bmad-plus 0.9.2 → 0.12.1

package/osint-agent-package/skills/bmad-osint-investigate/osint/SKILL.md

@@ -17,6 +17,36 @@ description: >
 Systematic intelligence gathering on individuals. From a name or handle to a scored
 dossier with psychoprofile, career map, and entry points.
 
+## Phase −1 — Lawful Basis Gate (MANDATORY, runs before anything else)
+
+> Profiling a **named natural person** — especially building a psychoprofile — is
+> processing of personal data (and, for inferred personality/health/political traits,
+> **special-category data**) under the GDPR and analogous laws. This gate is not
+> optional. Governed by the Shield (GRC) pack. **Do NOT start Phase 0** on a named
+> person until it passes.
+
+Before any investigation of a named/identifiable person, establish and record:
+
+1. **Lawful basis (GDPR Art. 6)** — which applies? (consent, contract, legal
+   obligation, vital interests, public task, or **legitimate interest** with a
+   documented balancing test). For psychoprofiling / special-category inferences,
+   also an **Art. 9** condition (explicit consent, or another Art. 9(2) exemption).
+2. **Purpose** — the specific, explicit, legitimate purpose (purpose limitation).
+   Reject open-ended "find everything" with no purpose.
+3. **Data-subject rights & retention** — who is the controller, retention period,
+   and how a DSAR / erasure request will be honored.
+
+**Record it** using `assets/lawful-basis-record.md` and put the completed header at
+the top of the dossier (see `assets/dossier-template.md` governance block).
+
+**If the operator cannot state a lawful basis and purpose → DECLINE** the named-person
+profiling. Offer the non-personal alternatives instead (company/product/market
+research, or investigation of a public entity), which do not require this gate.
+
+This gate does not restrict lawful, authorized use (due diligence with a basis,
+security research, investigations you are mandated to run) — it makes that basis
+explicit and auditable. See `references/gdpr-osint.md`.
+
 ## Phase Router
 
 Determine entry point from context:

package/osint-agent-package/skills/bmad-osint-investigate/osint/assets/dossier-template.md

@@ -3,6 +3,16 @@
 
 ---
 
+**⚖️ governance / lawful basis** *(Phase −1 gate — required before this dossier exists)*
+- controller: {controller_name}
+- lawful basis (Art. 6): {basis} {legitimate_interest_balancing_ref_if_LI}
+- special-category condition (Art. 9, if psychoprofile): {art9_condition_or_NA}
+- purpose: {specific_purpose}
+- retention: {retention_period} · DSAR/erasure contact: {dsar_contact}
+- recorded: {date} · see `assets/lawful-basis-record.md`
+
+---
+
 **контакты и соцсети**
 - telegram: {handle} {status}
 - linkedin: {url} {status}

package/osint-agent-package/skills/bmad-osint-investigate/osint/assets/lawful-basis-record.md

@@ -0,0 +1,48 @@
+# Lawful Basis Record — OSINT investigation (GDPR Phase −1 gate)
+
+Complete this BEFORE profiling a named natural person. It doubles as the ROPA
+(Record of Processing Activities) entry for this investigation. Governed by Shield (GRC).
+
+## 1. Parties
+- **Controller:** {who decides why/how — org or person}
+- **Operator / analyst:** {who runs the investigation}
+- **Data subject:** {named person} — category: {public figure | employee | counterparty | other}
+
+## 2. Purpose (purpose limitation — GDPR Art. 5(1)(b))
+- **Specific purpose:** {e.g. pre-contract due diligence on a supplier director; NOT "find everything"}
+- **Why OSINT is necessary & proportionate for this purpose:** {justification}
+
+## 3. Lawful basis — GDPR Art. 6(1)
+Select ONE and justify:
+- [ ] (a) Consent — attach/reference the consent record
+- [ ] (b) Contract — necessary for a contract with the data subject
+- [ ] (c) Legal obligation — cite the obligation
+- [ ] (d) Vital interests
+- [ ] (e) Public task
+- [ ] (f) **Legitimate interest** — complete the 3-part balancing test below
+
+**Legitimate Interest Assessment (if (f)):**
+- Purpose test (is there a legitimate interest?): {…}
+- Necessity test (is OSINT necessary, or is there a less intrusive way?): {…}
+- Balancing test (do the person's rights/freedoms override?): {…}
+
+## 4. Special-category data — GDPR Art. 9 (REQUIRED if building a psychoprofile)
+Inferring personality (MBTI/Big Five), health, political opinions, religion, sexual
+orientation, etc. is special-category processing. Select an Art. 9(2) condition:
+- [ ] (a) Explicit consent
+- [ ] (e) Data manifestly made public by the data subject (document how)
+- [ ] (f) Legal claims
+- [ ] other: {cite}
+- **If none applies → do NOT build the psychoprofile.** Keep the factual dossier only.
+
+## 5. Data-subject rights & retention
+- **Retention period:** {e.g. 90 days after purpose fulfilled, then delete}
+- **DSAR / erasure contact:** {email/process to honor access, rectification, erasure, objection}
+- **Transparency:** how/whether the data subject is or will be informed (Art. 14), or the exemption relied on.
+
+## 6. Sign-off
+- Basis confirmed by: {name} · date: {date}
+- Shield review (if enterprise/high-risk): {ref or N/A}
+
+> If sections 2–4 cannot be completed, the Phase −1 gate FAILS: decline the
+> named-person profiling and use the non-personal research paths instead.

package/osint-agent-package/skills/bmad-osint-investigate/osint/references/gdpr-osint.md

@@ -0,0 +1,48 @@
+# GDPR & OSINT — governance for the investigate skill
+
+This pack performs OSINT on named individuals, including psychoprofiling. That is
+personal-data processing (GDPR + analogous laws such as UK GDPR, LGPD, CCPA/CPRA).
+BMAD+ **keeps** this capability and **governs** it — the Phase −1 lawful-basis gate
+in `SKILL.md` makes lawful use explicit and auditable rather than removing the pack.
+(Decision: keep + govern, 2026-07-02.)
+
+## Why this matters
+- Profiling and evaluating personal aspects is regulated (GDPR Art. 4(4), Art. 22, Recital 71).
+- Inferring personality, health, political/religious views, or sexual orientation is
+  **special-category** processing (Art. 9) — a higher bar than ordinary personal data.
+- "Publicly available" ≠ "no rules apply." Scraping public profiles is still processing;
+  you still need a lawful basis and must respect purpose limitation and data-subject rights.
+
+## The gate, in one line
+No lawful basis + specific purpose recorded (`assets/lawful-basis-record.md`) → no
+named-person profiling. Non-personal research (company/product/market, public entities)
+is unaffected.
+
+## Legitimate interest (the common basis)
+When relying on Art. 6(1)(f), complete the 3-part LIA in the record:
+1. **Purpose** — a real, specific legitimate interest (due diligence, fraud/security, journalism).
+2. **Necessity** — OSINT is necessary and proportionate; no less-intrusive route.
+3. **Balancing** — the person's rights/freedoms do not override; consider their reasonable
+   expectations, the sensitivity of the data, and any special-category inference (which
+   usually tips the balance and requires an Art. 9 condition instead).
+
+## Special-category / psychoprofile
+Only build the psychoprofile (MBTI/Big Five, etc.) with a valid **Art. 9(2)** condition
+(typically explicit consent, or data manifestly made public by the subject). Otherwise
+keep the factual dossier and skip the personality inference.
+
+## Data-subject rights & retention
+- Define a **retention period**; delete when the purpose is met.
+- Provide a **DSAR/erasure** path (access, rectification, erasure, objection).
+- Consider **transparency** (Art. 14) or a documented exemption.
+
+## Prohibited / out of scope
+- No profiling without a recorded basis + purpose.
+- No use for unlawful discrimination, harassment, stalking, or unauthorized surveillance.
+- No special-category inference without an Art. 9 condition.
+
+## Related BMAD+ assets
+- `SKILL.md` → Phase −1 gate.
+- `assets/lawful-basis-record.md` → gate record + ROPA entry.
+- Shield (GRC) pack → `gdpr-agent`, `legitimate-interest`, `dpia-sentinel`, `privacy-notice-gen`
+  for DPIA, LIA, ROPA, and privacy-notice generation at scale.

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "bmad-plus",
-  "version": "0.9.2",
+  "version": "0.12.1",
   "description": "BMAD+ — Augmented AI-Driven Development Framework with multi-role agents, autopilot, and parallel execution",
   "keywords": [
     "bmad",
@@ -34,6 +34,8 @@
     "install:bmad": "node tools/cli/bmad-plus-cli.js install",
     "update:bmad": "node tools/cli/bmad-plus-cli.js update",
     "doctor:bmad": "node tools/cli/bmad-plus-cli.js doctor",
+    "build": "node tools/build/generate.js --out tools/cli/lib/packs.js",
+    "build:check": "node tools/build/generate.js --check",
     "lint": "eslint tools/ tests/",
     "format": "prettier --write \"tools/**/*.js\" \"tests/**/*.js\"",
     "format:check": "prettier --check \"tools/**/*.js\" \"tests/**/*.js\"",
@@ -43,10 +45,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.4.0",
-    "chalk": "^4.1.2",
     "commander": "^14.0.0",
-    "fs-extra": "^11.3.5",
-    "js-yaml": "^4.1.0",
+    "fs-extra": "^11.3.6",
+    "js-yaml": "^5.2.1",
     "picocolors": "^1.1.1"
   },
   "engines": {
@@ -81,7 +82,8 @@
     "testEnvironment": "node"
   },
   "devDependencies": {
-    "eslint": "^9.0.0",
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.6.0",
     "husky": "^9.0.0",
     "jest": "^30.4.2",
     "prettier": "^3.4.0"

package/readme-international/README.de.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Erweitertes Multi-Agent KI-Framework
 
-[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.12.0-blue.svg)](../CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](../LICENSE)
 
@@ -8,7 +8,7 @@
   <a href="../README.md">English</a> | <a href="README.fr.md">Français</a> | <a href="README.es.md">Español</a> | 🌐 <b>Deutsch</b>
 </div>
 
-> **56+ Multirole-Agenten · 9 modulare Packs · Autopilot-Modus · Parallele Ausführung · 143 Tests**
+> **56+ Multirole-Agenten · 9 modulare Packs · Autopilot-Modus · Parallele Ausführung · 333 Tests**
 > Intelligenter Fork von [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) — Selbstaktivierende Agenten mit 3-Stufen-Kontexterkennung, GRC-Compliance (Shield), vollständige SDLC-Pipeline (Dev Studio), OSINT-Intelligence, SEO-Audit, persistentes Cross-Session-Gedächtnis und 10-Sprachen CLI-Installer.
 
 ---
@@ -556,8 +556,13 @@ BMAD+/
 | **0.4.4** | 2026-05-17 | 🔧 UTF-8-Kodierungsfix, vollständige i18n 10 Sprachen, 62 Unit-Tests |
 | **0.5.0** | 2026-05-17 | 🛡️ **Pack Shield** — 38 GRC-Compliance-Agenten, 7 Kategorien, 25+ Frameworks (DSGVO, ISO 27001, SOC 2, EU AI Act...) |
 | **0.6.0** | 2026-05-17 | 🏗️ **Pack Dev Studio** — 6 SDLC-Agenten (Miriam, Yosef, Bezalel...) + 30 SDLC-Workflows, BWML DSL |
-| **0.9.0** | 2026-06-24 | 🚀 **Erweitert & Sicher** — 3 neue Packs (animated, backup, seo), P0 Sicherheitsbehebung, 143/143 Tests |
-| **0.8.0** | 2026-06-24 | 🚀 **Erweitert & Sicher** — 3 neue Packs (animated, backup, seo), P0 Sicherheitsbehebung, 143/143 Tests |
+| **0.8.0** | 2026-06-24 | 🚀 **Erweitert** — 3 neue Packs (animated, backup, seo), Sicherheits-Remediation, i18n-Sync |
+| **0.9.0** | 2026-06-24 | 🔒 **Sicher** — Audit-Remediation-Zyklus, npm audit sauber, gemeinsames Pack-Registry (`lib/packs.js`) |
+| **0.9.1** | 2026-07-01 | ✅ **Glaubwürdigkeit** — echte CI bei Push/PR, Jest-ESM-Harness repariert, ESLint-Flat-Config, falsche Badges entfernt |
+| **0.9.2** | 2026-07-01 | 🔐 **Sicherheit** — RCE (ci_cd-Allowlist), SSRF, Stored/DOM-XSS, XXE, Python-CVE-Bumps (~30 Findings) |
+| **0.10.0** | 2026-07-02 | 🧭 **Plattform-Rückgrat** — SSOT `registry.yaml` (generiertes `packs.js` + CI-Drift-Gate), Python-Provisioning, Eval- + Memory-Fundament |
+| **0.11.0** | 2026-07-02 | 🧠 **Karpathy-Schleife** — `bmad mem` recall/write/reinforce, Multi-CLI-Adapter-Generator, OSINT-Rechtsgrundlagen-Gate (CG-02) |
+| **0.12.0** | 2026-07-02 | 🏛️ **Load-bearing** — Root-Adapter aus dem Registry adoptiert, Memory über MCP, provider-neutrales Eval-Gateway; 333 Tests |
 
 Siehe [CHANGELOG.md](../CHANGELOG.md) für vollständige Details.
 

package/readme-international/README.es.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Framework Multi-Agente IA Aumentado
 
-[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.12.0-blue.svg)](../CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](../LICENSE)
 
@@ -8,7 +8,7 @@
   <a href="../README.md">English</a> | <a href="README.fr.md">Français</a> | 🌐 <b>Español</b> | <a href="README.de.md">Deutsch</a>
 </div>
 
-> **56+ agentes multirrol · 9 packs modulares · Modo Autopilot · Ejecución paralela · 143 tests**
+> **56+ agentes multirrol · 9 packs modulares · Modo Autopilot · Ejecución paralela · 333 tests**
 > Fork inteligente de [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) — Agentes auto-activables con detección contextual en 3 niveles, cumplimiento GRC (Shield), pipeline SDLC completo (Dev Studio), inteligencia OSINT, auditoría SEO, memoria persistente cross-session e instalador CLI en 10 idiomas.
 
 ---
@@ -571,8 +571,13 @@ BMAD+/
 | **0.4.4** | 2026-05-17 | 🔧 Corrección codificación UTF-8, i18n completa 10 idiomas, 62 tests unitarios |
 | **0.5.0** | 2026-05-17 | 🛡️ **Pack Shield** — 38 agentes de cumplimiento GRC, 7 categorías, 25+ frameworks (GDPR, ISO 27001, SOC 2, EU AI Act...) |
 | **0.6.0** | 2026-05-17 | 🏗️ **Pack Dev Studio** — 6 agentes SDLC (Miriam, Yosef, Bezalel...) + 30 flujos de trabajo SDLC, BWML DSL |
-| **0.9.0** | 2026-06-24 | 🚀 **Aumentado & Seguro** — 3 nuevos packs (animated, backup, seo), corrección P0 seguridad, 143/143 tests |
-| **0.8.0** | 2026-06-24 | 🚀 **Aumentado & Seguro** — 3 nuevos packs (animated, backup, seo), corrección P0 seguridad, 143/143 tests |
+| **0.8.0** | 2026-06-24 | 🚀 **Aumentado** — 3 nuevos packs (animated, backup, seo), pase de remediación de seguridad, sync i18n |
+| **0.9.0** | 2026-06-24 | 🔒 **Seguro** — ciclo de remediación de auditoría, npm audit limpio, registro de packs compartido (`lib/packs.js`) |
+| **0.9.1** | 2026-07-01 | ✅ **Credibilidad** — CI real en push/PR, arnés Jest ESM reparado, config ESLint flat, badges falsos retirados |
+| **0.9.2** | 2026-07-01 | 🔐 **Seguridad** — RCE (allowlist ci_cd), SSRF, XSS almacenado/DOM, XXE, bumps CVE Python (~30 hallazgos) |
+| **0.10.0** | 2026-07-02 | 🧭 **Columna vertebral de plataforma** — SSOT `registry.yaml` (`packs.js` generado + gate anti-drift en CI), provisioning Python, fundaciones eval + memoria |
+| **0.11.0** | 2026-07-02 | 🧠 **Bucle Karpathy** — `bmad mem` recall/write/reinforce, generador de adapters multi-CLI, gate de base legal OSINT (CG-02) |
+| **0.12.0** | 2026-07-02 | 🏛️ **Load-bearing** — adapters raíz adoptados desde el registry, memoria vía MCP, gateway eval multi-proveedor; 333 tests |
 
 Más descripciones a fondo en el archivo: [CHANGELOG.md](../CHANGELOG.md).
 

package/readme-international/README.fr.md

@@ -1,6 +1,6 @@
 # 🚀 BMAD+ — Framework Multi-Agent IA Augmenté
 
-[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](../CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.12.0-blue.svg)](../CHANGELOG.md)
 [![Based on](https://img.shields.io/badge/based%20on-BMAD--METHOD-green.svg)](https://github.com/bmad-code-org/BMAD-METHOD)
 [![License](https://img.shields.io/badge/license-MIT-yellow.svg)](../LICENSE)
 
@@ -8,7 +8,7 @@
   <a href="../README.md">English</a> | 🌐 <b>Français</b> | <a href="README.es.md">Español</a> | <a href="README.de.md">Deutsch</a>
 </div>
 
-> **56+ agents multi-rôles · 9 packs modulaires · Mode Autopilot · Exécution parallèle · 143 tests**
+> **56+ agents multi-rôles · 9 packs modulaires · Mode Autopilot · Exécution parallèle · 333 tests**
 > Fork intelligent de [BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) — Agents auto-activables avec détection contextuelle 3 niveaux, conformité GRC (Shield), pipeline SDLC complet (Dev Studio), intelligence OSINT, audit SEO, mémoire persistante cross-session, et installeur CLI 10 langues.
 
 ---
@@ -571,8 +571,13 @@ BMAD+/
 | **0.4.4** | 2026-05-17 | 🔧 Correction encodage UTF-8, i18n complète 10 langues, 62 tests unitaires |
 | **0.5.0** | 2026-05-17 | 🛡️ **Pack Shield** — 38 agents de conformité GRC, 7 catégories, 25+ frameworks (RGPD, ISO 27001, SOC 2, EU AI Act...) |
 | **0.6.0** | 2026-05-17 | 🏗️ **Pack Dev Studio** — 6 agents SDLC (Miriam, Yosef, Bezalel...) + 30 workflows SDLC, BWML DSL |
-| **0.9.0** | 2026-06-24 | 🚀 **Augmenté & Sécurisé** — 3 nouveaux packs (animated, backup, seo), correction P0 sécurité, 143/143 tests |
-| **0.8.0** | 2026-06-24 | 🚀 **Augmenté & Sécurisé** — 3 nouveaux packs (animated, backup, seo), correction P0 sécurité, 143/143 tests |
+| **0.8.0** | 2026-06-24 | 🚀 **Augmenté** — 3 nouveaux packs (animated, backup, seo), passe de remédiation sécurité, sync i18n |
+| **0.9.0** | 2026-06-24 | 🔒 **Sécurisé** — cycle de remédiation d'audit, npm audit propre, registre de packs partagé (`lib/packs.js`) |
+| **0.9.1** | 2026-07-01 | ✅ **Crédibilité** — vraie CI sur push/PR, harnais Jest ESM réparé, config ESLint flat, faux badges retirés |
+| **0.9.2** | 2026-07-01 | 🔐 **Sécurité** — RCE (allowlist ci_cd), SSRF, XSS stocké/DOM, XXE, bumps CVE Python (~30 findings) |
+| **0.10.0** | 2026-07-02 | 🧭 **Épine dorsale plateforme** — SSOT `registry.yaml` (`packs.js` généré + gate anti-drift CI), provisioning Python, fondations eval + mémoire |
+| **0.11.0** | 2026-07-02 | 🧠 **Boucle Karpathy** — `bmad mem` recall/write/reinforce, générateur d'adapters multi-CLI, gate base légale OSINT (CG-02) |
+| **0.12.0** | 2026-07-02 | 🏛️ **Load-bearing** — adapters racine adoptés depuis le registry, mémoire via MCP, gateway eval multi-provider ; 333 tests |
 
 Voir [CHANGELOG.md](../CHANGELOG.md) pour le détail complet.
 

package/src/bmad-plus/packs/pack-memory/shared/memory-protocol.md

@@ -29,6 +29,20 @@
     └── <hash>.yaml     ← Per-project metadata
 ```
 
+### Portfolio Brain (workspace-level, takes precedence)
+
+If a `_brain/` directory exists in the project directory or any ancestor (e.g. `D:\workspace\_brain\` above `D:\workspace\clients\my-project\`), install links the project to it instead of `~/.bmad-plus/brain`. The `BMAD_PLUS_BRAIN` env var overrides all auto-detection.
+
+The kind of brain that was linked is recorded in `.brain-link`:
+
+```json
+{ "linked_brain": "D:\\workspace\\_brain", "brain_type": "portfolio", "linked_at": "…" }
+```
+
+`brain_type` values: `portfolio` (workspace `_brain/` or env var) · `bmad-global` (`~/.bmad-plus/brain`) · `claude-memory` (`~/.claude/memory`).
+
+**Rule for agents**: a portfolio brain has its **own** conventions and layout — read its entry point (`README.md` / `AGENTS.md` / `HOT.md`) first and follow them. Do NOT assume the BMAD+ global layout above; in particular do not create `identity.yaml` or `projects/` inside a portfolio brain uninvited.
+
 ---
 
 ## Protocol: Session Start (READ)

package/tools/build/README.md

@@ -0,0 +1,78 @@
+# BMAD+ Build — Registry Generator (Pillar 1)
+
+`registry.yaml` at the repo root is the **single source of truth** for the
+9 packs, their agents, skills, data files, install layout, runtimes, and
+compliance tags. Until now this data was hand-replicated in 5 places
+(`tools/cli/lib/packs.js`, `src/bmad-plus/module.yaml`, `install.js`,
+`ide-config.js`, `i18n.js`) — and they drifted.
+
+`tools/build/generate.js` reads `registry.yaml` and generates the pack data
+consumed by the CLI. The migration proof (`tests/unit/generate.test.js`)
+asserts the generated `PACKS` / `PACK_ORDER` / `EXPECTED_AGENTS` are
+**deep-strict-equal** to the hand-written `tools/cli/lib/packs.js`, so the
+registry provably captures current reality before anything is replaced.
+
+## Usage
+
+```bash
+# Print the generated packs module source (drop-in packs.js replacement)
+node tools/build/generate.js
+
+# Print PACKS / PACK_ORDER / EXPECTED_AGENTS as JSON
+node tools/build/generate.js --json
+
+# Write the generated module to a file
+node tools/build/generate.js --out tools/cli/lib/packs.generated.js
+
+# CI drift gate: exit 1 if registry.yaml no longer reproduces packs.js
+# (also asserts product.version == package.json version)
+node tools/build/generate.js --check
+```
+
+## Registry contract (fields the generator consumes)
+
+Per pack under `packs:` in `registry.yaml`:
+
+| Field | Maps to | Notes |
+| --- | --- | --- |
+| `order` | `PACK_ORDER` position | integer, unique |
+| `cli.name` / `cli.icon` / `cli.desc` | `PACKS[id].name/icon/desc` | exact CLI strings (icon = glyph letter) |
+| `agents` | `PACKS[id].agents` | agent ids the installer copies |
+| `skills` | `PACKS[id].skills` | defaults to `[]` |
+| `data` | `PACKS[id].data` | **key presence is significant** — only core & maker declare it |
+| `external_package` | `PACKS[id].externalPackage` | osint only |
+| `pack_dir` / `pack_src_dir` | `PACKS[id].packDir/packSrcDir` | `pack_src_dir` defaults to `packs` |
+| `required` | `PACKS[id].required` | emitted **only when `true`** (packs.js omits it otherwise) |
+| `install_layout` | `EXPECTED_AGENTS[id]` | `loose` → agents as directories, `packDir: null`; `packaged` → `packDir` + `doctor.pack_agents` |
+| `doctor.pack_agents` | `EXPECTED_AGENTS[id].packAgents` | agent **filenames** inside `pack_dir` (packaged only) |
+
+Everything else in `registry.yaml` (`display_name`, `icon_emoji`, `summary`,
+`runtime`, `categories`, `workflows`, `governance`, `compliance_tags`,
+`targets`, `runtimes`, `memory`, `eval`) is north-star metadata consumed by
+future generators (module.yaml, README count tables, per-CLI adapters,
+role-triggers) — declared once here so counts are derived, never typed.
+
+## Editing workflow
+
+1. Edit `registry.yaml` (never the generated data).
+2. Run `node tools/build/generate.js --check`.
+3. While `packs.js` is still hand-written (migration phase), sync it via
+   `node tools/build/generate.js --out tools/cli/lib/packs.js` or apply the
+   equivalent hand edit — `--check` and `tests/unit/generate.test.js`
+   (`npx jest tests/unit/generate.test.js`) both fail on any divergence.
+
+## Migration end-state (for the orchestrator)
+
+Once integration is approved, `tools/cli/lib/packs.js` becomes either:
+
+- a checked-in generated file (`generate.js --out tools/cli/lib/packs.js`,
+  with `--check` as a CI/pre-commit gate), or
+- a thin runtime re-export:
+
+  ```js
+  const { loadRegistry, buildAll } = require('../../build/generate');
+  module.exports = buildAll(loadRegistry());
+  ```
+
+Both keep the exact `{ PACKS, PACK_ORDER, EXPECTED_AGENTS }` shape every CLI
+command already imports, so no call site changes.

package/tools/build/adapters.config.js

@@ -0,0 +1,117 @@
+/**
+ * BMAD+ Build — hand-authored project instructions (Pillar 5 adoption).
+ *
+ * When the root adapters (CLAUDE.md / GEMINI.md / AGENTS.md / .cursor / .codex /
+ * .opencode / CONVENTIONS.md) were adopted as GENERATED files, every substantive
+ * hand-written instruction they contained was folded into THIS file — the UNION
+ * of all three pre-adoption root files, nothing dropped:
+ *
+ *   - Agents roster (personas + Hebrew names + pack qualifiers) — from all three
+ *   - Skills paths (installed `.agents/` layout AND repo `src/bmad-plus/` layout)
+ *   - Project Structure                                      — from GEMINI/AGENTS
+ *   - Communication (user name + language policy)            — from CLAUDE
+ *   - Commit Rules (no AI co-author)                          — from GEMINI
+ *   - Repository Maintenance Rule (README i18n sync)          — from GEMINI/AGENTS
+ *   - Memory Protocol (Karpathy Guardrails G1–G4 + files)     — from CLAUDE
+ *
+ * These sections are injected VERBATIM into the generated spine (AGENTS.md) and
+ * into every generated adapter, so every tool keeps the full instructions even
+ * when it only auto-loads its own file.
+ *
+ * EDIT THIS FILE (never the generated root files), then regenerate:
+ *   node tools/build/generate-adapters.js --adopt
+ *
+ * Numbers policy: NO counts are hand-typed here (they drift — see audit DOC-06).
+ * All counts live in the generated "Registry facts" section, derived from
+ * registry.yaml. That is why the Shield line below carries no agent count.
+ *
+ * Author: Laurent Rochetta
+ */
+
+'use strict';
+
+/**
+ * Markdown lines (LF-joined by the generator). Headings are `##` level so the
+ * block nests directly under each generated file's H1.
+ */
+const PROJECT_INSTRUCTIONS = [
+  '## Agents',
+  '',
+  'To activate an agent, say its name or persona:',
+  '',
+  '- **Atlas** (Strategist) — Business analysis + Product management',
+  '- **Forge** (Architect-Dev) — Architecture + Development + Documentation',
+  '- **Sentinel** (Quality) — QA + UX review',
+  '- **Nexus** (Orchestrator) — Sprint management + Autopilot + Parallel execution',
+  '- **Shadow** (OSINT) — Investigation + Scraping + Psychoprofiling (if OSINT pack installed)',
+  '- **Maker** (Agent Creator) — Design, build, validate, and package new BMAD+ agents',
+  '- **Shield** (GRC) — Compliance agents for GDPR, ISO 27001, SOC 2, HIPAA, EU AI Act, DORA, NIS2 and more (derived counts: see Registry facts below)',
+  '- **Miriam** (מרים) — Business Analyst — Strategic analysis, research, product briefs (Dev Studio)',
+  '- **Huldah** (חולדה) — Technical Writer — Documentation, diagrams, editorial review (Dev Studio)',
+  '- **Yosef** (יוסף) — Product Manager — PRD, requirements, feature prioritization (Dev Studio)',
+  '- **Rachel** (רחל) — UX Designer — User experience, wireframes, empathy mapping (Dev Studio)',
+  '- **Bezalel** (בצלאל) — System Architect — Architecture, ADRs, epics & stories (Dev Studio)',
+  '- **Oholiab** (אהליאב) — Senior Engineer — TDD, sprint, code review, implementation (Dev Studio)',
+  '- **Zecher** (זכר, Memory Guardian) — Memory Archivist — Persistent cross-session memory, consolidation, project scanning, context recall, session handoffs',
+  '',
+  '## Skills',
+  '',
+  '- Installed projects load skills from `.agents/skills/`; in this repository the sources live in `src/bmad-plus/skills/` and `src/bmad-plus/agents/`.',
+  '- Each agent has a SKILL.md with capabilities, activation protocol, and role-switching rules.',
+  '- Auto-activation triggers: `.agents/data/role-triggers.yaml` (source: `src/bmad-plus/data/role-triggers.yaml`).',
+  '',
+  '## Project Structure',
+  '',
+  '- `src/bmad-plus/` — Custom module (agents, skills, data)',
+  '- `monitor/` — Upstream monitoring system (VPS)',
+  '- `mcp-server/` — Audit 360° MCP Server',
+  '- `osint-agent-package/` — OSINT package',
+  '- `upstream/` — BMAD-METHOD reference clone',
+  '',
+  '## Communication',
+  '',
+  '- User name: laurent',
+  '- Default language: Français for user-facing content, English for code and technical docs.',
+  '',
+  '## Commit Rules',
+  '',
+  '- NEVER add "Co-Authored-By: Claude" or any AI co-author attribution.',
+  '- The sole author is Laurent Rochetta.',
+  '',
+  '## Repository Maintenance Rule',
+  '',
+  'When updating the main README.md (English), you MUST synchronously update all translations in the readme-international/ directory (fr, es, de).',
+  '',
+  '## Memory Protocol (Karpathy Guardrails)',
+  '',
+  'Agents MUST follow these behavioral principles:',
+  '',
+  '### G1 — Think Before Coding',
+  '',
+  '- State assumptions explicitly. If uncertain, ask.',
+  '- Check `.agents/memory/decisions.md` for prior decisions before re-deciding.',
+  '',
+  '### G2 — Simplicity First',
+  '',
+  '- Minimum code that solves the problem. Nothing speculative.',
+  '- Check `.agents/memory/patterns.md` for existing solutions.',
+  '',
+  '### G3 — Surgical Changes',
+  '',
+  '- Touch only what you must. Match existing style.',
+  '- Log surprises in `.agents/memory/lessons.md`.',
+  '',
+  '### G4 — Goal-Driven Execution',
+  '',
+  '- Define success criteria before implementing.',
+  '- Log non-obvious decisions in `.agents/memory/decisions.md`.',
+  '',
+  '### Memory Files',
+  '',
+  '- `.agents/memory/decisions.md` — Read at session start, write when making decisions',
+  '- `.agents/memory/lessons.md` — Write when something unexpected happens',
+  '- `.agents/memory/patterns.md` — Write when a reusable pattern is validated',
+  '- `.agents/memory/context.md` — Update at session end with project state',
+];
+
+module.exports = { PROJECT_INSTRUCTIONS };