This commit enhances the internal review process by adding three critical review criteria that align with industry-standard automated code review practices.
New review criteria:
- **Security Vulnerabilities**: Checks for input validation, authentication issues, data exposure, and hardcoded secrets
- **Performance Impact**: Identifies N+1 queries, memory leaks, inefficient algorithms, and excessive resource usage
- **Architecture Compliance**: Validates separation of concerns, SOLID principles, and established architectural patterns
The expanded criteria bring BMAD's review process in line with tools like SonarQube and ESLint, ensuring comprehensive code quality assessment across functionality, security, performance, and architecture dimensions.
Updated review summary template to capture learnings from all six criteria, providing richer project memory synthesis and better guidance for future development.
This commit updates the complexity assessment system from a 1-10 scale to the industry-standard Fibonacci scale (1, 2, 3, 5, 8, 13), aligning BMAD with Agile best practices.
Key changes:
- Updated agentThresholdStory from 6 to 5 (Fibonacci equivalent)
- Updated agentThresholdTask from 7 to 8 (Fibonacci equivalent)
- Added Fibonacci complexity guidelines to help agents make consistent assessments
- Modified task instructions to reference Fibonacci scale instead of 1-10
This change ensures consistency with industry standards that most development teams already understand, while maintaining the same relative complexity thresholds for triggering review processes.
This commit enhances the resilience of the `implement-story-with-review` task by adding a graceful fallback mechanism for when the agent cannot access the internet.
Previously, the "Dependency & Standards Analysis" step assumed that an internet connection was available to research modern best practices. This would cause the agent to fail or hang in offline or restricted environments.
The workflow has been updated as follows:
1. The agent now *attempts* to perform the internet search.
2. If the search fails due to a lack of connectivity, it will:
- Inform the user of the situation.
- Ask the user if they want to enable access or if it should proceed using only its existing training data.
- Halt and wait for explicit user confirmation before continuing.
This change prevents the agent from getting stuck and empowers the user to make an informed decision, making the entire process more robust and suitable for a wider range of development environments.
This commit refactors the `implement-story-with-review` task to close a critical logic flaw.
Previously, the task-level complexity check was only performed if the entire story was already in "Review Mode." This created a blind spot where a complex task could go unreviewed if it was part of a story deemed "simple."
The workflow has been updated to a single, unified execution path:
1. The initial story-level complexity assessment now only serves to log a general "state of caution."
2. The task-level complexity check against `agentThresholdTask` is now **mandatory for every task in every story**, regardless of the initial mode.
This ensures that no complex task can be implemented without triggering the internal review process, making the agent's workflow more robust and reliable.
This major feature evolves the Developer Agent from a simple task executor into a context-aware engineer by introducing a new, intelligent workflow and a persistent project memory system.
The new workflow, encapsulated in the `implement-story-with-review` task, consists of two primary phases:
1. **Analysis & Review Phase:**
- Before implementation, the agent proactively analyzes the codebase using semantic search to find reusable patterns and components.
- It assesses story and task complexity against configurable thresholds (`agentThresholdStory`, `agentThresholdTask` in `core-config.yml`).
- For complex tasks, it enters a "Review Mode" and uses an internal "Reviewer" persona to self-critique its own code for duplication, errors, and standards alignment before proceeding.
2. **Memory Synthesis Phase:**
- Upon successfully completing a story, the agent automatically performs a holistic scan of its own developer notes.
- It distills explicit "Lessons Learned" and implicit knowledge into general, actionable rules.
- These memories are validated against existing knowledge to prevent contradictions and are then intelligently upserted into a new, shared `bmad-project-memory.md` file.
**Supporting System Changes:**
- **Orchestrator:** The `bmad-orchestrator` now loads the `bmad-project-memory.md` file on startup, providing all agents with shared, evolving project context.
- **Installer:** The BMAD installation process has been updated to correctly scaffold the new `.bmad-core/data/bmad-project-memory.md` file into new projects, ensuring the feature is available out-of-the-box.
This creates a powerful, real-time learning loop, enabling the AI team to improve and adapt based on project-specific experience, leading to higher-quality and more consistent code.
kevlingo