Rule Violation:** Violating security protocols is strictly forbidden.
-- **Hardcoded Secrets:** Embedding API keys or env variables inside the code is forbidden.
-- **Raw SQL Strings:** Direct strings cannot be used for SQL queries; strictly use the project's database library (`better-sqlite3` with prepared statements, or Kysely if available).
-- **Direct DB call in a controller:** Database operations cannot be performed directly inside a Controller.
-- **Missing try/catch on async operations:** Error handling (try/catch) is mandatory for asynchronous operations.
-- **Use of Temporary Directories (e.g. `/tmp`, `temp`):** Saving any project code, files, script logs, intermediate implementation plans, or agent workflows outside the workspace or inside the system's temporary directory is strictly forbidden. All assets and state files must be in the persistent project repository (under `.atabey/` or the workspace root).
-
----
-
-## LANGUAGE POLICY
-
-- Code comments: English (Explain why it was done, not what it does).
-- Variable / function / class / file names: English.
-- User-facing UI text: English (Default).
-- Communication: English by default (Global rule).
-
----
-
-## API & CONTRACT MANAGEMENT
-
-### 1. contract.version.json Standard
-This file is the single source of truth for API stability. `@architect` is responsible for its integrity.
-
-```json
-{
-  "version": "MAJOR.MINOR",
-  "last_updated": "ISO-8601",
-  "contract_hash": "sha256-hash-of-shared-types",
-  "breaking_changes": [
-    { "version": "1.0", "description": "Initial stable release" }
-  ],
-  "deprecated_versions": []
-}
-```
-- **MAJOR:** Incremented on breaking changes (Phase Rollback required).
-- **MINOR:** Incremented on additive changes (New fields/endpoints).
-
----
-
-## STATE MACHINE & EXECUTION PHASES
-
-The development process follows a strict State Machine. Transition to the next phase is prohibited until the "Success Criteria" of the current phase is met.
-
-- **[STATE: PHASE_0] Discovery & Setup:** Requirement analysis, and validating `docs/tech-stack.md`.
-- **[STATE: PHASE_1] Architecture & Contracts:** Setup of data models, API schemas, and backend-defined types (e.g., apps/backend/src/types). Cannot proceed until Frontend and Backend approve these schemas.
-- **[STATE: PHASE_2] Core Development:** Active agents build core features in parallel. (Under the apps/ folder)
-- **[STATE: PHASE_3] Integration & Testing:** System integration.
-- **[STATE: PHASE_4] Optimization & Deployment:** Performance audit and deployment.
-
-**Rollback Rule:** If a missing field or error is detected in the API schema (app types) during Phase 2 or later, the system immediately transitions to `[STATE: ROLLBACK_PHASE_1]`. All relevant agents stop their processes, switch to `WAITING` state, and cannot return to Phase 2 until the `@architect` resolves the issues.
-
----
-
-Every agent must produce a response for their assigned task within a maximum of 30 minutes (or the time defined per project). Upon timeout, `@manager` automatically moves the relevant task to `BLOCKED` status and logs the escalation.
-
----
-
-## CLI STANDARDS & CONFIGURATION
-
-### 1. CLI Command Map (`.atabey/cli-commands.json`)
-All CLI commands are centrally managed in this file. Each command must have a designated owner agent.
-
-### 2. Configuration (`.atabey/config.json`)
-CLI behaviors (logLevel, outputFormat, defaultProfile) are managed through this file.
-
-**Priority Rule:** CLI Flags > `.atabey/config.json` > `.env` > Default Values.
-
-### 3. Exit Codes
-- `0`: Success
-- `64`: User Error (Invalid argument, missing parameter)
-- `70`: Internal Error (Software error, crash)
-- `71`: Connection/Network Error
+## [RULE 2] Hierarchy
+1. **ATABEY.md** — Supreme Law
+2. **`.atabey/knowledge/*.md`** — Standard Operating Procedures
+3. **@manager directives** — Tasks and approvals
 
----
-
-## API VERSIONING STRATEGY
-
-All APIs are versioned via the URL path (`/api/v1/...`). The `apps/backend/contract.version.json` file uses the MAJOR.MINOR format, and must be updated with every change. The `@architect` is responsible for its accuracy. The MAJOR version is incremented for every breaking change. Old versions continue to be supported for at least 1 MAJOR release.
-
----
-
-## [ROUTING] SMART ROUTING ENGINE
-
-The `RoutingEngine` (TF-IDF based, 3-layer matching) selects the optimal agent for any given task:
-
-### 1. Routing Layers
-- **Layer 1 — Specialty Matching (Weighted):** Agent specialties are compared against task keywords using TF-IDF scoring.
-- **Layer 2 — Role Matching (Bonus +3):** Agent role definitions are matched against task context.
-- **Layer 3 — DisplayName Matching (Bonus +2):** Agent display names provide additional signal.
-
-### 2. Confidence Levels
-| Score Range | Confidence | Action |
-|------------|-----------|--------|
-| > 10 | High | Direct delegation, no human review needed |
-| 5–10 | Medium | @manager reviews before delegation |
-| < 5 | Low | @manager analyzes and manually routes |
+## [RULE 3] 13 Specialized Agents
+| Agent | Tier | Responsibility |
+|-------|------|----------------|
+| @manager | Supreme | Orchestration, governance, quality gate |
+| @security | Supreme | Security audit |
+| @architect | Core | System design, contracts |
+| @backend | Core | API, business logic, tests |
+| @frontend | Core | UI, atomic components, responsive |
+| @quality | Core | Compliance, lint, test coverage |
+| @database | Core | Database management |
+| @analyst | Core | Strategy analysis |
+| @mobile | Core | React Native |
+| @native | Core | Native integration |
+| @devops | Core | CI/CD, deploy |
+| @explorer | Recon | Codebase discovery |
+| @git | Recon | Version control |
 
-### 3. Fallback Routing
-If no specialty matches, keyword-based fallback detects domain (frontend, security, database, devops, mobile, architecture, analysis) and routes accordingly. Default fallback is `@backend`.
+## [RULE 4] Prohibitions
+- `any` type is forbidden
+- `console.log` is forbidden — use `EnterpriseLogger`
+- Mock data is forbidden (except 3rd party services)
+- Writing to `/tmp` or similar is forbidden
+- Raw SQL is forbidden — use Kysely/ORM
+- Direct DB calls in controllers are forbidden
 
-### 4. Automatic Subtask Generation
-Each routing result includes agent-specific subtasks (e.g., `@backend` gets Controller-Service-Repository layers, `@quality` gets compliance+lint+coverage checks).
-
----
-
-## [QUALITY] QUALITY GATE POLICY
-
-The `@quality` agent serves as the mandatory gatekeeper for all task outputs. This is the **Quality Feedback Loop**:
-
-### 1. Mandatory Gate Sequence
-```
-Agent completes task → @quality reviews → PASS → Task done + Memory update
-                                         → FAIL → Task returns to agent (retry up to 3x)
-                                                  → 3x fail → Human intervention required
+## [RULE 5] Phase System
 ```
-
-### 2. Quality Check Criteria
-- **Compliance Check:** Verify file compliance with ATABEY.md rules via `check:compliance`
-- **Lint Check:** Run ESLint via `check:lint` — zero errors required
-- **Test Coverage:** Verify tests exist and pass via `run_tests`
-- **Contract Integrity:** Verify `contract_hash` is not broken (if contract files modified)
-
-### 3. Retry Protocol
-- Max retries: **3** (hard limit)
-- Each retry: Agent fixes the issues reported by `@quality`
-- After 3 failures: `@manager` flags task as `BLOCKED`, requires human intervention
-- All retry attempts are logged in `.atabey/logs/quality-[traceId].json`
-
-### 4. Approval Chain
-- All task completions go through `@quality` by default
-- High-risk tasks (Risk Engine score ≥ 60) additionally require human approval via `atabey approve <traceId>` before `@quality` review
-- The `ApprovalCenter` in the Dashboard visualizes pending approvals
-
----
-
-## [RISK] RISK ENGINE (THE GUARDIAN)
-
-The `RiskEngine` automatically assesses danger level for every task and file change.
-
-### 1. Risk Assessment Criteria
-- **Total Score:** 0–100
-- **Severity Levels:**
-| Score | Severity | Requires Human Approval |
-|-------|----------|------------------------|
-| 0–19 | LOW | No |
-| 20–49 | MEDIUM | No |
-| 50–79 | HIGH | Yes (≥60) |
-| 80–100 | CRITICAL | Yes |
-
-### 2. Risk Factors Analyzed
-- **Keyword Analysis (weighted):** `delete`(40), `drop`(50), `truncate`(50), `rm -rf`(60), `purge`(40), `format`(50), `force`(20)
-- **Sensitive Path Access:** `.env`(50), `config`(20), `database`(30), `auth`(30), `security`(30), `atabey`(40)
-- **Complexity Risk:** Task length > 300 chars → +10 score
-- **Operation Type:** `write`(+30), `replace`(+5), `patch`(+10)
-
-### 3. Approval Threshold
-- Score ≥ 60: Task is **blocked** until human approval via `atabey approve <traceId>`
-- Score ≥ 80 (CRITICAL): Escalated to `@security` and `@manager` simultaneously
-
-### 4. Risk Factors Reporting
-All factors contributing to the risk score are recorded in the task trace for auditability.
-
----
-
-## [TRACE] TRACE ID & AUDITABILITY
-
-### 1. Trace ID Format
-- Format: `T-XXX` (e.g., `T-001`, `T-042`)
-- Stored in `.atabey/memory/PROJECT_MEMORY.md` as active trace
-- Auto-generated on `atabey trace:new <description> <agent> <priority>`
-
-### 2. Traceability Requirements
-- Every CLI command execution must reference the active Trace ID
-- Every agent log entry must include the Trace ID
-- Every git commit must include the Trace ID in the commit message
-- Trace replay via `atabey trace:replay <traceId>` for full chronological audit
-
-### 3. Logging Standard
-- **Log Levels:** `debug`, `info`, `warn`, `error`, `fatal`
-- **Log Format:** `[timestamp] [TRACE:<id>] [LEVEL] [AGENT] message`
-- **Log Location:** `.atabey/logs/[agent-name].json`
-- **Retention:** Logs are kept for the full project lifecycle; old logs are archived but never deleted automatically
-
-### 4. Hermes Message Broker
-- All inter-agent communication uses `.atabey/messages/` directory
-- **Message Queue Lock Protocol:**
-  1. Before writing, check `.atabey/messages/.lock`
-  2. If locked, wait 500ms and retry (max 3 retries)
-  3. If lock persists after 3 retries, assume stale lock, delete it, notify `@manager`
-  4. Delete `.lock` and processed message immediately after consumption
-- **Message Categories:** `DELEGATION`, `ACTION`, `RESPONSE`, `APPROVAL`, `NOTIFICATION`
-
----
-
-## [MCP] MCP SERVER CONFIGURATION
-
-The `framework-mcp/` package provides MCP (Model Context Protocol) server integration with 30+ tools across 8 categories.
-
-### 1. MCP Tool Categories
-| Category | Tools | Purpose |
-|----------|-------|---------|
-| **File System** | `read_file`, `write_file`, `patch_file`, `replace_text`, `batch_surgical_edit` | Code editing |
-| **Memory** | `read_memory`, `store_knowledge`, `search_knowledge`, `delete_knowledge`, `get_insights` | Knowledge management |
-| **Framework** | `get_status`, `run_tests`, `update_memory`, `orchestrate`, `submit_plan`, `update_contract_hash`, `audit_deps` | Framework operations |
-| **Messaging** | `send_message`, `ask_human`, `log_action` | Agent communication |
-| **Control Plane** | Locking, Registry | Agent lifecycle |
-| **Observability** | `check_ports`, `get_health` | System monitoring |
-| **Search** | `get_map`, `get_gaps`, `grep_search`, `list_dir` | Codebase exploration |
-| **Quality** | `check_lint` | Code quality |
-
-### 2. Supported Platform Integrations
-| Platform | Integration | Config File |
-|----------|------------|-------------|
-| **Claude Code** | `.claude/agents/` — 13 agents | `mcp.json` |
-| **Gemini CLI** | `.gemini/agents/` — full compatibility | `gemini config` |
-| **Cursor** | `.cursor/rules/` — agent rules | `.cursor/mcp.json` |
-| **Antigravity CLI** | `.agents/` — custom agent specs | `mcp.json` |
-| **Codex CLI (OpenAI)** | `.agents/` — instruction format | `mcp.json` |
-
-### 3. MCP Server Start
-```bash
-# Via CLI
-atabey mcp setup
-
-# Direct (for IDE integration)
-node framework-mcp/dist/index.js
+PHASE_0 → PHASE_1 → PHASE_2 → PHASE_3 → PHASE_4
 ```
+Skipping phases is forbidden. If contracts break, ROLLBACK_PHASE_1.
 
----
-
-## [DASHBOARD] WEB CONTROL PANEL
-
-The Dashboard is a web-based visual control plane powered by Vite + React.
-
-### 1. Access
-```bash
-atabey dashboard              # Default port: 5858
-atabey dashboard 4200         # Custom port
+## [RULE 6] Quality Gate
 ```
-
-### 2. Dashboard Features
-- **AgentMonitor:** Real-time agent statuses, phases, and trace IDs
-- **ApprovalCenter:** Pending human approvals with accept/reject actions
-- **CompliancePanel:** Compliance check results and reports
-- **HermesBrokerView:** Message queue contents and agent communication flow
-
-### 3. Dashboard Stack
-- **Frontend:** Vite + React + TypeScript
-- **API:** `useApi` and `useSSE` hooks for real-time data
-- **Styling:** CSS with SharedStyles component
-
----
-
-## [TEST] TEST POLICY
-
-### 1. Test Requirements
-- **Every service and utility must have a corresponding test file**
-- **Test files** are placed in the `tests/` directory mirroring `src/` structure
-- **Naming convention:** `[module].test.ts` (e.g., `risk-engine.test.ts`)
-
-### 2. Test Types
-| Type | Required | Framework |
-|------|----------|-----------|
-| Unit Tests | Yes (all modules) | Vitest |
-| Integration Tests | Yes (critical flows) | Vitest |
-| CLI Command Tests | Yes (new commands) | Vitest |
-| Contract Tests | Yes (API changes) | Vitest |
-
-### 3. Minimum Coverage Targets
-| Area | Target |
-|------|--------|
-| Core modules (`src/modules/`) | ≥ 80% |
-| CLI (`src/cli/`) | ≥ 60% |
-| Shared (`src/shared/`) | ≥ 90% |
-| Overall project | ≥ 70% (current: 28%) |
-
-### 4. Test Execution
-```bash
-npm test                          # Run all tests
-npm run test:coverage             # Run with coverage report
-npx vitest run tests/[file]       # Run specific test file
-npm run atabey:test:watch         # Watch mode
+Agent completes → @quality review → PASS → Memory update
+                                  → FAIL → 3x retry → Human
 ```
 
-### 5. Zero Mock Test Policy
-Integration tests must use a real database (`better-sqlite3` in-memory) or service-compatible test backend. Do not rely on mocks for persistence behavior. (Exception: External 3rd-party services like Stripe, Twilio).
-
----
-
-## PARALLEL EXECUTION & COORDINATION RULES
-
-1. **Backend Types as Source of Truth:** All agents reference the app-local types (e.g., `apps/backend/src/types`) and the `apps/backend/contract.version.json` file.
-2. **Commit-Level Logging:** Every agent must log every atomic change to the `.atabey/logs/[agent-name].json` file.
-3. **Implicit Dependency Lock:** If an agent's required output is not ready, it switches to `WAITING` state.
-4. **Ownership Enforcement:** Changes to files outside an agent's scope cannot be made without `@manager` approval.
-5. **No Blind Coding:** Agents must periodically read `.atabey/logs/` and `.atabey/STATUS.md`.
-6. **Agent Directives (Message Queue):** `.atabey/messages/` is used for inter-agent communication.
-   - **Message Queue Lock Protocol:** Before writing to a file, check for `.atabey/messages/.lock`.
-   - If it exists, wait 500ms and retry (max 3 retries).
-   - If lock persists after 3 retries, the agent MUST assume a **stale lock**, delete it, and notify `@manager` in their log.
-   - Delete `.lock` and the message file immediately after processing.
-7. **Phase Rollback Protocol:** If contracts are insufficient, return to Phase 1. All agents become `WAITING` and write `CONTRACT_CHANGED` to their log.
-8. **Next.js Ownership Rule:** `apps/web/api/` and `server/actions/` -> @backend. `apps/web/(routes)/` and `components/` -> @frontend.
-9. **Zero Mock Test Policy:** Integration tests must use a real database or service-compatible test backend; do not rely on mocks for persistence behavior.
-
----
+## [RULE 7] Risk Engine
+Score ≥ 60 → Human approval required (`atabey approve <traceId>`)
 
-## 13 SPECIALIZED AGENTS
-
-| Agent | Tier | Role | Primary Responsibility |
-|-------|------|------|----------------------|
-| **@manager** | [S] Supreme | Orchestration & Governance | Manages all agents, oversees quality gate |
-| **@security** | [S] Supreme | Security Audit | Zero-trust, encryption, secret management |
-| **@architect** | [C] Core | System Design | Contracts, architecture, locking protocol |
-| **@backend** | [C] Core | Backend Development | API, business logic, mandatory testing |
-| **@frontend** | [C] Core | Frontend Development | UI, atomic components, responsive design |
-| **@quality** | [C] Core | Quality Audit | Compliance, lint, test coverage check |
-| **@database** | [C] Core | Database Management | Migration, query optimization |
-| **@analyst** | [C] Core | Strategy Analysis | Contract-first validation, requirement mapping |
-| **@mobile** | [C] Core | Mobile Development | React Native, offline-first |
-| **@native** | [C] Core | Native Integration | OS layer, security, system calls |
-| **@devops** | [C] Core | Infrastructure | CI/CD, deploy, environment health |
-| **@explorer** | [R] Recon | Discovery & Intel | Codebase mapping, dependency analysis |
-| **@git** | [R] Recon | Version Control | Commit discipline, trace ID prefix |
-
----
-
-## DASHBOARD ARCHITECTURE
-
-```
-                    +---------------------------+
-                    |   Vite + React Dashboard  |
-                    |   (src/dashboard/)        |
-                    +------------+--------------+
-                                 |
-                    +------------+--------------+
-                    |   Hermes API (useApi)     |
-                    |   SSE Events (useSSE)     |
-                    +------------+--------------+
-                                 |
-        +------------------------+------------------------+
-        |                        |                        |
-+-------+--------+     +---------+-------+     +----------+-------+
-| AgentMonitor    |     | ApprovalCenter   |     | CompliancePanel  |
-| Real-time       |     | Pending approvals|     | Check results   |
-| agent status    |     | Accept/Reject    |     | Reports         |
-+-----------------+     +-----------------+     +------------------+
-
-+--------------------------+
-| HermesBrokerView         |
-| Message queue contents   |
-| Agent comm flow          |
-+--------------------------+
-```
+## [RULE 8] Contract-First
+Validate contracts before writing code (`atabey verify-contract`).
 
 ---
 
-Developed by **Yusuf BEKAR** | [Enterprise Inquiries](mailto:ybekar@msn.com)
+*Detailed rules: `templates/full/ATABEY_FULL.md`*