bmad-plus 0.21.0 → 0.23.0

package/CHANGELOG.md

@@ -5,6 +5,45 @@ All notable changes to BMAD+ will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.23.0] - 2026-10-17
+
+### Added
+
+- **Pack intake** (`bmad-plus intake check|plan|record|render`, skill `bmad-plus-intake`). A pack declares the questions it needs answered before it acts (`intake.yaml`: sections, kinds, must-haves with the risk of not knowing, defaults, the artifact each answer feeds). `plan` says what is still missing and the next batch to ask, must-haves first and a few at a time; `record` writes only what the user gave, marks what they do not know, and never invents; `render` writes the brief that becomes the contract for everything the pack does next. The build validates every declared intake with the same contract the CLI uses.
+- **Swarm runtime** (`bmad-plus swarm init|briefs|check|save|tally|inspect|plan`, skill `bmad-plus-swarm`). A pack declares a swarm (a panel dealt deterministically from a profile, a jury of listed lenses, or a fanout of units with disjoint write scopes); the CLI deals the cards under a seed, renders one brief per unit, validates each sub-agent's answer file, tallies rates, counts, verbatim quotes and numbers over valid answers only, and exports a fanout as a durable Nexus plan. A new `swarm` block in `_bmad/config.yaml` sets the budget of sub-agents a run may use before the host asks (26 by default) and keeps paid media generation out of any budget. The host spawns the sub-agents; the CLI never calls a model and never answers for a unit.
+- **Skill packs in the registry.** `uses_skills` names the skills an agent drives (rendered on its roster line as `drives:`); `external_module` takes a pack's skills from a pinned npm package the installer copies into `.agents/skills/` with a version check; `pipelines` declares ordered workflow or agent steps with a checkpoint gate each, rendered step by step in the generated instructions; `intake` names the pack's intake file. All four are validated at build time.
+- **Design pack (Atelier).** The design engine published as `design-skill` (three skills: `design`, `design-review`, `redesign`, with their reference modules) joins every installation as a referenced package, driven by the Atelier persona through an intake first. The pack ships a sealed evaluation, a shipping test and its trigger block; `pack-animated` stays until the brand-site pack supersedes it.
+- **Trigger gate** (`npm run check:triggers`, Platform workflow). `role-triggers.yaml` may only name Core agents, pack personas and declared pipelines; a role needs patterns, and a pattern repeated within one agent is refused.
+
+### Changed
+
+- Nexus runs a pack's declared pipeline after its intake and runs swarms through `bmad-plus swarm` within the configured budget; autopilot's Discovery starts with the intake of every pack involved. The generated instructions tell an agent to read the `SKILL.md` of every skill it drives before acting.
+- `bmad-plus install` lists every selected pack's files before writing any, so an unresolvable external module leaves the project untouched.
+
+### Fixed
+
+- `bmad-plus uninstall` removes the skills copied from an external module (found by the 0.23.0 acceptance run: the three Atelier skills stayed in `.agents/skills/` after uninstall). Edited copies stay, as for every other managed file, and nothing is removed when the package can no longer be compared.
+
+## [0.22.0] - 2026-09-29
+
+### Added
+
+- **Shield security assurance case** (`bmad-plus assurance init|run|verify <case>`). A case states claims, an argument for each, and evidence that can only be a check that ran. `run` executes each declared command without a shell and with a minimal environment, and appends a hash-chained ledger record (exit code, output digest, redacted excerpt, digests of the artifacts it wrote, commit, working-tree state). `verify` finds a claim unsupported when its evidence is missing, failed or stale, and can emit a CI check. `verify --ledger-head` catches removed runs; with `BMAD_PLUS_ASSURANCE_KEY` every record carries an HMAC that no check can read.
+- **Shield AI processing register** (`bmad-plus ai-register init|check`). `_bmad/ai-processing-register.yaml` records each AI tool with its provider, purpose, data categories, legal basis, retention, transfers and processing agreement. `check` compares it with the AI integrations found in the project (BMAD+ adapters, tool folders, MCP server declarations) and warns about any tool not registered; `bmad-plus doctor` reports it when Shield is installed.
+- **Compliance review rules.** A review rule can name the controls it examines (`FRAMEWORK:ID`, validated). An installed Shield adds six path-scoped rules in a `compliance` group (access control, personal data, cryptography, logging, AI integrations, change and supply chain); the checklist opens with the controls a change touches, and a finding may list the controls it breaks.
+
+### Security
+
+- **Data-handling doctrine and egress gate.** `registry.yaml` declares what BMAD+ sends, to whom, when and under which consent basis. `tools/build/verify-egress.js` fails CI when a network, listener or process site of the package or of the maintainer services is undeclared, miscounted or stale, or when a module load cannot be resolved. `SECURITY.md` has a generated "Data handling" section and the generated adapters state the flows of the installed packs. BMAD+ has no telemetry; `update-check` is opt-out.
+- **The UAT recipe page loads nothing from another origin.** Google Fonts is gone; the page uses installed fonts. The build refuses a template that would load or send anything elsewhere (`no-third-party-requests`), reading it as the HTML tokenizer does, with references, escapes and `data:` documents decoded. The jsdom and Chromium checks record every request and socket of a run.
+- **The SEO HTML report opens without asking any server**, and `GOOGLE_API_KEY` is sent in the `x-goog-api-key` header, never in a URL, and redacted from errors.
+- **OSINT provider calls are HTTPS-only**: other schemes, URL credentials and redirects that leave https or the host are refused before connecting.
+- **SEO screenshots are pinned** to the address `seo_fetch.py` validated: Chromium resolves nothing else, other hosts and redirect hops are blocked and reported.
+
+### Fixed
+
+- **MCP server:** SSE client disconnects and graceful shutdowns no longer log `Exception in ASGI application`; an open SSE stream ends cleanly on SIGTERM. The middlewares are pure ASGI. An `MCP_TOKEN_CREATED_AT` with a UTC offset no longer makes every authenticated request answer 500, and non-ASCII secrets are refused with 401 instead of raising.
+
 ## [0.21.0] - 2026-09-28
 
 ### Added

package/README.md

@@ -1,8 +1,8 @@
 # BMAD+
 
-[![Version](https://img.shields.io/badge/version-0.21.0-blue)](https://www.npmjs.com/package/bmad-plus)
+[![Version](https://img.shields.io/badge/version-0.23.0-blue)](https://www.npmjs.com/package/bmad-plus)
 
-**Version 0.21.0** · Node.js `>=20.0.0` · MIT
+**Version 0.23.0** · Node.js `>=20.0.0` · MIT
 
 Project-local AI development workflows with clear roles, shared context, safe updates and coding-tool adapters
 
@@ -35,7 +35,7 @@ Run the installer. Select the adapters for the AI tools you use and the packs yo
 **In your project terminal:**
 
 ```sh
-npx bmad-plus@0.21.0 install
+npx bmad-plus@0.23.0 install
 ```
 
 The installer creates the agent instructions, shared project spine and selected tool adapters. Optional packs may need additional runtimes or API access.
@@ -98,6 +98,7 @@ Read the changes and test results. The assistant follows the permissions and cap
 | Dev Studio | Specialized roles and workflows for product planning, design, engineering and documentation. |
 | Backup | Instructions and utilities for timestamped backups, restoration and rotation. |
 | Animated | A focused workflow for creating video-driven scrolling websites. |
+| Design | Atelier, the design engine: build, audit and redesign interfaces under checkable rules, with an intake first. |
 
 ## Examples
 
@@ -151,6 +152,16 @@ Zecher, update this project’s memory from the changes and checks we actually c
 
 Expected result: a concise current context, a dated session handoff and a restart prompt that identifies the next unfinished task.
 
+### Design a screen with Atelier
+
+Use with the optional Design pack installed. Atelier asks its questions first, then follows checkable rules.
+
+```text
+Atelier, run the design read for the invoice list of my app, build the screen, and end with the pre-flight verdict.
+```
+
+Expected result: the recorded design read, the screen with every state covered, and the pre-flight verdict quoted as the last line.
+
 ### Read a test run without guessing
 
 Use when a person has completed or stopped an acceptance run.
@@ -171,18 +182,17 @@ Read AGENTS.md and the available project memory. Summarize the last verified sta
 
 Expected result: a short, evidence-based restart. Project notes are useful context and still need to be checked against the current work.
 
-## What’s new in 0.21.0
+## What’s new in 0.23.0
 
-Reviews that stop honestly, resume, and report to CI
+Ask first, then swarm
 
-A review now records why it stopped and what it used, writes a check a CI step can read, and resumes on the scope it sealed. The SEO fetcher connects only to addresses it has validated, and the MCP server moves to the official SDK on Python 3.12. Nothing changes in how you install or update.
+A pack now declares the questions it needs answered before it acts, and Nexus can run a swarm of sub-agents, a simulated panel or a jury, within a budget you set. Atelier, the design engine, joins as the tenth pack. Installing and updating work as before.
 
-- coverage.json can record how a review ran: why it stopped (completed, budget, time limit, three failed attempts in a row, interrupted), the passes run and the usage the host reported. A review that stopped early is always incomplete, and a unit is abandoned after three consecutive failed attempts.
-- bmad-plus review gate --emit-check followed by a file name writes the verdict as a check document for CI: disposition, reasons, open findings by severity with their lines, and a block shaped for GitHub check runs. The same evidence always gives the same file.
-- bmad-plus review continue resumes an interrupted review on the same sealed scope and lists what is still owed. It refuses when the code, the rules or a selected file changed, and points to a new scope and review compare.
-- Review rules can belong to a group (code, data, delivery or your own), so parallel reviewers can split a unit by rule family.
-- For maintainers, a review bench scores recorded review answers against planted defects and decoys with a published matching rule, and copy-ready CI recipes gate pull requests with a host agent on a self-hosted runner without trusting anything the agent can rewrite.
-- The SEO fetcher and crawler resolve each host themselves, refuse internal addresses and connect to the exact address they validated, on every redirect too, which defeats DNS rebinding. The MCP server uses the official SDK on Python 3.12 with current chromadb and sentence-transformers; re-run ingest.py once after upgrading.
+- bmad-plus intake asks a pack’s questions a few at a time, marks the must-haves, proposes defaults, records what you do not know with its risk, and renders the brief that becomes the contract for what the pack does next. Nothing in it is invented.
+- bmad-plus swarm deals simulated units from a profile under a seed, writes one brief per sub-agent, validates every answer file, counts only valid answers, and states that simulated buyers are not customers. The swarm block in _bmad/config.yaml sets how many sub-agents run before the assistant asks you; paid media generation always asks.
+- The registry now records which skills an agent drives, which npm package a pack’s skills come from, which pipeline steps and gates a pack declares and which intake it runs. The generated instructions carry all of it, so nothing is typed twice.
+- Design pack: Atelier, built from the design-skill package, interviews you with a design read, then builds, audits or redesigns an interface under checkable rules. The installer copies its three skills with their reference modules, and doctor checks them.
+- A trigger gate refuses auto-activation rules that name an agent or a pipeline the registry does not know, and the installer writes nothing when a pack’s files cannot all be listed first.
 
 ## Version History
 
@@ -190,9 +200,9 @@ These dates identify reviewed CHANGELOG notes, not npm publication dates. The we
 
 | Version | Release-notes date | Reviewed summary |
 | --- | --- | --- |
+| 0.23.0 | 2026-10-17 | A pack now declares the questions it needs answered before it acts, and Nexus can run a swarm of sub-agents, a simulated panel or a jury, within a budget you set. Atelier, the design engine, joins as the tenth pack. Installing and updating work as before. |
+| 0.22.0 | 2026-09-29 | BMAD+ now declares every way it sends data or starts a process, and its CI refuses anything undeclared. The recipe page and the SEO report load nothing from other sites, OSINT calls are HTTPS-only, and Shield gains an evidence-bound assurance case and an AI processing register. Nothing changes in how you install or update. |
 | 0.21.0 | 2026-09-28 | A review now records why it stopped and what it used, writes a check a CI step can read, and resumes on the scope it sealed. The SEO fetcher connects only to addresses it has validated, and the MCP server moves to the official SDK on Python 3.12. Nothing changes in how you install or update. |
-| 0.20.0 | 2026-09-28 | bmad-plus review now hands the reviewer the rules that apply to the changed files, fixes the depth of a review before it starts, compares a review with an earlier one without calling an unchecked finding fixed, and masks credentials in what it writes. Nothing changes in how you install or update. |
-| 0.19.0 | 2026-09-27 | bmad-plus review seals what a review must cover, locates every finding by the code it quotes, and derives the verdict from coverage instead of the number of findings. Review triage now keeps a finding unless a quoted ground refutes it. Nothing changes in how you install or update. |
 
 [Release history and update guide](https://bmad-plus.rochetta.fr/docs/#changelog) · [All published npm versions](https://www.npmjs.com/package/bmad-plus?activeTab=versions)
 

package/SECURITY.md

@@ -65,7 +65,7 @@ Security researchers who report valid vulnerabilities will be credited in the CH
 - Production npm dependencies are audited before each release; high and critical findings block publication
 - Maintained Python requirements are audited in CI and block publication on known findings
 - The private legacy MCP ML stack has a separate, visible advisory audit and migration backlog; its findings do not describe the npm runtime
-- Minimal dependency footprint (6 runtime dependencies)
+- Minimal dependency footprint (7 runtime dependencies; `design-skill` contributes the skill files BMAD+ copies at install and a linker CLI that BMAD+ never runs)
 - Bundled source notices are included in [THIRD-PARTY-LICENSES.md](THIRD-PARTY-LICENSES.md); npm runtime dependency licenses are recorded in the release SBOM
 
 ### Distribution Security
@@ -75,5 +75,67 @@ Security researchers who report valid vulnerabilities will be credited in the CH
 - Each release retains its CycloneDX production SBOM, archive and integrity manifest as workflow artifacts; registry integrity must match the checked archive before the landing is deployed
 - Publication uses npm OIDC authentication. npm provenance is not enabled: the private build repository and distribution repository differ. An inventory or hash is not a provenance attestation
 
+## Data handling
+
+BMAD+ has no telemetry and no silent self-update. The first table lists every flow of the
+npm package that can send data off the machine; the second covers the maintainer services
+deployed from this repository (the Audit 360° MCP server and the upstream monitor), which
+users do not install. Both are generated from the `data_handling` doctrine in
+`registry.yaml`. Before each release, CI scans every shipped and service source file and
+fails when a network, listener or process site is missing from the doctrine, or when a
+declared one no longer exists. "Through a started program" means BMAD+ starts a tool (npm,
+uv or pip, git, Codex CLI, Chromium, a command you declared) and that tool does the sending.
+
+<!-- data-handling:begin — generated from registry.yaml by tools/build/verify-egress.js --write -->
+
+| Flow | Component | Leaves the machine | What | To whom | When | Consent |
+|---|---|---|---|---|---|---|
+| `update-check` | cli | through a started program | The package name and channel (`npm view bmad-plus@latest`) with npm's request metadata: IP address, user agent (npm, Node.js and OS versions) and npm session headers. | registry.npmjs.org (the policy accepts no other registry) | `bmad-plus update-check`, which the generated adapters ask the agent to run once per session; the answer is cached in `.bmad/update-check.json`. | **opt-out**: `bmad-plus update-policy --mode off` stops every lookup. |
+| `update-apply` | cli | through a started program | The exact release requested, with npm's request metadata, to download that version's package. | registry.npmjs.org | `bmad-plus update --latest --yes`, or `--auto` when the project policy allows it. | **opt-in**: Each run needs `--yes`, or policy mode `auto` with an explicit range (`bmad-plus update-policy --mode auto --range <range>`). |
+| `python-provision` | cli | through a started program | The names and versions in the pack's requirements.txt, with the installer's request metadata; uv may also download a Python build. | pypi.org and files.pythonhosted.org, or the index configured for pip or uv on the machine, github.com (python-build-standalone releases) when uv downloads Python | `bmad-plus install --provision-python` for a selected Python pack. | **opt-in**: Only with `--provision-python`; without it no environment is created. |
+| `nexus-worker` | cli | through a started program | With `codex-exec`, the task's instruction and input files (at most 1 MiB) go to Codex CLI, which sends them to the model provider of the user's own Codex login. With `command`, whatever that command sends. | the model provider configured in the user's Codex CLI, whoever a declared command contacts | `bmad-plus nexus launch` on a plan with an explicit execution contract. | **invocation**: Nothing starts without a plan the user wrote and an explicit launch; shell, environment and arbitrary Codex flags are refused. |
+| `nexus-verifier` | cli | through a started program | Whatever the declared command sends; it runs with a minimal allow-listed environment. | whoever the declared command contacts | `bmad-plus nexus verify` on a task of a plan the user wrote. | **invocation**: The command and its hash are fixed in the plan; a changed executable is refused. |
+| `uat-page-results` | core | directly | The run: tester name, step verdicts and notes. | the origin serving the page: `bmad-plus uat serve` on 127.0.0.1, or the claude.ai artifact store when the page is published as an artifact | Each recorded verdict, when the page is served; a page opened from a file keeps results in the browser. | **invocation**: The tester chooses how the page is opened; a page opened from a file sends nothing. |
+| `osint-providers` | osint | directly | The investigation query (names, handles, keywords and URLs about the subject) and that provider's API key, over verified HTTPS: the shared helper refuses any other scheme and any redirect off the provider's host. | api.apify.com, api.exa.ai, r.jina.ai, s.jina.ai, deepsearch.jina.ai, api.parallel.ai, api.perplexity.ai, api.tavily.com, the Bright Data MCP URL the user configures | When the Shadow agent, or `volley.py` fanning out to the others, runs a provider script during an investigation. | **credential**: A provider is contacted only once its key (or Bright Data MCP URL) is set; the skill's Phase −1 lawful-basis gate precedes profiling a named person. |
+| `seo-site-fetch` | seo | directly | HTTP requests for the audited site's pages, robots.txt and sitemap, with the user agent the audit selects, from the user's IP address. | the site the user asks to audit (public addresses only) | `seo_fetch.py` and `seo_crawl.py`, run by the SEO agents during an audit. | **invocation**: Only the URL the user gives and its internal links are fetched; private, loopback and link-local addresses are refused. |
+| `seo-google-apis` | seo | directly | The audited URL or origin, and the user's GOOGLE_API_KEY in the x-goog-api-key header, never in the request URL; redirects are not followed. | www.googleapis.com, chromeuxreport.googleapis.com, searchconsole.googleapis.com | `seo_apis.py`, run during an audit's performance phase. | **credential**: Only when GOOGLE_API_KEY is set; without it the script returns an error and sends nothing. |
+| `seo-screenshot` | seo | through a started program | Chromium's requests for the audited page and the resources its own host serves, with a browser user agent, from the user's IP address. Third-party resources are blocked, not fetched. | the site the user asks to audit (public addresses only) | `seo_screenshot.py`, when an audit asks for screenshots. | **invocation**: Only the URL the user gives, with the Playwright and Chromium the user installed; non-public addresses, other hosts and redirects off the host are refused. |
+| `assurance-checks` | cli | through a started program | Whatever a declared check command sends; the CLI itself sends nothing. | whoever a declared check command contacts | `bmad-plus assurance run` on a case the user wrote. | **invocation**: Only the commands listed in the user's own case file run, and only on an explicit `assurance run`; the signing key is never passed to a check. |
+
+Stays on the machine:
+
+- `npx-launcher` (cli): Starts the CLI in the same Node.js executable. When: Every `npx bmad-plus` run.
+- `python-health` (cli): Runs a pack environment's own Python, isolated (-I), to confirm its modules import. When: `bmad-plus doctor` on a project with a provisioned Python pack.
+- `review-git` (cli): Reads the local repository with git (rev-parse, merge-base, diff, ls-files, show) to build a review scope. When: `bmad-plus review` commands.
+- `nexus-git` (cli): Reads the repository root and HEAD commit with `git rev-parse`. When: `bmad-plus nexus` plan and run commands.
+- `uat-serve` (cli): Serves a recipe page and stores its verdicts, listening on 127.0.0.1 only and refusing any other Host header. When: `bmad-plus uat serve`.
+- `uat-release-gate` (core): Runs the project's own bmad-plus CLI with the current Node.js to grade recorded acceptance runs. When: The release-gate script a project copies from the UAT skill, when the project runs it.
+- `osint-install` (osint): Copies the OSINT agent and skills into a BMAD project, then runs the pack's local diagnostic script with the system Python. When: When the user runs the package's install.sh or install.ps1.
+
+Maintainer services, deployed from this repository and not part of the npm package:
+
+- `mcp-server` (`mcp-server/`): The Audit 360° MCP server the maintainer runs on a VPS: git, GitHub, Gamma, CI, RAG and memory tools for the maintainer's agents, behind a bearer token and a password-protected dashboard.
+- `monitor` (`monitor/`): The upstream monitor the maintainer schedules on a VPS: it watches the BMAD-METHOD repository and notifies the maintainer of new changes.
+
+| Flow | Service | Leaves the machine | What | To whom | When | Consent |
+|---|---|---|---|---|---|---|
+| `mcp-listener` | mcp-server | directly | Tool results (repository contents and diffs, command output, audit reports, knowledge-base passages, memory entries) and the dashboard's audit data. | MCP clients presenting the bearer token, dashboard users logged in with the dashboard password | While the service runs: HTTPS on 0.0.0.0:443 when SSL_CERT_FILE and SSL_KEY_FILE are set, plain HTTP on 127.0.0.1:8000 with BMAD_DEV=1, otherwise it refuses to start. | **credential**: Every MCP request needs MCP_AUDIT360_TOKEN and every dashboard request the dashboard password; 30 requests per minute per address. |
+| `mcp-dashboard-cdn` | mcp-server | directly | The dashboard user's IP address, user agent and the dashboard origin as referrer. | cdn.jsdelivr.net | Each time the dashboard page is opened. | **invocation**: Opening the dashboard loads it. |
+| `mcp-knowledge-ingest` | mcp-server | through a started program | Git clone and pull requests for the sources in knowledge/sources.json, and the model download request (model name, library version) on first use. | the Git hosts of the configured knowledge sources, huggingface.co (the embedding model named by RAG_EMBEDDING_MODEL or the default) | At server start when the knowledge base is empty, and on the admin_refresh_knowledge tool. | **invocation**: The maintainer lists the sources; chromadb runs with anonymized_telemetry=False. |
+| `mcp-git-tools` | mcp-server | through a started program | Clone, pull and push traffic for the repositories a client names, with the credentials git holds on the server; pushes carry the commits made through git_commit. | the Git hosts of the repositories the client names (URLs validated before cloning) | git_* tools, audit_scan_repo and orchestrate_full_audit, when an authenticated client calls them. | **credential**: Only through an authenticated MCP call; paths are confined to the server's repository root. |
+| `mcp-github-api` | mcp-server | directly | GITHUB_TOKEN with the repository names, file contents, pull-request texts and collaborator names the client passes; orchestrate_full_audit creates a private delivery repository. | api.github.com | github_* tools and orchestrate_full_audit, when an authenticated client calls them. | **credential**: Only with GITHUB_TOKEN set on the server and an authenticated MCP call. |
+| `mcp-gamma` | mcp-server | directly | The report content (Markdown, title, infographic URLs, instructions) and GAMMA_API_KEY; export downloads carry no content. | public-api.gamma.app, the export host named in Gamma's answer | gamma_* tools, when an authenticated client calls them. | **credential**: Only with GAMMA_API_KEY set on the server and an authenticated MCP call. |
+| `mcp-ci-tools` | mcp-server | through a started program | Whatever those programs send: dependency downloads of npm, pip, cargo or go, Semgrep's registry requests for --config=auto, Trivy's vulnerability-database download, and whatever a repository's deploy script sends. | the package registries of the repository's toolchain, semgrep.dev, Trivy's database mirrors, whoever a repository's deploy script contacts | ci_* tools, when an authenticated client calls them. | **credential**: Only through an authenticated MCP call; commands must equal an allow-listed argv, deploy scripts must lie inside the repository. |
+| `monitor-upstream-git` | monitor | through a started program | Git fetch requests for the configured upstream ref, with the host's IP address. | github.com (bmad-code-org/BMAD-METHOD, or the HTTPS repository the configuration names) | Each scheduled run of weekly-check.py. | **invocation**: The maintainer installs the schedule and chooses the repository and ref. |
+| `monitor-ai-analysis` | monitor | directly | Bounded excerpts of the upstream commit messages, diff statistics and diff, the previous observed version, and the configured API key. | generativelanguage.googleapis.com (Google Gemini API) | weekly-check.py --ai, when a change is observed. | **opt-in**: Only with --ai and an API key and model list in the configuration; --dry-run never calls it. |
+| `monitor-notify` | monitor | directly | The observation report: upstream version and commit summaries, with the advisory analysis when one was requested. | the Evolution API instance the configuration names (loopback unless HTTPS), which relays it to the configured WhatsApp number, the SMTP server of the fallback email configuration (STARTTLS) | weekly-check.py --notify, once per newly observed upstream state. | **opt-in**: Only with --notify and a configured channel; --dry-run never notifies. |
+| `monitor-mcp-bridge` | monitor | directly | Tool names and arguments (repository URLs and paths, pull-request texts) with the MCP bearer token. | the maintainer's MCP server (VPS_HOST or the configured mcp_url) | When code constructs an MCPBridge; weekly-check.py does not. | **credential**: Only with an MCP token and server address supplied by the maintainer. |
+
+Stays on the service host:
+
+- `mcp-memory` (mcp-server): Runs the bmad-plus CLI's `mem` command with the server's Node.js for the memory tools. When: memory_* tools, when an authenticated client calls them.
+
+<!-- data-handling:end -->
+
 BMAD+ is an independent derivative of BMAD-METHOD. It is not an official release
 of BMad Code, LLC and does not imply its endorsement.

package/osint-agent-package/skills/bmad-osint-investigate/osint/scripts/_http.py

@@ -1,43 +1,87 @@
-"""Shared HTTP utilities for OSINT scripts — stdlib only, zero dependencies."""
+"""Shared HTTP utilities for OSINT scripts — stdlib only, zero dependencies.
+
+Every request goes over verified HTTPS: the providers receive API keys and
+investigation queries, so a plain-text or unverified hop is never acceptable.
+"""
 
 import http.client
 import json
 import os
 import ssl
 import sys
-from urllib.parse import urlparse, urlencode, quote
+from urllib.parse import urljoin, urlparse
 
+MAX_REDIRECTS = 5
+_REDIRECT_STATUSES = frozenset({301, 302, 303, 307, 308})
 
-def https_request(method, url, headers=None, body=None, timeout=120):
-    """Make an HTTPS request and return (status, headers, body_str).
-    
-    Handles both http and https URLs.
+
+class InsecureURLError(ValueError):
+    """A URL the helper refuses to contact (not HTTPS, credentials, no host)."""
+
+
+def _check_https_url(url):
+    """Return ``(host, port, target)`` for an acceptable URL, or raise InsecureURLError.
+
+    Only ``https://`` with a host is accepted: no plain HTTP, no other scheme
+    and no implicit one. Credentials in the URL are refused, since they would
+    travel outside the headers the caller controls.
     """
     parsed = urlparse(url)
-    scheme = parsed.scheme or "https"
-    host = parsed.hostname
-    port = parsed.port or (443 if scheme == "https" else 80)
-    path = parsed.path or "/"
+    if parsed.scheme.lower() != "https":
+        raise InsecureURLError(f"only https:// URLs are allowed, got {parsed.scheme or '(none)'}://")
+    if parsed.username is not None or parsed.password is not None:
+        raise InsecureURLError("credentials in URL are not allowed")
+    if not parsed.hostname:
+        raise InsecureURLError("URL has no host")
+    try:
+        port = parsed.port or 443
+    except ValueError:
+        raise InsecureURLError("URL has an invalid port") from None
+    target = parsed.path or "/"
     if parsed.query:
-        path += "?" + parsed.query
+        target += "?" + parsed.query
+    return parsed.hostname, port, target
 
-    if scheme == "https":
-        ctx = ssl.create_default_context()
-        conn = http.client.HTTPSConnection(host, port, timeout=timeout, context=ctx)
-    else:
-        conn = http.client.HTTPConnection(host, port, timeout=timeout)
 
+def https_request(method, url, headers=None, body=None, timeout=120):
+    """Make a verified HTTPS request and return (status, headers, body_str).
+
+    Refuses anything but ``https://`` with InsecureURLError, verifies the
+    certificate and host name against the system trust store (TLS 1.2 or
+    later), and follows at most MAX_REDIRECTS redirects that stay on the same
+    host and port: a redirect to plain HTTP, another scheme or another host is
+    refused rather than handing the API key and query to a recipient the
+    caller did not name.
+    """
     hdrs = {"User-Agent": "osint-skill/3.2-python"}
     if headers:
         hdrs.update(headers)
-
-    conn.request(method, path, body=body, headers=hdrs)
-    resp = conn.getresponse()
-    data = resp.read().decode("utf-8", errors="replace")
-    status = resp.status
-    resp_headers = dict(resp.getheaders())
-    conn.close()
-    return status, resp_headers, data
+    context = ssl.create_default_context()
+    context.minimum_version = ssl.TLSVersion.TLSv1_2
+
+    host, port, target = _check_https_url(url)
+    for _ in range(MAX_REDIRECTS + 1):
+        conn = http.client.HTTPSConnection(host, port, timeout=timeout, context=context)
+        try:
+            conn.request(method, target, body=body, headers=hdrs)
+            resp = conn.getresponse()
+            data = resp.read().decode("utf-8", errors="replace")
+        finally:
+            conn.close()
+
+        location = resp.getheader("Location")
+        if resp.status not in _REDIRECT_STATUSES or not location:
+            return resp.status, dict(resp.getheaders()), data
+        url = urljoin(url, location)
+        next_host, next_port, target = _check_https_url(url)
+        if (next_host.lower(), next_port) != (host.lower(), port):
+            raise InsecureURLError(f"redirect leaves {host}:{port} for {next_host}:{next_port}")
+        # As browsers do: 301, 302 and 303 continue a POST as a bodiless GET;
+        # 307 and 308 repeat the request unchanged.
+        if resp.status in (301, 302, 303) and method not in ("GET", "HEAD"):
+            method, body = "GET", None
+            hdrs = {k: v for k, v in hdrs.items() if k.lower() != "content-type"}
+    raise InsecureURLError(f"too many redirects (max {MAX_REDIRECTS})")
 
 
 def api_post(url, payload, headers=None, timeout=120):

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-plus",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "Project-local AI development workflows with clear roles, shared context, safe updates and coding-tool adapters",
   "homepage": "https://bmad-plus.rochetta.fr",
   "keywords": [
@@ -30,6 +30,7 @@
     "tools/build/adapters.config.js",
     "tools/build/generate-adapters.js",
     "tools/build/generate.js",
+    "tools/build/intake-contract.js",
     "tools/build/module.template.yaml",
     "tools/build/pack-delivery.js",
     "src/bmad-plus",
@@ -49,6 +50,7 @@
     "build": "node tools/build/generate.js --out tools/cli/lib/packs.js --module-out src/bmad-plus/module.yaml",
     "build:check": "node tools/build/generate.js --check",
     "check:counts": "node tools/build/check-counts.js",
+    "check:triggers": "node tools/build/check-triggers.js",
     "check:counts:full": "jest --coverage=false --silent --json --outputFile=coverage/jest-report.json && node tools/build/check-counts.js --jest-report coverage/jest-report.json",
     "uat:spec": "node src/bmad-plus/skills/bmad-plus-uat/templates/uat-spec-present.mjs --dir recettes",
     "uat:gate": "node src/bmad-plus/skills/bmad-plus-uat/templates/uat-release-gate.mjs --dir recettes --cli tools/cli/bmad-plus-cli.js",
@@ -66,6 +68,7 @@
   "dependencies": {
     "@clack/prompts": "^1.4.0",
     "commander": "^14.0.0",
+    "design-skill": "0.2.1",
     "fs-extra": "^11.3.6",
     "js-yaml": "^5.2.2",
     "picocolors": "^1.1.1",

package/readme-international/README.de.md

@@ -4,9 +4,9 @@
   <a href="../README.md">English</a> | <a href="README.fr.md">Français</a> | <a href="README.es.md">Español</a> | 🌐 <b>Deutsch</b>
 </div>
 
-[![Version](https://img.shields.io/badge/version-0.21.0-blue)](https://www.npmjs.com/package/bmad-plus)
+[![Version](https://img.shields.io/badge/version-0.23.0-blue)](https://www.npmjs.com/package/bmad-plus)
 
-**Version 0.21.0** · Node.js `>=20.0.0` · MIT
+**Version 0.23.0** · Node.js `>=20.0.0` · MIT
 
 Projektlokale KI-Entwicklungsworkflows mit klaren Rollen, gemeinsamem Kontext, sicheren Updates und Adaptern für Coding-Tools.
 
@@ -39,7 +39,7 @@ Starte das Installationsprogramm. Wähle die Adapter deiner KI-Werkzeuge und die
 **Im Terminal deines Projekts:**
 
 ```sh
-npx bmad-plus@0.21.0 install
+npx bmad-plus@0.23.0 install
 ```
 
 Die Installation erstellt Agentenanweisungen, die gemeinsame Projektbasis und die gewählten Adapter. Optionale Packs können weitere Laufzeitumgebungen oder API-Zugänge benötigen.
@@ -102,6 +102,7 @@ Lies die Änderungen und Testergebnisse. Der Assistent arbeitet innerhalb der Re
 | Dev Studio | Spezialisierte Rollen und Workflows für Produktplanung, Design, Entwicklung und Dokumentation. |
 | Backup | Anweisungen und Hilfsprogramme für datierte Sicherungen, Wiederherstellung und Rotation. |
 | Animated | Ein gezielter Workflow für Websites mit videobasierten Scrolleffekten. |
+| Design | Atelier, die Design-Engine: Oberflächen nach prüfbaren Regeln bauen, auditieren und überarbeiten, mit einem Briefing zuerst. |
 
 ## Beispiele
 
@@ -175,18 +176,27 @@ Lies AGENTS.md und die verfügbare Projekterinnerung. Fasse den letzten geprüft
 
 Erwartetes Ergebnis: ein kurzer, belegter Wiedereinstieg. Projektnotizen liefern Kontext und müssen mit dem aktuellen Stand abgeglichen werden.
 
-## Neu in 0.21.0
+### Einen Bildschirm mit Atelier gestalten
 
-Reviews, die ehrlich anhalten, fortgesetzt werden und an die CI berichten
+Nutze dies mit dem optionalen Design-Pack. Atelier stellt zuerst seine Fragen und folgt dann prüfbaren Regeln.
 
-Ein Review hält jetzt fest, warum es angehalten hat und was es verbraucht hat, schreibt eine Prüfung, die ein CI-Schritt lesen kann, und wird auf dem versiegelten Umfang fortgesetzt. Der SEO-Abruf verbindet sich nur mit Adressen, die er geprüft hat, und der MCP-Server wechselt zum offiziellen SDK unter Python 3.12. An Installation und Update ändert sich nichts.
+```text
+Atelier, führe die Design-Analyse für die Rechnungsliste meiner App durch, baue den Bildschirm und schließe mit dem Preflight-Urteil ab.
+```
+
+Erwartetes Ergebnis: die festgehaltene Design-Analyse, der Bildschirm mit allen abgedeckten Zuständen und das Preflight-Urteil als letzte Zeile.
+
+## Neu in 0.23.0
+
+Erst fragen, dann schwärmen
+
+Ein Pack erklärt jetzt, welche Fragen beantwortet sein müssen, bevor es handelt, und Nexus kann einen Schwarm von Unteragenten, ein simuliertes Panel oder eine Jury innerhalb eines von dir gesetzten Budgets ausführen. Atelier, die Design-Engine, kommt als zehntes Pack hinzu. Installation und Update bleiben wie bisher.
 
-- coverage.json kann festhalten, wie ein Review verlief: warum es anhielt (abgeschlossen, Budget, Zeitlimit, drei Fehlversuche in Folge, unterbrochen), die ausgeführten Durchgänge und die vom Host gemeldete Nutzung. Ein vorzeitig angehaltenes Review ist immer unvollständig, und eine Einheit wird nach drei Fehlversuchen in Folge aufgegeben.
-- bmad-plus review gate --emit-check mit einem Dateinamen schreibt das Urteil als Prüfdokument für die CI: Ergebnis, Gründe, offene Befunde nach Schwere mit ihren Zeilen und einen Block im Format der GitHub-Check-Runs. Dieselben Belege ergeben immer dieselbe Datei.
-- bmad-plus review continue setzt ein unterbrochenes Review auf demselben versiegelten Umfang fort und listet, was noch aussteht. Es verweigert, wenn sich Code, Regeln oder eine ausgewählte Datei geändert haben, und verweist auf einen neuen Umfang und review compare.
-- Review-Regeln können einer Gruppe angehören (code, data, delivery oder eine eigene), damit parallele Prüfende eine Einheit nach Regelfamilie aufteilen.
-- Für Maintainer bewertet ein Review-Prüfstand aufgezeichnete Review-Antworten gegen eingebaute Fehler und Köder mit einer veröffentlichten Zuordnungsregel, und kopierfertige CI-Vorlagen lassen einen Pull Request von einem Host-Agenten auf einem selbst gehosteten Runner prüfen, ohne etwas zu vertrauen, das der Agent umschreiben kann.
-- SEO-Abruf und Crawler lösen jeden Host selbst auf, lehnen interne Adressen ab und verbinden sich genau mit der geprüften Adresse, auch bei jeder Weiterleitung, was DNS-Rebinding verhindert. Der MCP-Server nutzt das offizielle SDK unter Python 3.12 mit aktuellem chromadb und sentence-transformers; führe ingest.py nach dem Update einmal erneut aus.
+- bmad-plus intake stellt die Fragen eines Packs in kleinen Gruppen, markiert die Pflichtangaben, schlägt Standardwerte vor, hält fest, was du nicht weißt, samt Risiko, und erzeugt das Briefing, das zum Vertrag für alles Weitere wird. Nichts darin wird erfunden.
+- bmad-plus swarm zieht simulierte Einheiten aus einem Profil mit einem Seed, schreibt ein Briefing pro Unteragent, prüft jede Antwortdatei, zählt nur gültige Antworten und sagt klar, dass simulierte Käufer keine Kunden sind. Der Block swarm in _bmad/config.yaml legt fest, wie viele Unteragenten laufen, bevor der Assistent dich fragt; bezahlte Mediengenerierung fragt immer.
+- Die Registry hält jetzt fest, welche Skills ein Agent führt, aus welchem npm-Paket die Skills eines Packs stammen, welche Pipeline-Schritte und Freigaben ein Pack erklärt und welches Briefing es durchführt. Die erzeugten Anweisungen tragen all das, nichts wird zweimal getippt.
+- Design-Pack: Atelier, gebaut aus dem Paket design-skill, befragt dich mit einer Design-Analyse und baut, prüft oder überarbeitet dann eine Oberfläche nach prüfbaren Regeln. Der Installer kopiert seine drei Skills mit ihren Referenzmodulen, und doctor prüft sie.
+- Ein Trigger-Gate lehnt Regeln zur automatischen Aktivierung ab, die einen der Registry unbekannten Agenten oder eine unbekannte Pipeline nennen, und der Installer schreibt nichts, wenn sich die Dateien eines Packs nicht vorher vollständig auflisten lassen.
 
 ## Versionsverlauf
 
@@ -194,9 +204,9 @@ Diese Daten bezeichnen geprüfte CHANGELOG-Einträge, nicht die Veröffentlichun
 
 | Version | Datum der Notizen | Geprüfte Zusammenfassung |
 | --- | --- | --- |
+| 0.23.0 | 2026-10-17 | Ein Pack erklärt jetzt, welche Fragen beantwortet sein müssen, bevor es handelt, und Nexus kann einen Schwarm von Unteragenten, ein simuliertes Panel oder eine Jury innerhalb eines von dir gesetzten Budgets ausführen. Atelier, die Design-Engine, kommt als zehntes Pack hinzu. Installation und Update bleiben wie bisher. |
+| 0.22.0 | 2026-09-29 | BMAD+ erklärt jetzt jede Datenübertragung und jeden Prozess, den es startet, und seine CI lehnt alles Unerklärte ab. Die Abnahmeseite und der SEO-Bericht laden nichts mehr von anderen Websites, OSINT-Aufrufe laufen nur über HTTPS, und Shield erhält einen Sicherheitsnachweis aus ausgeführten Prüfungen und ein Verzeichnis der KI-Verarbeitungen. An Installation und Update ändert sich nichts. |
 | 0.21.0 | 2026-09-28 | Ein Review hält jetzt fest, warum es angehalten hat und was es verbraucht hat, schreibt eine Prüfung, die ein CI-Schritt lesen kann, und wird auf dem versiegelten Umfang fortgesetzt. Der SEO-Abruf verbindet sich nur mit Adressen, die er geprüft hat, und der MCP-Server wechselt zum offiziellen SDK unter Python 3.12. An Installation und Update ändert sich nichts. |
-| 0.20.0 | 2026-09-28 | bmad-plus review gibt der prüfenden Person jetzt die Regeln, die für die geänderten Dateien gelten, legt die Tiefe eines Reviews vor Beginn fest, vergleicht ein Review mit einem früheren, ohne einen ungeprüften Befund für behoben zu erklären, und schwärzt Zugangsdaten in dem, was es schreibt. An Installation und Update ändert sich nichts. |
-| 0.19.0 | 2026-09-27 | bmad-plus review versiegelt, was ein Review abdecken muss, findet jeden Befund über den Code, den er zitiert, und leitet das Urteil aus der Abdeckung ab statt aus der Zahl der Befunde. Die Review-Sichtung behält einen Befund jetzt, solange kein zitierter Grund ihn widerlegt. An Installation und Update ändert sich nichts. |
 
 [Versionsverlauf und Update-Anleitung](https://bmad-plus.rochetta.fr/de/docs/#changelog) · [Alle veröffentlichten Versionen auf npm](https://www.npmjs.com/package/bmad-plus?activeTab=versions)
 

package/readme-international/README.es.md

@@ -4,9 +4,9 @@
   <a href="../README.md">English</a> | <a href="README.fr.md">Français</a> | 🌐 <b>Español</b> | <a href="README.de.md">Deutsch</a>
 </div>
 
-[![Version](https://img.shields.io/badge/version-0.21.0-blue)](https://www.npmjs.com/package/bmad-plus)
+[![Version](https://img.shields.io/badge/version-0.23.0-blue)](https://www.npmjs.com/package/bmad-plus)
 
-**Versión 0.21.0** · Node.js `>=20.0.0` · MIT
+**Versión 0.23.0** · Node.js `>=20.0.0` · MIT
 
 Flujos de desarrollo con IA propios de cada proyecto, con roles claros, contexto compartido, actualizaciones seguras y adaptadores para herramientas de programación.
 
@@ -39,7 +39,7 @@ Ejecuta el instalador. Selecciona los adaptadores de tus herramientas de IA y lo
 **En la terminal del proyecto:**
 
 ```sh
-npx bmad-plus@0.21.0 install
+npx bmad-plus@0.23.0 install
 ```
 
 El instalador crea las instrucciones de los agentes, la base compartida y los adaptadores seleccionados. Algunos packs opcionales necesitan otros entornos o acceso a API.
@@ -102,6 +102,7 @@ Lee los cambios y los resultados de las pruebas. El asistente sigue los permisos
 | Dev Studio | Roles y flujos especializados en producto, diseño, ingeniería y documentación. |
 | Backup | Instrucciones y utilidades para copias con fecha, restauración y rotación. |
 | Animated | Un flujo centrado en crear sitios cuyo desplazamiento utiliza vídeo. |
+| Design | Atelier, el motor de diseño: construir, auditar y rediseñar interfaces con reglas verificables, empezando por una entrevista. |
 
 ## Ejemplos
 
@@ -175,18 +176,27 @@ Lee AGENTS.md y la memoria de proyecto disponible. Resume el último estado veri
 
 Resultado esperado: una reanudación breve y fundamentada. Las notas aportan contexto que debe contrastarse con el trabajo actual.
 
-## Novedades de la 0.21.0
+### Diseñar una pantalla con Atelier
 
-Revisiones que se detienen con honestidad, se reanudan e informan a la CI
+Úsalo con el paquete opcional Design instalado. Atelier hace primero sus preguntas y luego sigue reglas comprobables.
 
-Una revisión registra ahora por qué se detuvo y qué consumió, escribe un control que un paso de CI puede leer y se reanuda sobre el alcance que selló. El descargador SEO solo se conecta a direcciones que ha validado, y el servidor MCP pasa al SDK oficial con Python 3.12. Nada cambia en la instalación ni en la actualización.
+```text
+Atelier, haz la lectura de diseño de la lista de facturas de mi aplicación, construye la pantalla y termina con el veredicto de la comprobación previa.
+```
+
+Resultado esperado: la lectura de diseño registrada, la pantalla con todos sus estados cubiertos y el veredicto de la comprobación previa citado como última línea.
+
+## Novedades de la 0.23.0
+
+Preguntar primero, luego el enjambre
+
+Un paquete declara ahora las preguntas que necesita respondidas antes de actuar, y Nexus puede lanzar un enjambre de subagentes, un panel simulado o un jurado, dentro de un presupuesto que tú fijas. Atelier, el motor de diseño, se incorpora como décimo paquete. Instalar y actualizar funcionan como antes.
 
-- coverage.json puede registrar cómo transcurrió una revisión: por qué se detuvo (completada, presupuesto, límite de tiempo, tres intentos fallidos seguidos, interrumpida), las pasadas realizadas y el uso que informó el host. Una revisión detenida antes de tiempo siempre está incompleta, y una unidad se abandona tras tres intentos fallidos consecutivos.
-- bmad-plus review gate --emit-check seguido de un nombre de archivo escribe el veredicto como un documento de control para la CI: disposición, motivos, hallazgos abiertos por gravedad con sus líneas y un bloque con el formato de los check runs de GitHub. Las mismas pruebas dan siempre el mismo archivo.
-- bmad-plus review continue reanuda una revisión interrumpida sobre el mismo alcance sellado y enumera lo que queda pendiente. Se niega cuando cambiaron el código, las reglas o un archivo seleccionado, y remite a un nuevo alcance y a review compare.
-- Las reglas de revisión pueden pertenecer a un grupo (code, data, delivery o uno propio), para que revisores en paralelo se repartan una unidad por familia de reglas.
-- Para mantenedores, un banco de pruebas puntúa respuestas de revisión grabadas frente a defectos sembrados y señuelos con una regla de correspondencia publicada, y recetas de CI listas para copiar hacen pasar una pull request por un agente en un runner autoalojado sin fiarse de nada que el agente pueda reescribir.
-- El descargador y el rastreador SEO resuelven cada host por sí mismos, rechazan direcciones internas y se conectan exactamente a la dirección validada, también en cada redirección, lo que neutraliza el DNS rebinding. El servidor MCP usa el SDK oficial con Python 3.12 y chromadb y sentence-transformers actuales; vuelve a ejecutar ingest.py una vez tras actualizar.
+- bmad-plus intake hace las preguntas de un paquete de pocas en pocas, marca las imprescindibles, propone valores por defecto, anota lo que no sabes con su riesgo y redacta el brief que se convierte en el contrato de todo lo que el paquete hace después. Nada en él se inventa.
+- bmad-plus swarm reparte unidades simuladas a partir de un perfil con una semilla, escribe un brief por subagente, valida cada archivo de respuesta, cuenta solo las respuestas válidas y deja claro que los compradores simulados no son clientes. El bloque swarm de _bmad/config.yaml fija cuántos subagentes se lanzan antes de que el asistente te pregunte; la generación de medios de pago siempre pregunta.
+- El registro anota ahora qué habilidades conduce un agente, de qué paquete npm proceden las habilidades de un paquete, qué pasos de pipeline y qué puertas declara y qué cuestionario ejecuta. Las instrucciones generadas lo recogen todo, así que nada se escribe dos veces.
+- Paquete Design: Atelier, construido a partir del paquete design-skill, te entrevista con una lectura de diseño y luego construye, audita o rediseña una interfaz con reglas comprobables. El instalador copia sus tres habilidades con sus módulos de referencia, y doctor las comprueba.
+- Una puerta de disparadores rechaza las reglas de activación automática que nombran un agente o un pipeline que el registro no conoce, y el instalador no escribe nada cuando los archivos de un paquete no pueden listarse todos primero.
 
 ## Historial de versiones
 
@@ -194,9 +204,9 @@ Estas fechas identifican las notas revisadas del CHANGELOG, no las fechas de pub
 
 | Versión | Fecha de las notas | Resumen revisado |
 | --- | --- | --- |
+| 0.23.0 | 2026-10-17 | Un paquete declara ahora las preguntas que necesita respondidas antes de actuar, y Nexus puede lanzar un enjambre de subagentes, un panel simulado o un jurado, dentro de un presupuesto que tú fijas. Atelier, el motor de diseño, se incorpora como décimo paquete. Instalar y actualizar funcionan como antes. |
+| 0.22.0 | 2026-09-29 | BMAD+ declara ahora cada envío de datos y cada proceso que inicia, y su CI rechaza todo lo que no esté declarado. La página de aceptación y el informe SEO ya no cargan nada de otros sitios, las llamadas OSINT van solo por HTTPS, y Shield incorpora un caso de seguridad basado en pruebas ejecutadas y un registro de tratamientos de IA. Nada cambia en la instalación ni en la actualización. |
 | 0.21.0 | 2026-09-28 | Una revisión registra ahora por qué se detuvo y qué consumió, escribe un control que un paso de CI puede leer y se reanuda sobre el alcance que selló. El descargador SEO solo se conecta a direcciones que ha validado, y el servidor MCP pasa al SDK oficial con Python 3.12. Nada cambia en la instalación ni en la actualización. |
-| 0.20.0 | 2026-09-28 | bmad-plus review ahora entrega a quien revisa las reglas que se aplican a los archivos modificados, fija la profundidad de una revisión antes de empezar, compara una revisión con otra anterior sin dar por corregido un hallazgo no comprobado y oculta las credenciales en lo que escribe. Nada cambia en la instalación ni en la actualización. |
-| 0.19.0 | 2026-09-27 | bmad-plus review sella lo que una revisión debe cubrir, localiza cada hallazgo por el código que cita y deduce el veredicto de la cobertura en lugar del número de hallazgos. La clasificación de las revisiones conserva ahora un hallazgo mientras ningún motivo citado lo refute. Nada cambia en la instalación ni en la actualización. |
 
 [Historial de versiones y guía de actualización](https://bmad-plus.rochetta.fr/es/docs/#changelog) · [Todas las versiones publicadas en npm](https://www.npmjs.com/package/bmad-plus?activeTab=versions)