bmad-plus 0.16.0 → 0.17.0

package/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.17.0] - 2026-09-22
+
+### Added
+- The acceptance skill ships the two project gates it describes: `uat-spec-present.mjs` refuses a version that no recipe names, and `uat-release-gate.mjs` refuses a deployment whose recipe has no finished, current and classified run. Both need only Node, read the gate's own answer rather than guessing from an exit code, and report a gate that could not run as exactly that — never as a pass. `templates/README.md` carries the wiring.
+
+- BMAD+ submits to its own gate. Its recipe describes what a person walks in a fresh project — install, roster, doctor, one workflow, an acceptance page, update awareness, and an uninstall that keeps the project's memory. Recipes, runs and triage stay on the maintainer's machine under `recettes/`: they carry local paths and terminal output, so git ignores the folder, the public mirror scrubs it and npm never packs it. A versioned `.husky/pre-push` hook refuses to push a `v*` tag — the push that publishes — unless `npm run uat:spec` and `npm run uat:gate` pass on that machine.
+- The skill ships `templates/example-uat-spec.json`, a complete specification to copy, with a witness and its proof, a writing step and its read-only confirmation, and a positive control. A test keeps it passing the lint it teaches.
+
+### Changed
+- Public guides and generated npm documentation explain the acceptance fixes, include prompts for reviewing results and maintaining project memory, and stay synchronized in English, French, Spanish and German. The landing links to the official public source from its menu, footer and discovery assets.
+- Release checks distinguish automated evidence, human observations and an explicit `accept-risk` decision by a named owner. A blocked expectation cannot be presented as observed merely because it was classified.
+
+### Fixed
+- The distribution scrub now covers every maintainer adapter declared in the registry, including Codex, Cursor, OpenCode and Aider root files. Installed product templates remain available. A registry-derived regression check guards future adapter additions.
+- **A blocked expectation can no longer pass the gate on a classification alone.** Nothing was observed, so explaining why establishes nothing about the product: the gate now requires a replay, or an `accept-risk` decision signed with `decidedBy`. The second run of BMAD+'s own recipe had 17 of 21 expectations blocked, all rightly classified as recipe defects — and would otherwise have passed.
+- `uat build <id>` finds a recipe by its id whatever its file is called: the shipped `example-uat-spec.json` holds `example-1.0.0`, and building it by id used to report that no spec existed.
+- **The acceptance page could discard a whole run in silence.** Classes that set `display` overrode the `hidden` attribute, so the steps showed before any run existed; a tester could tick and annotate every step, nothing was recorded, and "Save the JSON" exported `null.json`. The page now hides what must stay hidden whatever a class says, refuses to record, finish or export before a run starts, and says so where the tester is looking. Pages served inside claude.ai were protected by the host's own stylesheet, which is why the defect only appeared through `uat serve` and local files — it also affects 0.16.0.
+- The page's progress bar shows one segment per step — green seen, red not seen, orange blocked, grey skipped — with the tester and the finish date ("Run by laurent · finished on 2026-09-16") and each count spelled out; a segment jumps to its step.
+- A command in a "Do" line copies itself on click, and the lint warns when punctuation follows a command: testers had copied `doctor.` from a sentence into their terminal.
+- The installer's test-environment question is translated into the ten installer languages.
+- The skill asked for `recette.mode` while installation writes a `uat` block; it now names `uat.mode` and states that an absent block means `advisory`, which is what an updated project has until its configuration is extended by hand.
+- The release gate ran the CLI through `npx`, which cannot be spawned without a shell on Windows: the gate reported `spawnSync npx.cmd EINVAL` instead of a verdict. It now runs the CLI's own entry point with the Node that started it, taken from `--cli`, from `BMAD_PLUS_CLI`, or from the project's `node_modules`, and says plainly when there is none.
+- `autoconfig` no longer takes a health argument it never read.
+
 ## [0.16.0] - 2026-09-16
 
 ### Added

package/README.md

@@ -1,8 +1,8 @@
 # BMAD+
 
-[![Version](https://img.shields.io/badge/version-0.16.0-blue)](https://www.npmjs.com/package/bmad-plus)
+[![Version](https://img.shields.io/badge/version-0.17.0-blue)](https://www.npmjs.com/package/bmad-plus)
 
-**Version 0.16.0** · Node.js `>=20.0.0` · MIT
+**Version 0.17.0** · Node.js `>=20.0.0` · MIT
 
 Project-local AI development workflows with clear roles, shared context, safe updates and coding-tool adapters
 
@@ -35,7 +35,7 @@ Run the installer. Select the adapters for the AI tools you use and the packs yo
 **In your project terminal:**
 
 ```sh
-npx bmad-plus@0.16.0 install
+npx bmad-plus@0.17.0 install
 ```
 
 The installer creates the agent instructions, shared project spine and selected tool adapters. Optional packs may need additional runtimes or API access.
@@ -136,37 +136,55 @@ Expected result: bounded assignments, explicit dependencies and one integrated r
 Use when a version reaches your test environment and someone must check it on screen.
 
 ```text
-Sentinel, write the acceptance recipe for this delivery on our test environment. One step per gesture, one verifiable fact per line, on-screen labels quoted from the code, and mark the steps that write for real. Build the page, then tell me the link, how long it takes and what I must not skip.
+Sentinel, write the acceptance recipe for this delivery on our test environment. One step per gesture, one verifiable fact per line, on-screen labels quoted from the code, and mark the steps that write for real. Build the page, then tell me the link, how long it takes and what I must not skip. Use disposable test data when possible, name the exact folder and files each command changes, and keep automated evidence separate from the person’s answers.
 ```
 
 Expected result: a page a non-technical person can play, and a run the agent reads back to classify every failure before anything is fixed.
 
+### Save a session with Zecher
+
+Use before ending a session, with the optional Memory pack installed.
+
+```text
+Zecher, update this project’s memory from the changes and checks we actually completed. Separate implemented, tested, published and still pending work. Record decisions and useful evidence, archive superseded notes without deleting them, and write a short prompt for the next session. Keep project memory local and exclude secrets.
+```
+
+Expected result: a concise current context, a dated session handoff and a restart prompt that identifies the next unfinished task.
+
+### Read a test run without guessing
+
+Use when a person has completed or stopped an acceptance run.
+
+```text
+Sentinel, read the latest acceptance run and compare its fingerprint with the current recipe. Ask what actually happened when answers and evidence disagree. Classify failures before proposing fixes, verify writing steps read-only, and distinguish human observations, automated checks and any explicit risk decision by its named owner. Never mark an unperformed step as passed.
+```
+
+Expected result: a clear verdict, evidence for confirmed writes and a short list of checks still requiring action.
+
 ### Resume without losing decisions
 
-Use at the start of a later session in the same project.
+Use at the start of a later session in the same project; no optional pack is required.
 
 ```text
-Read AGENTS.md and the available project memory. Summarize the last verified state, open decisions and the next unfinished task. Check that the notes still match the code before continuing.
+Read AGENTS.md and the available project memory. Summarize the last verified state, open decisions and the next unfinished task. Distinguish released features from local candidates, and automated checks from human acceptance. Check that the notes still match the code before continuing.
 ```
 
 Expected result: a short, evidence-based restart. Project notes are useful context and still need to be checked against the current work.
 
-## What’s new in 0.16.0
+## What’s new in 0.17.0
 
-Human acceptance, written down and read back
+Reliable acceptance pages and clearer release checks
 
-A delivery now produces a step-by-step page a person plays, and their run comes back as evidence the agents read, classify and gate on. This release also carries what 0.15.0 had prepared and never shipped: durable Nexus execution, evidence-ranked memory and scored checks for every pack.
+Acceptance pages now prevent silent answer loss and empty exports, recipes build by their own identifier, and project release checks work directly with Node on Windows. Guides add practical prompts for reading results and preserving project context.
 
-- bmad-plus uat builds a self-contained acceptance page from a JSON specification: one verifiable fact per line, on-screen labels quoted from your own code, and every step that writes for real marked as such.
-- The tester answers Seen, Not seen or Blocked and writes what they saw instead. Answers are saved as they go — straight into the project with uat serve, or in the page itself when it travels as a file.
-- uat read returns every failure with its expectation and the tester note; uat gate passes only when the run is finished, answers the current revision of the recipe, is fully classified, and every writing step was confirmed read-only.
-- The page speaks the ten languages of the installer, opens in the project language and lets the tester switch. Sentinel gains a Recette role, and the delivery report quotes the run instead of claiming acceptance.
-- Nexus records task dependencies, write scopes, attempts and recovery evidence. Use nexus create --plan plan.json, then nexus launch RUN TASK for an explicitly configured command or Codex CLI process.
-- After launch, inspect the run, collect its exact attempt identity, run nexus verify RUN TASK and finally nexus accept RUN TASK. A finished process or an agent's success message cannot replace independent checks; host permissions still apply.
-- mem observe --input observation.json links one project memory section to a currently accepted Nexus task. mem recall QUERY --ranking evidence --context-scope PATH rechecks the evidence; stale, superseded or explicitly conflicting advice is excluded.
-- All nine packs have scored deterministic replay checks with negative controls. A small native pilot and repeated-campaign tooling keep real model observations separate from replay results; no general model-quality gain is claimed.
-- The release workflow checks a production dependency SBOM, publishes the exact validated archive and compares npm integrity before updating this site. Source notices ship with the package; npm provenance is not enabled.
-- Existing project update policies and customized-file protections remain in force. Restart the assistant or reload AGENTS.md and the affected skills after applying the update.
+- Pages served locally or opened as files keep their steps hidden until a run starts. Recording, finishing or exporting before that point produces a visible message instead of losing answers or downloading null.json.
+- uat build resolves the specification by its id even when the filename differs. The shipped example-uat-spec.json can be built with uat build example-1.0.0.
+- The progress bar shows each step’s state, the tester and the finish date. Its segments jump to the corresponding step, and commands in action lines copy on click.
+- The skill includes a recipe-presence check and a release gate, plus a complete example with witnesses, a writing step and read-only confirmation. Wire the checks into your own project; the installer does not add lifecycle hooks to user projects.
+- A blocked expectation needs a replay or an explicit accept-risk decision naming its owner. Classifying an unobserved check does not establish success, and a passed writing step still needs independent evidence.
+- The release gate calls the CLI through Node instead of spawning an npx.cmd shim. A missing CLI or a gate that could not run produces an error, never a passing verdict.
+- The skill uses uat.mode consistently. An updated project with no uat block remains advisory, and the installer’s test-environment question is translated into all ten installer languages.
+- English, French, Spanish and German guides share the reviewed release notes and seven examples, including Zecher memory handoffs and acceptance-result review. The official public GitHub source is linked from the site; distribution checks exclude maintainer-only adapters.
 
 ## Version History
 
@@ -174,9 +192,9 @@ These dates identify reviewed CHANGELOG notes, not npm publication dates. The we
 
 | Version | Release-notes date | Reviewed summary |
 | --- | --- | --- |
+| 0.17.0 | 2026-09-22 | Acceptance pages now prevent silent answer loss and empty exports, recipes build by their own identifier, and project release checks work directly with Node on Windows. Guides add practical prompts for reading results and preserving project context. |
 | 0.16.0 | 2026-09-16 | A delivery now produces a step-by-step page a person plays, and their run comes back as evidence the agents read, classify and gate on. This release also carries what 0.15.0 had prepared and never shipped: durable Nexus execution, evidence-ranked memory and scored checks for every pack. |
 | 0.14.0 | 2026-09-09 | Dev Studio gains complete instructions and verifiable context loading; release documentation follows the published package. |
-| 0.13.0 | 2026-09-08 | Discover published releases, control automatic-update policy and preserve customized agent files. |
 
 [Release history and update guide](https://bmad-plus.rochetta.fr/docs/#changelog) · [All published npm versions](https://www.npmjs.com/package/bmad-plus?activeTab=versions)
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-plus",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Project-local AI development workflows with clear roles, shared context, safe updates and coding-tool adapters",
   "homepage": "https://bmad-plus.rochetta.fr",
   "keywords": [
@@ -43,6 +43,8 @@
     "build": "node tools/build/generate.js --out tools/cli/lib/packs.js --module-out src/bmad-plus/module.yaml",
     "build:check": "node tools/build/generate.js --check",
     "check:counts": "node tools/build/check-counts.js",
+    "uat:spec": "node src/bmad-plus/skills/bmad-plus-uat/templates/uat-spec-present.mjs --dir recettes",
+    "uat:gate": "node src/bmad-plus/skills/bmad-plus-uat/templates/uat-release-gate.mjs --dir recettes --cli tools/cli/bmad-plus-cli.js",
     "lint": "eslint tools/ tests/",
     "format": "prettier --write \"tools/**/*.js\" \"tests/**/*.js\"",
     "format:check": "prettier --check \"tools/**/*.js\" \"tests/**/*.js\"",

package/readme-international/README.de.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Erweitertes Multi-Agent KI-Framework
 
-[![Version](https://img.shields.io/badge/version-0.16.0-blue.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.17.0-blue.svg)](../CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](../LICENSE)
 
@@ -8,6 +8,10 @@
   <a href="../README.md">English</a> | <a href="README.fr.md">Français</a> | <a href="README.es.md">Español</a> | 🌐 <b>Deutsch</b>
 </div>
 
+**Quelldokumentation: 0.17.0.** Das [npm-Paket](https://www.npmjs.com/package/bmad-plus) und die [öffentliche Anleitung](https://bmad-plus.rochetta.fr/de/docs/) nennen die veröffentlichte Version. Das [offizielle Distributionsrepository](https://github.com/lrochetta/BMAD-PLUS) ist öffentlich. Version 0.15.0 wurde mit 0.16.0 ausgeliefert und nicht separat veröffentlicht.
+
+Version 0.17.0 behebt unbemerkt verlorene Abnahmeantworten und leere JSON-Exporte, findet Rezepte anhand ihrer Kennung und führt Veröffentlichungsprüfungen unter Windows mit Node aus. Sie ergänzt verständlichen Fortschritt, kopierbare Befehle und Vorlagen für Projektprüfungen. Blockierte Prüfungen erfordern eine Wiederholung oder eine ausdrückliche Risikoübernahme durch eine benannte Person; automatische Tests und menschliche Beobachtungen bleiben getrennt.
+
 > **Multirole-Agenten · 9 modulare Packs · Autopilot-Modus · Parallele Ausführung**
 > Intelligenter Fork von [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) — Selbstaktivierende Agenten mit 3-Stufen-Kontexterkennung, GRC-Compliance (Shield), vollständige SDLC-Pipeline (Dev Studio), OSINT-Intelligence, SEO-Audit, persistentes Cross-Session-Gedächtnis und 10-Sprachen CLI-Installer.
 
@@ -15,9 +19,9 @@
 
 ## 📋 Inhaltsverzeichnis
 
-Repository-Prüfung: **1254 JavaScript-Tests** (`npm test`). Die Deinstallation erhält den Projektspeicher und angepasste Dateien; für Installation oder Deinstallation ohne interaktives Terminal `--yes` verwenden.
+Repository-Prüfung: **1272 JavaScript-Tests** (`npm test`). Die Deinstallation erhält den Projektspeicher und angepasste Dateien; für Installation oder Deinstallation ohne interaktives Terminal `--yes` verwenden.
 
-Version 0.16.0 ergänzt die menschliche Abnahme: eine Lieferung erzeugt eine Schritt-für-Schritt-Seite, die eine Person durchgeht, ihr Durchlauf kommt als JSON zurück, das die Agenten lesen und einordnen, und `uat gate` weist einen unfertigen, veralteten, nicht eingeordneten oder unbestätigten Durchlauf zurück. Die Seite spricht die zehn Sprachen des Installers. Version 0.15.0 ergänzt persistente Nexus-Versuche, optionale Befehls- oder Codex-Ausführung im Vordergrund und eine Speicherbewertung anhand akzeptierter Ergebnisse. Ein abgeschlossener Agentenlauf benötigt weiterhin unabhängige Prüfungen. Alle neun Packs haben bewertete deterministische Kontrollen; Modellbeobachtungen bleiben davon getrennt. Dev-Studio-Kontextvorbereitung und geschützte Updates bleiben verfügbar. Siehe [Einstieg und Versionshinweise](https://bmad-plus.rochetta.fr/de/docs/).
+Version 0.16.0 ergänzt die menschliche Abnahme: eine Lieferung erzeugt eine Schritt-für-Schritt-Seite, die eine Person durchgeht, ihr Durchlauf kommt als JSON zurück, das die Agenten lesen und einordnen, und `uat gate` weist einen unfertigen, veralteten, nicht eingeordneten oder unbestätigten Durchlauf zurück. Die Seite spricht die zehn Sprachen des Installers. Sie liefert auch die für 0.15.0 vorbereiteten Änderungen: persistente Nexus-Versuche, optionale Befehls- oder Codex-Ausführung im Vordergrund und eine Speicherbewertung anhand akzeptierter Ergebnisse. Ein abgeschlossener Agentenlauf benötigt weiterhin unabhängige Prüfungen. Alle neun Packs haben bewertete deterministische Kontrollen; Modellbeobachtungen bleiben davon getrennt. Dev-Studio-Kontextvorbereitung und geschützte Updates bleiben verfügbar. Siehe [Einstieg und Versionshinweise](https://bmad-plus.rochetta.fr/de/docs/).
 
 - [Warum BMAD+?](#-warum-bmad-)
 - [Schnellstart](#-schnellstart)
@@ -163,7 +167,7 @@ Nexus orchestriert alles automatisch mit Checkpoints für deine Genehmigung.
 | `npx bmad-plus memory status` | Statusbericht des Gedächtnisses (Projekt + globales Gehirn) |
 | `npx bmad-plus memory export` | Gehirn als portables Markdown-Archiv exportieren |
 | `npx bmad-plus doctor` | Installationsintegrität prüfen |
-| `node tools/cli/bmad-plus-cli.js doctor --json` | Quellrepository: schreibgeschützter Bericht über Inventar und Fähigkeiten (nächste Version) |
+| `node tools/cli/bmad-plus-cli.js doctor --json` | Quellrepository: schreibgeschützter Bericht über Inventar und Fähigkeiten |
 | `npx bmad-plus update` | Agenten und Skills aktualisieren (Konfiguration bleibt erhalten) |
 | `npx bmad-plus uninstall` | BMAD+ vom aktuellen Projekt entfernen |
 | `npx bmad-plus autoconfig` | Intelligentes Bootstrap — Auto-Erkennung, Installation und Konfiguration |
@@ -173,12 +177,12 @@ Nexus orchestriert alles automatisch mit Checkpoints für deine Genehmigung.
 
 Die installierten Anweisungen bitten das LLM um eine Prüfung pro Sitzung. Das Ergebnis wird 24 Stunden zwischengespeichert; offline bleibt die veröffentlichte Version unbekannt. Automatische Updates erfordern eine ausdrückliche Richtlinie und unveränderte verwaltete Dateien.
 
-Für Installationen mit 0.12.2 oder älter einmal die neue CLI mit `npx --yes bmad-plus@0.16.0 update --yes` laden. Diese ausdrückliche Migration sichert vorhandene Dateien vor dem Ersetzen.
+Für Installationen mit 0.12.2 oder älter einmal die neue CLI mit `npx --yes bmad-plus@0.17.0 update --yes` laden. Diese ausdrückliche Migration sichert vorhandene Dateien vor dem Ersetzen.
 
 ```bash
 npx bmad-plus update-check --json
 npx bmad-plus update --latest --yes
-npx bmad-plus update-policy --mode auto --range "^0.16.0"
+npx bmad-plus update-policy --mode auto --range "^0.17.0"
 npx bmad-plus update --latest --auto
 npx bmad-plus update-check --offline --json
 ```
@@ -599,8 +603,9 @@ BMAD+/
 | **0.12.2** | 2026-07-16 | 🚚 **Fähigkeiten ausgeliefert** — SEO-Toolkit in-pack ausgeliefert (funktioniert von npm), OSINT-Rechtsgrundlagen-Gate auf jedem Pfad, Monitor rebuildbar, Crawler-SSRF geschlossen, mcp-server + CLI Testabdeckung; 483 Tests |
 | **0.13.0** | 2026-09-08 | Kontrollierte Updates, geschützte Agenten, wiederherstellbare Sicherungen und Registry-basierte Installation; 709 Tests |
 | **0.14.0** | 2026-09-09 | Vollständige Dev-Studio-Workflows und Kontextvorbereitung, Diagnosen, synchronisierte npm-Dokumentation und mehrsprachige Website |
-| **0.15.0** | 2026-09-11 | Persistente Nexus-Ausfuehrung, evidenzbasierter Speicher, Pack-Kontrollen und gepruefte Archive |
+| **0.15.0** | 2026-09-11 | Im Quellstand vorbereitet; mit 0.16.0 ausgeliefert. Persistente Nexus-Ausfuehrung, evidenzbasierter Speicher, Pack-Kontrollen und gepruefte Archive |
 | **0.16.0** | 2026-09-16 | Menschliche Abnahme: Seite fuer eine Person, zurueckgelesener Durchlauf, Einordnung und evidenzgebundene Pruefung, zehn Sprachen |
+| **0.17.0** | 2026-09-22 | Zuverlässige Abnahmeseiten, Suche nach Kennung, Windows-Veröffentlichungsprüfungen, ausdrückliche Risikoentscheidungen und synchronisierte Anleitungen |
 
 Siehe [CHANGELOG.md](../CHANGELOG.md) für vollständige Details.
 

package/readme-international/README.es.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Framework Multi-Agente IA Aumentado
 
-[![Version](https://img.shields.io/badge/version-0.16.0-blue.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.17.0-blue.svg)](../CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](../LICENSE)
 
@@ -8,6 +8,10 @@
   <a href="../README.md">English</a> | <a href="README.fr.md">Français</a> | 🌐 <b>Español</b> | <a href="README.de.md">Deutsch</a>
 </div>
 
+**Documentación fuente: 0.17.0.** Consulta el [paquete npm](https://www.npmjs.com/package/bmad-plus) y la [guía pública](https://bmad-plus.rochetta.fr/es/docs/) para conocer la versión publicada. El [repositorio oficial de distribución](https://github.com/lrochetta/BMAD-PLUS) es público. La 0.15.0 se entregó con la 0.16.0, sin publicación separada.
+
+La versión 0.17.0 corrige la pérdida silenciosa de respuestas y las exportaciones JSON vacías, encuentra recetas por su identificador y ejecuta los controles de publicación con Node en Windows. Añade un progreso más claro, comandos que se pueden copiar y plantillas de controles de proyecto. Una comprobación bloqueada requiere repetirla o una aceptación explícita del riesgo por un responsable identificado; las pruebas automáticas y las observaciones humanas siguen separadas.
+
 > **Agentes multirrol · 9 packs modulares · Modo Autopilot · Ejecución paralela**
 > Fork inteligente de [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) — Agentes auto-activables con detección contextual en 3 niveles, cumplimiento GRC (Shield), pipeline SDLC completo (Dev Studio), inteligencia OSINT, auditoría SEO, memoria persistente cross-session e instalador CLI en 10 idiomas.
 
@@ -15,9 +19,9 @@
 
 ## 📋 Tabla de contenidos
 
-Validación del repositorio: **1254 tests JavaScript** (`npm test`). La desinstalación conserva la memoria del proyecto y los archivos personalizados; utiliza `--yes` para instalar o desinstalar sin un terminal interactivo.
+Validación del repositorio: **1272 tests JavaScript** (`npm test`). La desinstalación conserva la memoria del proyecto y los archivos personalizados; utiliza `--yes` para instalar o desinstalar sin un terminal interactivo.
 
-La versión 0.16.0 añade la aceptación humana: una entrega produce una página paso a paso que una persona recorre, su prueba vuelve en JSON que los agentes leen y clasifican, y `uat gate` rechaza una prueba inacabada, desactualizada, sin clasificar o sin confirmar. La página habla los diez idiomas del instalador. La versión 0.15.0 añade intentos Nexus persistentes, ejecución opcional de comandos o Codex en primer plano y clasificación de memoria basada en resultados aceptados. Un turno de agente terminado aún requiere verificación independiente. Los nueve paquetes tienen controles deterministas puntuados; las observaciones de modelos se mantienen separadas. La preparación de contexto Dev Studio y las protecciones de actualización siguen disponibles. Consulta la [guía de inicio y las novedades](https://bmad-plus.rochetta.fr/es/docs/).
+La versión 0.16.0 añade la aceptación humana: una entrega produce una página paso a paso que una persona recorre, su prueba vuelve en JSON que los agentes leen y clasifican, y `uat gate` rechaza una prueba inacabada, desactualizada, sin clasificar o sin confirmar. La página habla los diez idiomas del instalador. También entrega el trabajo preparado para la 0.15.0: intentos Nexus persistentes, ejecución opcional de comandos o Codex en primer plano y clasificación de memoria basada en resultados aceptados. Un turno de agente terminado aún requiere verificación independiente. Los nueve paquetes tienen controles deterministas puntuados; las observaciones de modelos se mantienen separadas. La preparación de contexto Dev Studio y las protecciones de actualización siguen disponibles. Consulta la [guía de inicio y las novedades](https://bmad-plus.rochetta.fr/es/docs/).
 
 - [¿Por qué BMAD+?](#-por-qué-bmad-)
 - [Inicio Rápido](#-inicio-rápido)
@@ -163,7 +167,7 @@ Nexus orquesta todo automáticamente con puntos de control (checkpoints) para tu
 | `npx bmad-plus memory status` | Informe de salud de memoria (proyecto + cerebro global) |
 | `npx bmad-plus memory export` | Exportar cerebro como archivo Markdown portable |
 | `npx bmad-plus doctor` | Verificar integridad de la instalación |
-| `node tools/cli/bmad-plus-cli.js doctor --json` | Repositorio fuente: informe de inventario y capacidades de solo lectura (próxima versión) |
+| `node tools/cli/bmad-plus-cli.js doctor --json` | Repositorio fuente: informe de inventario y capacidades de solo lectura |
 | `npx bmad-plus update` | Actualizar agentes y skills (preserva la config) |
 | `npx bmad-plus uninstall` | Eliminar BMAD+ del proyecto actual |
 | `npx bmad-plus autoconfig` | Bootstrap inteligente — detección auto, instalación y configuración |
@@ -173,12 +177,12 @@ Nexus orquesta todo automáticamente con puntos de control (checkpoints) para tu
 
 Las instrucciones instaladas piden al LLM una comprobación por sesión. El resultado se conserva durante 24 horas; sin conexión, la versión publicada permanece desconocida. Las actualizaciones automáticas requieren una política explícita y archivos administrados sin cambios locales.
 
-Para instalaciones con 0.12.2 o anterior, carga una vez el nuevo CLI con `npx --yes bmad-plus@0.16.0 update --yes`. Esta migración explícita guarda copias de seguridad antes de reemplazar los archivos antiguos.
+Para instalaciones con 0.12.2 o anterior, carga una vez el nuevo CLI con `npx --yes bmad-plus@0.17.0 update --yes`. Esta migración explícita guarda copias de seguridad antes de reemplazar los archivos antiguos.
 
 ```bash
 npx bmad-plus update-check --json
 npx bmad-plus update --latest --yes
-npx bmad-plus update-policy --mode auto --range "^0.16.0"
+npx bmad-plus update-policy --mode auto --range "^0.17.0"
 npx bmad-plus update --latest --auto
 npx bmad-plus update-check --offline --json
 ```
@@ -614,8 +618,9 @@ BMAD+/
 | **0.12.2** | 2026-07-16 | 🚚 **Capacidades entregadas** — toolkit SEO embarcado in-pack (funciona desde npm), gate de base legal OSINT en cada ruta, monitor reconstruible, SSRF del crawler cerrado, cobertura de tests mcp-server + CLI; 483 tests |
 | **0.13.0** | 2026-09-08 | Actualizaciones controladas, agentes protegidos, copias restaurables e instalación derivada del registro; 709 tests |
 | **0.14.0** | 2026-09-09 | Flujos completos de Dev Studio y preparación del contexto, diagnósticos, documentación npm y web multilingüe sincronizadas |
-| **0.15.0** | 2026-09-11 | Ejecucion Nexus persistente, memoria con evidencias, controles de paquetes y archivos verificados |
+| **0.15.0** | 2026-09-11 | Preparada en el repositorio; entregada con la 0.16.0. Ejecucion Nexus persistente, memoria con evidencias, controles de paquetes y archivos verificados |
 | **0.16.0** | 2026-09-16 | Aceptacion humana: pagina recorrida por una persona, prueba releida, clasificacion y control con evidencias, diez idiomas |
+| **0.17.0** | 2026-09-22 | Páginas de aceptación fiables, búsqueda por identificador, controles de Windows, decisiones explícitas de riesgo y guías sincronizadas |
 
 Más descripciones a fondo en el archivo: [CHANGELOG.md](../CHANGELOG.md).
 

package/readme-international/README.fr.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Framework Multi-Agent IA Augmenté
 
-[![Version](https://img.shields.io/badge/version-0.16.0-blue.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.17.0-blue.svg)](../CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](../LICENSE)
 
@@ -8,6 +8,10 @@
   <a href="../README.md">English</a> | 🌐 <b>Français</b> | <a href="README.es.md">Español</a> | <a href="README.de.md">Deutsch</a>
 </div>
 
+**Documentation source : 0.17.0.** Consultez le [paquet npm](https://www.npmjs.com/package/bmad-plus) et le [guide public](https://bmad-plus.rochetta.fr/fr/docs/) pour connaître la version effectivement publiée. Le [dépôt officiel de distribution](https://github.com/lrochetta/BMAD-PLUS) est public. La 0.15.0 a été livrée avec la 0.16.0, sans publication séparée.
+
+La version 0.17.0 corrige la perte silencieuse des réponses de recette et les exports JSON vides, retrouve les recettes par identifiant et exécute les contrôles de publication avec Node sous Windows. Elle ajoute une progression lisible, des commandes copiables et des modèles de contrôles projet. Un contrôle bloqué nécessite un nouveau passage ou une acceptation explicite du risque par un responsable nommé ; tests automatisés et observations humaines restent distincts.
+
 > **Agents multi-rôles · 9 packs modulaires · Mode Autopilot · Exécution parallèle**
 > Fork intelligent de [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) — Agents auto-activables avec détection contextuelle 3 niveaux, conformité GRC (Shield), pipeline SDLC complet (Dev Studio), intelligence OSINT, audit SEO, mémoire persistante cross-session, et installeur CLI 10 langues.
 
@@ -15,9 +19,9 @@
 
 ## 📋 Table des matières
 
-Validation du dépôt : **1254 tests JavaScript** (`npm test`). La désinstallation conserve la mémoire du projet et les fichiers personnalisés ; utilisez `--yes` pour installer ou désinstaller sans terminal interactif.
+Validation du dépôt : **1272 tests JavaScript** (`npm test`). La désinstallation conserve la mémoire du projet et les fichiers personnalisés ; utilisez `--yes` pour installer ou désinstaller sans terminal interactif.
 
-La version 0.16.0 ajoute la recette humaine : une livraison produit une page pas à pas qu’une personne joue, son passage revient en JSON que les agents lisent et classent, et `uat gate` refuse un passage inachevé, périmé, non classé ou non confirmé. La page parle les dix langues de l’installeur. La version 0.15.0 ajoute des tentatives Nexus persistantes, le lancement facultatif de commandes ou de Codex au premier plan et un classement mémoire fondé sur des résultats acceptés. Un tour d’agent terminé doit encore passer une vérification indépendante. Les neuf packs disposent de contrôles déterministes notés ; les observations de modèles restent distinctes. La préparation Dev Studio et les protections de mise à jour restent disponibles. Consultez le [guide de démarrage et les nouveautés](https://bmad-plus.rochetta.fr/fr/docs/).
+La version 0.16.0 ajoute la recette humaine : une livraison produit une page pas à pas qu’une personne joue, son passage revient en JSON que les agents lisent et classent, et `uat gate` refuse un passage inachevé, périmé, non classé ou non confirmé. La page parle les dix langues de l’installeur. Elle livre aussi le travail préparé pour la 0.15.0 : des tentatives Nexus persistantes, le lancement facultatif de commandes ou de Codex au premier plan et un classement mémoire fondé sur des résultats acceptés. Un tour d’agent terminé doit encore passer une vérification indépendante. Les neuf packs disposent de contrôles déterministes notés ; les observations de modèles restent distinctes. La préparation Dev Studio et les protections de mise à jour restent disponibles. Consultez le [guide de démarrage et les nouveautés](https://bmad-plus.rochetta.fr/fr/docs/).
 
 - [Pourquoi BMAD+ ?](#-pourquoi-bmad-)
 - [Quick Start](#-quick-start)
@@ -163,7 +167,7 @@ Nexus orchestre tout automatiquement avec des checkpoints pour ton approbation.
 | `npx bmad-plus memory status` | Rapport de santé mémoire (projet + cerveau global) |
 | `npx bmad-plus memory export` | Export du cerveau en archive Markdown portable |
 | `npx bmad-plus doctor` | Vérifier l'intégrité de l'installation |
-| `node tools/cli/bmad-plus-cli.js doctor --json` | Dépôt source : rapport en lecture seule sur l'inventaire et les capacités (prochaine version) |
+| `node tools/cli/bmad-plus-cli.js doctor --json` | Dépôt source : rapport en lecture seule sur l'inventaire et les capacités |
 | `npx bmad-plus update` | Mettre à jour agents et skills (préserve la config) |
 | `npx bmad-plus uninstall` | Supprimer BMAD+ du projet actuel |
 | `npx bmad-plus autoconfig` | Bootstrap intelligent — détection auto, installation et configuration |
@@ -173,12 +177,12 @@ Nexus orchestre tout automatiquement avec des checkpoints pour ton approbation.
 
 Les instructions installées demandent au LLM une vérification par session. Le résultat est conservé 24 heures ; hors connexion, la version publiée reste inconnue. Les mises à jour automatiques exigent une politique explicite et des fichiers gérés sans modification locale.
 
-Pour les installations en 0.12.2 ou antérieures, chargez une fois le nouveau CLI avec `npx --yes bmad-plus@0.16.0 update --yes`. Cette migration explicite sauvegarde les anciens fichiers avant leur remplacement.
+Pour les installations en 0.12.2 ou antérieures, chargez une fois le nouveau CLI avec `npx --yes bmad-plus@0.17.0 update --yes`. Cette migration explicite sauvegarde les anciens fichiers avant leur remplacement.
 
 ```bash
 npx bmad-plus update-check --json
 npx bmad-plus update --latest --yes
-npx bmad-plus update-policy --mode auto --range "^0.16.0"
+npx bmad-plus update-policy --mode auto --range "^0.17.0"
 npx bmad-plus update --latest --auto
 npx bmad-plus update-check --offline --json
 ```
@@ -614,8 +618,9 @@ BMAD+/
 | **0.12.2** | 2026-07-16 | 🚚 **Capacités livrées** — toolkit SEO embarqué in-pack (fonctionne depuis npm), gate base légale OSINT sur tout chemin, monitor reconstructible, SSRF crawler fermé, couverture de tests mcp-server + CLI ; 483 tests |
 | **0.13.0** | 2026-09-08 | Mises à jour contrôlées, agents protégés, sauvegardes restaurables et installation issue du registre ; 709 tests |
 | **0.14.0** | 2026-09-09 | Workflows Dev Studio complets et préparation du contexte, diagnostics, documentation npm et landing multilingue synchronisées |
-| **0.15.0** | 2026-09-11 | Execution Nexus persistante, memoire fondee sur des preuves, controles des packs et archives verifiees |
+| **0.15.0** | 2026-09-11 | Préparée dans le dépôt ; livrée avec la 0.16.0. Execution Nexus persistante, memoire fondee sur des preuves, controles des packs et archives verifiees |
 | **0.16.0** | 2026-09-16 | Recette humaine : page jouee par une personne, passage relu, classement et porte liee aux preuves, dix langues |
+| **0.17.0** | 2026-09-22 | Recettes fiables, recherche par identifiant, contrôles de publication sous Windows, décisions de risque explicites et guides synchronisés |
 
 Voir [CHANGELOG.md](../CHANGELOG.md) pour le détail complet.
 

package/src/bmad-plus/skills/bmad-plus-uat/SKILL.md

@@ -29,10 +29,11 @@ delivery ─► spec JSON ─► build page ─► deploy to test env ─► a p
 - Someone asks for "the recette", "the UAT", "what should I check".
 - A results file appears, or the user says "read the run".
 
-Read `recette.mode` from `_bmad/config.yaml`: `advisory` (default — build and offer the page,
-never block), `gate` (the delivery waits for a passing gate), `off` (no recipe; say so in the
-delivery report). A delivery with no human-observable change states that fact rather than
-skipping in silence.
+Read `uat.mode` from `_bmad/config.yaml`: `advisory` (build and offer the page, never block),
+`gate` (the delivery waits for a passing gate), `off` (no recipe; say so in the delivery report).
+**An absent `uat` block means `advisory`** — a project updated from an earlier version keeps its
+configuration untouched, so the block is simply missing there. A delivery with no
+human-observable change states that fact rather than skipping in silence.
 
 ## 1. Write the spec — `_bmad-output/uat/specs/<product>-<version>.json`
 
@@ -113,6 +114,19 @@ with the figures, the tester's name, and what stays open. The evidence is labell
 **human-observed**: the gate establishes that the run is complete, current and triaged, never
 that the tester looked at the right place.
 
+## Gating the project itself
+
+`templates/` ships two scripts to copy into the project — they need nothing but Node,
+and they are the only layer an agent cannot skip:
+
+| Script | Where it belongs | What it refuses |
+|---|---|---|
+| `uat-spec-present.mjs` | next to the project's other checks, before the push | a version in `package.json` that no recipe names. A grouped recipe covers a version because it lists it in `versions`, never because its file name suggests a range |
+| `uat-release-gate.mjs` | the production deploy step | a deployment whose recipe has no finished run, an outdated one, an unclassified failure, or a passed writing step nobody confirmed. Exit 4 means the gate could not run at all — which is not a pass |
+
+`templates/README.md` carries the wiring. Tell the user plainly when a project has
+neither: the recipe is then produced and offered, and nothing enforces it.
+
 ## Gating a delivery with Nexus
 
 ```bash