ma-agents 3.6.2 → 3.9.0

package/lib/bmad-extension-plugin/skills/cyber-immunity-estimation/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: cyber-immunity-estimation
+description: Assess overall security posture and immunity against common attack vectors
+type: skill
+triggers:
+  - "immunity estimation"
+  - "security posture"
+---
+
+# workflow-immunity-estimation.md
+# Cyber Immunity Estimation Workflow
+
+Assesses the overall security posture and 'immunity' of the system against common attack vectors.
+
+## Instructions
+1.  **Attack Surface Analysis**: Identify all entry points (APIs, UI, SSH, 3rd party integrations).
+2.  **Control Verification**:
+    - Authentication/Authorization presence.
+    - Encryption in transit and at rest.
+    - Secret management maturity (Hardcoded vs Vault).
+3.  **Posture Scoring**: Rate 1-10 on:
+    - Code quality/Sanitization.
+    - Dependency health.
+    - Infrastructure hardening.
+    - Visibility/Logging.
+4.  **Immunity Report**:
+    - Summarize major gaps.
+    - Provide a roadmap for reach 'Immunity Level 5' (Robust).
+5.  **Verification**: Recommend automated regression tests for security controls.

package/lib/bmad-extension-plugin/skills/cyber-immunity-estimation/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: cyber-immunity-estimation
+module: ma-skills

package/lib/bmad-extension-plugin/skills/cyber-security-audit/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: cyber-security-audit
+description: Comprehensive security audit of infrastructure and application configuration
+type: skill
+triggers:
+  - "security audit"
+  - "run security audit"
+---
+
+# workflow-security-audit.md
+# Comprehensive Security Audit Workflow
+
+Deep-dive audit of infrastructure and application configuration.
+
+## Instructions
+1.  **Infrastructure Audit**:
+    - **K8s**: Check for privileged containers, missing network policies, root users.
+    - **Docker**: Check for exposed ports, unnecessary packages in images.
+2.  **Code Audit**:
+    - Static Analysis (SAST) for common patterns (SQLi, XSS).
+    - Check for insecure defaults in frameworks.
+3.  **Identity Audit**:
+    - Review ServiceAccount permissions (RBAC).
+    - Check for hard-coded credentials.
+4.  **Final Recommendation**: 
+    - Provide a prioritized list of hardening tasks.
+    - Propose CIDCD guardrails.

package/lib/bmad-extension-plugin/skills/cyber-security-audit/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: cyber-security-audit
+module: ma-skills

package/lib/bmad-extension-plugin/skills/cyber-vault-secrets/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: cyber-vault-secrets
+description: Manage secrets, policies, and authentication in HashiCorp Vault
+type: skill
+triggers:
+  - "vault secrets"
+  - "manage vault"
+---
+
+# workflow-vault-secrets.md
+# HashiCorp Vault Secret Management Workflow
+
+This workflow guides the agent through managing secrets, policies, and authentication in HashiCorp Vault.
+
+## Instructions
+1.  **Check Connection**: Verify `vault status` and authentication.
+2.  **Secret Creation/Update**:
+    - `vault kv put secret/{path} {key}={value}`
+    - Ensure secrets are never logged or echoed in plain text.
+3.  **Policy Management**:
+    - Define HCL policies for restricted access.
+    - `vault policy write {name} {policy_file}`
+4.  **Integration**:
+    - Manage Kubernetes auth method: `vault auth enable kubernetes`
+    - Setup Vault Agent injector configurations.
+5.  **Audit**:
+    - Check for expired tokens or orphaned secrets.
+    - Review access logs if available.

package/lib/bmad-extension-plugin/skills/cyber-vault-secrets/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: cyber-vault-secrets
+module: ma-skills

package/lib/bmad-extension-plugin/skills/cyber-verify-docker-users/SKILL.md

@@ -0,0 +1,23 @@
+---
+name: cyber-verify-docker-users
+description: Audit Docker images for proper user management and least privilege
+type: skill
+triggers:
+  - "verify docker users"
+  - "docker user audit"
+---
+
+# verify-docker-users.md
+# Docker User & Hardening Verification Workflow
+
+This workflow guides the Cyber agent through auditing Docker images for proper user management and least privilege.
+
+## Instructions
+1.  **Inspect Metadata**:
+    - Use the `docker-hardening-verification` skill.
+    - Run: `bash skills/docker-hardening-verification/scripts/verify-hardening.sh {image_name}`.
+2.  **Audit Result Analysis**:
+    - **UID Check**: Confirm the defined user is non-zero.
+    - **Permissive Files**: Scan for world-writable files in common paths (/tmp, /etc, /var).
+3.  **Governance Check**: Ensure the image follows OpenShift/hardened cluster requirements (no root, arbitrary UID support).
+4.  **Reporting**: provide a high-level summary of hardening quality and mandatory fixes.

package/lib/bmad-extension-plugin/skills/cyber-verify-docker-users/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: cyber-verify-docker-users
+module: ma-skills

package/lib/bmad-extension-plugin/skills/cyber-verify-image-signature/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: cyber-verify-image-signature
+description: Verify Docker image signatures for supply chain security
+type: skill
+triggers:
+  - "verify image signature"
+  - "check image signature"
+---
+
+# verify-image-signature.md
+# Docker Image Signature Verification Workflow
+
+This workflow guides the Cyber agent through verifying that a Docker image has been properly signed.
+
+## Instructions
+1.  **Identify Image**: Get the image name and digest.
+2.  **Locate Public Key**: Obtain the public key or certificate used for signing.
+3.  **Execute Verification**:
+    - Use `cosign verify --key {public_key} {image_digest}`.
+    - Check the output for valid signatures.
+4.  **Policy Compliance**: Verify if the signing entity (certificate CN) matches the expected trusted authorities.
+5.  **Report**: Alert the user if the image is unsigned or the signature is invalid.

package/lib/bmad-extension-plugin/skills/cyber-verify-image-signature/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: cyber-verify-image-signature
+module: ma-skills

package/lib/bmad-extension-plugin/skills/cyber-vulnerability-scan/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: cyber-vulnerability-scan
+description: Orchestrate comprehensive vulnerability scanning across tech stacks
+type: skill
+triggers:
+  - "vulnerability scan"
+  - "run vulnerability scan"
+---
+
+# workflow-vulnerability-scan.md
+# ma-agents Vulnerability Scan Orchestration
+
+Orchestrates multiple security-focused skills from the `ma-agents` package to provide a comprehensive security scan.
+
+## Instructions
+1.  **Select Scanners**: Based on project tech stack, trigger:
+    - **JS/TS**: `js-ts-security-skill`
+    - **Python**: `python-security-skill`
+    - **Docker**: `verify-hardened-docker-skill`
+2.  **Run Tools**:
+    - Execute `npm audit` or `yarn audit`.
+    - Run `pip-audit` for Python environments.
+    - Run `trivy image {image}` for containers.
+3.  **Aggregate Results**: Collect all findings into a unified report.
+4.  **Prioritization**: Rank vulnerabilities by CVSS score and exploitability.
+5.  **Remediation**:
+    - Propose version upgrades.
+    - Propose configuration hardening steps.

package/lib/bmad-extension-plugin/skills/cyber-vulnerability-scan/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: cyber-vulnerability-scan
+module: ma-skills

package/lib/bmad-extension-plugin/skills/devops-configure-infrastructure/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: devops-configure-infrastructure
+description: Define and configure core infrastructure components in Kubernetes
+type: skill
+triggers:
+  - "configure infrastructure"
+  - "infrastructure configuration"
+---
+
+# workflow-configure-infrastructure.md
+# Infrastructure Configuration Workflow
+
+This workflow focuses on defining and configuring core infrastructure components in a Kubernetes environment.
+
+## Instructions
+1.  **Storage Definition**:
+    - Define `PersistentVolume` (PV) with appropriate access modes and storage classes.
+    - Define `PersistentVolumeClaim` (PVC) for application workloads.
+2.  **Networking**:
+    - Configure `Service` type `LoadBalancer` or `Ingress` controllers.
+    - Define `NetworkPolicies` for secure communication.
+3.  **Disconnected Environments**:
+    - Provide templates for local storage provisioners (e.g., hostPath, Local Persistent Volumes).
+    - Configure static IP assignments for on-prem load balancers.
+4.  **Validation**:
+    - Verify binding status: `kubectl get pv,pvc`
+    - Verify endpoint availability: `kubectl get endpoints`

package/lib/bmad-extension-plugin/skills/devops-configure-infrastructure/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: devops-configure-infrastructure
+module: ma-skills

package/lib/bmad-extension-plugin/skills/devops-disconnected-deployment/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: devops-disconnected-deployment
+description: Deploy applications in air-gapped or restricted on-prem environments
+type: skill
+triggers:
+  - "disconnected deployment"
+  - "air-gapped deployment"
+---
+
+# workflow-disconnected-deployment.md
+# Disconnected Environment Deployment Workflow
+
+Strategies and actions for deploying applications in air-gapped or restricted on-prem environments.
+
+## Instructions
+1.  **Dependency Gathering**:
+    - Identify all required container images.
+    - Export images: `docker save {image_list} | gzip > images.tar.gz`
+    - Package Helm charts: `helm package {chart_path}`
+2.  **Target Readiness**:
+    - Verify local registry availability.
+    - Import images: `docker load < images.tar.gz`
+3.  **Deployment**:
+    - Use `--set image.repository={local_registry}/{repo}` for Helm.
+    - Verify offline connectivity between components.
+4.  **Troubleshooting**:
+    - Check for 'ImagePullBackOff' due to incorrect registry paths.

package/lib/bmad-extension-plugin/skills/devops-disconnected-deployment/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: devops-disconnected-deployment
+module: ma-skills

package/lib/bmad-extension-plugin/skills/devops-docker-compose-setup/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: devops-docker-compose-setup
+description: Multi-container orchestration using Docker Compose for development and on-prem
+type: skill
+triggers:
+  - "docker compose setup"
+  - "docker compose"
+---
+
+# workflow-docker-compose-setup.md
+# Docker Compose Management Workflow
+
+This workflow handles multi-container orchestration using Docker Compose, optimized for development and on-prem deployments.
+
+## Instructions
+1.  **Define Services**: Map application components to Docker services.
+2.  **Environment Sync**: Setup `.env` file management for different environments (on-prem, dev).
+3.  **Disconnected Operations**:
+    - Build images with `--pull=false` if registry is unavailable.
+    - Use local image tags.
+4.  **Orchestration**:
+    - Setup dependencies with `depends_on` and health checks.
+    - Configure volumes for persistence.
+5.  **Execution**:
+    - `docker-compose up -d`
+    - `docker-compose ps`

package/lib/bmad-extension-plugin/skills/devops-docker-compose-setup/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: devops-docker-compose-setup
+module: ma-skills

package/lib/bmad-extension-plugin/skills/devops-manage-helm/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: devops-manage-helm
+description: Create and manage Helm charts and Helm umbrellas for complex systems
+type: skill
+triggers:
+  - "manage helm"
+  - "helm chart"
+---
+
+# workflow-manage-helm.md
+# Helm Management Workflow
+
+This workflow handles the creation and management of Helm charts and Helm umbrellas for complex systems.
+
+## Instructions
+1.  **Analyze System**: Determine if a single chart or an umbrella chart (multiple sub-charts) is needed.
+2.  **Chart Creation**: 
+    - `helm create {chart_name}`
+    - Structure for disconnected environments: Ensure all chart dependencies are bundled (vendorized).
+3.  **Helm Umbrella Setup**:
+    - Configure `Chart.yaml` with sub-chart dependencies.
+    - Setup `values.yaml` to override sub-chart values.
+4.  **On-prem Optimization**:
+    - Prepare `chart-save` and `chart-load` routines for air-gapped systems.
+    - Configure local registry mirrors.
+5.  **Validation**:
+    - `helm lint {chart_path}`
+    - `helm template {chart_path}`

package/lib/bmad-extension-plugin/skills/devops-manage-helm/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: devops-manage-helm
+module: ma-skills

package/lib/bmad-extension-plugin/skills/devops-sign-docker-image/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: devops-sign-docker-image
+description: Cryptographically sign Docker images using certificates and Cosign
+type: skill
+triggers:
+  - "sign docker image"
+  - "docker image signing"
+---
+
+# sign-docker-image.md
+# Docker Image Signing Workflow
+
+This workflow guides the DevOps agent through the process of cryptographically signing a Docker image.
+
+## Instructions
+1.  **Select Image**: Identify the image to sign.
+2.  **Get Digest**: Retrieve the immutable digest: `docker inspect --format='{{index .RepoDigests 0}}' {image_name}`.
+3.  **Prepare Certificate**: Locate the certificate file provided by the user.
+4.  **Execute Signing**:
+    - Use the `docker-image-signing` skill.
+    - Path: `skills/docker-image-signing/scripts/sign-image.sh`
+    - Run: `bash skills/docker-image-signing/scripts/sign-image.sh {image_digest} {cert_file} {key_file}`
+5.  **Verify**: Confirm the signature using `cosign verify`.
+6.  **Report**: provide the signed image reference to the user.

package/lib/bmad-extension-plugin/skills/devops-sign-docker-image/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: devops-sign-docker-image
+module: ma-skills

package/lib/bmad-extension-plugin/skills/generate-backlog/SKILL.md

@@ -0,0 +1,236 @@
+---
+name: generate-backlog
+description: Generate or refresh the backlog section of sprint-status.yaml from epics and bug stories, preserving existing priorities and sprint assignments
+type: skill
+triggers:
+  - "generate backlog"
+  - "refresh backlog"
+  - "update backlog"
+---
+
+# Generate Backlog
+
+Generate or refresh the `backlog` section of `sprint-status.yaml` from epics and bug story files, while preserving existing sprint assignments and priorities.
+
+## Purpose
+
+This skill reads `epics.md` and `bug-*.md` files and writes the `backlog` and `epics` sections of `sprint-status.yaml`. The `sprints` section is preserved unchanged. This implements the single-source-of-truth model from Architecture Decision P2-11: all unassigned stories and bugs live in the `backlog` section of the unified file.
+
+**Output target:** `{sprint_management_path}/_bmad-output/implementation-artifacts/sprint-status.yaml` (`backlog` and `epics` sections only — `sprints` section is preserved unchanged)
+**Never writes:** A standalone `backlog.yaml` file.
+**Path resolution:** Use `_bmad/bmm/config.yaml` → `sprint_management_path` to resolve the project root. If not set, default to the project root.
+
+---
+
+## Backend Routing
+
+Before executing any file-system operations, determine and route to the correct backend:
+
+1. Read `_bmad-output/implementation-artifacts/sprint-status.yaml` and extract the `tracking_system` field.
+   If the field is absent or the file does not exist, default to `file-system`.
+
+2. If `tracking_system` is `file-system`:
+   Proceed with the **File-System Backend** instructions below.
+
+3. If `tracking_system` is `jira`:
+   > "This operation will create/update Jira items in bulk. If it fails mid-way, Jira may be in partial state. The Jira server URL is `{jira_url}` and project key is `{jira_project_key}` (from `_bmad/bmm/config.yaml`). Proceed?"
+
+   a. Perform the Jira operation: Query all Jira epics (issues of type Epic) in project `{jira_project_key}` at `{jira_url}` to build the epics map. Query all backlog issues (Story and Bug type, not assigned to any active sprint) in project `{jira_project_key}`. For any backlog items not already present in Jira, create new Jira issues (one API call per item). For existing items whose fields have changed, update them. Use the Jira field mapping: item.title → issue summary, item.type → issue type (story → Story, bug → Bug), item.status → Jira workflow status (see status mapping below), item.priority → issue priority. Status mapping: backlog → Backlog/Open, ready-for-dev → To Do/Selected for Development, in-progress → In Progress, review → In Review/Code Review, done → Done/Resolved, on-hold → On Hold/Blocked, cancelled → Won't Do/Cancelled.
+      Use whatever Jira-capable tool is available in your current tool context.
+      Map Jira entities to the canonical schema (Sprint → sprints[], Backlog → backlog[],
+      Epic → epics[], Jira status → canonical vocabulary per Section 6.3 of the routing spec).
+   b. If the Jira operation SUCCEEDS: continue with the Jira data returned. Jira is the source of truth.
+   c. If the Jira operation FAILS for any reason:
+      - If no Jira-capable tool is available in your current context:
+        Pause and present the user with:
+        > "No Jira-capable tool is available. To use Jira tracking, configure a Jira integration
+        > in your agent (an MCP server, plugin, or native integration connected to the Jira
+        > instance at `{jira_url}`). How would you like to proceed?
+        > (a) Retry — attempt the Jira operation again once a Jira tool is configured
+        > (b) Switch to file management — update sprint-status.yaml and config to use
+        >     file-system backend, then complete this operation locally. This change is permanent."
+      - If a Jira tool attempted the operation but returned an error:
+        Pause and present the user with:
+        > "The Jira operation failed: {actual Jira error details}. How would you like to proceed?
+        > (a) Retry — attempt the Jira operation again
+        > (b) Switch to file management — update sprint-status.yaml and config to use
+        >     file-system backend, then complete this operation locally. This change is permanent."
+      If user chooses (b) in either case: write `tracking_system: file-system` to `sprint-status.yaml`,
+      update `sprint_backend: file-system` in `_bmad/bmm/config.yaml`,
+      then proceed with **File-System Backend** instructions below.
+
+4. **File-System Backend** — execute the workflow steps below.
+
+---
+
+<workflow>
+
+<step n="1" goal="Resolve paths and load existing sprint-status.yaml state">
+  <action>Read `_bmad/bmm/config.yaml` to resolve `sprint_management_path` (default: project root if not set)</action>
+  <action>Resolve the sprint-status file path: `{sprint_management_path}/_bmad-output/implementation-artifacts/sprint-status.yaml`</action>
+  <action>Resolve the epics file path: `{sprint_management_path}/_bmad-output/planning-artifacts/epics.md`</action>
+  <action>Resolve the bug files glob: `{sprint_management_path}/_bmad-output/implementation-artifacts/bug-*.md`</action>
+  <action>Resolve the done archive path: `{sprint_management_path}/_bmad-output/implementation-artifacts/done/`</action>
+
+  <check if="sprint-status.yaml does not exist">
+    <output>ERROR: `sprint-status.yaml` not found at `{resolved_path}`. Run `/bmad-sprint-planning` first to bootstrap the file before using `generate-backlog`.</output>
+    <action>Exit workflow</action>
+  </check>
+
+  <action>Read and parse `sprint-status.yaml`</action>
+  <action>Parse the `sprints` section (map keyed by sprint-N). For each sprint, collect all item IDs from the sprint's `items` array. Build {{sprint_item_ids}} = flat set of all item IDs across ALL sprints (planning, active, and closed).</action>
+  <action>Parse the `backlog` section (array). Build {{existing_backlog_map}} = map from item ID to the full item object (to preserve priority and status during merge).</action>
+  <action>Preserve the top-level metadata fields: {{generated}}, {{project}}, {{project_key}}, {{tracking_system}}, {{story_location}}</action>
+  <action>Preserve the full {{sprints}} section verbatim (passed through unchanged on write)</action>
+  <action>Preserve the existing {{epics}} section for status/retrospective merge in Step 7</action>
+</step>
+
+<step n="2" goal="Build done-items exclusion set from done/ archive">
+  <action>List files in `{sprint_management_path}/_bmad-output/implementation-artifacts/done/` matching `*.md`</action>
+  <action>For each file found, derive the item ID from the filename (strip `.md` extension, use basename)</action>
+  <action>Build {{done_item_ids}} = set of all archived item IDs</action>
+  <check if="no done/ files found">
+    <action>Set {{done_item_ids}} = empty set</action>
+  </check>
+</step>
+
+<step n="3" goal="Extract stories from epics.md">
+  <action>Read `{resolved_epics_path}`</action>
+  <check if="file does not exist">
+    <output>WARNING: `epics.md` not found at `{resolved_epics_path}`. No stories will be extracted from epics. Continuing with bug-only backlog.</output>
+    <action>Set {{epic_stories}} = [] and {{parsed_epics}} = []</action>
+  </check>
+  <action>Parse epics.md to extract:
+    - Each epic: epic number (N from "Epic N" header), epic title, epic status (if present in the file)
+    - Each story under each epic: story number (M from "Story N.M" format), story title
+  </action>
+  <action>For each story, generate the kebab-case item ID: `{epic_number}-{story_number}-{title-slug}` where title-slug is the title lowercased, spaces replaced with hyphens, non-alphanumeric characters (except hyphens) removed, consecutive hyphens collapsed</action>
+  <action>Exclude stories whose derived ID is in {{sprint_item_ids}} (already assigned to a sprint)</action>
+  <action>Exclude stories whose derived ID is in {{done_item_ids}} (archived)</action>
+  <action>Store remaining stories as {{epic_stories}} — list of objects with: id, epic (integer), title, type="story", severity=null</action>
+  <action>Store parsed epics as {{parsed_epics}} — list of objects with: epic_id (e.g., "epic-5"), epic_number (integer), title</action>
+</step>
+
+<step n="4" goal="Extract bugs from bug-*.md files">
+  <action>Glob `{resolved_bug_glob}` to discover all bug story files</action>
+  <check if="no bug files found">
+    <action>Set {{bug_stories}} = []</action>
+  </check>
+  <action>For each bug file found:
+    - Parse YAML frontmatter to extract: `id` (or derive from filename), `title`, `severity` (critical/high/medium/low), `status`
+    - If `id` is not in frontmatter, derive from filename: strip `bug-` prefix and `.md` extension, prefix with `BUG-`
+    - If `status` is not in frontmatter, default to `backlog`
+    - Exclude bugs whose ID is in {{sprint_item_ids}} or {{done_item_ids}}
+    - Create bug item: {id, type="bug", epic=null, title, severity, status}
+  </action>
+  <action>Store as {{bug_stories}}</action>
+</step>
+
+<step n="5" goal="Merge with existing backlog — preserve priorities, detect orphans">
+  <action>Build {{all_source_ids}} = set of all IDs from {{epic_stories}} + {{bug_stories}}</action>
+
+  <action>**Orphan detection:** For each item in {{existing_backlog_map}} whose ID is NOT in {{all_source_ids}} AND NOT in {{sprint_item_ids}} AND NOT in {{done_item_ids}}:
+    - Flag the item as orphaned
+    - Collect orphaned items in {{orphaned_items}} list
+    - Keep the orphaned item in the backlog (do NOT auto-remove — human review required)
+  </action>
+
+  <action>**New item detection:** For each item in {{epic_stories}} and {{bug_stories}} whose ID is NOT in {{existing_backlog_map}}:
+    - Assign status = "backlog"
+    - Mark as new in {{new_items}} list
+  </action>
+
+  <action>**Existing item preservation:** For each item in {{epic_stories}} and {{bug_stories}} whose ID IS in {{existing_backlog_map}}:
+    - Preserve the existing item's `priority` and `status` values from {{existing_backlog_map}}
+    - Update title from the source file (in case it was renamed)
+  </action>
+
+  <action>Assemble {{merged_items}} = all items from {{epic_stories}} (with preserved or new priority/status) + all items from {{bug_stories}} (with preserved or new priority/status) + all items from {{orphaned_items}} (with existing priority/status preserved)</action>
+
+  <action>**Backlog-sprint conflict detection:** Set {{backlog_sprint_conflicts}} = list of items that were in {{existing_backlog_map}} AND in {{sprint_item_ids}} (items found in both the backlog and a sprint — data integrity violation corrected by removing them from the backlog; sprint assignment takes precedence)</action>
+</step>
+
+<step n="6" goal="Sort and renumber backlog items by priority">
+  <action>Sort {{merged_items}} by the following criteria (most important first):
+    1. **Critical bugs first:** Items with type="bug" AND severity="critical" rank highest
+       - Among critical bugs: existing items ordered by their current priority (ascending); new critical bugs ordered by their position in the discovered bug file list (alphabetical by filename)
+    2. **Explicit priority (preserved from existing backlog):** Items that existed in the previous backlog are ranked by their preserved priority value (lower number = higher rank)
+    3. **New items by epic order:** New items (not in existing backlog) are ranked by their epic number (ascending), then by story number within the epic (ascending)
+    4. **Bugs without explicit priority:** New bugs (not in existing backlog) are appended after all stories, sorted by severity (high → medium → low → null)
+    5. **Orphaned items:** Orphaned items are appended last, maintaining their relative order
+  </action>
+  <action>Re-number priorities sequentially: assign priority = 1 to the first item, priority = 2 to the second, etc. (position 0 in array = priority 1)</action>
+  <action>Store as {{sorted_backlog}}</action>
+</step>
+
+<step n="7" goal="Build refreshed epics section">
+  <action>For each epic in {{parsed_epics}}:
+    - Look up the epic in the existing {{epics}} section by key (e.g., "epic-5")
+    - If the epic already exists: preserve its `status` and `retrospective` values. Do NOT downgrade status (e.g., if existing status is "in-progress" and the source implies "backlog", keep "in-progress").
+    - If the epic is new (not in existing epics): set status = "backlog", retrospective = "optional"
+  </action>
+  <action>Build {{refreshed_epics}} = map of all epics from the existing file PLUS any newly discovered epics. Existing epics not present in parsed_epics are preserved unchanged (do not remove epics — they may be in-progress or done).</action>
+</step>
+
+<step n="8" goal="Write sprint-status.yaml atomically">
+  <action>Assemble the complete file content:
+    1. Preserve top-level metadata: `generated`, `project`, `project_key`, `tracking_system`, `story_location` (unchanged)
+    2. Set `last_updated` = current ISO-8601 datetime string (e.g., "2026-04-06T10:00:00Z")
+    3. Write `epics` section from {{refreshed_epics}}
+    4. Write `backlog` section from {{sorted_backlog}} (array, ordered by priority)
+    5. Write `sprints` section from the preserved {{sprints}} section (verbatim, NO changes)
+  </action>
+  <action>Validate before writing:
+    - Every backlog item has all 7 required fields: id, type, epic, title, priority, status, severity
+    - priority values are sequential starting from 1 and match array position
+    - No item ID appears in both backlog and any sprint's items array (single-location invariant)
+    - Every epic has both status and retrospective fields
+  </action>
+  <action>Write the assembled content to `{resolved_sprint_status_path}` as a single atomic write (read-modify-write pattern)</action>
+</step>
+
+<step n="9" goal="Report summary">
+  <output>
+## Generate Backlog — Complete
+
+**Backlog section refreshed in `sprint-status.yaml`**
+
+| Metric | Count |
+|--------|-------|
+| Total stories from epics.md | {{epic_story_count}} |
+| Total bugs from bug-*.md | {{bug_count}} |
+| New items added to backlog | {{new_items_count}} |
+| Existing items preserved | {{preserved_count}} |
+| Items excluded (sprint-assigned) | {{sprint_excluded_count}} |
+| Items excluded (archived in done/) | {{done_excluded_count}} |
+| Items corrected (removed from backlog — already in sprint) | {{backlog_sprint_conflicts.length}} |
+| Total backlog items | {{total_backlog_count}} |
+
+{{#if backlog_sprint_conflicts}}
+⚠️ **Data integrity corrections:**
+The following items were found in both the backlog and a sprint. They have been removed from the backlog (sprint assignment takes precedence):
+{{#each backlog_sprint_conflicts}}
+- {{id}} — {{title}}
+{{/each}}
+
+{{/if}}
+{{#if orphaned_items}}
+### Orphaned Items (WARNING — Human Review Required)
+
+The following items exist in the backlog but were NOT found in `epics.md` or any `bug-*.md` file. They have been kept in the backlog but should be reviewed:
+
+{{#each orphaned_items}}
+- `{{id}}` — {{title}} (priority: {{priority}}, status: {{status}})
+{{/each}}
+
+These items may represent: renamed stories, deleted epics, or manually added items. Remove them manually if they are no longer needed.
+{{/if}}
+
+**Next steps:**
+- Use `/prioritize-backlog` to reorder items
+- Use `/add-to-sprint` to assign items to a sprint
+- Use `/bmad-sprint-planning` to plan a full sprint
+  </output>
+</step>
+
+</workflow>

package/lib/bmad-extension-plugin/skills/generate-backlog/bmad-skill-manifest.yaml

@@ -0,0 +1,3 @@
+type: skill
+name: generate-backlog
+module: ma-skills

package/lib/{bmad-extension/skills/bmad-ma-agent-cyber → bmad-extension-plugin/skills/ma-agent-cyber}/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: bmad-ma-agent-cyber
+name: ma-agent-cyber
 description: Cyber Agent (Yael) — Cybersecurity analyst specializing in vulnerability assessment, compliance, and security hardening
 ---
 

package/lib/{bmad-extension/skills/bmad-ma-agent-cyber → bmad-extension-plugin/skills/ma-agent-cyber}/bmad-skill-manifest.yaml

@@ -1,5 +1,5 @@
 type: agent
-name: bmad-ma-agent-cyber
+name: ma-agent-cyber
 displayName: Yael
 title: Cyber Analyst
 icon: "\U0001F6E1\uFE0F"