bmad-plus 0.20.0 → 0.22.0

package/src/bmad-plus/packs/pack-shield/review-rules/access-control.md

@@ -0,0 +1,10 @@
+Read the change as the person who should not get in.
+
+- **Enforcement point.** Every new route, handler, job or command checks who is calling and what they may do, on the server, before it reads or writes. A check only in the UI, in a client-side guard or in the caller is not enforcement.
+- **Object ownership.** A lookup by an id taken from the request is scoped to the caller (tenant, owner, organisation). Listing, export, search and bulk endpoints apply the same filter as the single-object read.
+- **Least privilege.** A new role, scope, permission or service account grants only what the feature needs; a wildcard, an admin fallback or a default of "allow" when the policy is missing is a defect.
+- **Authentication.** Passwords hashed with a slow, salted algorithm; comparison of secrets in constant time; MFA not bypassable through a secondary path (API token, password reset, legacy login, support impersonation).
+- **Sessions and tokens.** Expiry and revocation exist and are checked; logout and password change invalidate what they should; tokens are bound to their audience and never accepted from a query string where they would be logged.
+- **Access changes.** Granting, changing or removing a right is recorded with who did it; removal takes effect on the next request, not at the next login.
+
+Name the control a finding breaks (for example `ISO27001:A.8.5` for authentication) in the finding's description.

package/src/bmad-plus/packs/pack-shield/review-rules/ai-integrations.md

@@ -0,0 +1,10 @@
+Every model, agent or MCP server the change reaches is a recipient of data and a source of untrusted input.
+
+- **Register.** A new provider, model endpoint, agent tool or MCP server appears in the AI processing register (`_bmad/ai-processing-register.yaml`) with its purpose, the data it sees, legal basis, retention and transfers; `bmad-plus ai-register check` reports the ones missing.
+- **Data sent.** Prompts, context windows, retrieved documents and tool results carry only what the task needs; personal data, secrets and customer content are filtered or pseudonymised before they leave. A new field added to a prompt template is a new disclosure.
+- **Transfers.** A provider outside the EEA, or a region setting that changed, needs a transfer mechanism; a processor needs an agreement covering training use and retention of prompts.
+- **Untrusted output.** Model output and retrieved text reach no query, shell command, file path, HTML or permission decision without the same validation as user input; instructions found in data are data (prompt injection).
+- **Agent tooling.** Tools, MCP servers and agent adapters get the narrowest permissions and paths; a new tool that can write, send or spend has an explicit confirmation or an allow-list.
+- **Transparency.** A person who interacts with the system, or receives generated content presented as fact, is told it comes from an AI where the law requires it.
+
+Name the control a finding breaks (for example `GDPR:Art.28` for a processor without an agreement) in the finding's description.

package/src/bmad-plus/packs/pack-shield/review-rules/change-and-supply-chain.md

@@ -0,0 +1,10 @@
+Look at what reaches production and who could change it.
+
+- **Change path.** A pipeline change keeps review and approval before deployment: no new branch that deploys unreviewed, no `continue-on-error` or skipped job on a required check, no manual override without a record.
+- **Separation.** The identity that writes code cannot approve and deploy it alone; a workflow that widens `permissions`, adds `pull_request_target` with a checkout of untrusted code, or exposes deployment secrets to forks breaks that.
+- **Dependencies.** A new dependency comes from the expected publisher, is pinned by lockfile or hash, and is needed; actions and images are pinned to a digest or a full commit, not a moving tag. Install scripts of new packages are read.
+- **Build provenance.** Artifacts are built by the pipeline from the reviewed commit; a step that downloads and runs a script from a URL, or publishes from a developer machine, removes the link between review and release.
+- **Configuration baseline.** Hardening settings in images and manifests (non-root user, read-only filesystem, dropped capabilities, resource limits) are not weakened; a changed base image is a new supplier.
+- **Vulnerabilities.** A dependency with a known exploitable vulnerability, or a scanner disabled for convenience, is reported with its advisory id.
+
+Name the control a finding breaks (for example `ISO27001:A.8.32` for change management) in the finding's description.

package/src/bmad-plus/packs/pack-shield/review-rules/cryptography.md

@@ -0,0 +1,10 @@
+Check that the protection claimed is the protection delivered.
+
+- **Primitives.** Vetted library calls only; no home-made encryption, padding or random numbers. Reject MD5, SHA-1 or an unsalted fast hash for anything security-relevant, ECB mode, static or reused IVs and nonces, and `Math.random`-class generators for tokens or keys.
+- **Keys.** Keys and secrets come from a secret store or the environment, never from source, fixtures or container images. Each key has one purpose, a rotation path, and an owner; a key used both to sign and to encrypt is a defect.
+- **In transit.** TLS verification stays on (no `verify=False`, `rejectUnauthorized: false`, `InsecureSkipVerify`); internal calls that carry personal data or credentials are encrypted too.
+- **At rest.** Data the change stores that needs confidentiality is encrypted at the field or volume level the design promised; exports and backups receive the same protection as the primary store.
+- **Tokens and signatures.** Signed tokens pin the algorithm (no `none`, no algorithm taken from the token header), verify issuer, audience and expiry, and compare in constant time.
+- **Failure.** A decryption or verification failure is an error, never a fallback to the plaintext or unsigned path.
+
+Name the control a finding breaks (for example `ISO27001:A.8.24` for the use of cryptography) in the finding's description.

package/src/bmad-plus/packs/pack-shield/review-rules/index.yaml

@@ -0,0 +1,134 @@
+# Shield compliance review rules, applied by path once the Shield pack is installed.
+# They add to the built-in rules (a pack never replaces or disables one); a project replaces
+# or disables them by id in _bmad/review-rules.yaml. Every rule names the controls it
+# examines as FRAMEWORK:ID (bmad-plus review rules lists them), so a checklist can say which
+# controls a change touches. All rules share the `compliance` group: one parallel reviewer
+# can take them together.
+schema: bmad-plus/review-rules/1
+rules:
+  - id: shield-access-control
+    title: Identity, authentication and authorisation
+    group: compliance
+    globs:
+      - '**/{auth,authn,authz,login,session,sessions,permissions,rbac,acl,oauth,oidc,sso,iam,guards,policies}/**'
+      - '**/*{auth,Auth,session,Session,permission,Permission,policy,Policy}*.*'
+    controls:
+      [
+        ISO27001:A.5.15,
+        ISO27001:A.5.18,
+        ISO27001:A.8.2,
+        ISO27001:A.8.5,
+        SOC2:CC6.1,
+        SOC2:CC6.2,
+        SOC2:CC6.3,
+        NIST-800-53:AC-3,
+        NIST-800-53:AC-6,
+        NIST-800-53:IA-2,
+        NIS2:Art.21(2)(i),
+        NIS2:Art.21(2)(j),
+      ]
+    doc: access-control.md
+  - id: shield-personal-data
+    title: Personal data in models, schemas and migrations
+    group: compliance
+    globs:
+      - '**/{models,entities,schemas,schema,dto,dtos,migrations,migrate}/**'
+      - '**/*{user,User,customer,Customer,profile,Profile,account,Account,contact,Contact,consent,Consent,privacy,Privacy}*.*'
+    controls:
+      [
+        GDPR:Art.5(1)(c),
+        GDPR:Art.5(1)(e),
+        GDPR:Art.25,
+        GDPR:Art.30,
+        GDPR:Art.32,
+        ISO27001:A.5.34,
+        ISO27001:A.8.10,
+        ISO27001:A.8.11,
+        SOC2:P4.2,
+        SOC2:P4.3,
+      ]
+    doc: personal-data.md
+  - id: shield-cryptography
+    title: Cryptography, keys and secrets handling
+    group: compliance
+    globs:
+      - '**/{crypto,cryptography,security,secrets,certs,certificates,tls,vault,kms}/**'
+      - '**/*{crypt,Crypt,cipher,Cipher,hash,Hash,signature,Signature,token,Token,secret,Secret}*.*'
+    controls:
+      [
+        ISO27001:A.8.24,
+        ISO27001:A.5.17,
+        SOC2:CC6.1,
+        SOC2:CC6.7,
+        NIST-800-53:SC-8,
+        NIST-800-53:SC-12,
+        NIST-800-53:SC-13,
+        NIST-800-53:SC-28,
+        GDPR:Art.32(1)(a),
+        NIS2:Art.21(2)(h),
+      ]
+    doc: cryptography.md
+  - id: shield-logging
+    title: Logging, audit trail and monitoring
+    group: compliance
+    globs:
+      - '**/{logs,logger,logging,audit,telemetry,observability,monitoring,metrics,tracing}/**'
+      - '**/*{logger,Logger,logging,Logging,audit,Audit,telemetry,Telemetry}*.*'
+    controls:
+      [
+        ISO27001:A.8.15,
+        ISO27001:A.8.16,
+        ISO27001:A.8.17,
+        SOC2:CC7.2,
+        SOC2:CC7.3,
+        NIST-800-53:AU-2,
+        NIST-800-53:AU-3,
+        NIST-800-53:AU-9,
+        NIST-800-53:AU-11,
+        GDPR:Art.5(1)(c),
+        NIS2:Art.23,
+      ]
+    doc: logging.md
+  - id: shield-ai-integrations
+    title: AI models, prompts and agent tooling
+    group: compliance
+    globs:
+      - '**/{ai,llm,llms,prompts,agents,mcp,rag,embeddings}/**'
+      - '**/*{openai,OpenAI,anthropic,Anthropic,gemini,Gemini,llm,LLM,prompt,Prompt}*.*'
+      - '**/{.mcp.json,mcp.json}'
+      - '{CLAUDE,GEMINI,AGENTS,CONVENTIONS}.md'
+      - '{.claude,.cursor,.codex,.opencode,.gemini}/**'
+    controls:
+      [
+        GDPR:Art.28,
+        GDPR:Art.35,
+        GDPR:Art.44,
+        EU-AI-Act:Art.50,
+        ISO27001:A.5.19,
+        ISO27001:A.5.23,
+        ISO27001:A.8.12,
+      ]
+    doc: ai-integrations.md
+  - id: shield-change-and-supply-chain
+    title: Change control and supply chain
+    group: compliance
+    globs:
+      - '.github/workflows/**/*.{yml,yaml}'
+      - '**/{.gitlab-ci.yml,azure-pipelines.yml,bitbucket-pipelines.yml,CODEOWNERS}'
+      - '**/{package.json,pyproject.toml,requirements*.txt,go.mod,Cargo.toml,composer.json,Gemfile}'
+      - '**/{Dockerfile,Containerfile}'
+    controls:
+      [
+        ISO27001:A.8.25,
+        ISO27001:A.8.32,
+        ISO27001:A.5.21,
+        ISO27001:A.8.9,
+        SOC2:CC8.1,
+        SOC2:CC7.1,
+        NIST-800-53:CM-3,
+        NIST-800-53:SA-10,
+        NIST-800-53:SR-3,
+        NIS2:Art.21(2)(d),
+        NIS2:Art.21(2)(e),
+      ]
+    doc: change-and-supply-chain.md

package/src/bmad-plus/packs/pack-shield/review-rules/logging.md

@@ -0,0 +1,10 @@
+A log is evidence for an investigation and a store of personal data at the same time.
+
+- **Security events.** Sign-in success and failure, access denied, privilege and role changes, exports, deletions and configuration changes are logged with who, what, when and from where. A security-relevant path the change adds without an event is a gap.
+- **Content.** No passwords, tokens, keys, full card numbers, session ids or request bodies with personal data in log lines, traces, metrics labels or error reports. Identifiers are pseudonymised where the investigation does not need them in clear.
+- **Integrity.** Audit records cannot be edited or deleted by the application account that writes them; a change that routes audit events through a mutable table or a best-effort queue that drops on failure weakens the trail.
+- **Time.** Timestamps are in UTC from a synchronised clock and carry their zone; ordering never depends on a client-supplied time.
+- **Retention.** The retention of new logs is set, matches the policy for their content, and is shorter for logs holding personal data than for pure security events where the policy says so.
+- **Detection.** An alert or dashboard that the change removes, renames or silences is called out: incident detection and notification deadlines depend on it.
+
+Name the control a finding breaks (for example `ISO27001:A.8.15` for logging) in the finding's description.

package/src/bmad-plus/packs/pack-shield/review-rules/personal-data.md

@@ -0,0 +1,10 @@
+Follow each personal field from where it enters to where it is deleted.
+
+- **Minimisation.** A new field, column or payload property that identifies a person has a purpose the feature needs now. Collecting "in case" is the defect; so is copying a whole user object into another table, a cache, an event or a third-party call.
+- **Special categories.** Health, biometric, political, religious, sexual orientation, criminal or children's data needs its own legal basis and safeguards; flag it even when the rest of the change is clean.
+- **Retention and deletion.** Data added here has a retention period, and account deletion or an erasure request reaches it: backups, search indexes, analytics exports, soft-deleted rows and denormalised copies included.
+- **Masking.** Identifiers and contact details are masked or pseudonymised where the full value is not needed: admin lists, logs, support views, test fixtures and seed data.
+- **Migrations.** A migration that copies, backfills or widens personal data states why; a rollback does not resurrect erased data; a new nullable column that will hold personal data has a default that collects nothing.
+- **Records of processing.** A new purpose, recipient or category of data subject is a change to the record of processing activities; say so in the finding so the register is updated.
+
+Name the control a finding breaks (for example `GDPR:Art.5(1)(c)` for minimisation) in the finding's description.

package/src/bmad-plus/packs/pack-shield/shared/ai-processing-register-template.yaml

@@ -0,0 +1,53 @@
+# AI processing register (bmad-plus/ai-processing-register/1).
+#
+# Start with `bmad-plus ai-register init` (it writes _bmad/ai-processing-register.yaml)
+# and describe every AI tool the project uses:
+# coding assistants, agent CLIs, model APIs called by the product, MCP servers. Then:
+#   bmad-plus ai-register check
+# warns about any AI integration found in the project (adapter files such as CLAUDE.md,
+# tool folders such as .cursor/, servers declared in .mcp.json) that no entry covers.
+# `bmad-plus doctor` reports the same when the Shield pack is installed. A missing entry
+# never fails a build: the register is a record of processing, kept honest by review.
+#
+# integrations: the ids this entry covers. Tool ids are those of the BMAD+ adapters
+#   (claude-code, gemini-cli, antigravity, cursor, codex-cli, opencode, aider) or of other
+#   tools (github-copilot, windsurf, continue); an MCP server is mcp:<name as declared>.
+# legalBasis (GDPR Art. 6(1)), only when personalData is true: consent, contract,
+#   legal-obligation, vital-interests, public-task, legitimate-interests.
+# transfers: every destination outside the EEA with its mechanism: adequacy-decision,
+#   standard-contractual-clauses, binding-corporate-rules, derogation. [] when none.
+# Every value below is an example: replace it with what the provider's terms actually say.
+schema: bmad-plus/ai-processing-register/1
+controller: Example Ltd, 1 Example Street, Example City
+reviewed: 2026-09-29
+
+tools:
+  - id: coding-assistant
+    name: Claude Code
+    provider: Anthropic PBC
+    integrations: [claude-code]
+    purpose: Assist developers in reading, writing and reviewing the code of this repository.
+    data:
+      - Source code and commit history of this repository
+      - File contents and command output the developer shares in a session
+    personalData: true
+    legalBasis: legitimate-interests
+    retention: The period set by the provider's terms for the plan in use, written here in days.
+    transfers:
+      - to: United States
+        mechanism: standard-contractual-clauses
+    agreement: Data processing addendum attached to the commercial terms.
+
+  - id: issue-tracker-connector
+    name: GitHub MCP server
+    provider: GitHub, Inc.
+    integrations: ['mcp:github']
+    purpose: Let the coding assistant read and comment on issues and pull requests.
+    data:
+      - Issue and pull-request text, including contributor names and handles
+    personalData: true
+    legalBasis: legitimate-interests
+    retention: Not stored by the connector; the assistant's retention applies to what it reads.
+    transfers:
+      - to: United States
+        mechanism: standard-contractual-clauses

package/src/bmad-plus/packs/pack-shield/shared/ai-processing-register.md

@@ -0,0 +1,32 @@
+# AI Processing Register
+
+> Procedure used by Shield when a user asks which AI tools touch the project's data, prepares a record of processing (GDPR Art. 30), a DPIA involving AI tooling, or an ISO 27001 / ISO 42001 supplier review. Template: `shared/ai-processing-register-template.yaml`. Tooling: `bmad-plus ai-register init|check`, and `bmad-plus doctor` when Shield is installed.
+
+## What it produces
+
+`_bmad/ai-processing-register.yaml`: one entry per AI tool the project uses — coding assistants, agent CLIs, model APIs called by the product, MCP servers — with its provider, purpose, the categories of data it sees, whether that includes personal data and on which legal basis, retention, transfers outside the EEA with their mechanism, and the processing agreement in place.
+
+## Steps
+
+1. **Inventory.** Run `bmad-plus ai-register check`. It lists the AI integrations present in the project: the adapter files BMAD+ installs (`CLAUDE.md`, `GEMINI.md`, `.cursor/rules/`, `.codex/AGENTS.md`...), the tools' own folders (`.claude/`, `.cursor/`, `.gemini/`...), and the MCP servers declared in `.mcp.json`, `.cursor/mcp.json`, `.gemini/settings.json` or `.vscode/mcp.json` (comments and trailing commas allowed). Ask the user for tools used without a trace in the repository (a model API called by the product, a browser assistant).
+2. **One entry per tool.** `bmad-plus ai-register init` starts the file from the template; replace its example entries. An MCP server is registered as `mcp:` followed by its name exactly as declared. Fill each field from facts: the provider's terms and data processing addendum, the tool's settings (training opt-out, retention, region), what the tool can actually read. When a fact is unknown, say so to the user; do not guess a retention period or a transfer mechanism.
+3. **Personal data.** Code rarely is, but commit authors, issue text, customer data in fixtures, logs and support tickets are. When `personalData` is true, choose the legal basis with the user (the `gdpr-agent` and `legitimate-interest` workflow help) and flag the entry for a DPIA (`dpia-sentinel`) when the processing is large-scale or novel.
+4. **Transfers.** Every destination outside the EEA needs a mechanism; an adequacy decision covers a US provider only while it is certified under the Data Privacy Framework.
+5. **Check again.** `bmad-plus ai-register check` must report every integration registered. Set `reviewed` to the date of the review; the check warns after twelve months.
+
+## How the gate behaves
+
+| Situation                                                                                                                   | Result                                                     |
+| --------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
+| An AI integration found in the project that no entry covers                                                                 | Warning (exit code 0)                                      |
+| No register while AI integrations are present                                                                               | Warning                                                    |
+| Register last reviewed more than 365 days ago                                                                               | Warning                                                    |
+| An entry that matches nothing found here                                                                                    | Listed as not found; it may be used outside the repository |
+| A register that does not follow the schema (unknown key, legal basis missing for personal data, unknown transfer mechanism) | Error (exit code 1)                                        |
+
+The gate is deliberately soft: it keeps the register in step with the tooling, and a missing entry never blocks a build; only a register that cannot be read exits non-zero. `bmad-plus doctor` shows every case, that one included, as a warning.
+
+## Boundaries
+
+- The register records processing; it does not make it lawful. The legal basis, transfer mechanism and agreements are decisions for the controller and its DPO.
+- Detection sees configuration in the repository only. A tool installed on a developer's machine without project configuration is found by asking, not by the check.

package/src/bmad-plus/packs/pack-shield/shared/assurance-case-template.yaml

@@ -0,0 +1,87 @@
+# Security assurance case (bmad-plus/assurance-case/1).
+#
+# Start with `bmad-plus assurance init _bmad/assurance/<id>.yaml`, then replace every
+# example with the project's own claims and checks. At the commit the case is about:
+#   bmad-plus assurance run _bmad/assurance/<id>.yaml
+#   bmad-plus assurance verify _bmad/assurance/<id>.yaml --ledger-head <head reported by run>
+#     --emit-check _bmad-output/assurance/<id>/check.json
+# Keep the head outside the ledger, and set BMAD_PLUS_ASSURANCE_KEY from a secret in CI:
+# without them the ledger shows accidental edits, not deliberate ones.
+#
+# Evidence is only ever a check below that ran: its command, exit code, output digest and
+# artifact digests are recorded in a hash-chained ledger (_bmad-output/assurance/<id>/runs.jsonl).
+# A statement, a document or a link is not evidence, and verify refuses a case that relies
+# on one. Evidence goes stale when the commit, the command or an artifact changes, or when
+# it is older than freshness.maxAgeDays.
+#
+# Commands run without a shell: write each argument separately. On Windows, programs such
+# as npm are .cmd files and need [cmd, /c, npm, ...]. A check inherits only PATH, HOME and
+# the temporary folders; name any other variable it needs under env.
+schema: bmad-plus/assurance-case/1
+id: release-security
+title: Release security case
+scope: >-
+  The service at the commit being released, built by the pipeline from this repository.
+freshness:
+  maxAgeDays: 30
+  sameCommit: true
+
+checks:
+  - id: unit-tests
+    run: [npm, test]
+    timeoutSeconds: 900
+  - id: dependency-audit
+    run: [npm, audit, --audit-level=high, --omit=dev]
+  - id: secret-scan
+    run: [gitleaks, detect, --no-banner, --redact, --report-path, reports/gitleaks.json]
+    artifacts: [reports/gitleaks.json]
+  - id: review-gate
+    run: [npx, bmad-plus, review, gate, release, --emit-check, reports/review-check.json]
+    artifacts: [reports/review-check.json]
+
+claims:
+  - id: C1
+    claim: The release ships no known exploitable weakness, no committed credential, and no unreviewed change.
+    argument: >-
+      The top claim holds when each of the four sub-claims below holds; together they cover
+      third-party code, secrets, the change process and the behaviour the controls rely on.
+  - id: C1.1
+    parent: C1
+    claim: Production dependencies carry no known vulnerability rated high or critical.
+    argument: >-
+      npm audit compares the resolved dependency tree with the advisory database and exits
+      non-zero at the chosen level; a zero exit at this commit shows none is known today.
+    controls: [ISO27001:A.8.8, NIST-800-53:RA-5]
+    evidence:
+      - check: dependency-audit
+        shows: npm audit reports no advisory at high or above for production dependencies.
+  - id: C1.2
+    parent: C1
+    claim: No credential is committed in the repository history.
+    argument: >-
+      The scanner reads every commit reachable from this one and exits non-zero on a finding;
+      its report is kept as an artifact so the result can be inspected.
+    controls: [ISO27001:A.5.17, SOC2:CC6.1]
+    evidence:
+      - check: secret-scan
+        shows: gitleaks finds no secret in the history and writes its report.
+  - id: C1.3
+    parent: C1
+    claim: Every changed file of the release was reviewed and no finding is left open.
+    argument: >-
+      The review gate derives its verdict from coverage of the sealed scope: it exits zero
+      only when every selected file is completed or waived and no finding is open.
+    controls: [ISO27001:A.8.32, SOC2:CC8.1]
+    evidence:
+      - check: review-gate
+        shows: bmad-plus review gate reports the release review clean.
+  - id: C1.4
+    parent: C1
+    claim: The behaviour the security controls rely on is covered by passing tests.
+    argument: >-
+      Access checks, input validation and redaction have tests in the suite; the suite
+      passing at this commit shows that behaviour is intact.
+    controls: [ISO27001:A.8.29]
+    evidence:
+      - check: unit-tests
+        shows: The test suite passes at this commit.

package/src/bmad-plus/packs/pack-shield/shared/assurance-case.md

@@ -0,0 +1,50 @@
+# Security Assurance Case
+
+> Procedure used by Shield when a user asks for an assurance case, evidence for an audit, or proof that security controls hold at a given commit. Template: `shared/assurance-case-template.yaml`. Tooling: `bmad-plus assurance init|run|verify`.
+
+## What it produces
+
+A case in `_bmad/assurance/<id>.yaml` that states **claims**, gives for each an **argument**, and supports it with **evidence**. Evidence is only ever a check that ran: `bmad-plus assurance run` executes each declared command without a shell and appends to a hash-chained ledger what happened (exit code, output digest, digests of the artifacts the run wrote, commit, whether the tree was clean of changes and untracked files). `bmad-plus assurance verify` then refuses any claim whose evidence is missing, failed or stale, and the case file itself cannot name evidence that is only asserted.
+
+## Steps
+
+0. **Start.** `bmad-plus assurance init _bmad/assurance/<id>.yaml` copies this template under that id; it never overwrites a case.
+1. **Scope.** Agree with the user on what the case covers (system, commit or release, deployment) and which frameworks matter. Write it in `scope`.
+2. **Claims from controls.** Start from the controls in scope (the relevant framework agent and `shared/cross-framework-mapper.md` help). Write one top claim, then sub-claims narrow enough that a single command can show each one. Tag a claim with the controls it supports (`ISO27001:A.8.8`, `SOC2:CC8.1`, `GDPR:Art.32`); unknown or mistyped controls are refused.
+3. **Checks.** For every leaf claim, choose a command that exits zero only when the claim holds: a test suite, a dependency audit, a secret scanner, a configuration linter, `bmad-plus review gate`, a policy-as-code evaluation. Declare artifacts the command writes (reports, SBOMs) so they are hashed with the run.
+4. **Argument.** Say why a passing check shows the claim, and what it does not show. A check that cannot fail for the reason the claim is about is not evidence of it.
+5. **Run and verify** at the commit the case is about, with a clean working tree (untracked files count unless git ignores them; the case's own ledger folder and artifacts do not):
+   ```
+   bmad-plus assurance run _bmad/assurance/<id>.yaml
+   bmad-plus assurance verify _bmad/assurance/<id>.yaml --ledger-head <head> --emit-check _bmad-output/assurance/<id>/check.json
+   ```
+   `run` reports the ledger head; keep it where the ledger's writers cannot change it (the CI job log, the audit file) and pass it to `verify`. In CI, run both in the same job with `BMAD_PLUS_ASSURANCE_KEY` set from a secret.
+6. **Report.** Present the verdict: supported and unsupported claims with their reasons, and the controls that now have executed evidence (`controls.supported`). Never describe an unsupported claim as met.
+
+## What is refused
+
+| Situation                                                                                                                                               | Result                                                            |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
+| Evidence that is a statement, a document or a link                                                                                                      | The case does not load: evidence must name a check                |
+| A claim with neither evidence nor sub-claims                                                                                                            | The case does not load: the claim is only asserted                |
+| A check that never ran                                                                                                                                  | `missing` — the claim is unsupported                              |
+| A non-zero or unexpected exit code, a timeout, an artifact the run did not write (absent, or left unchanged from before)                                | `failed`                                                          |
+| A run at another commit or on uncommitted changes or untracked files, a command changed since, an artifact changed since, a run older than `maxAgeDays` | `stale`                                                           |
+| A ledger record edited or reordered, or removed before the last one                                                                                     | The whole case is unsupported until the ledger is rebuilt         |
+| The last records removed                                                                                                                                | Unsupported with `--ledger-head` given; unseen without it         |
+| A record written by hand, with its digest recomputed                                                                                                    | Unsupported with `BMAD_PLUS_ASSURANCE_KEY` set; unseen without it |
+
+## How far the ledger can be trusted
+
+Without a key, the chain of SHA-256 digests shows accidental and careless edits only: anyone who can write the ledger can append a record that verifies, or cut off the records after a run they want forgotten. Two things close that, both kept outside the ledger:
+
+- **A key.** With `BMAD_PLUS_ASSURANCE_KEY` (at least 32 characters) set, `run` signs every record with an HMAC and `verify` refuses any record the key does not authenticate. The key is never passed to a check, and a case cannot ask for it.
+- **The head.** `verify --ledger-head <sha256>` refuses a ledger that no longer holds the record `run` reported last, so removed runs are seen.
+
+Report which of the two applied (`ledger.authenticated`, `ledger.anchor` in the verdict); without either, say the evidence is recorded, not tamper-proof.
+
+## Boundaries
+
+- The case shows that named checks passed at a commit. It does not certify the system, and it is not an audit opinion: a qualified auditor decides what the evidence is worth.
+- `assurance run` executes the commands written in the case, with the same trust as a project's own scripts. Read a case from someone else before running it.
+- Evidence is bound to the commit by default (`freshness.sameCommit: true`). Set it to false only for a project outside git, and say so in the report.

package/src/bmad-plus/packs/pack-shield/shield-orchestrator.md

@@ -128,6 +128,25 @@ Detect the relevant framework(s) from user input using these trigger patterns:
 - FRIA, fundamental rights, Art. 27, impact assessment AI → route to `ai-act-fria`
 - AI incident, serious incident, Art. 73, incident reporting → route to `ai-act-incidents`
 
+**Evidence & tooling triggers:**
+- assurance case, security case, audit evidence, prove the controls hold, claims and evidence → follow `shared/assurance-case.md`
+- AI tools register, which AI tools see our data, record of processing for AI tooling, MCP servers inventory → follow `shared/ai-processing-register.md`
+- compliance review of a change, which controls does this change touch → use the Shield review rules (see Evidence & Tooling below)
+
+---
+
+## Evidence & Tooling
+
+Three Shield capabilities rest on BMAD+ CLI commands, so their results are checked by code, not asserted:
+
+| Need | Procedure | Command |
+|------|-----------|---------|
+| A security assurance case whose every piece of evidence is a check that ran, at the commit concerned | `shared/assurance-case.md`, template `shared/assurance-case-template.yaml` | `bmad-plus assurance init <case>`, `bmad-plus assurance run <case>`, `bmad-plus assurance verify <case> --ledger-head <head>`; `BMAD_PLUS_ASSURANCE_KEY` authenticates the ledger |
+| A register of the AI tools the project uses, what data they see and on which legal basis | `shared/ai-processing-register.md`, template `shared/ai-processing-register-template.yaml` | `bmad-plus ai-register init`, `bmad-plus ai-register check` (a warning, never a failure, for an unregistered tool) |
+| A code review that says which compliance controls a change touches | `review-rules/`: access control, personal data, cryptography, logging, AI integrations, change and supply chain, all in the `compliance` group | `bmad-plus review scope` writes the checklist; `bmad-plus review rules <path>` lists the rules and controls for one file |
+
+Controls are written `FRAMEWORK:ID` (`ISO27001:A.8.28`, `SOC2:CC8.1`, `GDPR:Art.32(1)(b)`, `NIS2:Art.21(2)(d)`, `NIST-800-53:AC-6(1)`, `EU-AI-Act:Art.50`); an unknown or mistyped control is refused. Report a supported claim or a touched control as what it is: evidence that a named check passed, or a prompt to review, never a certification. An assurance ledger without a key and a kept head shows accidental edits, not deliberate ones: say which protections applied.
+
 ---
 
 ## Multi-Framework Analysis
@@ -200,7 +219,11 @@ What type of compliance question do you have?
 8. 🔄 Cross-Framework Analysis
    "I need to comply with multiple frameworks — help me map controls."
 
-Which area? (1-8, or describe your situation)
+9. 🧾 Evidence & AI Tooling
+   → Assurance case, AI processing register, compliance review rules
+   "Prove our controls hold at this release" / "Which AI tools see our data?"
+
+Which area? (1-9, or describe your situation)
 ```
 
 ---

package/src/bmad-plus/skills/bmad-plus-uat/SKILL.md

@@ -116,6 +116,7 @@ template lacks is a change to the template, made in BMAD+ with its tests.
 | `storage-explained` | where the answers live and what makes them disappear (site data cleared, private window closed), and that nobody receives them until the JSON is handed over |
 | `finished-is-not-accepted` · `unload-guard` | unanswered lines are said on the page before finishing (a second click finishes anyway); finishing keeps the date and says it is not an acceptance; leaving with an unsaved run is questioned |
 | `utf8-and-escaped-diacritics` · `export-is-the-run` | UTF-8 declared, diacritics handled as escapes, and the exported JSON is the run as answered |
+| `no-third-party-requests` | opening the page asks nothing of any origin but its own: no remote font, stylesheet, script or image, so no third party learns who opened it |
 
 **Before a person opens the page**, in this order, and say in the delivery which ones ran:
 

package/src/bmad-plus/skills/bmad-plus-uat/template/page.html

@@ -4,16 +4,17 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>__TITLE__</title>
-<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Serif:wght@500;600&family=IBM+Plex+Mono:wght@400;500&display=swap">
 <style>
   :root {
     --bg: #f6f5f2; --card: #ffffff; --ink: #1b1d1f; --muted: #6b6f73; --line: #d9d7d1; --line-strong: #b9b6ae;
     --accent: #0f6f74; --accent-ink: #ffffff; --accent-soft: #e2f0f0;
     --ok: #1f7a3a; --ok-soft: #e4f2e8; --ko: #b3261e; --ko-soft: #f8e3e1; --warn: #b26a00; --warn-soft: #fbeeda;
     --mono-bg: #edece7; --focus: #0f6f74;
-    --sans: "IBM Plex Sans", "Segoe UI", system-ui, sans-serif;
-    --serif: "IBM Plex Serif", Georgia, "Times New Roman", serif;
-    --mono: "IBM Plex Mono", Consolas, "Courier New", monospace;
+    /* Installed faces only: the page asks nothing of any origin but its own, and every
+       platform's own fonts cover the scripts of every language the page ships. */
+    --sans: system-ui, "Segoe UI", Roboto, "Helvetica Neue", "Noto Sans", "Liberation Sans", Arial, sans-serif;
+    --serif: Charter, "Bitstream Charter", "Sitka Text", Cambria, "Noto Serif", "DejaVu Serif", Georgia, serif;
+    --mono: ui-monospace, "Cascadia Mono", "SF Mono", Menlo, Consolas, "Liberation Mono", "DejaVu Sans Mono", monospace;
   }
   @media (prefers-color-scheme: dark) {
     :root:not([data-theme="light"]) {

package/tools/build/generate-adapters.js

@@ -155,6 +155,9 @@ function factsFromDerived(derived, packs = derived.packOrder) {
         ? derived.installerAgents
         : selected.reduce((total, pack) => total + pack.agentCount, 0),
     packs: selected,
+    dataFlows: (derived.dataHandling || []).filter(
+      (flow) => flow.component === 'cli' || packs.includes(flow.component)
+    ),
   };
 }
 
@@ -217,6 +220,10 @@ function renderFactsSection(facts) {
       `  - ${p.name}${p.required ? ' (required)' : ''}: ${p.agentCount} installer agent${p.agentCount === 1 ? '' : 's'} — ${p.desc}${suffix}`
     );
   }
+  if (facts.dataFlows.length)
+    lines.push(
+      `- Data handling: no telemetry; ${facts.dataFlows.length} flow${facts.dataFlows.length === 1 ? '' : 's'} can send data off the machine, each under its consent basis: ${facts.dataFlows.map((flow) => `${flow.id} (${flow.consent})`).join(', ')}. What, to whom and when: "Data handling" in the bmad-plus SECURITY.md.`
+    );
   return lines;
 }
 

package/tools/build/generate.js

@@ -302,6 +302,19 @@ function renderSummary(pack, derived, field = 'summary') {
   });
 }
 
+/**
+ * The package flows of the data-handling doctrine that can leave the machine, with their
+ * consent basis; maintainer services are not installed and stay out. verify-egress.js owns
+ * the doctrine's schema and its agreement with the code.
+ */
+function buildDataHandling(registry) {
+  const doctrine = registry.data_handling || {};
+  const services = new Set((doctrine.services || []).map((service) => service.id));
+  return (doctrine.flows || [])
+    .filter((flow) => flow.egress !== 'none' && !services.has(flow.component))
+    .map((flow) => ({ id: flow.id, component: flow.component, consent: flow.consent?.basis }));
+}
+
 /** The one derivation engine; its JSON result is shipped for runtime consumers. */
 function buildDerived(registry, { sourceRoot = path.join(REPO_ROOT, 'src', 'bmad-plus') } = {}) {
   const packs = {};
@@ -381,6 +394,7 @@ function buildDerived(registry, { sourceRoot = path.join(REPO_ROOT, 'src', 'bmad
     languages: Object.keys(LANGUAGES),
     packs,
     pythonPacks,
+    dataHandling: buildDataHandling(registry),
     diagnostics: {
       schemaVersion: 1,
       processExecution: registry.targets.optional_process_backend || null,

package/tools/cli/bmad-plus-cli.js

@@ -120,6 +120,8 @@ for (const modulePath of [
   './commands/nexus',
   './commands/uat',
   './commands/review',
+  './commands/assurance',
+  './commands/ai-register',
 ]) {
   const command = require(modulePath);
   const configured = program.command(command.command).description(command.description);

package/tools/cli/commands/ai-register.js

@@ -0,0 +1,63 @@
+/**
+ * The AI processing register: start it from the Shield template, warn about AI integrations
+ * it does not cover.
+ */
+'use strict';
+
+const path = require('node:path');
+const register = require('../lib/ai-register');
+
+module.exports = {
+  command: 'ai-register <action>',
+  description:
+    'AI processing register: start it from the Shield template, check which AI integrations it does not cover',
+  options: [
+    ['-d, --directory <path>', 'Project directory'],
+    ['--json', 'Machine-readable output'],
+  ],
+  action: (action, options = {}) => {
+    const projectDir = path.resolve(options.directory || process.cwd());
+    if (action === 'init') {
+      try {
+        const file = register.initRegister(projectDir);
+        if (options.json) console.log(JSON.stringify({ schemaVersion: 1, action, file }, null, 2));
+        else
+          console.log(
+            `${file}: started from the Shield template. Replace the example entries, then run bmad-plus ai-register check.`
+          );
+      } catch (error) {
+        console.error(`ai-register: ${error.message}`);
+        process.exitCode = 3;
+      }
+      return;
+    }
+    if (action !== 'check') {
+      console.error(`ai-register: unknown action "${action}" (init, check)`);
+      process.exitCode = 3;
+      return;
+    }
+    const result = register.checkRegister(projectDir);
+    // A soft gate: warnings never fail the command; only an unreadable register does.
+    process.exitCode = result.errors.length ? 1 : 0;
+    if (options.json) {
+      console.log(JSON.stringify({ schemaVersion: 1, ...result }, null, 2));
+      return;
+    }
+    const covered = result.integrations.filter((item) => item.coveredBy);
+    console.log(
+      `${result.registerFile}: ${result.register ? `reviewed ${result.register.reviewed}` : 'absent'} — ${covered.length}/${result.integrations.length} AI integration(s) registered`
+    );
+    for (const item of covered)
+      console.log(`  registered ${item.ids.join(' or ')} → ${item.coveredBy}`);
+    for (const warning of result.warnings) console.log(`  warning   ${warning}`);
+    for (const error of result.errors) console.error(`  error     ${error}`);
+    if (result.unmatched.length)
+      console.log(
+        `  not found here (may be used outside the repository): ${result.unmatched.join(', ')}`
+      );
+    if (result.warnings.length && !result.errors.length)
+      console.log(
+        '  Add each tool with its purpose, data, legal basis, retention and transfers; see the Shield template shared/ai-processing-register-template.yaml.'
+      );
+  },
+};