bmad-plus 0.16.0 → 0.17.1

package/CHANGELOG.md

@@ -7,6 +7,55 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.17.1] - 2026-09-24
+
+### Changed
+- **`install` no longer overwrites a different installed version.** A downgrade is refused; an upgrade stops and points to `bmad-plus update`, which keeps backups and restorable receipts. Re-installing the same version only adds what is missing. Scripts that re-ran `install` to change versions must call `update` instead.
+- **`--packs` and `--tools` add to the previous installation** instead of replacing it. An unknown pack or tool ID now fails before anything is written, and the error lists the valid IDs.
+- **Unattended installs default to English.** Without a terminal, the communication language comes from `--lang`, then from the system locale, then English. `--yes` with no detected AI tool writes no adapter files.
+- `update` deletes files that a new version no longer ships when you have not changed them; each deletion is backed up in the update receipt and `--restore` brings it back. Files you edited are kept and reported as `modified-orphaned-file`.
+- The npm package no longer ships the maintainers' release and maintenance scripts, only the launcher, the CLI and the build modules it needs at runtime. The archive is smaller; installed projects are unaffected.
+- The OSINT pack opens with a legal and ethics notice (GDPR lawful basis, platform terms, no private profiling), and Shadow's reports start with an AI-generated, not-legal-advice disclaimer. Shadow is described as governed public-source research; its lawful-basis gate is unchanged.
+- The Shield pack and its audit report template carry a shared not-legal-advice notice, an AI-generated banner and a qualified-reviewer sign-off field.
+
+### Fixed
+- Re-installing keeps your `_bmad/config.yaml`: existing settings win, missing defaults are added, and an unparsable file is left untouched. The manifest and configuration are written atomically, so an interrupted install cannot leave them half-written.
+- A `.bmad/update.lock` left by a crashed process no longer blocks the project: when its owner is provably dead on this machine, the lock is moved aside and taken over. Other stale locks are reported by `doctor`, and the error states the manual remedy.
+- `uninstall` accepts `-d`/`--directory` like the other maintenance commands. Help names the program `bmad-plus`, and a subcommand's `--lang` is no longer swallowed by a global option.
+- The installer shows each pack with its emoji icon.
+- Release automation now waits for npm's publish-time scanning before verifying public archive integrity. Polling is bounded to thirty attempts with thirty-second intervals and a twenty-minute step limit. An unavailable version still blocks the landing, and recovery instructions explicitly forbid uploading the same version again.
+
+### Security
+- The development-only `js-yaml` copy used by the coverage tooling is pinned to the patched 4.3.2. The production dependency audit remains clean.
+
+### Documentation
+- The French, Spanish and German READMEs mirror the public README section by section. The README states that BMAD+ is not affiliated with BMad Code, LLC, and replaces the BMAD-METHOD comparison with a factual list of what BMAD+ ships.
+- The website shows the install command with a copy control in its hero, supports a dark color scheme, folds navigation on small screens and names the supported tools.
+
+## [0.17.0] - 2026-09-22
+
+### Added
+- The acceptance skill ships the two project gates it describes: `uat-spec-present.mjs` refuses a version that no recipe names, and `uat-release-gate.mjs` refuses a deployment whose recipe has no finished, current and classified run. Both need only Node, read the gate's own answer rather than guessing from an exit code, and report a gate that could not run as exactly that — never as a pass. `templates/README.md` carries the wiring.
+
+- BMAD+ submits to its own gate. Its recipe describes what a person walks in a fresh project — install, roster, doctor, one workflow, an acceptance page, update awareness, and an uninstall that keeps the project's memory. Recipes, runs and triage stay on the maintainer's machine under `recettes/`: they carry local paths and terminal output, so git ignores the folder, the public mirror scrubs it and npm never packs it. A versioned `.husky/pre-push` hook refuses to push a `v*` tag — the push that publishes — unless `npm run uat:spec` and `npm run uat:gate` pass on that machine.
+- The skill ships `templates/example-uat-spec.json`, a complete specification to copy, with a witness and its proof, a writing step and its read-only confirmation, and a positive control. A test keeps it passing the lint it teaches.
+
+### Changed
+- Public guides and generated npm documentation explain the acceptance fixes, include prompts for reviewing results and maintaining project memory, and stay synchronized in English, French, Spanish and German. The landing links to the official public source from its menu, footer and discovery assets.
+- Release checks distinguish automated evidence, human observations and an explicit `accept-risk` decision by a named owner. A blocked expectation cannot be presented as observed merely because it was classified.
+
+### Fixed
+- The distribution scrub now covers every maintainer adapter declared in the registry, including Codex, Cursor, OpenCode and Aider root files. Installed product templates remain available. A registry-derived regression check guards future adapter additions.
+- **A blocked expectation can no longer pass the gate on a classification alone.** Nothing was observed, so explaining why establishes nothing about the product: the gate now requires a replay, or an `accept-risk` decision signed with `decidedBy`. The second run of BMAD+'s own recipe had 17 of 21 expectations blocked, all rightly classified as recipe defects — and would otherwise have passed.
+- `uat build <id>` finds a recipe by its id whatever its file is called: the shipped `example-uat-spec.json` holds `example-1.0.0`, and building it by id used to report that no spec existed.
+- **The acceptance page could discard a whole run in silence.** Classes that set `display` overrode the `hidden` attribute, so the steps showed before any run existed; a tester could tick and annotate every step, nothing was recorded, and "Save the JSON" exported `null.json`. The page now hides what must stay hidden whatever a class says, refuses to record, finish or export before a run starts, and says so where the tester is looking. Pages served inside claude.ai were protected by the host's own stylesheet, which is why the defect only appeared through `uat serve` and local files — it also affects 0.16.0.
+- The page's progress bar shows one segment per step — green seen, red not seen, orange blocked, grey skipped — with the tester and the finish date ("Run by laurent · finished on 2026-09-16") and each count spelled out; a segment jumps to its step.
+- A command in a "Do" line copies itself on click, and the lint warns when punctuation follows a command: testers had copied `doctor.` from a sentence into their terminal.
+- The installer's test-environment question is translated into the ten installer languages.
+- The skill asked for `recette.mode` while installation writes a `uat` block; it now names `uat.mode` and states that an absent block means `advisory`, which is what an updated project has until its configuration is extended by hand.
+- The release gate ran the CLI through `npx`, which cannot be spawned without a shell on Windows: the gate reported `spawnSync npx.cmd EINVAL` instead of a verdict. It now runs the CLI's own entry point with the Node that started it, taken from `--cli`, from `BMAD_PLUS_CLI`, or from the project's `node_modules`, and says plainly when there is none.
+- `autoconfig` no longer takes a health argument it never read.
+
 ## [0.16.0] - 2026-09-16
 
 ### Added
@@ -153,7 +202,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Verified
 - `npm test` 333/333 (16 suites); lint 0 errors under eslint 10; both `npx npm@10 ci --dry-run` and `npm ci --dry-run` green; CI + Platform workflows green on GOLDEN master.
 
-## [0.12.0] — 2026-07-02
+## [0.12.0] - 2026-07-02
 
 ### Added — Load-bearing activation (north-star Pillars 3, 4, 5)
 - **Pillar 4 executable:** `evals/_runner/providers.py` — a provider-neutral model gateway (anthropic / openai / generic-HTTP adapters selected by `BMAD_EVAL_PROVIDER`, default deterministic **mock** so `--self-check` and CI never hit the network). `run_agent(spec, model)` now routes through it; the eval harness genuinely runs (3/3 specs pass).
@@ -166,7 +215,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Verified
 - `npm test` **333 passed / 16 suites**; `build:check` + `generate-adapters --check` no drift; `run.py --self-check` 3/3; edited Python parses.
 
-## [0.11.0] — 2026-07-02
+## [0.11.0] - 2026-07-02
 
 ### Added — Karpathy loop CLI + multi-CLI adapters (north-star Pillars 3 & 5)
 - **`bmad mem` command (Pillar 3):** `recall <query>` / `write` / `reinforce` expose the memory-journal (append/recall + Elo reward + governance guard) from the CLI, so the learning loop is usable from any driving tool. `tests/unit/memory-journal-cmd.test.js`.
@@ -179,7 +228,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Verified
 - `npm test` **325 passed / 16 suites**; `npm run build:check` no drift; `generate-adapters.js --check` no drift.
 
-## [0.10.0] — 2026-07-02
+## [0.10.0] - 2026-07-02
 
 ### Added — Platform-spine foundations (north-star Phase 2)
 Built as **new files only** (no existing core file modified); test suite grew from 176/10 to **258 passed / 13 suites**. Cut nothing; multi-tool/multi-model preserved.
@@ -192,7 +241,7 @@ Built as **new files only** (no existing core file modified); test suite grew fr
 
 Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remaining integration (provisioning called from install, memory exposed via MCP, generated multi-CLI adapters) lands next as its own tested commit — see `audit/2026-07-01/PHASE-2-STATUS.md`.
 
-## [0.9.2] — 2026-07-01
+## [0.9.2] - 2026-07-01
 
 ### Security — Phase 1 remediation (exploitable findings)
 - **RCE closed** (`ci_cd.py`): command allowlist now uses exact-token matching (shlex.split) + realpath/commonpath containment instead of prefix/`startswith` — defeats argument injection (`make -f attacker.mk`) and sibling-path bypass; `shell=False` throughout; dead Makefile fallback removed.
@@ -213,7 +262,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - Documented residual follow-ups (SSRF crawler-class redirect hops, DNS-rebinding IP pinning, Dockerfile digest pin) are tracked in `audit/2026-07-01/PHASE-1-STATUS.md`.
 - Verified: `npm test` 176/176, `npm run lint` 0 errors, all edited Python parses; SEO report smoke-tested (renders + XSS escaped).
 
-## [0.9.1] — 2026-07-01
+## [0.9.1] - 2026-07-01
 
 ### Fixed — Credibility (honest status)
 - **Real CI on push/PR** (`.github/workflows/ci.yml`): lint + test + npm audit, all blocking. Previously the only workflow ran at release-tag and swallowed failures with `|| echo`.
@@ -228,7 +277,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - Fixed the corrupted version-history table (0.9.0/0.8.0 were duplicated).
 - **Note on 0.9.0 below:** the "64/64 fixed, score A+" and "auth on all endpoints" claims in the 0.9.0 entry were **overstated**. A 2026-07-01 adversarial re-audit (see `audit/2026-07-01/`) found 102 open findings and re-graded the project **C+**. The MCP token *is* checked by middleware on `/sse` and `/messages/`, but the prior "all endpoints" phrasing and the A+ score were not accurate. This release begins the honest remediation.
 
-## [0.9.0] — 2026-06-24
+## [0.9.0] - 2026-06-24
 
 ### Security
 - Full audit remediation: 64/64 findings fixed, score C- → A+
@@ -256,7 +305,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 ### Tests
 - 143/143 tests passing
 
-## [0.8.0] — 2026-06-24
+## [0.8.0] - 2026-06-24
 
 ### Added
 - 3 new packs: pack-animated (web animation agent), pack-backup (universal backup agent), pack-seo (full SEO audit — 15 files with agents, refs, templates, playbooks)
@@ -281,7 +330,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 ### Tests
 - 143/143 tests passing ✅
 
-## [0.7.5] — 2026-05-17
+## [0.7.5] - 2026-05-17
 
 ### 🩺 Quality & Compliance
 
@@ -299,7 +348,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
   - 2 decisions (anti-regression protocol, i18n-first CLI)
   - 2 patterns (dual-tier memory, surgical edit protocol)
 
-## [0.7.4] — 2026-05-17
+## [0.7.4] - 2026-05-17
 
 ### 🧠 Smart Autoconfig
 
@@ -314,7 +363,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 ### Fixed
 - `--tools none` installer crash (undefined IDE name)
 
-## [0.7.3] — 2026-05-17
+## [0.7.3] - 2026-05-17
 
 ### 🎨 Scan UX Improvements
 
@@ -323,11 +372,11 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - **`--active-days <n>`** — Custom threshold for "active" status (default: 30 days)
 - **`--paused-days <n>`** — Custom threshold for "paused" status (default: 180 days)
 
-## [0.7.2] - 2026-06-XX
+## [0.7.2] - 2026-05-17
 ### Fixed
 - `scan` command: `bmad-plus scan <path>` now accepts a positional path argument
 
-## [0.7.1] — 2026-05-17
+## [0.7.1] - 2026-05-17
 
 ### 🛠️ CLI Commands & Guardrails Injection
 
@@ -346,7 +395,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - **Karpathy Guardrails injection** — 4 principles auto-injected into CLAUDE.md/GEMINI.md/AGENTS.md when Memory pack is installed
 - **i18n** — Memory + Dev Studio keys for EN and FR (other languages use fallback)
 
-## [0.7.0] — 2026-05-17
+## [0.7.0] - 2026-05-17
 
 ### 🧠 Pack Memory — Persistent Brain
 
@@ -366,7 +415,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - IDE config generation: Zecher agent listed when memory pack selected
 - Install guide: memory-specific examples (Zecher commands)
 
-## [0.6.0] — 2026-05-17
+## [0.6.0] - 2026-05-17
 
 ### 🏗️ Pack Dev Studio — Full Software Development Lifecycle
 
@@ -389,7 +438,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 - **install.js** — IDE configs now include 6 Torah-named agents when Dev Studio is selected
 - **Version reference** — Updated from BMAD-METHOD v6.2.0 to v6.6.0
 
-## [0.5.0] — 2026-05-17
+## [0.5.0] - 2026-05-17
 
 > **Correction (2026-07-15)** — as published, this section announced "38 expert compliance agents"
 > and "85 Reference Files". Both were false on the day they were written, so they are corrected
@@ -429,7 +478,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.4] — 2026-05-17
+## [0.4.4] - 2026-05-17
 
 ### 🔧 Encoding Fix + i18n Complete + Tests
 
@@ -445,7 +494,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.3] — 2026-05-17
+## [0.4.3] - 2026-05-17
 
 ### 🔧 CLI Commands + Security Hardening + UX Enhancements
 
@@ -473,7 +522,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.2] — 2026-03-19
+## [0.4.2] - 2026-03-19
 
 ### 📦 Public Packs — SEO/Backup/Animated now in npm
 
@@ -484,7 +533,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.1] — 2026-03-19
+## [0.4.1] - 2026-03-19
 
 ### 🌐 CLI Internationalization + DevOps Hardening
 
@@ -502,7 +551,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.4.0] — 2026-03-19
+## [0.4.0] - 2026-03-19
 
 ### 🏢 SEO Engine — Enterprise Extensions (Sprint 4)
 
@@ -518,7 +567,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.3.3] — 2026-03-19
+## [0.3.3] - 2026-03-19
 
 ### 🧪 SEO Engine — Quality & Security (Sprint 3)
 
@@ -530,7 +579,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.3.2] — 2026-03-19
+## [0.3.2] - 2026-03-19
 
 ### 📊 SEO Engine — Reports, Competitor & Hreflang (Sprint 2)
 
@@ -541,7 +590,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.3.1] — 2026-03-19
+## [0.3.1] - 2026-03-19
 
 ### 🔧 SEO Engine Enhancements (Sprint 1)
 
@@ -553,7 +602,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.3.0] — 2026-03-19
+## [0.3.0] - 2026-03-19
 
 ### 🚀 SEO Engine v2.0 — Complete Rewrite
 
@@ -590,7 +639,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.2.0] — 2026-03-18
+## [0.2.0] - 2026-03-18
 
 ### 🔀 Oveanet Fusion
 
@@ -611,7 +660,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.1.3] — 2026-03-18
+## [0.1.3] - 2026-03-18
 
 ### 🔧 Cross-Platform Fix
 
@@ -621,7 +670,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.1.2] — 2026-03-17
+## [0.1.2] - 2026-03-17
 
 ### 📝 Credits Update
 
@@ -631,7 +680,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.1.1] — 2026-03-17
+## [0.1.1] - 2026-03-17
 
 ### 👤 Author Attribution
 
@@ -641,7 +690,7 @@ Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remainin
 
 ---
 
-## [0.1.0] — 2026-03-17
+## [0.1.0] - 2026-03-17
 
 ### 🎉 Initial Release — Foundation
 
@@ -709,3 +758,39 @@ First release of BMAD+, an augmented fork of BMAD-METHOD v6.2.0.
 ---
 
 *For earlier history, see the upstream [BMAD-METHOD CHANGELOG](https://github.com/bmad-code-org/BMAD-METHOD/blob/main/CHANGELOG.md).*
+
+<!-- Version links point to the npm release page. The public repository is a single snapshot, so per-version compare links are not available. Not published on npm: 0.15.0, 0.11.0, 0.10.0, 0.1.2. -->
+
+[0.17.1]: https://www.npmjs.com/package/bmad-plus/v/0.17.1
+[0.17.0]: https://www.npmjs.com/package/bmad-plus/v/0.17.0
+[0.16.0]: https://www.npmjs.com/package/bmad-plus/v/0.16.0
+[0.14.0]: https://www.npmjs.com/package/bmad-plus/v/0.14.0
+[0.13.0]: https://www.npmjs.com/package/bmad-plus/v/0.13.0
+[0.12.2]: https://www.npmjs.com/package/bmad-plus/v/0.12.2
+[0.12.1]: https://www.npmjs.com/package/bmad-plus/v/0.12.1
+[0.12.0]: https://www.npmjs.com/package/bmad-plus/v/0.12.0
+[0.9.2]: https://www.npmjs.com/package/bmad-plus/v/0.9.2
+[0.9.1]: https://www.npmjs.com/package/bmad-plus/v/0.9.1
+[0.9.0]: https://www.npmjs.com/package/bmad-plus/v/0.9.0
+[0.8.0]: https://www.npmjs.com/package/bmad-plus/v/0.8.0
+[0.7.5]: https://www.npmjs.com/package/bmad-plus/v/0.7.5
+[0.7.4]: https://www.npmjs.com/package/bmad-plus/v/0.7.4
+[0.7.3]: https://www.npmjs.com/package/bmad-plus/v/0.7.3
+[0.7.2]: https://www.npmjs.com/package/bmad-plus/v/0.7.2
+[0.7.1]: https://www.npmjs.com/package/bmad-plus/v/0.7.1
+[0.7.0]: https://www.npmjs.com/package/bmad-plus/v/0.7.0
+[0.6.0]: https://www.npmjs.com/package/bmad-plus/v/0.6.0
+[0.5.0]: https://www.npmjs.com/package/bmad-plus/v/0.5.0
+[0.4.4]: https://www.npmjs.com/package/bmad-plus/v/0.4.4
+[0.4.3]: https://www.npmjs.com/package/bmad-plus/v/0.4.3
+[0.4.2]: https://www.npmjs.com/package/bmad-plus/v/0.4.2
+[0.4.1]: https://www.npmjs.com/package/bmad-plus/v/0.4.1
+[0.4.0]: https://www.npmjs.com/package/bmad-plus/v/0.4.0
+[0.3.3]: https://www.npmjs.com/package/bmad-plus/v/0.3.3
+[0.3.2]: https://www.npmjs.com/package/bmad-plus/v/0.3.2
+[0.3.1]: https://www.npmjs.com/package/bmad-plus/v/0.3.1
+[0.3.0]: https://www.npmjs.com/package/bmad-plus/v/0.3.0
+[0.2.0]: https://www.npmjs.com/package/bmad-plus/v/0.2.0
+[0.1.3]: https://www.npmjs.com/package/bmad-plus/v/0.1.3
+[0.1.1]: https://www.npmjs.com/package/bmad-plus/v/0.1.1
+[0.1.0]: https://www.npmjs.com/package/bmad-plus/v/0.1.0

package/README.md

@@ -1,8 +1,8 @@
 # BMAD+
 
-[![Version](https://img.shields.io/badge/version-0.16.0-blue)](https://www.npmjs.com/package/bmad-plus)
+[![Version](https://img.shields.io/badge/version-0.17.1-blue)](https://www.npmjs.com/package/bmad-plus)
 
-**Version 0.16.0** · Node.js `>=20.0.0` · MIT
+**Version 0.17.1** · Node.js `>=20.0.0` · MIT
 
 Project-local AI development workflows with clear roles, shared context, safe updates and coding-tool adapters
 
@@ -35,7 +35,7 @@ Run the installer. Select the adapters for the AI tools you use and the packs yo
 **In your project terminal:**
 
 ```sh
-npx bmad-plus@0.16.0 install
+npx bmad-plus@0.17.1 install
 ```
 
 The installer creates the agent instructions, shared project spine and selected tool adapters. Optional packs may need additional runtimes or API access.
@@ -136,37 +136,55 @@ Expected result: bounded assignments, explicit dependencies and one integrated r
 Use when a version reaches your test environment and someone must check it on screen.
 
 ```text
-Sentinel, write the acceptance recipe for this delivery on our test environment. One step per gesture, one verifiable fact per line, on-screen labels quoted from the code, and mark the steps that write for real. Build the page, then tell me the link, how long it takes and what I must not skip.
+Sentinel, write the acceptance recipe for this delivery on our test environment. One step per gesture, one verifiable fact per line, on-screen labels quoted from the code, and mark the steps that write for real. Build the page, then tell me the link, how long it takes and what I must not skip. Use disposable test data when possible, name the exact folder and files each command changes, and keep automated evidence separate from the person’s answers.
 ```
 
 Expected result: a page a non-technical person can play, and a run the agent reads back to classify every failure before anything is fixed.
 
+### Save a session with Zecher
+
+Use before ending a session, with the optional Memory pack installed.
+
+```text
+Zecher, update this project’s memory from the changes and checks we actually completed. Separate implemented, tested, published and still pending work. Record decisions and useful evidence, archive superseded notes without deleting them, and write a short prompt for the next session. Keep project memory local and exclude secrets.
+```
+
+Expected result: a concise current context, a dated session handoff and a restart prompt that identifies the next unfinished task.
+
+### Read a test run without guessing
+
+Use when a person has completed or stopped an acceptance run.
+
+```text
+Sentinel, read the latest acceptance run and compare its fingerprint with the current recipe. Ask what actually happened when answers and evidence disagree. Classify failures before proposing fixes, verify writing steps read-only, and distinguish human observations, automated checks and any explicit risk decision by its named owner. Never mark an unperformed step as passed.
+```
+
+Expected result: a clear verdict, evidence for confirmed writes and a short list of checks still requiring action.
+
 ### Resume without losing decisions
 
-Use at the start of a later session in the same project.
+Use at the start of a later session in the same project; no optional pack is required.
 
 ```text
-Read AGENTS.md and the available project memory. Summarize the last verified state, open decisions and the next unfinished task. Check that the notes still match the code before continuing.
+Read AGENTS.md and the available project memory. Summarize the last verified state, open decisions and the next unfinished task. Distinguish released features from local candidates, and automated checks from human acceptance. Check that the notes still match the code before continuing.
 ```
 
 Expected result: a short, evidence-based restart. Project notes are useful context and still need to be checked against the current work.
 
-## What’s new in 0.16.0
+## What’s new in 0.17.1
 
-Human acceptance, written down and read back
+Safer installs and cleaner updates
 
-A delivery now produces a step-by-step page a person plays, and their run comes back as evidence the agents read, classify and gate on. This release also carries what 0.15.0 had prepared and never shipped: durable Nexus execution, evidence-ranked memory and scored checks for every pack.
+Installing over a different version now stops and points to update, re-installs keep your settings, and updates remove files a version no longer ships while keeping a restorable backup. Some install behaviors changed; review your scripts before rerunning them.
 
-- bmad-plus uat builds a self-contained acceptance page from a JSON specification: one verifiable fact per line, on-screen labels quoted from your own code, and every step that writes for real marked as such.
-- The tester answers Seen, Not seen or Blocked and writes what they saw instead. Answers are saved as they go — straight into the project with uat serve, or in the page itself when it travels as a file.
-- uat read returns every failure with its expectation and the tester note; uat gate passes only when the run is finished, answers the current revision of the recipe, is fully classified, and every writing step was confirmed read-only.
-- The page speaks the ten languages of the installer, opens in the project language and lets the tester switch. Sentinel gains a Recette role, and the delivery report quotes the run instead of claiming acceptance.
-- Nexus records task dependencies, write scopes, attempts and recovery evidence. Use nexus create --plan plan.json, then nexus launch RUN TASK for an explicitly configured command or Codex CLI process.
-- After launch, inspect the run, collect its exact attempt identity, run nexus verify RUN TASK and finally nexus accept RUN TASK. A finished process or an agent's success message cannot replace independent checks; host permissions still apply.
-- mem observe --input observation.json links one project memory section to a currently accepted Nexus task. mem recall QUERY --ranking evidence --context-scope PATH rechecks the evidence; stale, superseded or explicitly conflicting advice is excluded.
-- All nine packs have scored deterministic replay checks with negative controls. A small native pilot and repeated-campaign tooling keep real model observations separate from replay results; no general model-quality gain is claimed.
-- The release workflow checks a production dependency SBOM, publishes the exact validated archive and compares npm integrity before updating this site. Source notices ship with the package; npm provenance is not enabled.
-- Existing project update policies and customized-file protections remain in force. Restart the assistant or reload AGENTS.md and the affected skills after applying the update.
+- install refuses to overwrite a different installed version. A downgrade is refused; for an upgrade, run bmad-plus update, which keeps backups and restorable receipts. Re-installing the same version only adds missing files.
+- Re-installing keeps your _bmad/config.yaml settings and adds only missing defaults. The manifest and configuration are written atomically.
+- --packs and --tools add to the previous installation instead of replacing it. An unknown pack or tool ID fails before any write and lists the valid IDs.
+- update deletes unchanged files that the new version no longer ships, backs them up in the update receipt and restores them with --restore. Files you edited are kept and reported.
+- A project lock left by a crashed process is taken over automatically when its owner is provably no longer running on this machine; doctor reports other stale locks with the manual remedy.
+- Without a terminal, installs use --lang, then the system locale, then English. --yes with no detected AI tool writes no adapter files. uninstall accepts -d/--directory.
+- The npm package no longer includes maintainer release scripts. OSINT and Shield carry legal and AI-generated-output notices; Shadow is described as governed public-source research.
+- Translated READMEs mirror the public README, which adds a non-affiliation notice and a factual comparison. The website shows the install command up front and supports a dark color scheme.
 
 ## Version History
 
@@ -174,21 +192,25 @@ These dates identify reviewed CHANGELOG notes, not npm publication dates. The we
 
 | Version | Release-notes date | Reviewed summary |
 | --- | --- | --- |
+| 0.17.1 | 2026-09-24 | Installing over a different version now stops and points to update, re-installs keep your settings, and updates remove files a version no longer ships while keeping a restorable backup. Some install behaviors changed; review your scripts before rerunning them. |
+| 0.17.0 | 2026-09-22 | Acceptance pages now prevent silent answer loss and empty exports, recipes build by their own identifier, and project release checks work directly with Node on Windows. Guides add practical prompts for reading results and preserving project context. |
 | 0.16.0 | 2026-09-16 | A delivery now produces a step-by-step page a person plays, and their run comes back as evidence the agents read, classify and gate on. This release also carries what 0.15.0 had prepared and never shipped: durable Nexus execution, evidence-ranked memory and scored checks for every pack. |
-| 0.14.0 | 2026-09-09 | Dev Studio gains complete instructions and verifiable context loading; release documentation follows the published package. |
-| 0.13.0 | 2026-09-08 | Discover published releases, control automatic-update policy and preserve customized agent files. |
 
 [Release history and update guide](https://bmad-plus.rochetta.fr/docs/#changelog) · [All published npm versions](https://www.npmjs.com/package/bmad-plus?activeTab=versions)
 
 ---
 
-## 📄 License
+## License
 
 MIT — Based on [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) (MIT)
 
-BMAD+ is an independent derivative, not an official BMad Code, LLC release or endorsement.
+BMAD+ is an independent community project derived from BMAD-METHOD (MIT) by BMad Code, LLC. It is not affiliated with, endorsed by or certified by BMad Code, LLC. BMad™ and BMad Method™ are trademarks of BMad Code, LLC; see the [BMad trademark guidelines](https://github.com/bmad-code-org/BMAD-METHOD/blob/main/TRADEMARK.md).
 Bundled source attributions and terms: [Third-party notices](THIRD-PARTY-LICENSES.md).
 
+The OSINT pack is governed: researching a named person requires a recorded purpose and legal basis. See the [OSINT legal notice](osint-agent-package/skills/bmad-osint-investigate/osint/references/gdpr-osint.md).
+
+Translations: [Français](readme-international/README.fr.md) · [Español](readme-international/README.es.md) · [Deutsch](readme-international/README.de.md)
+
 ### Credits
 
 **Creator**
@@ -205,7 +227,3 @@ Bundled source attributions and terms: [Third-party notices](THIRD-PARTY-LICENSE
 - **OSINT Pipeline** based on [smixs/osint-skill](https://github.com/smixs/osint-skill) (MIT)
 - **Apify integration** — OSINT helper and inspiration from [Apify agent skills](https://github.com/apify/agent-skills) (upstream declares Apache-2.0; see notices)
 - **Karpathy Guardrails** — Memory Pack adaptation of [community guidelines by forrestchang](https://github.com/multica-ai/andrej-karpathy-skills), inspired by Andrej Karpathy (MIT declared upstream)
-
-**Tools & Infrastructure**
-- [Evolution API](https://github.com/EvolutionAPI/evolution-api) — WhatsApp notifications for upstream monitoring
-- [Gemini API](https://ai.google.dev/) — AI analysis for upstream change classification

package/SECURITY.md

@@ -14,7 +14,15 @@ and in the [release history](https://bmad-plus.rochetta.fr/docs/#releases).
 
 If you discover a security vulnerability in BMAD+, please report it responsibly:
 
-### 📧 Contact
+### 🔒 Preferred: GitHub private vulnerability reporting
+
+Use **[Report a vulnerability](https://github.com/lrochetta/BMAD-PLUS/security/advisories/new)**
+(repository *Security* tab → *Report a vulnerability*). The report stays private
+between you and the maintainer, and the fix and advisory are coordinated there.
+
+### 📧 Fallback: email
+
+If you cannot use GitHub private reporting:
 
 **Email:** [l.rochetta@gmail.com](mailto:l.rochetta@gmail.com)
 

package/osint-agent-package/README.md

@@ -1,5 +1,18 @@
 # 🔍 OSINT Agent Package — BMAD Compatible
 
+> [!WARNING]
+> **Avis juridique et éthique — à lire avant toute utilisation / Legal & ethics notice**
+>
+> - **Base légale obligatoire (RGPD art. 6).** Toute collecte ou analyse de données sur une personne identifiable est un traitement de données personnelles : il faut une base légale documentée (intérêt légitime mis en balance, obligation légale, mission d'intérêt public…) *avant* de lancer une investigation. La consigner dans [`lawful-basis-record.md`](skills/bmad-osint-investigate/osint/assets/lawful-basis-record.md).
+> - **Données sensibles (RGPD art. 9).** Opinions politiques, religion, santé, orientation sexuelle, données biométriques, etc. sont interdites de traitement sauf exception de l'art. 9(2). Le psychoprofilage peut *inférer* ce type de données : ne pas le faire sans base légale explicite.
+> - **Pas de profilage de particuliers sans base légale.** Aucun ciblage, surveillance ou profilage de personnes privées (ex-conjoint, voisin, salarié, candidat…) par curiosité ou pour harceler. Les personnalités publiques ne sont couvertes que pour leur rôle public.
+> - **Conditions d'utilisation des plateformes.** Le scraping (Apify, LinkedIn, Instagram, Facebook, TikTok…) peut violer les CGU des plateformes et le droit local ; vérifier avant usage.
+> - **Responsabilité de l'utilisateur.** Vous êtes le responsable de traitement : BMAD+ fournit un outil, pas une autorisation. Le résultat est généré par IA, peut être faux et doit être vérifié par un humain avant toute décision.
+>
+> Cadre de référence : [`gdpr-osint.md`](skills/bmad-osint-investigate/osint/references/gdpr-osint.md). La porte de conformité intégrée à l'agent (« Phase −1 — Lawful Basis Gate » du `SKILL.md`, qui refuse toute investigation nominative sans base légale) reste active et ne doit pas être contournée.
+>
+> *EN — You need a documented GDPR Art. 6 lawful basis (and an Art. 9(2) exception for special-category data) before investigating anyone; respect platform ToS; never profile private individuals without a legal basis; you, the user, are the data controller and bear full responsibility.*
+
 Agent d'intelligence OSINT pour les installations BMAD. De un nom ou pseudo à un dossier complet avec psychoprofil, parcours professionnel et grades de confiance.
 
 ## Features

package/osint-agent-package/SETUP_KEYS.md

@@ -1,5 +1,18 @@
 # 🔑 Configuration des Clés API
 
+> [!WARNING]
+> **Avis juridique et éthique — à lire avant toute utilisation / Legal & ethics notice**
+>
+> - **Base légale obligatoire (RGPD art. 6).** Toute collecte ou analyse de données sur une personne identifiable est un traitement de données personnelles : il faut une base légale documentée (intérêt légitime mis en balance, obligation légale, mission d'intérêt public…) *avant* de lancer une investigation. La consigner dans [`lawful-basis-record.md`](skills/bmad-osint-investigate/osint/assets/lawful-basis-record.md).
+> - **Données sensibles (RGPD art. 9).** Opinions politiques, religion, santé, orientation sexuelle, données biométriques, etc. sont interdites de traitement sauf exception de l'art. 9(2). Le psychoprofilage peut *inférer* ce type de données : ne pas le faire sans base légale explicite.
+> - **Pas de profilage de particuliers sans base légale.** Aucun ciblage, surveillance ou profilage de personnes privées (ex-conjoint, voisin, salarié, candidat…) par curiosité ou pour harceler. Les personnalités publiques ne sont couvertes que pour leur rôle public.
+> - **Conditions d'utilisation des plateformes.** Le scraping (Apify, LinkedIn, Instagram, Facebook, TikTok…) peut violer les CGU des plateformes et le droit local ; vérifier avant usage.
+> - **Responsabilité de l'utilisateur.** Vous êtes le responsable de traitement : BMAD+ fournit un outil, pas une autorisation. Le résultat est généré par IA, peut être faux et doit être vérifié par un humain avant toute décision.
+>
+> Cadre de référence : [`gdpr-osint.md`](skills/bmad-osint-investigate/osint/references/gdpr-osint.md). La porte de conformité intégrée à l'agent (« Phase −1 — Lawful Basis Gate » du `SKILL.md`, qui refuse toute investigation nominative sans base légale) reste active et ne doit pas être contournée.
+>
+> *EN — You need a documented GDPR Art. 6 lawful basis (and an Art. 9(2) exception for special-category data) before investigating anyone; respect platform ToS; never profile private individuals without a legal basis; you, the user, are the data controller and bear full responsibility.*
+
 Ce guide explique comment configurer les clés API pour l'agent OSINT.  
 **Tu n'as besoin que d'UNE SEULE clé pour démarrer.** Plus tu en configures, plus l'agent est puissant.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-plus",
-  "version": "0.16.0",
+  "version": "0.17.1",
   "description": "Project-local AI development workflows with clear roles, shared context, safe updates and coding-tool adapters",
   "homepage": "https://bmad-plus.rochetta.fr",
   "keywords": [
@@ -25,7 +25,13 @@
     "bmad-plus": "tools/bmad-plus-npx.js"
   },
   "files": [
-    "tools",
+    "tools/bmad-plus-npx.js",
+    "tools/cli",
+    "tools/build/adapters.config.js",
+    "tools/build/generate-adapters.js",
+    "tools/build/generate.js",
+    "tools/build/module.template.yaml",
+    "tools/build/pack-delivery.js",
     "src/bmad-plus",
     "osint-agent-package",
     "readme-international",
@@ -43,12 +49,17 @@
     "build": "node tools/build/generate.js --out tools/cli/lib/packs.js --module-out src/bmad-plus/module.yaml",
     "build:check": "node tools/build/generate.js --check",
     "check:counts": "node tools/build/check-counts.js",
+    "check:counts:full": "jest --coverage=false --silent --json --outputFile=coverage/jest-report.json && node tools/build/check-counts.js --jest-report coverage/jest-report.json",
+    "uat:spec": "node src/bmad-plus/skills/bmad-plus-uat/templates/uat-spec-present.mjs --dir recettes",
+    "uat:gate": "node src/bmad-plus/skills/bmad-plus-uat/templates/uat-release-gate.mjs --dir recettes --cli tools/cli/bmad-plus-cli.js",
     "lint": "eslint tools/ tests/",
     "format": "prettier --write \"tools/**/*.js\" \"tests/**/*.js\"",
     "format:check": "prettier --check \"tools/**/*.js\" \"tests/**/*.js\"",
     "test": "jest --coverage",
+    "test:parallel": "jest --coverage=false --testPathIgnorePatterns \"(nexus(-cli|-process)?|memory-outcomes|upstream-candidate|npm-runner)\\.test\\.js$\"",
+    "test:serial": "jest --coverage=false --runInBand --testPathPatterns \"(nexus(-cli|-process)?|memory-outcomes|upstream-candidate|npm-runner)\\.test\\.js$\"",
     "test:install-contract": "node tools/build/check-install-contract.js",
-    "prepare": "husky || true",
+    "prepare": "node -e \"try{require('node:child_process').execSync('husky',{stdio:'inherit'})}catch{console.warn('WARNING: husky did not install the git hooks, so the pre-push release gate is inactive in this checkout. Run npx husky to retry.')}\"",
     "uninstall:bmad": "node tools/cli/bmad-plus-cli.js uninstall"
   },
   "dependencies": {
@@ -64,29 +75,42 @@
   },
   "overrides": {
     "@istanbuljs/load-nyc-config": {
-      "js-yaml": "4.2.0"
+      "js-yaml": "4.3.2"
     }
   },
   "publishConfig": {
     "access": "public"
   },
   "jest": {
+    "roots": [
+      "<rootDir>/tests",
+      "<rootDir>/tools"
+    ],
     "testPathIgnorePatterns": [
       "/node_modules/",
       "/website/",
       "/evals/"
     ],
     "collectCoverage": true,
+    "collectCoverageFrom": [
+      "tools/**/*.js",
+      "!tools/build/generated-adapters/**"
+    ],
     "coverageDirectory": "coverage",
     "moduleNameMapper": {
       "^@clack/prompts$": "<rootDir>/tests/__mocks__/clack-prompts.js"
     },
     "coverageThreshold": {
       "global": {
-        "branches": 35,
-        "functions": 40,
-        "lines": 40,
-        "statements": 40
+        "branches": 65,
+        "functions": 70,
+        "lines": 70,
+        "statements": 70
+      },
+      "./tools/cli/commands/install.js": {
+        "lines": 65,
+        "statements": 65,
+        "functions": 45
       },
       "./tools/cli/commands/doctor.js": {
         "lines": 60,