bmad-plus 0.13.0 → 0.16.0

package/CHANGELOG.md

@@ -7,6 +7,80 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.16.0] - 2026-09-16
+
+### Added
+- Human acceptance recipes (recette): `bmad-plus uat` (alias `bmad-plus recette`) turns a delivery into a self-contained page a person plays step by step, and turns their answers into evidence the agents read. Actions: `lint`, `build`, `serve`, `import`, `read`, `gate`, `order`.
+- Three versioned schemas ship with the skill: `bmad-plus/uat-spec/2` (what the agent writes), `bmad-plus/uat-results/2` (one run, never modified afterwards) and `bmad-plus/uat-triage/1` (how each failure was classified and decided).
+- `uat lint --src <dir>` refuses a spec whose quoted on-screen label exists in no source file, a step that writes without its read-only confirmation, markup outside the allowlist, a witness that names an unknown step, and warns when a page exceeds its step or duration budget.
+- The page reports per expectation: seen, not seen, blocked, or skipped for an optional step, with a note attached to the expectation rather than the whole step. It carries the SHA-256 of the specification it was built from, so a run always states which revision it answered.
+- Answers reach the project three ways with the same result document: `uat serve` writes them into the repository at every tick over the loopback interface; a Claude artifact saves them in its own database; a local file exports or copies the JSON for `uat import`.
+- `uat gate` passes only when the latest run is finished, answers the current revision, leaves no expectation unanswered, has every failure classified with a decision, and has every passed writing step confirmed read-only. `--emit-check` writes a self-contained verifier for a Nexus task, so its hash covers the whole check.
+- The page ships the ten languages of the installer, opens in the recipe's language, otherwise the project's `communication_language`, otherwise English, and lets the tester switch on the page. Hebrew renders right to left.
+- Sentinel gains a Recette role with three capabilities (build, read and triage, gate), auto-activation triggers, and the skill `bmad-plus-uat` installed with Core.
+- `_bmad/config.yaml` carries a `uat` block. Installation asks once for the test environment. `advisory` (the default) produces and offers the page at every delivery and never blocks; `gate` makes the delivery checkpoint wait for a passing gate; `off` produces no recipe and says so in the delivery report.
+- Specifications and runs written for the standalone FormaPro kit (`recette-interactive/1`) are read without conversion.
+
+### Changed
+- Autopilot and the orchestrator draft acceptance steps per story, finalize, deliver and read the recipe during Ship, and quote the run in the delivery report — figures, tester, what stays open.
+- Dev Studio: a story states which acceptance criteria a person can observe and where; the acceptance matrix accepts the evidence status "awaiting human recette", which no implementer claim can replace; the delivery checklist requires the run to be read and classified first.
+
+### Evidence and limits
+- 41 tests cover the library and the command in a separate process, including the gate refusing an unfinished run, a stale one, an unclassified failure, an undecided classification and an unconfirmed write.
+- A real human run through `uat serve` was recorded end to end: answers stored at every tick, the downloaded file byte-identical to the project's, and the gate refusing a ticked writing step whose write was never confirmed.
+- A recipe establishes that a person saw a screen; it is labelled human-observed. The gate proves the run is complete, current and classified — never that the tester looked at the right place.
+- The design is shaped by eight real runs on one product: of seventeen "not seen" answers, eleven were defects of the recipe itself, four of the product, two undecided, and one step ticked nine times out of nine had written nothing. Those figures come from a single product and are not a general measurement.
+
+## [0.15.0] - 2026-09-11
+
+### Added
+- `nexus` manages durable project-local runs and attempts, with dependency and write-scope validation, exact host/session bindings, current-artifact checks, bounded retries and explicit interruption/cancellation reconciliation.
+- Optional `nexus launch` supervises an explicitly planned command or Codex CLI process in the foreground. Independent clients inspect and collect exact attempt receipts; only the original supervisor controls its direct child. Host-managed attempts remain the default, and host permissions still apply.
+- `mem observe` binds an exact project memory section to an accepted, currently verified Nexus result. Opt-in evidence ranking rechecks sources, scopes, artifacts, supersession and explicit contradictions before using a bounded relevance boost; ordinary lexical recall remains available.
+- A registry-driven scored evaluation gate covers all nine packs with sealed deterministic replays and completion-only/interrupted negative controls. Repeated native campaigns record every planned attempt and keep replay validation separate from model observations.
+- Release artifacts include a CycloneDX production dependency SBOM and integrity manifest. Publication uses the exact checked npm archive and verifies registry integrity before the dependent landing deployment.
+- The evaluation backend loads the actual selected agent and declared resources, preserves effective inputs and result evidence, and distinguishes mock, rendered-response and native-host execution. A native harness prepares isolated task packets and independently scores resulting artifacts.
+- Three paired native tasks cover cache contracts, stale CLI consumers and review false positives. All six observations passed, with 3/3 for both generic and selected-agent contexts; this small pilot demonstrates no quality advantage.
+
+### Changed
+- Forge, Sentinel and Nexus use proportionate investigation, evidence-backed review, consumer verification and bounded repair. Selected original adaptations are mapped to pinned BMAD-METHOD 6.12 sources; the declared baseline remains 6.6.0.
+- Autopilot and parallel instructions use durable Nexus receipts while preserving host ownership, existing authorization and useful interrupted work.
+
+### Fixed
+- Completion prose, a zero worker exit or stale test evidence cannot satisfy current critical acceptance checks.
+- Nexus verifier environments exclude inherited interpreter hooks and credentials; unsafe older verification receipts require fresh checks.
+- Native evaluation collection is reserved exclusively before grading and publishes one complete receipt atomically. Check output capture is bounded, with explicit overflow, timeout and partial-stream evidence.
+- Maintained Python dependency audits now block CI. Patch proposals remain visible for the separately frozen private MCP stack, whose known findings remain in an explicit advisory audit.
+- Bundled third-party notices preserve upstream attribution, correct Shield provenance and distinguish declared licenses from missing upstream notice files. npm OIDC authentication remains separate from npm provenance, which is not enabled for the private build/mirror arrangement.
+- Python interpreter caches are excluded from source installation and npm archives; executing a local toolkit no longer adds generated bytecode to managed framework files.
+
+### Evidence and limits
+- The nine scored replays and eighteen negative controls test the evaluation checks and failure handling; they make no model calls and do not establish model quality.
+- The fixed 24-case English/French memory retrieval corpus reports 12/24 correct for lexical ranking and 24/24 for evidence ranking. This synthetic corpus includes explicit stale/conflicting cases; downstream LLM quality and causal improvement remain unmeasured.
+- A real Codex CLI smoke attempt started and returned a transcript, but its host denied the requested file write. Independent verification failed and acceptance was refused. No sandbox bypass, successful Codex file edit, automatic scheduling or orphan-worker takeover is claimed.
+
+## [0.14.0] - 2026-09-09
+
+### Added
+- `studio list` and `studio prepare` resolve installed Dev Studio routes, real instruction contents, input hashes and YAML configuration without executing an agent or writing deliverables.
+- Dev Studio supplies original, self-contained procedures for all 38 workflows and six existing personas, with working entry points, declared resources and compatibility guides for earlier step paths.
+- Installation diagnostics share one human/JSON report with registry-declared resources, ownership evidence, runtime limits and explicit host-managed execution capabilities.
+- Optional `doctor --verify-python` checks a real provisioned environment, supported Python version and required imports within a bounded subprocess. Default diagnostics remain inspection-only.
+- English-first public guides with French, Spanish and German translations cover installation, role activation, examples, updates and reviewed release history.
+- Release tooling generates the npm README from shared public content, validates every translated candidate guide before publication, and verifies official npm metadata before synchronizing and deploying the website. Landing-only recovery uses the original source revision without republishing npm.
+
+### Fixed
+- Memory declares its shipped Node/file-based features; separately deployed MCP/RAG dependencies are no longer provisioned from an absent npm path.
+- SEO entry points explain prompts-only operation and mark missing measurements unverified. Incomplete audits omit unsupported scores and use a report format that preserves missing evidence.
+- Orchestrator, autopilot and upstream-sync notifications require a configured, authorized channel; ordinary installations report checkpoints in the session.
+- The distributed npm README now includes the current reviewed release history and the official `bmad-plus.rochetta.fr` documentation links.
+
+### Quality
+- Python runtime paths are checked against package boundaries and the actual npm archive; shipped and tested SEO toolkit copies must match in file inventory and bytes.
+- Regression coverage includes missing delivery resources, ownership changes, Python probe failures, unpublished release candidates and stale public content.
+- Dev Studio resource graphs, aliases, input requirements, configuration, relocation and customized-file update/restore are checked against real consumer installations. Missing inputs remain explicit; the coding assistant executes the prepared instructions.
+- The BMAD-METHOD 6.12 review informs selective original adaptations. The declared upstream baseline remains 6.6; no full 6.12 compatibility or standalone agent runtime is claimed.
+
 ## [0.13.0] - 2026-09-08
 
 ### Added