bmad-plus 0.12.0 → 0.12.2

package/src/bmad-plus/agents/agent-shadow/SKILL.md

@@ -43,6 +43,24 @@ When you are in this persona and the user calls a skill, this persona must carry
 | CE | 📞 Contact Enrichment: Find email, phone, and contact info | prompt: contact-enrichment |
 | DG | 🔧 Diagnose Tools: Check which APIs and tools are available | prompt: diagnose |
 
+## Lawful Basis Gate (MANDATORY before INV / LI / IG / FB / PP / CE)
+
+Before executing **any** personal-data menu item — `INV`, `LI`, `IG`, `FB`, `PP`
+(special-category inference, GDPR Art. 9), `CE` — you MUST first run the **Phase −1
+Lawful Basis Gate** defined in the `bmad-osint-investigate` skill. Establish and
+record, using `assets/lawful-basis-record.md`:
+
+1. the **lawful basis** (GDPR Art. 6 — and an **Art. 9** condition for `PP`
+   psychoprofiling / special-category inference),
+2. the specific, explicit **purpose** (reject open-ended "find everything"),
+3. the controller, **retention** period, and how DSAR / erasure is honored.
+
+If the operator cannot state a lawful basis and purpose → **DECLINE** the named-person
+operation and offer the non-personal alternatives (company / product / market research,
+or a public entity). This gate governs every direct menu path — there is no path to
+personal data that skips it. It does not remove any capability or restrict lawful,
+authorized use (CG-02); `QS` on a public handle, `DG`, and tooling paths are exempt.
+
 ## Required Setup
 
 - Python 3.10+

package/src/bmad-plus/data/role-triggers.yaml

@@ -207,3 +207,55 @@ orchestrator:
       reasoning:
         - "stories_have_no_shared_dependencies"
         - "workload_can_be_distributed"
+
+seo:
+  default_role: seo-chief
+  auto_triggers:
+    seo-chief:
+      # Level 1 — Pattern matching (keywords in user request)
+      patterns:
+        - "SEO"
+        - "référencement"
+        - "audit SEO"
+        - "search ranking"
+        - "SERP"
+        - "on-page"
+        - "meta tags"
+      # Level 2 — Contextual (situations detected during work)
+      contexts:
+        - "seo_audit_requested"
+        - "website_launch"
+        - "organic_traffic_drop"
+      # Level 3 — Reasoning chain
+      reasoning:
+        - "organic_visibility_concern"
+
+    seo-scout:
+      patterns:
+        - "crawl"
+        - "sitemap"
+        - "robots.txt"
+        - "fetch page"
+        - "technical SEO"
+        - "core web vitals"
+        - "indexation"
+      contexts:
+        - "site_structure_unknown"
+        - "pre_audit_reconnaissance"
+      reasoning:
+        - "structure_must_be_mapped_before_scoring"
+
+    seo-judge:
+      patterns:
+        - "SEO score"
+        - "E-E-A-T"
+        - "EEAT"
+        - "quality gate"
+        - "PageSpeed"
+        - "CrUX"
+        - "ranking factors"
+      contexts:
+        - "post_crawl_scoring"
+        - "competitive_gap_analysis"
+      reasoning:
+        - "findings_need_prioritized_scoring"

package/src/bmad-plus/module.yaml

@@ -1,283 +1,283 @@
-code: bmad-plus
-name: "BMAD+ Streamlined AI-Driven Development"
-description: "Augmented BMAD framework with multi-role agents, autopilot mode, and parallel execution"
-default_selected: true
-
-# Compatibility with upstream
-extends: bmm
-compatibility:
-  min_core_version: "6.0.0"
-  max_core_version: "7.0.0"
-  replaces_modules: ["bmm"]
-  keeps_core_skills: true
-
-# ═══════════════════════════════════════════
-# MODULAR PACK SYSTEM
-# Core is always installed. Additional packs
-# add specialized agents and skills.
-# ═══════════════════════════════════════════
-
-packs:
-  core:
-    name: "Core Development"
-    icon: "⚙️"
-    description: "4 multi-role agents for full development lifecycle"
-    required: true   # Always installed
-    agents:
-      - agent-strategist
-      - agent-architect-dev
-      - agent-quality
-      - agent-orchestrator
-    skills:
-      - bmad-plus-autopilot
-      - bmad-plus-parallel
-      - bmad-plus-sync
-    data:
-      - role-triggers.yaml
-
-  osint:
-    name: "OSINT Intelligence"
-    icon: "🔍"
-    description: "Investigation, scraping, psychoprofiling (55+ Apify actors, 7 APIs)"
-    required: false
-    agents:
-      - agent-shadow
-    skills:
-      - bmad-osint-investigate
-    external_package: "osint-agent-package"
-    required_keys:
-      - APIFY_API_TOKEN
-    optional_keys:
-      - PERPLEXITY_API_KEY
-      - EXA_API_KEY
-      - TAVILY_API_KEY
-      - JINA_API_KEY
-
-  maker:
-    name: "Agent Creator"
-    icon: "🧬"
-    description: "Créer de nouveaux agents BMAD+ compatibles: design, build, package"
-    required: false
-    agents:
-      - agent-maker
-    skills: []
-
-  shield:
-    name: "Shield — GRC Compliance"
-    icon: "🛡️"
-    description: "38 compliance agents covering 25+ regulatory frameworks (GDPR, ISO 27001, SOC 2, HIPAA, PCI DSS, EU AI Act, DORA, NIS2...)"
-    required: false
-    packDir: pack-shield
-    packSrcDir: packs
-    orchestrator: shield-orchestrator
-    categories:
-      - id: data-privacy
-        name: "Data Privacy"
-        icon: "🔐"
-        agents: [gdpr-agent, ccpa-agent, lgpd-agent, dpdpa-agent, iso27701-agent]
-      - id: cybersecurity
-        name: "Cybersecurity"
-        icon: "🛡️"
-        agents: [iso27001-agent, nist-csf-agent, nist-800-53-agent, cis-controls-agent, nis2-agent, ism-agent]
-      - id: industry-compliance
-        name: "Industry Compliance"
-        icon: "🏢"
-        agents: [soc2-agent, pci-dss-agent, hipaa-agent, swift-csp-agent, dora-agent, fedramp-agent]
-      - id: defense-export
-        name: "Defense & Export Control"
-        icon: "🔒"
-        agents: [cmmc-agent, itar-agent, ear-agent, tsa-agent]
-      - id: ai-governance
-        name: "AI Governance"
-        icon: "🤖"
-        agents: [eu-ai-act-agent, iso42001-agent, nist-ai-rmf-agent]
-      - id: accessibility-esg
-        name: "Accessibility & ESG"
-        icon: "♿"
-        agents: [wcag-agent, section508-agent, csrd-agent]
-      - id: workflows
-        name: "GDPR & AI Act Workflows"
-        icon: "📋"
-        agents: [dpia-sentinel, breach-sentinel, legitimate-interest, privacy-advisor, privacy-notice-gen, privacy-policy-gen, cookie-policy-gen, ai-act-classifier, ai-act-roles, ai-act-fria, ai-act-incidents]
-
-  dev-studio:
-    name: "Dev Studio — Full SDLC"
-    icon: "🏗️"
-    description: "6 specialized agents + 30 workflows covering Analysis → Planning → Architecture → Implementation → Review. Adapted from BMAD-METHOD v6.6.0."
-    required: false
-    packDir: pack-dev-studio
-    packSrcDir: packs
-    orchestrator: dev-studio-orchestrator
-    cohabitation_warning: "Dev Studio agents overlap with Core agents (Atlas/Forge/Sentinel/Nexus). Both can be installed — Dev Studio offers more specialized, phase-specific workflows."
-    categories:
-      - id: analysis
-        name: "Analysis"
-        icon: "📊"
-        agents: [analyst-agent, tech-writer-agent, product-brief, prfaq, document-project, market-research, domain-research, technical-research]
-      - id: planning
-        name: "Planning"
-        icon: "📋"
-        agents: [pm-agent, ux-designer-agent, create-prd, prd, edit-prd, validate-prd, create-ux-design]
-      - id: architecture
-        name: "Architecture"
-        icon: "🏗️"
-        agents: [architect-agent, create-architecture, create-epics-stories, implementation-readiness, generate-project-context]
-      - id: implementation
-        name: "Implementation"
-        icon: "💻"
-        agents: [dev-agent, sprint-planning, create-story, dev-story, code-review, quick-dev, sprint-status, retrospective, correct-course, investigate, checkpoint-preview, qa-e2e-tests]
-      - id: utilities
-        name: "Utilities"
-        icon: "🔧"
-        agents: [distillator, party-mode, brainstorming, adversarial-review, edge-case-hunter, editorial-review-prose, editorial-review-structure, advanced-elicitation, shard-doc, index-docs, bmad-help, customize]
-
-  seo:
-    name: "SEO Audit 360"
-    icon: "🔍"
-    description: "3 agents (Scout, Chief, Judge) + 6-phase audit + PageSpeed loop"
-    required: false
-    packDir: pack-seo
-    packSrcDir: packs
-    agents:
-      - seo-scout
-      - seo-chief
-      - seo-judge
-
-  backup:
-    name: "Universal Backup"
-    icon: "🗂️"
-    description: "Timestamped ZIP backup with smart exclusions"
-    required: false
-    packDir: pack-backup
-    packSrcDir: packs
-    agents:
-      - backup-agent
-
-  animated:
-    name: "Animated Website"
-    icon: "🎬"
-    description: "Luxury scroll-driven website from video"
-    required: false
-    packDir: pack-animated
-    packSrcDir: packs
-    agents:
-      - animated-website-agent
-
-  memory:
-    name: "Memory — Persistent Brain"
-    icon: "🧠"
-    description: "Cross-session memory + project scanner + Karpathy guardrails"
-    required: false
-    packDir: pack-memory
-    packSrcDir: packs
-    agents:
-      - zecher
-    cohabitation_warning: "Memory can detect and link to existing brain directories (_brain/, ~/.claude/memory/). It will NEVER overwrite existing memory files."
-
-install_packs:
-  prompt:
-    - "Quels packs additionnels souhaites-tu installer ?"
-    - "Core (Atlas, Forge, Sentinel, Nexus) est toujours inclus."
-  default: "none"
-  result: "{value}"
-  multi-select:
-    - value: "osint"
-      label: "🔍 OSINT — Agent Shadow (investigation, scraping, psychoprofil)"
-    - value: "maker"
-      label: "🧬 Agent Creator — Créer de nouveaux agents BMAD+ compatibles"
-    - value: "shield"
-      label: "🛡️ Shield GRC — 38 agents de conformité (GDPR, ISO 27001, SOC 2, EU AI Act...)"
-    - value: "dev-studio"
-      label: "🏗️ Dev Studio — 6 agents + 30 workflows SDLC complet (Miriam, Yosef, Bezalel, Oholiab...)"
-    - value: "seo"
-      label: "🔍 SEO Audit 360 — 3 agents (Scout, Chief, Judge)"
-    - value: "backup"
-      label: "🗂️ Universal Backup — Backup ZIP intelligent"
-    - value: "animated"
-      label: "🎬 Animated Website — Luxury scroll-driven site from video"
-    - value: "memory"
-      label: "🧠 Memory — Cerveau persistant + scanner de projets + guardrails Karpathy"
-    - value: "all"
-      label: "🤖 Tout installer"
-    - value: "none"
-      label: "Aucun — Core uniquement"
-
-# Variables from Core Config inserted:
-## user_name
-## communication_language
-## document_output_language
-## output_folder
-
-project_name:
-  prompt: "What is your project called?"
-  default: "{directory_name}"
-  result: "{value}"
-
-user_skill_level:
-  prompt:
-    - "What is your development experience level?"
-    - "This affects how agents explain concepts in chat."
-  default: "expert"
-  result: "{value}"
-  single-select:
-    - value: "beginner"
-      label: "Beginner - Explain things clearly"
-    - value: "intermediate"
-      label: "Intermediate - Balance detail with speed"
-    - value: "expert"
-      label: "Expert - Be direct and technical"
-
-execution_mode:
-  prompt:
-    - "How do you want to work with BMAD+ agents?"
-    - "Manual: you call agents when needed. Autopilot: orchestrator manages everything."
-  default: "manual"
-  result: "{value}"
-  single-select:
-    - value: "manual"
-      label: "Manual - Call agents yourself"
-    - value: "autopilot"
-      label: "Autopilot - Orchestrator manages the pipeline"
-    - value: "hybrid"
-      label: "Hybrid - Autopilot with frequent checkpoints"
-
-auto_role_activation:
-  prompt: "Enable intelligent auto-activation of agent roles based on context?"
-  default: "true"
-  result: "{value}"
-  single-select:
-    - value: "true"
-      label: "Yes - Agents auto-switch roles when context demands it"
-    - value: "false"
-      label: "No - Only switch roles when I explicitly ask"
-
-parallel_execution:
-  prompt: "Enable parallel multi-agent execution for independent tasks?"
-  default: "true"
-  result: "{value}"
-  single-select:
-    - value: "true"
-      label: "Yes - Run independent tasks in parallel"
-    - value: "false"
-      label: "No - Sequential execution only"
-
-planning_artifacts:
-  prompt: "Where should planning artifacts be stored? (Discovery phase output)"
-  default: "{output_folder}/discovery"
-  result: "{project-root}/{value}"
-
-implementation_artifacts:
-  prompt: "Where should implementation artifacts be stored? (Build & Ship phase output)"
-  default: "{output_folder}/build"
-  result: "{project-root}/{value}"
-
-project_knowledge:
-  prompt: "Where should long-term project knowledge be stored?"
-  default: "docs"
-  result: "{project-root}/{value}"
-
-# Directories to create during installation
-directories:
-  - "{planning_artifacts}"
-  - "{implementation_artifacts}"
-  - "{project_knowledge}"
+code: bmad-plus
+name: "BMAD+ Streamlined AI-Driven Development"
+description: "Augmented BMAD framework with multi-role agents, autopilot mode, and parallel execution"
+default_selected: true
+
+# Compatibility with upstream
+extends: bmm
+compatibility:
+  min_core_version: "6.0.0"
+  max_core_version: "7.0.0"
+  replaces_modules: ["bmm"]
+  keeps_core_skills: true
+
+# ═══════════════════════════════════════════
+# MODULAR PACK SYSTEM
+# Core is always installed. Additional packs
+# add specialized agents and skills.
+# ═══════════════════════════════════════════
+
+packs:
+  core:
+    name: "Core Development"
+    icon: "⚙️"
+    description: "4 multi-role agents for full development lifecycle"
+    required: true   # Always installed
+    agents:
+      - agent-strategist
+      - agent-architect-dev
+      - agent-quality
+      - agent-orchestrator
+    skills:
+      - bmad-plus-autopilot
+      - bmad-plus-parallel
+      - bmad-plus-sync
+    data:
+      - role-triggers.yaml
+
+  osint:
+    name: "OSINT Intelligence"
+    icon: "🔍"
+    description: "Investigation, scraping, psychoprofiling (55+ Apify actors, 7 APIs)"
+    required: false
+    agents:
+      - agent-shadow
+    skills:
+      - bmad-osint-investigate
+    external_package: "osint-agent-package"
+    required_keys:
+      - APIFY_API_TOKEN
+    optional_keys:
+      - PERPLEXITY_API_KEY
+      - EXA_API_KEY
+      - TAVILY_API_KEY
+      - JINA_API_KEY
+
+  maker:
+    name: "Agent Creator"
+    icon: "🧬"
+    description: "Créer de nouveaux agents BMAD+ compatibles: design, build, package"
+    required: false
+    agents:
+      - agent-maker
+    skills: []
+
+  shield:
+    name: "Shield — GRC Compliance"
+    icon: "🛡️"
+    description: "27 compliance agents + 11 workflows covering 25+ regulatory frameworks (GDPR, ISO 27001, SOC 2, HIPAA, PCI DSS, EU AI Act, DORA, NIS2...)"
+    required: false
+    packDir: pack-shield
+    packSrcDir: packs
+    orchestrator: shield-orchestrator
+    categories:
+      - id: data-privacy
+        name: "Data Privacy"
+        icon: "🔐"
+        agents: [gdpr-agent, ccpa-agent, lgpd-agent, dpdpa-agent, iso27701-agent]
+      - id: cybersecurity
+        name: "Cybersecurity"
+        icon: "🛡️"
+        agents: [iso27001-agent, nist-csf-agent, nist-800-53-agent, cis-controls-agent, nis2-agent, ism-agent]
+      - id: industry-compliance
+        name: "Industry Compliance"
+        icon: "🏢"
+        agents: [soc2-agent, pci-dss-agent, hipaa-agent, swift-csp-agent, dora-agent, fedramp-agent]
+      - id: defense-export
+        name: "Defense & Export Control"
+        icon: "🔒"
+        agents: [cmmc-agent, itar-agent, ear-agent, tsa-agent]
+      - id: ai-governance
+        name: "AI Governance"
+        icon: "🤖"
+        agents: [eu-ai-act-agent, iso42001-agent, nist-ai-rmf-agent]
+      - id: accessibility-esg
+        name: "Accessibility & ESG"
+        icon: "♿"
+        agents: [wcag-agent, section508-agent, csrd-agent]
+      - id: workflows
+        name: "GDPR & AI Act Workflows"
+        icon: "📋"
+        agents: [dpia-sentinel, breach-sentinel, legitimate-interest, privacy-advisor, privacy-notice-gen, privacy-policy-gen, cookie-policy-gen, ai-act-classifier, ai-act-roles, ai-act-fria, ai-act-incidents]
+
+  dev-studio:
+    name: "Dev Studio — Full SDLC"
+    icon: "🏗️"
+    description: "6 specialized agents + 38 workflows covering Analysis → Planning → Architecture → Implementation → Review. Adapted from BMAD-METHOD v6.6.0."
+    required: false
+    packDir: pack-dev-studio
+    packSrcDir: packs
+    orchestrator: dev-studio-orchestrator
+    cohabitation_warning: "Dev Studio agents overlap with Core agents (Atlas/Forge/Sentinel/Nexus). Both can be installed — Dev Studio offers more specialized, phase-specific workflows."
+    categories:
+      - id: analysis
+        name: "Analysis"
+        icon: "📊"
+        agents: [analyst-agent, tech-writer-agent, product-brief, prfaq, document-project, market-research, domain-research, technical-research]
+      - id: planning
+        name: "Planning"
+        icon: "📋"
+        agents: [pm-agent, ux-designer-agent, create-prd, prd, edit-prd, validate-prd, create-ux-design]
+      - id: architecture
+        name: "Architecture"
+        icon: "🏗️"
+        agents: [architect-agent, create-architecture, create-epics-stories, implementation-readiness, generate-project-context]
+      - id: implementation
+        name: "Implementation"
+        icon: "💻"
+        agents: [dev-agent, sprint-planning, create-story, dev-story, code-review, quick-dev, sprint-status, retrospective, correct-course, investigate, checkpoint-preview, qa-e2e-tests]
+      - id: utilities
+        name: "Utilities"
+        icon: "🔧"
+        agents: [distillator, party-mode, brainstorming, adversarial-review, edge-case-hunter, editorial-review-prose, editorial-review-structure, advanced-elicitation, shard-doc, index-docs, bmad-help, customize]
+
+  seo:
+    name: "SEO Audit 360"
+    icon: "🔍"
+    description: "3 agents (Scout, Chief, Judge) + 6-phase audit + PageSpeed loop"
+    required: false
+    packDir: pack-seo
+    packSrcDir: packs
+    agents:
+      - seo-scout
+      - seo-chief
+      - seo-judge
+
+  backup:
+    name: "Universal Backup"
+    icon: "🗂️"
+    description: "Timestamped ZIP backup with smart exclusions"
+    required: false
+    packDir: pack-backup
+    packSrcDir: packs
+    agents:
+      - backup-agent
+
+  animated:
+    name: "Animated Website"
+    icon: "🎬"
+    description: "Luxury scroll-driven website from video"
+    required: false
+    packDir: pack-animated
+    packSrcDir: packs
+    agents:
+      - animated-website-agent
+
+  memory:
+    name: "Memory — Persistent Brain"
+    icon: "🧠"
+    description: "Cross-session memory + project scanner + Karpathy guardrails"
+    required: false
+    packDir: pack-memory
+    packSrcDir: packs
+    agents:
+      - zecher
+    cohabitation_warning: "Memory can detect and link to existing brain directories (_brain/, ~/.claude/memory/). It will NEVER overwrite existing memory files."
+
+install_packs:
+  prompt:
+    - "Quels packs additionnels souhaites-tu installer ?"
+    - "Core (Atlas, Forge, Sentinel, Nexus) est toujours inclus."
+  default: "none"
+  result: "{value}"
+  multi-select:
+    - value: "osint"
+      label: "🔍 OSINT — Agent Shadow (investigation, scraping, psychoprofil)"
+    - value: "maker"
+      label: "🧬 Agent Creator — Créer de nouveaux agents BMAD+ compatibles"
+    - value: "shield"
+      label: "🛡️ Shield GRC — 27 agents de conformité + 11 workflows (GDPR, ISO 27001, SOC 2, EU AI Act...)"
+    - value: "dev-studio"
+      label: "🏗️ Dev Studio — 6 agents + 38 workflows SDLC complet (Miriam, Yosef, Bezalel, Oholiab...)"
+    - value: "seo"
+      label: "🔍 SEO Audit 360 — 3 agents (Scout, Chief, Judge)"
+    - value: "backup"
+      label: "🗂️ Universal Backup — Backup ZIP intelligent"
+    - value: "animated"
+      label: "🎬 Animated Website — Luxury scroll-driven site from video"
+    - value: "memory"
+      label: "🧠 Memory — Cerveau persistant + scanner de projets + guardrails Karpathy"
+    - value: "all"
+      label: "🤖 Tout installer"
+    - value: "none"
+      label: "Aucun — Core uniquement"
+
+# Variables from Core Config inserted:
+## user_name
+## communication_language
+## document_output_language
+## output_folder
+
+project_name:
+  prompt: "What is your project called?"
+  default: "{directory_name}"
+  result: "{value}"
+
+user_skill_level:
+  prompt:
+    - "What is your development experience level?"
+    - "This affects how agents explain concepts in chat."
+  default: "expert"
+  result: "{value}"
+  single-select:
+    - value: "beginner"
+      label: "Beginner - Explain things clearly"
+    - value: "intermediate"
+      label: "Intermediate - Balance detail with speed"
+    - value: "expert"
+      label: "Expert - Be direct and technical"
+
+execution_mode:
+  prompt:
+    - "How do you want to work with BMAD+ agents?"
+    - "Manual: you call agents when needed. Autopilot: orchestrator manages everything."
+  default: "manual"
+  result: "{value}"
+  single-select:
+    - value: "manual"
+      label: "Manual - Call agents yourself"
+    - value: "autopilot"
+      label: "Autopilot - Orchestrator manages the pipeline"
+    - value: "hybrid"
+      label: "Hybrid - Autopilot with frequent checkpoints"
+
+auto_role_activation:
+  prompt: "Enable intelligent auto-activation of agent roles based on context?"
+  default: "true"
+  result: "{value}"
+  single-select:
+    - value: "true"
+      label: "Yes - Agents auto-switch roles when context demands it"
+    - value: "false"
+      label: "No - Only switch roles when I explicitly ask"
+
+parallel_execution:
+  prompt: "Enable parallel multi-agent execution for independent tasks?"
+  default: "true"
+  result: "{value}"
+  single-select:
+    - value: "true"
+      label: "Yes - Run independent tasks in parallel"
+    - value: "false"
+      label: "No - Sequential execution only"
+
+planning_artifacts:
+  prompt: "Where should planning artifacts be stored? (Discovery phase output)"
+  default: "{output_folder}/discovery"
+  result: "{project-root}/{value}"
+
+implementation_artifacts:
+  prompt: "Where should implementation artifacts be stored? (Build & Ship phase output)"
+  default: "{output_folder}/build"
+  result: "{project-root}/{value}"
+
+project_knowledge:
+  prompt: "Where should long-term project knowledge be stored?"
+  default: "docs"
+  result: "{project-root}/{value}"
+
+# Directories to create during installation
+directories:
+  - "{planning_artifacts}"
+  - "{implementation_artifacts}"
+  - "{project_knowledge}"