bmad-plus 0.12.1 → 0.13.0

package/src/bmad-plus/agents/agent-orchestrator/SKILL.md

@@ -65,6 +65,8 @@ Focuses on: end-to-end pipeline management, agent sequencing, checkpoint managem
    - Run full code review → UX review → documentation
    - 🔴 CHECKPOINT: Wait for user approval before finalization
 
+Read `execution_mode` and `checkpoints` from `_bmad/config.yaml` before starting the pipeline. The checkpoint keys are `discovery`, `architecture`, `story`, and `delivery`.
+
 **Checkpoint behavior** (configurable):
 - `require_approval` (🔴 STOP): Pause and wait for user input. Notify via WhatsApp if configured.
 - `notify_only` (🟡 INFO): Send notification, continue unless user intervenes within timeout.

package/src/bmad-plus/agents/agent-shadow/SKILL.md

@@ -43,6 +43,24 @@ When you are in this persona and the user calls a skill, this persona must carry
 | CE | 📞 Contact Enrichment: Find email, phone, and contact info | prompt: contact-enrichment |
 | DG | 🔧 Diagnose Tools: Check which APIs and tools are available | prompt: diagnose |
 
+## Lawful Basis Gate (MANDATORY before INV / LI / IG / FB / PP / CE)
+
+Before executing **any** personal-data menu item — `INV`, `LI`, `IG`, `FB`, `PP`
+(special-category inference, GDPR Art. 9), `CE` — you MUST first run the **Phase −1
+Lawful Basis Gate** defined in the `bmad-osint-investigate` skill. Establish and
+record, using `assets/lawful-basis-record.md`:
+
+1. the **lawful basis** (GDPR Art. 6 — and an **Art. 9** condition for `PP`
+   psychoprofiling / special-category inference),
+2. the specific, explicit **purpose** (reject open-ended "find everything"),
+3. the controller, **retention** period, and how DSAR / erasure is honored.
+
+If the operator cannot state a lawful basis and purpose → **DECLINE** the named-person
+operation and offer the non-personal alternatives (company / product / market research,
+or a public entity). This gate governs every direct menu path — there is no path to
+personal data that skips it. It does not remove any capability or restrict lawful,
+authorized use (CG-02); `QS` on a public handle, `DG`, and tooling paths are exempt.
+
 ## Required Setup
 
 - Python 3.10+

package/src/bmad-plus/data/role-triggers.yaml

@@ -207,3 +207,55 @@ orchestrator:
       reasoning:
         - "stories_have_no_shared_dependencies"
         - "workload_can_be_distributed"
+
+seo:
+  default_role: seo-chief
+  auto_triggers:
+    seo-chief:
+      # Level 1 — Pattern matching (keywords in user request)
+      patterns:
+        - "SEO"
+        - "référencement"
+        - "audit SEO"
+        - "search ranking"
+        - "SERP"
+        - "on-page"
+        - "meta tags"
+      # Level 2 — Contextual (situations detected during work)
+      contexts:
+        - "seo_audit_requested"
+        - "website_launch"
+        - "organic_traffic_drop"
+      # Level 3 — Reasoning chain
+      reasoning:
+        - "organic_visibility_concern"
+
+    seo-scout:
+      patterns:
+        - "crawl"
+        - "sitemap"
+        - "robots.txt"
+        - "fetch page"
+        - "technical SEO"
+        - "core web vitals"
+        - "indexation"
+      contexts:
+        - "site_structure_unknown"
+        - "pre_audit_reconnaissance"
+      reasoning:
+        - "structure_must_be_mapped_before_scoring"
+
+    seo-judge:
+      patterns:
+        - "SEO score"
+        - "E-E-A-T"
+        - "EEAT"
+        - "quality gate"
+        - "PageSpeed"
+        - "CrUX"
+        - "ranking factors"
+      contexts:
+        - "post_crawl_scoring"
+        - "competitive_gap_analysis"
+      reasoning:
+        - "findings_need_prioritized_scoring"