bmad-plus 0.9.2 → 0.12.0

package/CHANGELOG.md

@@ -5,6 +5,45 @@ All notable changes to BMAD+ will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.12.0] — 2026-07-02
+
+### Added — Load-bearing activation (north-star Pillars 3, 4, 5)
+- **Pillar 4 executable:** `evals/_runner/providers.py` — a provider-neutral model gateway (anthropic / openai / generic-HTTP adapters selected by `BMAD_EVAL_PROVIDER`, default deterministic **mock** so `--self-check` and CI never hit the network). `run_agent(spec, model)` now routes through it; the eval harness genuinely runs (3/3 specs pass).
+- **Pillar 3 portable via MCP:** `mcp-server/tools/memory_tools.py` exposes `memory.recall` / `memory.write` / `memory.reinforce` as MCP tools that shell out to the same `bmad mem --json` CLI (single source of truth) — MCP-capable CLIs and the CLI can never diverge. Registered additively in `server.py`.
+- **Pillar 5 adopt mode:** `tools/build/generate-adapters.js --adopt` can generate the REAL repo-root adapters + AGENTS.md spine from the registry; hand-authored instructions live in `tools/build/adapters.config.js` and are injected so no tool loses content. `.gitattributes` pins LF on the adopted files (avoids the CRLF drift class). Root adoption is opt-in and NOT applied in this release.
+
+### Fixed
+- Adapter `--check` is now EOL-insensitive; `.gitattributes` pins LF on `tools/build/**` + registry so a Windows clone doesn't false-positive drift. Verified from a **fresh clone**: `npm ci` + `npm test` (333/333) + both drift-checks green.
+
+### Verified
+- `npm test` **333 passed / 16 suites**; `build:check` + `generate-adapters --check` no drift; `run.py --self-check` 3/3; edited Python parses.
+
+## [0.11.0] — 2026-07-02
+
+### Added — Karpathy loop CLI + multi-CLI adapters (north-star Pillars 3 & 5)
+- **`bmad mem` command (Pillar 3):** `recall <query>` / `write` / `reinforce` expose the memory-journal (append/recall + Elo reward + governance guard) from the CLI, so the learning loop is usable from any driving tool. `tests/unit/memory-journal-cmd.test.js`.
+- **Multi-CLI adapter generator (Pillar 5):** `tools/build/generate-adapters.js` generates the per-CLI wrappers (CLAUDE.md, GEMINI.md, `.codex/AGENTS.md`, `.cursor/rules`, `.opencode/AGENTS.md`, CONVENTIONS.md) from `registry.yaml` — counts/names computed, never typed — with a `--check` drift gate. Generated previews live under `tools/build/generated-adapters/`. `tests/unit/generate-adapters.test.js`.
+
+### Changed — Compliance (govern, don't cut)
+- **CG-02 — OSINT pack governed:** added a mandatory **Phase −1 Lawful Basis Gate** to the OSINT skill (lawful basis Art. 6, Art. 9 condition for psychoprofiles, purpose, retention, DSAR) + a lawful-basis/ROPA record template + a GDPR-OSINT reference + a governance block in the dossier template. The capability is kept in full; lawful use is now explicit and auditable. See `audit/2026-07-01/CG-RESOLUTION.md`.
+- **CG-01 — trademark:** `bmad-plus` name kept by owner decision.
+
+### Verified
+- `npm test` **325 passed / 16 suites**; `npm run build:check` no drift; `generate-adapters.js --check` no drift.
+
+## [0.10.0] — 2026-07-02
+
+### Added — Platform-spine foundations (north-star Phase 2)
+Built as **new files only** (no existing core file modified); test suite grew from 176/10 to **258 passed / 13 suites**. Cut nothing; multi-tool/multi-model preserved.
+
+- **Registry-as-SSOT (Pillar 1) — ACTIVE:** `registry.yaml` (repo root) is now the single source of truth for all 9 packs. `tools/cli/lib/packs.js` is **generated from it** (`npm run build`), no longer hand-maintained. `tools/build/generate.js` provides the generator + `npm run build:check` drift gate; `tests/unit/generate.test.js` (14 tests) proves the generated `PACKS`/`PACK_ORDER`/`EXPECTED_AGENTS` strictly equal the shipped module. This kills the 5-place pack-registry drift at its root.
+- **Python provisioning (Pillar 2):** `tools/cli/lib/python-provision.js` — detect python≥3.11, pick uv/pipx/venv, create isolated env, install requirements, verify entry (shell-safe, testable).
+- **Karpathy learning layer (Pillar 3):** `tools/cli/lib/memory-journal.js` — `journal.ndjson` append/recall, Elo/decayed reward update (eval+acceptance+ci), governance guard (promotions PROPOSED, never auto-applied).
+- **Eval harness (Pillar 4 — the moat):** `evals/` schema + Forge/Shield/Sentinel golden specs + fixtures + `run.py --self-check`, provider-neutral model backend seam.
+- **CI:** `.github/workflows/platform.yml` — registry drift-check + eval self-check, blocking, SHA-pinned.
+
+Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remaining integration (provisioning called from install, memory exposed via MCP, generated multi-CLI adapters) lands next as its own tested commit — see `audit/2026-07-01/PHASE-2-STATUS.md`.
+
 ## [0.9.2] — 2026-07-01
 
 ### Security — Phase 1 remediation (exploitable findings)

package/README.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Augmented Multi-Agent AI Framework
 
-[![Version](https://img.shields.io/badge/version-0.9.2-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.12.0-blue.svg)](CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](LICENSE)
 

package/osint-agent-package/skills/bmad-osint-investigate/osint/SKILL.md

@@ -17,6 +17,36 @@ description: >
 Systematic intelligence gathering on individuals. From a name or handle to a scored
 dossier with psychoprofile, career map, and entry points.
 
+## Phase −1 — Lawful Basis Gate (MANDATORY, runs before anything else)
+
+> Profiling a **named natural person** — especially building a psychoprofile — is
+> processing of personal data (and, for inferred personality/health/political traits,
+> **special-category data**) under the GDPR and analogous laws. This gate is not
+> optional. Governed by the Shield (GRC) pack. **Do NOT start Phase 0** on a named
+> person until it passes.
+
+Before any investigation of a named/identifiable person, establish and record:
+
+1. **Lawful basis (GDPR Art. 6)** — which applies? (consent, contract, legal
+   obligation, vital interests, public task, or **legitimate interest** with a
+   documented balancing test). For psychoprofiling / special-category inferences,
+   also an **Art. 9** condition (explicit consent, or another Art. 9(2) exemption).
+2. **Purpose** — the specific, explicit, legitimate purpose (purpose limitation).
+   Reject open-ended "find everything" with no purpose.
+3. **Data-subject rights & retention** — who is the controller, retention period,
+   and how a DSAR / erasure request will be honored.
+
+**Record it** using `assets/lawful-basis-record.md` and put the completed header at
+the top of the dossier (see `assets/dossier-template.md` governance block).
+
+**If the operator cannot state a lawful basis and purpose → DECLINE** the named-person
+profiling. Offer the non-personal alternatives instead (company/product/market
+research, or investigation of a public entity), which do not require this gate.
+
+This gate does not restrict lawful, authorized use (due diligence with a basis,
+security research, investigations you are mandated to run) — it makes that basis
+explicit and auditable. See `references/gdpr-osint.md`.
+
 ## Phase Router
 
 Determine entry point from context:

package/osint-agent-package/skills/bmad-osint-investigate/osint/assets/dossier-template.md

@@ -3,6 +3,16 @@
 
 ---
 
+**⚖️ governance / lawful basis** *(Phase −1 gate — required before this dossier exists)*
+- controller: {controller_name}
+- lawful basis (Art. 6): {basis} {legitimate_interest_balancing_ref_if_LI}
+- special-category condition (Art. 9, if psychoprofile): {art9_condition_or_NA}
+- purpose: {specific_purpose}
+- retention: {retention_period} · DSAR/erasure contact: {dsar_contact}
+- recorded: {date} · see `assets/lawful-basis-record.md`
+
+---
+
 **контакты и соцсети**
 - telegram: {handle} {status}
 - linkedin: {url} {status}

package/osint-agent-package/skills/bmad-osint-investigate/osint/assets/lawful-basis-record.md

@@ -0,0 +1,48 @@
+# Lawful Basis Record — OSINT investigation (GDPR Phase −1 gate)
+
+Complete this BEFORE profiling a named natural person. It doubles as the ROPA
+(Record of Processing Activities) entry for this investigation. Governed by Shield (GRC).
+
+## 1. Parties
+- **Controller:** {who decides why/how — org or person}
+- **Operator / analyst:** {who runs the investigation}
+- **Data subject:** {named person} — category: {public figure | employee | counterparty | other}
+
+## 2. Purpose (purpose limitation — GDPR Art. 5(1)(b))
+- **Specific purpose:** {e.g. pre-contract due diligence on a supplier director; NOT "find everything"}
+- **Why OSINT is necessary & proportionate for this purpose:** {justification}
+
+## 3. Lawful basis — GDPR Art. 6(1)
+Select ONE and justify:
+- [ ] (a) Consent — attach/reference the consent record
+- [ ] (b) Contract — necessary for a contract with the data subject
+- [ ] (c) Legal obligation — cite the obligation
+- [ ] (d) Vital interests
+- [ ] (e) Public task
+- [ ] (f) **Legitimate interest** — complete the 3-part balancing test below
+
+**Legitimate Interest Assessment (if (f)):**
+- Purpose test (is there a legitimate interest?): {…}
+- Necessity test (is OSINT necessary, or is there a less intrusive way?): {…}
+- Balancing test (do the person's rights/freedoms override?): {…}
+
+## 4. Special-category data — GDPR Art. 9 (REQUIRED if building a psychoprofile)
+Inferring personality (MBTI/Big Five), health, political opinions, religion, sexual
+orientation, etc. is special-category processing. Select an Art. 9(2) condition:
+- [ ] (a) Explicit consent
+- [ ] (e) Data manifestly made public by the data subject (document how)
+- [ ] (f) Legal claims
+- [ ] other: {cite}
+- **If none applies → do NOT build the psychoprofile.** Keep the factual dossier only.
+
+## 5. Data-subject rights & retention
+- **Retention period:** {e.g. 90 days after purpose fulfilled, then delete}
+- **DSAR / erasure contact:** {email/process to honor access, rectification, erasure, objection}
+- **Transparency:** how/whether the data subject is or will be informed (Art. 14), or the exemption relied on.
+
+## 6. Sign-off
+- Basis confirmed by: {name} · date: {date}
+- Shield review (if enterprise/high-risk): {ref or N/A}
+
+> If sections 2–4 cannot be completed, the Phase −1 gate FAILS: decline the
+> named-person profiling and use the non-personal research paths instead.

package/osint-agent-package/skills/bmad-osint-investigate/osint/references/gdpr-osint.md

@@ -0,0 +1,48 @@
+# GDPR & OSINT — governance for the investigate skill
+
+This pack performs OSINT on named individuals, including psychoprofiling. That is
+personal-data processing (GDPR + analogous laws such as UK GDPR, LGPD, CCPA/CPRA).
+BMAD+ **keeps** this capability and **governs** it — the Phase −1 lawful-basis gate
+in `SKILL.md` makes lawful use explicit and auditable rather than removing the pack.
+(Decision: keep + govern, 2026-07-02.)
+
+## Why this matters
+- Profiling and evaluating personal aspects is regulated (GDPR Art. 4(4), Art. 22, Recital 71).
+- Inferring personality, health, political/religious views, or sexual orientation is
+  **special-category** processing (Art. 9) — a higher bar than ordinary personal data.
+- "Publicly available" ≠ "no rules apply." Scraping public profiles is still processing;
+  you still need a lawful basis and must respect purpose limitation and data-subject rights.
+
+## The gate, in one line
+No lawful basis + specific purpose recorded (`assets/lawful-basis-record.md`) → no
+named-person profiling. Non-personal research (company/product/market, public entities)
+is unaffected.
+
+## Legitimate interest (the common basis)
+When relying on Art. 6(1)(f), complete the 3-part LIA in the record:
+1. **Purpose** — a real, specific legitimate interest (due diligence, fraud/security, journalism).
+2. **Necessity** — OSINT is necessary and proportionate; no less-intrusive route.
+3. **Balancing** — the person's rights/freedoms do not override; consider their reasonable
+   expectations, the sensitivity of the data, and any special-category inference (which
+   usually tips the balance and requires an Art. 9 condition instead).
+
+## Special-category / psychoprofile
+Only build the psychoprofile (MBTI/Big Five, etc.) with a valid **Art. 9(2)** condition
+(typically explicit consent, or data manifestly made public by the subject). Otherwise
+keep the factual dossier and skip the personality inference.
+
+## Data-subject rights & retention
+- Define a **retention period**; delete when the purpose is met.
+- Provide a **DSAR/erasure** path (access, rectification, erasure, objection).
+- Consider **transparency** (Art. 14) or a documented exemption.
+
+## Prohibited / out of scope
+- No profiling without a recorded basis + purpose.
+- No use for unlawful discrimination, harassment, stalking, or unauthorized surveillance.
+- No special-category inference without an Art. 9 condition.
+
+## Related BMAD+ assets
+- `SKILL.md` → Phase −1 gate.
+- `assets/lawful-basis-record.md` → gate record + ROPA entry.
+- Shield (GRC) pack → `gdpr-agent`, `legitimate-interest`, `dpia-sentinel`, `privacy-notice-gen`
+  for DPIA, LIA, ROPA, and privacy-notice generation at scale.

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-plus",
-  "version": "0.9.2",
+  "version": "0.12.0",
   "description": "BMAD+ — Augmented AI-Driven Development Framework with multi-role agents, autopilot, and parallel execution",
   "keywords": [
     "bmad",
@@ -34,6 +34,8 @@
     "install:bmad": "node tools/cli/bmad-plus-cli.js install",
     "update:bmad": "node tools/cli/bmad-plus-cli.js update",
     "doctor:bmad": "node tools/cli/bmad-plus-cli.js doctor",
+    "build": "node tools/build/generate.js --out tools/cli/lib/packs.js",
+    "build:check": "node tools/build/generate.js --check",
     "lint": "eslint tools/ tests/",
     "format": "prettier --write \"tools/**/*.js\" \"tests/**/*.js\"",
     "format:check": "prettier --check \"tools/**/*.js\" \"tests/**/*.js\"",

package/tools/build/README.md

@@ -0,0 +1,78 @@
+# BMAD+ Build — Registry Generator (Pillar 1)
+
+`registry.yaml` at the repo root is the **single source of truth** for the
+9 packs, their agents, skills, data files, install layout, runtimes, and
+compliance tags. Until now this data was hand-replicated in 5 places
+(`tools/cli/lib/packs.js`, `src/bmad-plus/module.yaml`, `install.js`,
+`ide-config.js`, `i18n.js`) — and they drifted.
+
+`tools/build/generate.js` reads `registry.yaml` and generates the pack data
+consumed by the CLI. The migration proof (`tests/unit/generate.test.js`)
+asserts the generated `PACKS` / `PACK_ORDER` / `EXPECTED_AGENTS` are
+**deep-strict-equal** to the hand-written `tools/cli/lib/packs.js`, so the
+registry provably captures current reality before anything is replaced.
+
+## Usage
+
+```bash
+# Print the generated packs module source (drop-in packs.js replacement)
+node tools/build/generate.js
+
+# Print PACKS / PACK_ORDER / EXPECTED_AGENTS as JSON
+node tools/build/generate.js --json
+
+# Write the generated module to a file
+node tools/build/generate.js --out tools/cli/lib/packs.generated.js
+
+# CI drift gate: exit 1 if registry.yaml no longer reproduces packs.js
+# (also asserts product.version == package.json version)
+node tools/build/generate.js --check
+```
+
+## Registry contract (fields the generator consumes)
+
+Per pack under `packs:` in `registry.yaml`:
+
+| Field | Maps to | Notes |
+| --- | --- | --- |
+| `order` | `PACK_ORDER` position | integer, unique |
+| `cli.name` / `cli.icon` / `cli.desc` | `PACKS[id].name/icon/desc` | exact CLI strings (icon = glyph letter) |
+| `agents` | `PACKS[id].agents` | agent ids the installer copies |
+| `skills` | `PACKS[id].skills` | defaults to `[]` |
+| `data` | `PACKS[id].data` | **key presence is significant** — only core & maker declare it |
+| `external_package` | `PACKS[id].externalPackage` | osint only |
+| `pack_dir` / `pack_src_dir` | `PACKS[id].packDir/packSrcDir` | `pack_src_dir` defaults to `packs` |
+| `required` | `PACKS[id].required` | emitted **only when `true`** (packs.js omits it otherwise) |
+| `install_layout` | `EXPECTED_AGENTS[id]` | `loose` → agents as directories, `packDir: null`; `packaged` → `packDir` + `doctor.pack_agents` |
+| `doctor.pack_agents` | `EXPECTED_AGENTS[id].packAgents` | agent **filenames** inside `pack_dir` (packaged only) |
+
+Everything else in `registry.yaml` (`display_name`, `icon_emoji`, `summary`,
+`runtime`, `categories`, `workflows`, `governance`, `compliance_tags`,
+`targets`, `runtimes`, `memory`, `eval`) is north-star metadata consumed by
+future generators (module.yaml, README count tables, per-CLI adapters,
+role-triggers) — declared once here so counts are derived, never typed.
+
+## Editing workflow
+
+1. Edit `registry.yaml` (never the generated data).
+2. Run `node tools/build/generate.js --check`.
+3. While `packs.js` is still hand-written (migration phase), sync it via
+   `node tools/build/generate.js --out tools/cli/lib/packs.js` or apply the
+   equivalent hand edit — `--check` and `tests/unit/generate.test.js`
+   (`npx jest tests/unit/generate.test.js`) both fail on any divergence.
+
+## Migration end-state (for the orchestrator)
+
+Once integration is approved, `tools/cli/lib/packs.js` becomes either:
+
+- a checked-in generated file (`generate.js --out tools/cli/lib/packs.js`,
+  with `--check` as a CI/pre-commit gate), or
+- a thin runtime re-export:
+
+  ```js
+  const { loadRegistry, buildAll } = require('../../build/generate');
+  module.exports = buildAll(loadRegistry());
+  ```
+
+Both keep the exact `{ PACKS, PACK_ORDER, EXPECTED_AGENTS }` shape every CLI
+command already imports, so no call site changes.

package/tools/build/adapters.config.js

@@ -0,0 +1,117 @@
+/**
+ * BMAD+ Build — hand-authored project instructions (Pillar 5 adoption).
+ *
+ * When the root adapters (CLAUDE.md / GEMINI.md / AGENTS.md / .cursor / .codex /
+ * .opencode / CONVENTIONS.md) were adopted as GENERATED files, every substantive
+ * hand-written instruction they contained was folded into THIS file — the UNION
+ * of all three pre-adoption root files, nothing dropped:
+ *
+ *   - Agents roster (personas + Hebrew names + pack qualifiers) — from all three
+ *   - Skills paths (installed `.agents/` layout AND repo `src/bmad-plus/` layout)
+ *   - Project Structure                                      — from GEMINI/AGENTS
+ *   - Communication (user name + language policy)            — from CLAUDE
+ *   - Commit Rules (no AI co-author)                          — from GEMINI
+ *   - Repository Maintenance Rule (README i18n sync)          — from GEMINI/AGENTS
+ *   - Memory Protocol (Karpathy Guardrails G1–G4 + files)     — from CLAUDE
+ *
+ * These sections are injected VERBATIM into the generated spine (AGENTS.md) and
+ * into every generated adapter, so every tool keeps the full instructions even
+ * when it only auto-loads its own file.
+ *
+ * EDIT THIS FILE (never the generated root files), then regenerate:
+ *   node tools/build/generate-adapters.js --adopt
+ *
+ * Numbers policy: NO counts are hand-typed here (they drift — see audit DOC-06).
+ * All counts live in the generated "Registry facts" section, derived from
+ * registry.yaml. That is why the Shield line below carries no agent count.
+ *
+ * Author: Laurent Rochetta
+ */
+
+'use strict';
+
+/**
+ * Markdown lines (LF-joined by the generator). Headings are `##` level so the
+ * block nests directly under each generated file's H1.
+ */
+const PROJECT_INSTRUCTIONS = [
+  '## Agents',
+  '',
+  'To activate an agent, say its name or persona:',
+  '',
+  '- **Atlas** (Strategist) — Business analysis + Product management',
+  '- **Forge** (Architect-Dev) — Architecture + Development + Documentation',
+  '- **Sentinel** (Quality) — QA + UX review',
+  '- **Nexus** (Orchestrator) — Sprint management + Autopilot + Parallel execution',
+  '- **Shadow** (OSINT) — Investigation + Scraping + Psychoprofiling (if OSINT pack installed)',
+  '- **Maker** (Agent Creator) — Design, build, validate, and package new BMAD+ agents',
+  '- **Shield** (GRC) — Compliance agents for GDPR, ISO 27001, SOC 2, HIPAA, EU AI Act, DORA, NIS2 and more (derived counts: see Registry facts below)',
+  '- **Miriam** (מרים) — Business Analyst — Strategic analysis, research, product briefs (Dev Studio)',
+  '- **Huldah** (חולדה) — Technical Writer — Documentation, diagrams, editorial review (Dev Studio)',
+  '- **Yosef** (יוסף) — Product Manager — PRD, requirements, feature prioritization (Dev Studio)',
+  '- **Rachel** (רחל) — UX Designer — User experience, wireframes, empathy mapping (Dev Studio)',
+  '- **Bezalel** (בצלאל) — System Architect — Architecture, ADRs, epics & stories (Dev Studio)',
+  '- **Oholiab** (אהליאב) — Senior Engineer — TDD, sprint, code review, implementation (Dev Studio)',
+  '- **Zecher** (זכר, Memory Guardian) — Memory Archivist — Persistent cross-session memory, consolidation, project scanning, context recall, session handoffs',
+  '',
+  '## Skills',
+  '',
+  '- Installed projects load skills from `.agents/skills/`; in this repository the sources live in `src/bmad-plus/skills/` and `src/bmad-plus/agents/`.',
+  '- Each agent has a SKILL.md with capabilities, activation protocol, and role-switching rules.',
+  '- Auto-activation triggers: `.agents/data/role-triggers.yaml` (source: `src/bmad-plus/data/role-triggers.yaml`).',
+  '',
+  '## Project Structure',
+  '',
+  '- `src/bmad-plus/` — Custom module (agents, skills, data)',
+  '- `monitor/` — Upstream monitoring system (VPS)',
+  '- `mcp-server/` — Audit 360° MCP Server',
+  '- `osint-agent-package/` — OSINT package',
+  '- `upstream/` — BMAD-METHOD reference clone',
+  '',
+  '## Communication',
+  '',
+  '- User name: laurent',
+  '- Default language: Français for user-facing content, English for code and technical docs.',
+  '',
+  '## Commit Rules',
+  '',
+  '- NEVER add "Co-Authored-By: Claude" or any AI co-author attribution.',
+  '- The sole author is Laurent Rochetta.',
+  '',
+  '## Repository Maintenance Rule',
+  '',
+  'When updating the main README.md (English), you MUST synchronously update all translations in the readme-international/ directory (fr, es, de).',
+  '',
+  '## Memory Protocol (Karpathy Guardrails)',
+  '',
+  'Agents MUST follow these behavioral principles:',
+  '',
+  '### G1 — Think Before Coding',
+  '',
+  '- State assumptions explicitly. If uncertain, ask.',
+  '- Check `.agents/memory/decisions.md` for prior decisions before re-deciding.',
+  '',
+  '### G2 — Simplicity First',
+  '',
+  '- Minimum code that solves the problem. Nothing speculative.',
+  '- Check `.agents/memory/patterns.md` for existing solutions.',
+  '',
+  '### G3 — Surgical Changes',
+  '',
+  '- Touch only what you must. Match existing style.',
+  '- Log surprises in `.agents/memory/lessons.md`.',
+  '',
+  '### G4 — Goal-Driven Execution',
+  '',
+  '- Define success criteria before implementing.',
+  '- Log non-obvious decisions in `.agents/memory/decisions.md`.',
+  '',
+  '### Memory Files',
+  '',
+  '- `.agents/memory/decisions.md` — Read at session start, write when making decisions',
+  '- `.agents/memory/lessons.md` — Write when something unexpected happens',
+  '- `.agents/memory/patterns.md` — Write when a reusable pattern is validated',
+  '- `.agents/memory/context.md` — Update at session end with project state',
+];
+
+module.exports = { PROJECT_INSTRUCTIONS };