bmad-plus 0.16.0 → 0.17.1

package/src/bmad-plus/agents/agent-shadow/SKILL.md

@@ -61,6 +61,12 @@ or a public entity). This gate governs every direct menu path — there is no pa
 personal data that skips it. It does not remove any capability or restrict lawful,
 authorized use (CG-02); `QS` on a public handle, `DG`, and tooling paths are exempt.
 
+**Output disclaimer.** Open every dossier or profile with: *"AI-generated OSINT output —
+may contain errors; not legal advice. The operator is the data controller and is
+responsible for the lawful basis (GDPR Art. 6/9), platform Terms of Service, and human
+verification before any decision."* Never profile a private individual without a
+recorded legal basis.
+
 ## Required Setup
 
 - Python 3.10+

package/src/bmad-plus/packs/pack-memory/README.md

@@ -97,7 +97,7 @@ After installation:
 
 ```
 # Scan your projects
-"Zecher, scan projects in D:\travail\DEV"
+"Zecher, scan projects in ~/dev"
 
 # Start remembering
 "Atlas, create a PRD for..."    ← decisions auto-logged

package/src/bmad-plus/packs/pack-memory/memory-orchestrator.md

@@ -29,7 +29,7 @@ While executing the protocol, the host agent should:
 A session that ends without an agent turn has no guaranteed handoff.
 
 Manual activation via Zecher:
-- `"Zecher, scan projects in D:\travail\DEV"` — discover and index all projects
+- `"Zecher, scan projects in ~/dev"` — discover and index all projects
 - `"Zecher, consolidate memory"` — deduplicate, archive stale, promote
 - `"Zecher, where were we?"` — reconstruct context from last session
 - `"Zecher, health check"` — verify memory integrity

package/src/bmad-plus/packs/pack-memory/shared/memory-protocol.md

@@ -165,7 +165,7 @@ AGENTS.md             → Already agent-aware
 ### Project Metadata (per scan)
 ```yaml
 # ~/.bmad-plus/brain/projects/<hash>.yaml
-path: "D:\\travail\\DEV\\my-project"
+path: "~/dev/my-project"
 name: "my-project"
 hash: "a1b2c3d4"  # SHA256 of absolute path
 stack:

package/src/bmad-plus/packs/pack-shield/README.md

@@ -2,6 +2,8 @@
 
 > **27 compliance agents across 6 categories, plus 11 GDPR & AI Act workflows** + 1 orchestrator covering Data Privacy, Cybersecurity, Industry Compliance, Defense & Export, AI Governance, and Accessibility & ESG.
 
+> ⚠️ **Not legal advice.** Shield output is AI-generated, may be incomplete or out of date, and does not replace a lawyer, DPO or certified auditor. Human review by a qualified person is required before any compliance decision, filing or attestation.
+
 ## Overview
 
 Pack Shield transforms BMAD+ into a comprehensive GRC (Governance, Risk & Compliance) assistant. Each agent is an expert system prompt for a specific regulatory framework, providing structured compliance guidance including gap analysis, policy drafting, control mapping, and audit support.

package/src/bmad-plus/packs/pack-shield/SKILL.md

@@ -4,6 +4,8 @@
 > **Version:** 1.0.0
 > **Created by:** Laurent Rochetta — https://github.com/lrochetta/BMAD-PLUS
 
+> ⚠️ **Not legal advice.** Shield output is AI-generated, may be incomplete or out of date, and does not replace a lawyer, DPO or certified auditor. Human review by a qualified person is required before any compliance decision, filing or attestation.
+
 ## Overview
 
 Shield transforms BMAD+ into a comprehensive GRC (Governance, Risk & Compliance) assistant. It serves as an intelligent orchestrator for 27 compliance agents across 6 categories, plus 11 GDPR & AI Act workflows, covering 25+ regulatory frameworks. Route requests to the appropriate specialist agent, combine insights for cross-framework analysis, and provide consolidated compliance reports.

package/src/bmad-plus/packs/pack-shield/shared/audit-report-template.md

@@ -4,10 +4,14 @@
 > **Purpose:** Standardized compliance audit report format
 > **Version:** 1.0.0
 
+> ⚠️ **Not legal advice.** Shield output is AI-generated, may be incomplete or out of date, and does not replace a lawyer, DPO or certified auditor. Human review by a qualified person is required before any compliance decision, filing or attestation.
+
 ---
 
 ## Compliance Audit Report
 
+> 🤖 **AI-GENERATED DRAFT — Not legal advice.** Produced with BMAD+ Shield (AI-assisted). Requires review and sign-off by a qualified person (lawyer, DPO or certified auditor) before use. Keep this banner on every copy.
+
 ### Cover Page
 
 | Field | Value |
@@ -21,6 +25,8 @@
 | **Report Date** | [DATE] |
 | **Prepared by** | [NAME] |
 | **Classification** | Confidential |
+| **Generation** | AI-generated draft — human review required |
+| **Reviewed by (qualified person)** | [NAME, ROLE, DATE] |
 
 ---
 

package/src/bmad-plus/packs/pack-shield/shield-orchestrator.md

@@ -5,6 +5,8 @@
 > **Version:** 1.0.0
 > **Created by:** Laurent Rochetta — https://github.com/lrochetta/BMAD-PLUS
 
+> ⚠️ **Not legal advice.** Shield output is AI-generated, may be incomplete or out of date, and does not replace a lawyer, DPO or certified auditor. Human review by a qualified person is required before any compliance decision, filing or attestation.
+
 ---
 
 ## Persona
@@ -216,6 +218,8 @@ Which area? (1-8, or describe your situation)
 3. Use cross-framework-mapper for overlaps
 4. Present consolidated report with `shared/audit-report-template.md`
 
+Every report or assessment you produce MUST keep the template's "AI-generated" marking and the "Not legal advice" disclaimer above.
+
 ### Uncertainty
 If the framework is ambiguous:
 1. Ask 2-3 clarifying questions (jurisdiction, industry, data types)

package/src/bmad-plus/skills/bmad-plus-uat/SKILL.md

@@ -29,10 +29,11 @@ delivery ─► spec JSON ─► build page ─► deploy to test env ─► a p
 - Someone asks for "the recette", "the UAT", "what should I check".
 - A results file appears, or the user says "read the run".
 
-Read `recette.mode` from `_bmad/config.yaml`: `advisory` (default — build and offer the page,
-never block), `gate` (the delivery waits for a passing gate), `off` (no recipe; say so in the
-delivery report). A delivery with no human-observable change states that fact rather than
-skipping in silence.
+Read `uat.mode` from `_bmad/config.yaml`: `advisory` (build and offer the page, never block),
+`gate` (the delivery waits for a passing gate), `off` (no recipe; say so in the delivery report).
+**An absent `uat` block means `advisory`** — a project updated from an earlier version keeps its
+configuration untouched, so the block is simply missing there. A delivery with no
+human-observable change states that fact rather than skipping in silence.
 
 ## 1. Write the spec — `_bmad-output/uat/specs/<product>-<version>.json`
 
@@ -113,6 +114,19 @@ with the figures, the tester's name, and what stays open. The evidence is labell
 **human-observed**: the gate establishes that the run is complete, current and triaged, never
 that the tester looked at the right place.
 
+## Gating the project itself
+
+`templates/` ships two scripts to copy into the project — they need nothing but Node,
+and they are the only layer an agent cannot skip:
+
+| Script | Where it belongs | What it refuses |
+|---|---|---|
+| `uat-spec-present.mjs` | next to the project's other checks, before the push | a version in `package.json` that no recipe names. A grouped recipe covers a version because it lists it in `versions`, never because its file name suggests a range |
+| `uat-release-gate.mjs` | the production deploy step | a deployment whose recipe has no finished run, an outdated one, an unclassified failure, or a passed writing step nobody confirmed. Exit 4 means the gate could not run at all — which is not a pass |
+
+`templates/README.md` carries the wiring. Tell the user plainly when a project has
+neither: the recipe is then produced and offered, and nothing enforces it.
+
 ## Gating a delivery with Nexus
 
 ```bash

package/src/bmad-plus/skills/bmad-plus-uat/template/page.html

@@ -30,6 +30,11 @@
     --mono-bg: #24282c; --focus: #4fb3b8;
   }
   * { box-sizing: border-box; }
+  /* A class that sets display wins over the hidden attribute: without this rule the steps
+     showed before any run existed, and a tester's answers were silently discarded. */
+  [hidden] { display: none !important; }
+  code.cmd { cursor: copy; }
+  code.cmd.copied::after { content: " \2713 " attr(data-copied); font-family: var(--sans); color: var(--ok); }
   body { background: var(--bg); color: var(--ink); font-family: var(--sans); font-size: 15px; line-height: 1.5; margin: 0; padding-inline: 16px; padding-block: 0 64px; }
   h1, h2, h3 { font-family: var(--serif); text-wrap: balance; margin: 0; }
   h1 { font-size: 1.7rem; font-weight: 600; }
@@ -44,9 +49,15 @@
   .count { display: flex; gap: 14px; font-variant-numeric: tabular-nums; font-size: 0.9rem; }
   .count b { font-weight: 600; }
   .count .ok { color: var(--ok); } .count .ko { color: var(--ko); } .count .warn { color: var(--warn); } .count .todo { color: var(--muted); }
-  .gauge { flex: 1 1 160px; height: 6px; background: var(--line); border-radius: 3px; overflow: hidden; display: flex; }
-  .gauge i { display: block; height: 100%; }
-  .gauge .ok { background: var(--ok); } .gauge .ko { background: var(--ko); } .gauge .warn { background: var(--warn); }
+  /* One segment per step: green seen, red not seen, orange blocked, grey skipped, empty to do. */
+  .strip { flex: 1 1 100%; display: flex; gap: 3px; min-height: 12px; }
+  .strip a { flex: 1 1 0; min-width: 10px; height: 12px; border-radius: 3px; background: var(--line); border: 1px solid transparent; }
+  .strip a:hover, .strip a:focus-visible { border-color: var(--ink); outline: none; }
+  .strip a[data-state="passed"] { background: var(--ok); }
+  .strip a[data-state="failed"] { background: var(--ko); }
+  .strip a[data-state="blocked"] { background: var(--warn); }
+  .strip a[data-state="skipped"] { background: var(--line-strong); }
+  .strip a[data-state="partial"] { background: linear-gradient(90deg, var(--ok) 50%, var(--line) 50%); }
   .state { font-size: 0.82rem; color: var(--muted); }
   .state.saved { color: var(--ok); }
   .head { padding-block: 26px 18px; display: grid; gap: 10px; }
@@ -117,7 +128,7 @@
       <span class="warn"><b id="c-blocked">0</b> <span id="l-blocked"></span></span>
       <span class="todo"><b id="c-todo">0</b> <span id="l-todo"></span></span>
     </div>
-    <div class="gauge" aria-hidden="true"><i class="ok" id="g-passed" style="width:0%"></i><i class="ko" id="g-failed" style="width:0%"></i><i class="warn" id="g-blocked" style="width:0%"></i></div>
+    <nav class="strip" id="strip"></nav>
     <span class="state" id="save-state">—</span>
   </div>
 </div>
@@ -143,9 +154,9 @@
     <div id="closing" class="section"></div>
     <label class="note" for="overall"><span id="t-overall"></span><textarea id="overall"></textarea></label>
     <div class="row">
-      <button class="btn primary" id="btn-finish" type="button"></button>
-      <button class="btn" id="btn-save" type="button"></button>
-      <button class="btn" id="btn-copy" type="button"></button>
+      <button class="btn primary" id="btn-finish" type="button" disabled></button>
+      <button class="btn" id="btn-save" type="button" disabled></button>
+      <button class="btn" id="btn-copy" type="button" disabled></button>
       <span class="state" id="end-state"></span>
     </div>
     <p class="info-box" id="mode-note"></p>
@@ -215,13 +226,14 @@
     $("btn-finish").textContent = run && run.finishedAt ? T.finished : T.finishRun;
     $("btn-save").textContent = T.saveJson;
     $("btn-copy").textContent = T.copyJson;
-    $("l-passed").textContent = T.seen;
-    $("l-failed").textContent = T.notSeen;
-    $("l-blocked").textContent = T.blocked;
+    $("l-passed").textContent = T.countSeen;
+    $("l-failed").textContent = T.countNotSeen;
+    $("l-blocked").textContent = T.countBlocked;
     $("l-todo").textContent = T.todo;
     $("mode-note").textContent = dbDoc ? T.dbMode : serve ? T.serveMode : T.localMode;
     renderHead();
     renderSteps();
+    renderStrip();
     if (run) reflect();
     listResumable();
   }
@@ -321,10 +333,51 @@
       article.innerHTML = head + body;
       article.querySelector("h2").textContent = step.title;
       if (step.duration) article.querySelector(".duration").textContent = step.duration;
+      // A command read inside a sentence gets copied with the sentence's punctuation
+      // ("doctor." instead of "doctor"): each command in "Do" copies itself exactly.
+      Array.prototype.forEach.call(article.querySelectorAll(".section ol code"), function (code) {
+        code.classList.add("cmd");
+        code.setAttribute("role", "button");
+        code.setAttribute("tabindex", "0");
+        code.title = T.copyCommand;
+      });
       main.appendChild(article);
     });
   }
 
+  function renderStrip() {
+    var strip = $("strip");
+    strip.innerHTML = "";
+    STEPS.forEach(function (step, index) {
+      var segment = document.createElement("a");
+      segment.id = "s-" + step.id;
+      segment.href = "#step-" + step.id;
+      segment.title = index + " · " + step.title;
+      strip.appendChild(segment);
+    });
+  }
+
+  function copyCommand(code) {
+    var text = code.textContent.trim();
+    var done = function () {
+      code.setAttribute("data-copied", T.commandCopied);
+      code.classList.add("copied");
+      setTimeout(function () { code.classList.remove("copied"); }, 1500);
+    };
+    if (navigator.clipboard && navigator.clipboard.writeText) navigator.clipboard.writeText(text).then(done, function () {});
+  }
+
+  /** Nothing is recorded before a run exists: say so, instead of discarding answers in silence. */
+  function requireRun(event) {
+    if (run) return true;
+    if (event && event.target instanceof HTMLInputElement && event.target.type === "radio") event.target.checked = false;
+    $("startbox").hidden = false;
+    $("start-state").textContent = T.startFirst;
+    $("startbox").scrollIntoView({ block: "center" });
+    $("tester").focus();
+    return false;
+  }
+
   function reflect() {
     recount();
     STEPS.forEach(function (step) {
@@ -351,10 +404,20 @@
     $("c-failed").textContent = s.failed;
     $("c-blocked").textContent = s.blocked;
     $("c-todo").textContent = s.unanswered;
-    $("g-passed").style.width = (total ? (s.passed / total) * 100 : 0) + "%";
-    $("g-failed").style.width = (total ? (s.failed / total) * 100 : 0) + "%";
-    $("g-blocked").style.width = (total ? (s.blocked / total) * 100 : 0) + "%";
-    $("bar-tester").textContent = run.tester + (run.finishedAt ? " · " + T.finished : "");
+    STEPS.forEach(function (step, index) {
+      var segment = $("s-" + step.id);
+      if (!segment) return;
+      var observed = run.steps[step.id];
+      var states = Object.keys(observed.expect).map(function (k) { return observed.expect[k].state; });
+      var answered = states.filter(function (v) { return v !== null && v !== undefined; }).length;
+      var state = observed.state || (answered ? "partial" : "");
+      segment.setAttribute("data-state", state);
+      segment.title = index + " · " + step.title + " — " + (state === "passed" ? T.seen : state === "failed" ? T.notSeen : state === "blocked" ? T.blocked : state === "skipped" ? T.skip : T.todo) + " (" + answered + "/" + states.length + ")";
+    });
+    $("strip").setAttribute("aria-label", total + " · " + s.passed + " " + T.seen + " · " + s.failed + " " + T.notSeen + " · " + s.blocked + " " + T.blocked);
+    // "Run by laurent · finished on 2026-09-16", as the recipes played in claude.ai always read.
+    $("bar-tester").textContent = T.runBy.replace("{tester}", run.tester) +
+      (run.finishedAt ? " · " + T.finishedOn.replace("{date}", String(run.finishedAt).slice(0, 10)) : "");
     var overall = $("overall");
     if (document.activeElement !== overall) overall.value = run.overallNote || "";
     $("json").value = JSON.stringify(run, null, 2);
@@ -405,6 +468,8 @@
     $("steps").hidden = false;
     $("end").hidden = false;
     $("bar").hidden = false;
+    $("btn-save").disabled = false;
+    $("btn-copy").disabled = false;
     reflect();
     if (db) {
       dbDoc = db.doc("recettes/" + id);
@@ -422,7 +487,7 @@
 
   function start() {
     var tester = $("tester").value.trim();
-    if (!tester) { $("start-state").textContent = T.tester; $("tester").focus(); return; }
+    if (!tester) { $("start-state").textContent = T.startFirst; $("tester").focus(); return; }
     var id = newRunId(tester);
     open(id, newRun(tester));
     persist(true);
@@ -457,24 +522,31 @@
   document.addEventListener("change", function (event) {
     var target = event.target;
     if (target === $("lang")) { applyLanguage(target.value); return; }
-    if (!(target instanceof HTMLInputElement) || target.type !== "radio" || !run) return;
+    if (!(target instanceof HTMLInputElement) || target.type !== "radio") return;
     var m = /^e-(.+)-([a-z])$/.exec(target.name);
-    if (!m) return;
+    if (!m || !requireRun(event)) return;
     run.steps[m[1]].expect[m[2]].state = target.value;
     persist();
   });
   document.addEventListener("input", function (event) {
     var target = event.target;
-    if (!(target instanceof HTMLTextAreaElement) || !run) return;
+    if (!(target instanceof HTMLTextAreaElement)) return;
+    if (!requireRun(event)) return;
     if (target === $("overall")) { run.overallNote = target.value; persist(); return; }
     var step = /^note-(.+)$/.exec(target.id);
     if (step && run.steps[step[1]]) { run.steps[step[1]].note = target.value; persist(); return; }
     var expect = /^n-(.+)-([a-z])$/.exec(target.id);
     if (expect && run.steps[expect[1]]) { run.steps[expect[1]].expect[expect[2]].note = target.value; persist(); }
   });
+  document.addEventListener("keydown", function (event) {
+    var code = event.target && event.target.closest && event.target.closest("code.cmd");
+    if (code && (event.key === "Enter" || event.key === " ")) { event.preventDefault(); copyCommand(code); }
+  });
   document.addEventListener("click", function (event) {
+    var code = event.target && event.target.closest && event.target.closest("code.cmd");
+    if (code) { copyCommand(code); return; }
     var id = event.target && event.target.getAttribute && event.target.getAttribute("data-skip");
-    if (!id || !run) return;
+    if (!id || !requireRun(event)) return;
     Object.keys(run.steps[id].expect).forEach(function (k) { run.steps[id].expect[k].state = "skipped"; });
     persist();
   });
@@ -482,18 +554,22 @@
   $("btn-start").addEventListener("click", start);
   $("tester").addEventListener("keydown", function (event) { if (event.key === "Enter") start(); });
   $("btn-finish").addEventListener("click", function () {
+    if (!requireRun()) return;
     if (run.summary.unanswered > 0 && !window.confirm(T.confirmUnanswered.replace("{n}", run.summary.unanswered))) return;
     run.finishedAt = new Date().toISOString();
     persist(true);
     $("end-state").textContent = T.finished;
   });
   $("btn-copy").addEventListener("click", function () {
+    if (!requireRun()) return;
     var text = JSON.stringify(run, null, 2);
     var fallback = function () { $("json").parentElement.open = true; $("json").focus(); $("json").select(); };
     if (navigator.clipboard && navigator.clipboard.writeText) navigator.clipboard.writeText(text).then(function () { $("end-state").textContent = T.copied; }, fallback);
     else fallback();
   });
   $("btn-save").addEventListener("click", function () {
+    // Never export a run that does not exist: that is how a tester once saved "null.json".
+    if (!requireRun()) return;
     var name = runId + ".json";
     var text = JSON.stringify(run, null, 2);
     if (downloads) {

package/src/bmad-plus/skills/bmad-plus-uat/template/strings.json

@@ -33,7 +33,15 @@
     "savedRemote": "Saved ·",
     "localMode": "This page is a local file: at the end, save the JSON and hand the file over — that is what the agent reads.",
     "dbMode": "Your answers are saved as you go; the agent reads them directly, you have nothing to send.",
-    "serveMode": "Your answers are saved straight into the project as you tick; you have nothing to send."
+    "serveMode": "Your answers are saved straight into the project as you tick; you have nothing to send.",
+    "startFirst": "Enter your first name and start a run first — nothing is recorded before that.",
+    "copyCommand": "Click to copy",
+    "commandCopied": "Copied",
+    "runBy": "Run by {tester}",
+    "finishedOn": "finished on {date}",
+    "countSeen": "seen",
+    "countNotSeen": "not seen",
+    "countBlocked": "blocked"
   },
   "fr": {
     "name": "Français",
@@ -69,7 +77,15 @@
     "savedRemote": "Enregistré ·",
     "localMode": "Cette page est un fichier local : à la fin, enregistre le JSON et transmets le fichier — c'est lui que l'agent lit.",
     "dbMode": "Tes réponses sont enregistrées au fur et à mesure : l'agent les lit directement, tu n'as rien à envoyer.",
-    "serveMode": "Tes réponses sont enregistrées directement dans le projet à chaque coche ; tu n'as rien à envoyer."
+    "serveMode": "Tes réponses sont enregistrées directement dans le projet à chaque coche ; tu n'as rien à envoyer.",
+    "startFirst": "Écris ton prénom et commence la recette d’abord — rien n’est enregistré avant.",
+    "copyCommand": "Cliquer pour copier",
+    "commandCopied": "Copié",
+    "runBy": "Recette de {tester}",
+    "finishedOn": "terminée le {date}",
+    "countSeen": "vus",
+    "countNotSeen": "pas vus",
+    "countBlocked": "bloqués"
   },
   "es": {
     "name": "Español",
@@ -105,7 +121,15 @@
     "savedRemote": "Guardado ·",
     "localMode": "Esta página es un archivo local: al final, guarda el JSON y entrega el archivo — es lo que lee el agente.",
     "dbMode": "Tus respuestas se guardan sobre la marcha; el agente las lee directamente, no tienes que enviar nada.",
-    "serveMode": "Tus respuestas se guardan directamente en el proyecto con cada marca; no tienes que enviar nada."
+    "serveMode": "Tus respuestas se guardan directamente en el proyecto con cada marca; no tienes que enviar nada.",
+    "startFirst": "Escribe tu nombre y empieza la prueba primero: nada se guarda antes.",
+    "copyCommand": "Clic para copiar",
+    "commandCopied": "Copiado",
+    "runBy": "Prueba de {tester}",
+    "finishedOn": "terminada el {date}",
+    "countSeen": "vistos",
+    "countNotSeen": "no vistos",
+    "countBlocked": "bloqueados"
   },
   "de": {
     "name": "Deutsch",
@@ -141,7 +165,15 @@
     "savedRemote": "Gespeichert ·",
     "localMode": "Diese Seite ist eine lokale Datei: speichere am Ende das JSON und gib die Datei weiter — sie ist es, die der Agent liest.",
     "dbMode": "Deine Antworten werden laufend gespeichert; der Agent liest sie direkt, du musst nichts senden.",
-    "serveMode": "Deine Antworten werden bei jedem Klick direkt im Projekt gespeichert; du musst nichts senden."
+    "serveMode": "Deine Antworten werden bei jedem Klick direkt im Projekt gespeichert; du musst nichts senden.",
+    "startFirst": "Gib zuerst deinen Vornamen ein und starte den Durchlauf — vorher wird nichts gespeichert.",
+    "copyCommand": "Zum Kopieren klicken",
+    "commandCopied": "Kopiert",
+    "runBy": "Durchlauf von {tester}",
+    "finishedOn": "abgeschlossen am {date}",
+    "countSeen": "gesehen",
+    "countNotSeen": "nicht gesehen",
+    "countBlocked": "blockiert"
   },
   "pt-br": {
     "name": "Português (Brasil)",
@@ -177,7 +209,15 @@
     "savedRemote": "Salvo ·",
     "localMode": "Esta página é um arquivo local: no final, salve o JSON e entregue o arquivo — é ele que o agente lê.",
     "dbMode": "Suas respostas são salvas conforme você avança; o agente as lê diretamente, você não precisa enviar nada.",
-    "serveMode": "Suas respostas são salvas direto no projeto a cada marcação; você não precisa enviar nada."
+    "serveMode": "Suas respostas são salvas direto no projeto a cada marcação; você não precisa enviar nada.",
+    "startFirst": "Digite seu nome e comece a rodada primeiro — nada é salvo antes disso.",
+    "copyCommand": "Clique para copiar",
+    "commandCopied": "Copiado",
+    "runBy": "Rodada de {tester}",
+    "finishedOn": "encerrada em {date}",
+    "countSeen": "vistos",
+    "countNotSeen": "não vistos",
+    "countBlocked": "bloqueados"
   },
   "ru": {
     "name": "Русский",
@@ -213,7 +253,15 @@
     "savedRemote": "Сохранено ·",
     "localMode": "Эта страница — локальный файл: в конце сохраните JSON и передайте файл — именно его читает агент.",
     "dbMode": "Ваши ответы сохраняются по ходу; агент читает их напрямую, отправлять ничего не нужно.",
-    "serveMode": "Ваши ответы сохраняются прямо в проект при каждой отметке; отправлять ничего не нужно."
+    "serveMode": "Ваши ответы сохраняются прямо в проект при каждой отметке; отправлять ничего не нужно.",
+    "startFirst": "Сначала введите имя и начните прогон — до этого ничего не сохраняется.",
+    "copyCommand": "Нажмите, чтобы скопировать",
+    "commandCopied": "Скопировано",
+    "runBy": "Прогон: {tester}",
+    "finishedOn": "завершён {date}",
+    "countSeen": "видно",
+    "countNotSeen": "не видно",
+    "countBlocked": "недоступно"
   },
   "zh": {
     "name": "中文 (简体)",
@@ -249,7 +297,15 @@
     "savedRemote": "已保存 ·",
     "localMode": "本页是本地文件：结束时请保存 JSON 并把文件交出去 — 代理读取的正是这个文件。",
     "dbMode": "你的回答会即时保存，代理直接读取，你无需发送任何东西。",
-    "serveMode": "你的每次勾选都会直接保存到项目中，你无需发送任何东西。"
+    "serveMode": "你的每次勾选都会直接保存到项目中，你无需发送任何东西。",
+    "startFirst": "请先输入名字并开始验收——在此之前不会保存任何内容。",
+    "copyCommand": "点击复制",
+    "commandCopied": "已复制",
+    "runBy": "{tester} 的验收",
+    "finishedOn": "完成于 {date}",
+    "countSeen": "看到",
+    "countNotSeen": "没看到",
+    "countBlocked": "无法进行"
   },
   "he": {
     "name": "עברית",
@@ -285,7 +341,15 @@
     "savedRemote": "נשמר ·",
     "localMode": "הדף הזה הוא קובץ מקומי: בסוף שמור את ה‑JSON והעבר את הקובץ — זה מה שהסוכן קורא.",
     "dbMode": "התשובות נשמרות תוך כדי, והסוכן קורא אותן ישירות. אין מה לשלוח.",
-    "serveMode": "כל סימון נשמר ישירות בפרויקט. אין מה לשלוח."
+    "serveMode": "כל סימון נשמר ישירות בפרויקט. אין מה לשלוח.",
+    "startFirst": "קודם כתוב את שמך והתחל הרצה — לפני כן שום דבר לא נשמר.",
+    "copyCommand": "לחץ להעתקה",
+    "commandCopied": "הועתק",
+    "runBy": "הרצה של {tester}",
+    "finishedOn": "הסתיימה ב-{date}",
+    "countSeen": "נראו",
+    "countNotSeen": "לא נראו",
+    "countBlocked": "חסומים"
   },
   "ja": {
     "name": "日本語",
@@ -321,7 +385,15 @@
     "savedRemote": "保存済み ·",
     "localMode": "このページはローカルファイルです。最後に JSON を保存してファイルを渡してください — エージェントが読むのはそれです。",
     "dbMode": "回答は随時保存され、エージェントが直接読みます。送信は不要です。",
-    "serveMode": "チェックするたびに回答がプロジェクトへ直接保存されます。送信は不要です。"
+    "serveMode": "チェックするたびに回答がプロジェクトへ直接保存されます。送信は不要です。",
+    "startFirst": "まず名前を入力して実施を開始してください。それまでは何も保存されません。",
+    "copyCommand": "クリックしてコピー",
+    "commandCopied": "コピーしました",
+    "runBy": "{tester} の実施",
+    "finishedOn": "{date} に終了",
+    "countSeen": "見えた",
+    "countNotSeen": "見えない",
+    "countBlocked": "実施不可"
   },
   "it": {
     "name": "Italiano",
@@ -357,6 +429,14 @@
     "savedRemote": "Salvato ·",
     "localMode": "Questa pagina è un file locale: alla fine salva il JSON e consegna il file — è quello che legge l'agente.",
     "dbMode": "Le tue risposte vengono salvate man mano; l'agente le legge direttamente, non devi inviare nulla.",
-    "serveMode": "Le tue risposte vengono salvate direttamente nel progetto a ogni spunta; non devi inviare nulla."
+    "serveMode": "Le tue risposte vengono salvate direttamente nel progetto a ogni spunta; non devi inviare nulla.",
+    "startFirst": "Scrivi il tuo nome e inizia prima la sessione: prima non viene salvato nulla.",
+    "copyCommand": "Clic per copiare",
+    "commandCopied": "Copiato",
+    "runBy": "Sessione di {tester}",
+    "finishedOn": "terminata il {date}",
+    "countSeen": "visti",
+    "countNotSeen": "non visti",
+    "countBlocked": "bloccati"
   }
 }

package/src/bmad-plus/skills/bmad-plus-uat/templates/README.md

@@ -0,0 +1,63 @@
+# Project gates for human acceptance
+
+BMAD+ installs no lifecycle hook, so an instruction can be skipped and a Nexus task
+can be bypassed. These two scripts are the layer that cannot: they run inside your
+own checks and fail the command that calls them. Copy the ones you want into your
+project — for example under `scripts/` — and wire them where they bite.
+
+Both need nothing but Node 20 and are safe to read before you run them.
+
+## G1 — a version does not leave without its recipe
+
+`uat-spec-present.mjs` fails when no recipe names the version in `package.json`.
+
+```jsonc
+// package.json
+{
+  "scripts": {
+    "uat:spec": "node scripts/uat-spec-present.mjs",
+    "pretest": "npm run uat:spec"          // or call it from your CI step
+  }
+}
+```
+
+A grouped recipe covers a version because it **names** it in `versions`, never
+because its file name suggests a range. That is deliberate: deducing coverage from
+a range makes a version look checked when nobody wrote anything about it.
+
+Where to run it: the same place your tests run, and before the push, not after the
+deployment. A reminder printed once the version is live only records the miss.
+
+## G3 — production waits for a run that was read
+
+`uat-release-gate.mjs` resolves the recipe covering the current version and runs
+`bmad-plus uat gate` on it. It exits 0 only when the latest run is finished, answers
+the current revision of the recipe, leaves no expectation unanswered, has every
+failure classified with a decision, and has every passed writing step confirmed
+read-only.
+
+```sh
+# deploy-production.sh
+node scripts/uat-release-gate.mjs || exit 1
+# … deploy only below this line
+```
+
+Exit codes: `0` passed · `1` failed · `2` no finished run yet · `3` the run answered
+another revision of the recipe · `4` the gate itself could not run. The last one is
+not a pass: a missing gate is a missing gate.
+
+The script runs the CLI's own entry point with the Node that started it: `BMAD_PLUS_CLI`
+if you set it, otherwise `node_modules/bmad-plus/` if the project installed it. No shell
+and no `npx`: a Windows `.cmd` shim cannot be spawned without a shell, and a release gate
+must not depend on a download. If neither exists it exits 4 and says so.
+
+## What these gates do and do not establish
+
+They establish that a recipe exists for the version, and that a human run covering
+it is complete, current and classified. They do not establish that the tester looked
+at the right place, and they do not judge the product. Every report says
+*human-observed* for that reason.
+
+A failure classified as a defect of the recipe is not a product fix: amend the spec,
+rebuild it, replay the affected steps, and say so. A failure nobody could classify
+keeps the gate red on purpose — ask the tester what they saw instead of guessing.