bmad-plus 0.9.2 → 0.12.1

package/CHANGELOG.md

@@ -5,6 +5,71 @@ All notable changes to BMAD+ will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.12.1] - 2026-07-12
+
+### Added
+- **Portfolio brain detection** (`memory-init.js`): brain resolution now honors, in order, the `BMAD_PLUS_BRAIN` env var → a `_brain/` directory in the project dir **or any ancestor** (portfolio brain shared by sibling projects under a workspace root) → `~/.bmad-plus/brain` → `~/.claude/memory`. Previously `~/.bmad-plus/brain` always won once it existed, silently splitting memory away from an existing workspace-level brain. `.brain-link` now records a `brain_type` (`portfolio` / `bmad-global` / `claude-memory`). `resolveBrain()` is exported with 4 new unit tests; `pack-memory/shared/memory-protocol.md` documents the portfolio-brain rule.
+
+### Fixed
+- **Brain detection state machine (`memory-init.js`) — five defects (audit MEM-01..05 + JS-08):** the `projects/` index was written into `~/.bmad-plus/brain` unconditionally while identity/global-memory creation was skipped whenever any brain was detected, leaving a permanent identity-less "half brain" (now: idempotent `ensureGlobalBrain()` self-heals on every touch); `.brain-link` is now written on creation too (was: detection branch only — non-idempotent re-runs); brain candidates must be directories and `~/.claude/memory` must be non-empty (was: a stray *file* named `_brain` could be linked as a brain); project indexing now only targets the global brain when it is the linked brain (portfolio installs no longer write orphan entries); path hashing unified in `tools/cli/lib/path-hash.js` shared with `scan.js` (drive-letter casing no longer double-indexes projects); `initMemory` takes an injectable `homeDir` and the test suite runs against a temp home (was: every `npm test` polluted the real user brain — 454 junk entries live-confirmed); the install-time call is try/catch-wrapped so a read-only home warns instead of aborting pre-manifest. 15 unit tests. See `audit/2026-07-10/14-addendum-memory-init.md`.
+- **GitHub Actions red on master since v0.10.0:** `package-lock.json` was missing `@emnapi/core`/`@emnapi/runtime` entries required by npm 10 (Node 20 runners) — an npm 10 vs 11 ideal-tree divergence invisible to local (npm 11) validation, including fresh clones. Lock regenerated with `npm@10`; **CI + Platform now green on master for the first time**. New standing rule: locks are regenerated with `npx npm@10 install --package-lock-only` and validated with both npm 10 and npm 11 `ci --dry-run`.
+- `platform.yml`: the two adapter drift gates (`generate-adapters.js --check` and `--check --adopt`) joined the spine as blocking checks; the eval self-check job now installs its `pyyaml` dependency (it had none on the runner and failed every push).
+- Dependabot: removed the dead `docker` entry for `/monitor` (no Dockerfile there — the update job failed every weekly cycle).
+
+### Security — supply chain
+- `mcp-server/Dockerfile`: base image now **pinned by multi-arch index digest** (`python:3.11.15-slim@sha256:b27df584…`) — closes the PHASE-1 "Dockerfile digest pin" residual and picks up ~18 months of CPython security patches (3.11.9 → 3.11.15).
+- GitHub Actions bumped and SHA-pinned across all workflows: `checkout` v7.0.0, `setup-node` v6.4.0, `setup-python` v6.3.0.
+- Python pins raised: mcp-server `uvicorn` 0.49.0, `gitpython` 3.1.50, `pyyaml` 6.0.3, `requests>=2.34.2`; seo-audit-360 `requests>=2.34.2`, `beautifulsoup4` 4.15.0, `lxml` 6.1.1; Google extensions `google-auth` 2.55.1, `google-auth-oauthlib` 1.4.0, `google-analytics-data` 0.23.0, `google-api-python-client` 2.198.0. Validated in clean venvs (install + import/parse smoke).
+
+### Changed — dependency governance
+- npm: `eslint` 9 → 10 (flat config; `@eslint/js` now a declared devDependency — it was consumed transitively and broke under eslint 10), `js-yaml` 4 → 5.2.1 (CJS export intact, full suite green), `fs-extra` 11.3.6.
+- **Removed `chalk`** — declared but never imported (the CLI uses picocolors); removal beats chasing the ESM-only v5.
+- Declined with rationale (dependabot `ignore` rules added): `commander` 15 (ESM-only, requires Node ≥22.12; CLI is CommonJS on Node 20), fastmcp/chromadb/sentence-transformers at ALL levels (deliberate pins — breaking across minors, zero CI coverage; joint upgrade tracked as the mcp-server ML-stack modernization task), `pypdf` majors (5.x removed `PdfMerger`, used by `gamma_report.py`), docker `python` major/minor. Dependabot queue: 26+9 PRs → **0 open**.
+
+### Verified
+- `npm test` 333/333 (16 suites); lint 0 errors under eslint 10; both `npx npm@10 ci --dry-run` and `npm ci --dry-run` green; CI + Platform workflows green on GOLDEN master.
+
+## [0.12.0] — 2026-07-02
+
+### Added — Load-bearing activation (north-star Pillars 3, 4, 5)
+- **Pillar 4 executable:** `evals/_runner/providers.py` — a provider-neutral model gateway (anthropic / openai / generic-HTTP adapters selected by `BMAD_EVAL_PROVIDER`, default deterministic **mock** so `--self-check` and CI never hit the network). `run_agent(spec, model)` now routes through it; the eval harness genuinely runs (3/3 specs pass).
+- **Pillar 3 portable via MCP:** `mcp-server/tools/memory_tools.py` exposes `memory.recall` / `memory.write` / `memory.reinforce` as MCP tools that shell out to the same `bmad mem --json` CLI (single source of truth) — MCP-capable CLIs and the CLI can never diverge. Registered additively in `server.py`.
+- **Pillar 5 adopt mode:** `tools/build/generate-adapters.js --adopt` can generate the REAL repo-root adapters + AGENTS.md spine from the registry; hand-authored instructions live in `tools/build/adapters.config.js` and are injected so no tool loses content. `.gitattributes` pins LF on the adopted files (avoids the CRLF drift class). Root adoption is opt-in and NOT applied in this release.
+
+### Fixed
+- Adapter `--check` is now EOL-insensitive; `.gitattributes` pins LF on `tools/build/**` + registry so a Windows clone doesn't false-positive drift. Verified from a **fresh clone**: `npm ci` + `npm test` (333/333) + both drift-checks green.
+
+### Verified
+- `npm test` **333 passed / 16 suites**; `build:check` + `generate-adapters --check` no drift; `run.py --self-check` 3/3; edited Python parses.
+
+## [0.11.0] — 2026-07-02
+
+### Added — Karpathy loop CLI + multi-CLI adapters (north-star Pillars 3 & 5)
+- **`bmad mem` command (Pillar 3):** `recall <query>` / `write` / `reinforce` expose the memory-journal (append/recall + Elo reward + governance guard) from the CLI, so the learning loop is usable from any driving tool. `tests/unit/memory-journal-cmd.test.js`.
+- **Multi-CLI adapter generator (Pillar 5):** `tools/build/generate-adapters.js` generates the per-CLI wrappers (CLAUDE.md, GEMINI.md, `.codex/AGENTS.md`, `.cursor/rules`, `.opencode/AGENTS.md`, CONVENTIONS.md) from `registry.yaml` — counts/names computed, never typed — with a `--check` drift gate. Generated previews live under `tools/build/generated-adapters/`. `tests/unit/generate-adapters.test.js`.
+
+### Changed — Compliance (govern, don't cut)
+- **CG-02 — OSINT pack governed:** added a mandatory **Phase −1 Lawful Basis Gate** to the OSINT skill (lawful basis Art. 6, Art. 9 condition for psychoprofiles, purpose, retention, DSAR) + a lawful-basis/ROPA record template + a GDPR-OSINT reference + a governance block in the dossier template. The capability is kept in full; lawful use is now explicit and auditable. See `audit/2026-07-01/CG-RESOLUTION.md`.
+- **CG-01 — trademark:** `bmad-plus` name kept by owner decision.
+
+### Verified
+- `npm test` **325 passed / 16 suites**; `npm run build:check` no drift; `generate-adapters.js --check` no drift.
+
+## [0.10.0] — 2026-07-02
+
+### Added — Platform-spine foundations (north-star Phase 2)
+Built as **new files only** (no existing core file modified); test suite grew from 176/10 to **258 passed / 13 suites**. Cut nothing; multi-tool/multi-model preserved.
+
+- **Registry-as-SSOT (Pillar 1) — ACTIVE:** `registry.yaml` (repo root) is now the single source of truth for all 9 packs. `tools/cli/lib/packs.js` is **generated from it** (`npm run build`), no longer hand-maintained. `tools/build/generate.js` provides the generator + `npm run build:check` drift gate; `tests/unit/generate.test.js` (14 tests) proves the generated `PACKS`/`PACK_ORDER`/`EXPECTED_AGENTS` strictly equal the shipped module. This kills the 5-place pack-registry drift at its root.
+- **Python provisioning (Pillar 2):** `tools/cli/lib/python-provision.js` — detect python≥3.11, pick uv/pipx/venv, create isolated env, install requirements, verify entry (shell-safe, testable).
+- **Karpathy learning layer (Pillar 3):** `tools/cli/lib/memory-journal.js` — `journal.ndjson` append/recall, Elo/decayed reward update (eval+acceptance+ci), governance guard (promotions PROPOSED, never auto-applied).
+- **Eval harness (Pillar 4 — the moat):** `evals/` schema + Forge/Shield/Sentinel golden specs + fixtures + `run.py --self-check`, provider-neutral model backend seam.
+- **CI:** `.github/workflows/platform.yml` — registry drift-check + eval self-check, blocking, SHA-pinned.
+
+Pillar 1 is wired (packs.js generated + `npm run build`/`build:check`). Remaining integration (provisioning called from install, memory exposed via MCP, generated multi-CLI adapters) lands next as its own tested commit — see `audit/2026-07-01/PHASE-2-STATUS.md`.
+
 ## [0.9.2] — 2026-07-01
 
 ### Security — Phase 1 remediation (exploitable findings)