✨ Headline

bmad-loop lands as an installable module, and the automator that came before it steps aside. bmad-loop — the successor project for unattended dev-loop orchestration, adversarial review, and deferred-work sweeps — is now selectable straight from the installer picker, driven by the new bmad-dev-auto skill: a single-iteration unattended worker that clarifies intent, creates or resumes a spec, implements, reviews, and finalizes, all off a spec-frontmatter state machine an orchestrator can poll. bmad-automator, the experimental predecessor, is now deprecated in its favor.

Also in this release: party-mode gets an anti-consensus room and two sync fixes, the code-review/edge-case-hunter pipeline gets sharper severity triage and a named-set generalization pass, and bmad-investigate is retired.

💥 Breaking Changes

• bmad-automator deprecated, replaced by bmad-loop (#2532). New installs no longer show BMad Automator in the picker. Existing installs are untouched and keep showing, with a migration hint pointing to BMad Loop. If you're on Automator, plan the move to bmad-loop.

🎁 Features

• bmad-loop — new marketplace module (#2532). BMad's unattended-dev orchestrator ships as an opt-in installer module (bmad-loop, not selected by default). Its skills live behind a .claude-plugin/marketplace.json rather than a normal module.yaml folder, so the installer gained a marketplace-plugin registry flag that routes it through the existing custom-plugin resolver, and now fails loudly instead of installing an empty module if resolution comes up short. Installing the module only stages files — finish setup by running the bmad-loop-setup skill, which installs the orchestrator and wires up per-project hooks and policy; automation doesn't run until that completes. A new post-install-message registry field surfaces this instruction right after install (blocking on interactive installs so it isn't missed, non-blocking with --yes).
• bmad-dev-auto — new unattended workflow skill (#2500 and nine follow-ups). A Quick Dev sibling built to keep moving without a human in the loop, driven entirely off spec-frontmatter status so an orchestrator like bmad-loop can poll it. Hardened through the release: an append-only review-triage log with loopback tracking (#2505); an end-of-run commit so the worktree stays clean into the next iteration (#2506); a fix to the Blind Hunter reviewer, which was wrongly denied project access ("blind" means blind to intent, not to the codebase) (#2507); re-entry on a completed spec to trigger a fresh follow-up review pass (#2508); a final_revision recorded in frontmatter at exit, the only link back from an out-of-tree spec to its in-tree commits (#2522); a closed gap where Finalize could leave status: draft on an otherwise-done run (#2536); and a hardened contract requiring subagents to be invoked synchronously, since there's no event loop to resume a yielded turn (#2543). Reference doc at docs/reference/dev-auto.md (#2519), retitled "Autonomous Development Loops" (#2521). Some of the same prompt fixes were backported to Quick Dev (#2501).
• party-mode: anti-consensus club (#2530). New built-in persona group (Wildcard, Level, Killjoy, Splinter) for decision rooms that resist fast agreement while keeping a human in control. Launch with --party=anti-concensus-club, and use --mode subagent for best results. These can be configured as defaults if you use bmad customize and specify that.
• Two new elicitation methods: Subtraction and Map Is Not the Territory (#2515). Subtraction counters additive bias; Map Is Not the Territory guards against over-trusting a lossy model.
• Edge Case Hunter: named-set generalization pass (#2524). Catches diffs that special-case some members of a fixed set (enum, status code, sentinel, flag) while leaving the rest as silent unhandled branches. Measured catch-rate improvement of 50% to 100% on a real regression, at a 19% token cost per run.

🐛 Fixes

• party-mode stays interactive and the room stays in sync (#2531). Fixes a bug, observed under Codex, where a runtime treated the opening prompt as one-shot and closed spawned agents once satisfied. Party mode is open-ended by default now, ending only on explicit signal, with an opt-in --non-interactive flag; standing agents are kept alive and resumed rather than dropped.
• party-mode: agent-team sync corrected to point-to-point (#2539). Claude Code Agent Teams communicate mailbox-style, not over a shared broadcast channel, so an idle member doesn't see exchanges it isn't addressed in. Docs updated so the lead relays turns; subagent mode, which is genuinely broadcast, is unchanged.
• Code-review triage severity calibration hardened (#2523). Requires reading surrounding source (call sites, guards) before rating severity instead of judging from the diff hunk alone, fixing over-rated unreachable findings, and drops a "prefer conservative when uncertain" tie-breaker that was inflating severity.
• Deletion audit folded into Edge Case Hunter (#2525). Retires the standalone deletion-contract auditor layer, which added cold-start cost for near-zero yield, in favor of a gated deletion check inside Edge Case Hunter's existing turn.
• Review layer invocation normalized (#2526). Removes stale "no access/control" wording from code-review/quick-dev/dev-auto prompts and normalizes Blind Hunter / Edge Case Hunter invocation phrasing.
• Installer accepts Windows custom module paths (#2511). Local paths like C:\modules\foo, C:/modules/foo, and .\foo no longer fall through to the Git-URL parser and get rejected.
• bmad-help reads central config (#2541). Its config data source now goes through the shared four-layer TOML resolver instead of legacy config.yaml/user-config.yaml, fixing communication_language and project_knowledge not reaching the skill.

📚 Docs

• bmad-forge-idea wording tightened (#2513). Overview, session, persona, and exit language rewritten more directly; no behavior change.
• validate-skills exempts deprecated skills from the trigger-phrase check (#2486). Thin compatibility shims (bmad-create-prd, bmad-edit-prd, bmad-validate-prd, bmad-create-architecture) intentionally omit a trigger phrase to steer users to their replacement.

🗑️ Removed

• bmad-investigate retired. It reached the same conclusions as plain investigation at higher cost; the case-file artifact didn't justify the overhead.

✨ Headline

Reasoning skills get sharper and orchestration gets a memory.

bmad-forge-idea is a new core skill that takes a half-formed idea and pressure-tests it one Socratic question at a time — with an adversarial attack mode and optional persona rooms — until the idea hardens, proves out, or dies cheaply.

bmad-architecture lands as a ground-up rewrite of the old multi-step create-architecture flow: a lean spine (ARCHITECTURE-SPINE.md) that is the source of truth, intent-based routing (Create/Update/Validate), a breadth-coverage rubric so no dimension is silently skipped, and an opt-in reviewer gate.

party-mode is reborn with creatable, savable custom parties, optional party memory, and many pacing and dynamics improvements.

Under the hood: a canonical shared memlog (_bmad/scripts/memlog.py) replaces per-skill decision logs and is now the standard working-memory primitive across the suite. The installer now checks for uv and reframes it as the standard way to run BMAD's Python scripts (uv run). Plus an Astro 6 security upgrade clearing 8+ Dependabot advisories and two new platform targets.

⚠️ Upcoming Breaking Change (in v7) — standardizing on uv

The industry is converging on uv for running Python, and BMAD is following. Today our skills use a mix of uv run and direct python3 invocation. In the v7 release, every skill that runs a Python script will standardize on uv run instead of calling python3 directly — uv provisions the interpreter and manages dependencies, so scripts run consistently regardless of what's on your PATH.

What to do now: install and set up uv (docs) — or just ask your AI agent to "install and set up uv for me." Starting this release the installer checks for it and points you to setup if it's missing. uv is not yet required but without it some skills may have degraded performance or a shim AGENTS.md (or similar) or rule will need to be added to your environment to tell the agent when it sees uv run to use python3 instead. The best course of action though at this time is to install uv. A missing uv still warns rather than blocks, but it will be the assumed default in v7. Custom skills and overrides that shell out to python3 should plan to migrate to uv run.

🎁 Features

• bmad-forge-idea — new core skill (#2492). Domain-agnostic idea pressure-testing for the analysis phase: Socratic, one-question-at-a-time interrogation with an adversarial attack mode and optional persona rooms resolved from the installed roster. Hardens or kills an idea cheaply; emits memlog residue and an optional brief that feeds bmad-spec or bmad-quick-dev. Interactive only (menu code FI).
• bmad-architecture — lean spine rewrite (#2467, #2475). Replaces the fixed-step bmad-create-architecture (retained as a forwarding shim, removed in v7) with intent-based routing across five entry shapes (raw idea, large doc, codebase, feature slice, existing spine). The spine (ARCHITECTURE-SPINE.md) is the source of truth and SPEC.md is derived from it. Adds a breadth-coverage rubric (every altitude-owned dimension decided/deferred/open), an opt-in reviewer gate that scales lenses to rigor, and a full non-interactive headless mode. lint_spine.py hardened with fence-blanking, robust column detection, and 28 regression tests.
• party-mode: configurable parties + persistent memory (#2479, #2484). Custom personas (party_members) and named rooms (party_groups, with optional scenes), four run modes (auto/session/subagent/agent-team), and a preloaded "Code Review Crew" of five adversarial lenses. Each party keeps append-only session memory under {memory_dir}/<party_id>/ so sessions resume with prior context; ad-hoc casts stay ephemeral.
• bmad-brainstorming: facilitation modes + visual composer (#2445). Three modes (Facilitator / Creative Partner / Ideate for me), append-only memlog with optional --by authorship attribution, and a self-contained brain-selector.html composer (technique strategy, category chips, filter, copy-to-clipboard, dark mode). Catalog grows to 108 techniques (8 new classics: HMW, JTBD, Empathy Map, Backcasting, TRIZ, Fishbone, Build on What Works, Scenario Cross) plus a convergence phase.
• Canonical shared memlog script (#2462). New src/scripts/memlog.py — append-only chronological working memory with init/append/set ops, no lifecycle-status design, Python 3.8+ support, 30 tests. Any skill can call it at runtime.
• Retrospective action items tracked in sprint-status (#2465). The retrospective step appends an action_items section to sprint-status.yaml; sprint-status validates and surfaces open items, and sprint-planning preserves them on regenerate.
• Installer checks for uv and reframes it as the standard (#2495). Replaces the old python3 probe with a uv check, adds a heads-up to the install intro and a tip to the "BMAD is ready" summary, and updates docs/script docstrings (en/fr/vi-vn) to frame uv run as the standard and python3 as the transition fallback. Migration-friendly: a missing uv warns and points you to setup, never blocks. See the Upcoming Breaking Change note above.
• New installer platform targets: hermes-agent and CodeWhale (#2489, #2459). hermes-agent added as a tool target; CodeWhale uses .codewhale/skills/ (project) and ~/.codewhale/skills/ (global), both with test coverage.

🐛 Fixes

• Astro 6 security upgrade clears Dependabot alerts (#2493). Astro 5.18.1 → 6.4.6 and Starlight 0.37.5 → 0.40.0 (8 XSS/SSRF advisories), esbuild pinned to 0.28.1 (Windows dev-server file read), markdown-it 14.2.0 (smartquotes ReDoS), brace-expansion 5.0.6 (range DoS). Docs content config migrated to src/content.config.ts; page output verified identical to baseline.
• Guard WSL installs from Windows Node (#2470). Detects and prevents a Windows node.exe being used inside WSL, where it would silently fail.
• Remove empty skill-group dirs after install (#2461). Prunes empty parent dirs (e.g. _bmad/bmm/1-analysis) left after skill cleanup, with a path-boundary check to avoid sibling-dir collisions.
• bmad-create-epics-and-stories discovers bmad-ux spine outputs (#2446). Prerequisites now recognize DESIGN.md / EXPERIENCE.md alongside the legacy ux-spec.md.
• Pass diff inline to the blind-hunter reviewer (#2463). Diff output is passed inline in the subagent prompt rather than via a file the reviewer can't read, preventing context-starved hallucination.
• Website: nav height for dual announcement banners (#2473). Fixes layout crowding when two banners show at once.
• Workflow clarity & numbering — clarify quick-dev subagent use across code-review/create-story/quick-dev (#2450), renumber retrospective steps (#2448).

✨ Headline

New planning shapes lead this release. bmad-ux replaces the old single-spine UX skill with a two-spine contract: DESIGN.md (visual identity, Google Labs spec) and EXPERIENCE.md (behavior, flow, IA). bmad-spec distills any messy intent (brain dump, PRD, transcript, brief) into a tight five-field SPEC.md kernel that any downstream skill can consume. Both extend the streamlined Create/Update/Validate + Fast/Coaching template that bmad-prd and bmad-product-brief set in v6.7.0. The handoff from design into engineering is now a sealed file contract, not a translation layer.

Also shipping: Web Bundles for Gemini Gems and ChatGPT Custom GPTs (bmadcode.com/web-bundles) bring six planning bundles to non-IDE users with full IDE schema parity. bmad-automator (story automation) lands on the next channel. bmad-method-ui ships a community-alpha VS Code dashboard + standalone Next.js web UI. 19 new elicitation techniques arrive. Plus a long tail of installer and activation fixes.

💥 Breaking Changes

• bmad-create-ux-design replaced by bmad-ux. Single design.md spine is gone. New skill emits DESIGN.md (visual tokens per the Google Labs spec) and EXPERIENCE.md (behavior, flow, IA, states, a11y), with EXPERIENCE.md referencing DESIGN.md tokens via {path.to.token} syntax. Adds named-protagonist journeys, surface-closure validation, opt-in reviewer gate, and an extensible producer-handoff registry (default: Stitch). Installer auto-removes the legacy skill. PRD and brief templates aligned (form-factor probe, named-protagonist UJs, no standalone Primary Persona) (#2413)
• bmad-distillator retired, superseded by bmad-spec. Promoted to core because the kernel pattern is domain-agnostic. Installer cleans up automatically. No internal pipelines called it, but custom workflows must switch to bmad-spec.

🎁 Features

• Web Bundles v6 shelf: Six bundles purpose-built for Gemini Gems and ChatGPT Custom GPTs. Brainstorming (60 techniques, 10 categories), Product Brief (Create/Update/Validate, Fast/Coaching paths), PRFAQ (Working Backwards, 4 stages, weasel-word challenge), PRD (Vision- or Journey-led, 7-dimension validation), UX (two-spine, Don Norman framing, Stitch handoff), Market & Industry Research (Deep Research + Porter + Christensen). Full schema parity with IDE skills so Gem ↔ IDE handoffs do not break. bmadcode.com/web-bundles is the single supported install path (#2421, #2423, #2425)
• Web Bundle release packager: tools/bundle-web-bundles.js zips each bundle into dist/web-bundles/{slug}.zip for GitHub Release attachment. web-bundles/bundles.json carries persona, copy, accent color, knowledge files, and platform feature flags (web-browsing, deep-research, Stitch). Zero deps; execFileSync + strict slug regex (^[a-z0-9][a-z0-9-]*$) eliminates shell-injection surface (#2424)
• bmad-spec, new core skill: Distills any intent (brain dump, PRD, transcript, brief) into SPEC.md with a five-field kernel (Problem, Capabilities, Constraints, Non-goals, Success signal). Catalogs, tables, diagrams, and editorial-voice content go to named companions; absorbed inputs land in a sources: list downstream skips. Eight-rule Spec Law with lean-prose discipline. Outputs to {output_folder}/specs/spec-{slug}/, works without bmm installed. Headless callers get JSON; interactive runs close conversationally (#2417)
• bmad-ux, spine-based UX skill: Rewrite around DESIGN.md (visual identity, Google Labs spec) + EXPERIENCE.md (behavior, flow, IA). Six-step activation matches bmad-prd and bmad-product-brief. Fast/Coaching modes. Opt-in reviewer gate (no auto-spend on parallel reviewers for hobby work). Per-category verdicts, no misleading headline grade. Ships three DESIGN.md examples (editorial/Linen & Logic, native mobile/Quill, web SaaS/Drift), two paired EXPERIENCE.md examples, one unpaired DESIGN.md modeling the pure Stitch handoff (#2413)
• 19 new advanced-elicitation techniques: New framing category plus additions across 7 categories (all 50 existing methods preserved). Highlights: Chain-of-Thought Scaffolding, Six Thinking Hats, Delphi Method, Inversion Analysis, Steelmanning, Morphological Analysis, Abstraction Laddering, Cascading Failure Simulation, Boundary & Edge Case Sweep (#2062)
• Docs sidebar-order validator: tools/validate-sidebar-order.js flags duplicates, gaps, missing fields, and translation drift across English and translated docs. Wired into docs:validate-sidebar. Locale-pattern detection prevents nested English subfolders from being silently excluded (#2409)

🐛 Fixes

• Skill activation guardrails strengthened across 23+ skills: LLM agents were short-circuiting activation sequences (INCLUDE → READ → RUN → CHECK → FILTER → CD) by guessing variables instead of executing in order, silently skipping append steps and on_complete hooks. New guardrail names prepend/append steps explicitly and requires confirmation. Applied to all BMM planning + execution skills, all persona agents (analyst, tech-writer, pm, ux-designer, architect, dev), and new skills (bmad-spec, bmad-ux) (#2398)
• Installer reads config.toml on re-run: loadExistingConfig only read legacy _bmad/<module>/config.yaml, so user-scoped answers (user_name, communication_language) written to _bmad/config.user.toml were ignored and users got re-prompted. Adds parseCentralToml; central toml read first, legacy yaml as fallback (#2411)
• Stale custom-source caches refreshed on quick-update: Quick-update now calls cloneRepo for every cached custom module, persists the real next ref, and atomically dedupes the refresh. When git fetch fails (network, deleted repo, revoked auth), the previous clone is preserved with a warning instead of being wiped (#2399)
• Shallow-clone default branch resolution: --depth 1 clones leave origin/HEAD stale, so git reset --hard origin/HEAD never pulled new commits. Now resolves the default branch via git symbolic-ref and resets against origin/<branch> explicitly, falling back to main (#2332)
• SSH Git URLs with nested group paths: Custom module installer parses GitLab subgroup and Gitea nested-team SSH URLs correctly (#2379)
• project_context defined in dev-story, sprint-planning, sprint-status: Skills referenced the variable without resolving it, producing unresolved expansions at activation in some configurations (#2422)
• Dev story baseline commits captured: Baselining records the commit set the story was scoped against, so reviews compare against a stable reference (#2403)
• Customization JSON written as UTF-8: Non-ASCII team names, product names, and editorial overrides survive a round trip through _bmad/custom/ (#2414)
• Brainstorming idea-flow stays collaborative: Agent was prematurely converging on its own preferred ideas instead of mirroring and expanding the user's. Collaborative posture restored (#2402)

📚 Docs

• bmad-investigate added to agent trigger tables: agents.md and named-agents.md now show the IN trigger and forensic-investigation capability on Amelia's row, closing a v6.7.0 gap (#2410)
• Web Bundles install framing and update/customize guidance: Drops misleading "one-click install" and "two files" claims; adds explicit Gem/GPT setup pattern and an "Updating and customizing" section: custom changes belong in the pasted instructions block, not the knowledge files, so updates do not clobber team customizations (#2423)
• Web-bundles install traffic centralized at bmadcode.com/web-bundles: README, web-bundles README, explanation, and how-to pages all point at the site as the single supported install path (#2425)
• Reference docs for bmad-spec: Full entry in docs/reference/core-tools.md (en); table-row stubs in cs/fr/vi-vn/zh-cn pending full translation

BMad web bundles for Google Gemini Gems and ChatGPT Custom GPTs.

Each ZIP contains a self-contained bundle ready to install:

• SKILL.md (knowledge file)
• INSTRUCTIONS.md (persona + protocol)
• Supporting data files (templates, validation checklists, CSVs)

Install guide: https://bmadcode.com/web-bundles/

🐛 Fixes

• Installer no longer errors when a previously installed module's source can no longer be found — In v6.7.0 the experimental BMad Automator module's installer code (the value used for its _bmad/<code>/ folder and manifest entry) was renamed from baut to automator. Anyone who had installed it under the old baut code saw quick-update fail with Source for module 'baut' is not available and risked having the existing install removed. The installer now detects installed modules that can no longer be resolved from any source, leaves them in place untouched, and continues the update. If you previously installed it as baut and want the renamed automator version, run npx bmad-method install, choose Modify BMAD Installation, and reselect BMad Automator; the old _bmad/baut/ directory can then be deleted manually

✨ Headline

PRD and Product Brief rebuilt as lean, outcome-driven facilitators called bmad-prd and bmad-brief. Both flagship planning skills now ship three first-class intents (Create / Update / Validate), support express and guided modes, drive elicitation rather than LLM-suggested filler, and adapt output to your needs. New PRD validation pipeline replaces the adversarial reviewer with a quality-rubric synthesis pass that emits both HTML and markdown reports. New bmad-investigate skill brings forensic, evidence-graded case files for bug triage, incident RCA, and unfamiliar-code exploration.

A new .decision-log pattern is implemented in this release that will track through workflows all decisions made from the start, allowing for easier continuation or later modifications, where memory of what was decided and why will be remembered.

The existing create, edit and validate prd skills still exist but internally will route to the single prd skill with the proper intent. These shims will be removed with the 7.0.0 release when similar updates are completed across all of v6.

The shape of the toml customizations is still the same, so if you make them for create already, it will still work. There are new fields supported also that can improve your experience with the new bmad-prd skill.

💥 Breaking Changes

• Community modules picker removed from the interactive installer. Previously installed community modules are preserved on update. Install community modules headlessly with --custom-source <git-url-or-path>, or wait for the forthcoming dedicated community installer.
• Remote marketplace registry fully retired. The installer makes zero network calls to bmad-code-org/bmad-plugins-marketplace. Both the official-registry fetch (registry/official.yaml) and the community-catalog fetch (registry/community-index.yaml, categories.yaml) are gone. CommunityModuleManager and RegistryClient are deleted. The bundled bmad-modules.yaml at the repo root is the single source of truth for which official modules appear in the picker. Per-module version bumps continue to happen in each module's own repo. Migration note: users with previously installed community modules will see them preserved in their manifest, but updates must be handled via --custom-source <url> going forward (a dedicated community installer is planned separately).

🎁 Features

• WDS (Whiteport Design Studio) now bundled in the official module picker. Selectable alongside BMM, BMB, BMA, CIS, GDS, and TEA without needing --custom-source.

• Refreshed display names and hints across all bundled modules. Shorter, clearer names; hints now describe what each module provides. TEA repositioned to sit directly after BMM in the picker.

• Registry entries can declare a plugin_name override. When a module's .claude-plugin/marketplace.json declares the plugin under a name different from the module's installer code (e.g., WDS uses bmad-wds), set plugin_name: <name> on the registry entry to match the marketplace plugin without falling back to the single-plugin heuristic.

• bmad-prd overhaul — Three intents (Create / Update / Validate); new Discovery shape (Brain dump → Stakes calibration → Working mode → mode-scoped work); capability-first or user-first modes; Essential Spine template plus Adapt-In Menu with authorized section invention for compliance, integration, hardware, SLAs, monetization, data governance; subagent web research default-on; rebuilt validation via PRD Quality Rubric → synthesis pass → HTML + markdown reports; cross-skill parity with bmad-product-brief (variable names, .decision-log.md, persistent_facts auto-loads project-context.md); headless mode with per-intent inputs and partial status (#2385, #2378)

• bmad-product-brief refactor — Streamlined from a five-stage scripted workflow to a single outcome-driven SKILL.md with Create / Update / Validate intents; inline discovery, elicitation, and review (no more scripted agent fan-outs); new assets/brief-template.md with adapt-aggressively guidance; finalize chain through bmad-distillator and bmad-help; JSON headless responses (#2370, #2371)

• New bmad-investigate skill — Forensic case investigation with evidence-graded findings (Confirmed / Deduced / Hypothesized), delegation discipline for large codebases, resume-on-collision logic; supports both defect-chasing and area-exploration modes (#2345 and follow-ups)

• Interactive directory prompt in installer — @clack/core AutocompletePrompt for install-path selection: Tab-cycles existing child dirs, accepts not-yet-created paths, validates raw input (#2387)

• OpenCode and GitHub Copilot pointer files — Generic installCommandPointers() mechanism driven by per-platform YAML. OpenCode gets .opencode/commands/<id>.md for every skill; Copilot gets .github/agents/<id>.agent.md for persona agents only (plus bmad-tea allowlist), keeping the Custom Agents picker uncluttered. Works for external modules automatically via skill-manifest.csv (#2324)

• BMad Automator (bma) registered — Bundled registry fallback gains source-root external-module support, enabling --modules bma (#2345)

🐛 Fixes

• Clear installer error on missing module definition — findExternalModuleSource() throws an actionable error naming the module, missing path, and channel, with a suggested --next=<code> recovery path, replacing a silent ENOENT in getFileList (#2377)
• bmad-product-brief Update/Validate discipline — Headless Update now requires decision-log entry + addendum before modifying brief.md; distillate regeneration is mandatory; Validate always returns "offer_to_update": true; eval expectations tightened (#2371)
• Module help catalog directional clarity — Renamed after/before columns (and JSON manifest keys) to preceded-by/followed-by to eliminate ambiguity that was causing dependency-direction flips; required retains hard-gate semantics (#2360)
• bmad-help removed from Copilot Custom Agents picker — Not a true agent; every persona already advertises it on activation (#2359)
• bmad-investigate robustness — Collapsed multi-line description, unwrapped case-file template, tightened PRD discovery glob (review follow-ups)
• Dependency security audit — Lockfile-only fixes closed 12 of 14 open Dependabot alerts (vite, postcss, h3, yaml, brace-expansion, picomatch, astro, others). Two astro <6.1.10 alerts and one markdown-it (via markdownlint-cli2) deferred pending major bumps (#2382)

📚 Docs

• New docs/explanation/forensic-investigation.md (EN + FR) explaining the bmad-investigate workflow and evidence-grading discipline; workflow maps updated in both languages
• Installer prerequisite docs updated across README, install/upgrade/non-interactive/tutorial guides and FR / CS / ZH-CN / VI-VN translations to advertise Node.js 20.12+ (#2387)

💥 Breaking Changes

• --tools none is no longer accepted; fresh --yes installs now require an explicit --tools <id>. Existing-install flows are unchanged. Run npx bmad-method --list-tools to see supported IDs (#2346)
• project_name has moved from [modules.bmm] to [core] in config.toml. Existing installs are auto-migrated on next install/update — no manual action required (#2348)

🎁 Features

• Non-interactive config for CI/Docker — new --set <module>.<key>=<value> (repeatable) and --list-options [module] flags allow installer configuration without prompts. Routes values to the correct config file with prototype-pollution defenses (#2354)
• Brownfield epic scoping — Create Epics and Stories workflow now detects file-overlap between epics and applies an Implementation Efficiency principle plus a design completeness gate, reducing unnecessary file churn (#1826)

🐛 Fixes

• Custom module installer — Azure DevOps URLs now parse correctly with multi-segment paths and _git prefixes (#2269); HTTP (non-HTTPS) Git URLs are preserved for self-hosted servers (#2344); community installs route through PluginResolver so marketplace plugins with nested module.yaml install all skills (#2331); URL-source modules resolve from disk cache on re-install instead of warning (#2323); local --custom-content modules resolve correctly and [modules.<code>] TOML keys use the module code rather than display name (#2316); --yes with --custom-source now runs the full update path so version tags are respected (#2336)
• Installer safety — --list-tools flag added; empty/typo'd tool IDs rejected with specific errors (#2346)
• Channel and dist-tag handling — installer launched from a prerelease (e.g. @next) now defaults external module channels to next instead of silently downgrading to stable (#2321); stable publishes advance the @next dist-tag so prerelease users no longer leapfrog or miss update notifications (#2320)
• Architecture validation gate — step-07 validation template no longer ships pre-checked; status field is now templated against actual checklist completion (#2347)
• bmad-help data integrity — bmad-help.csv is no longer transformed at merge time and is emitted in its documented schema; 31 misaligned rows in core/bmm module-help.csv repaired (#2349)
• Config robustness — malformed module.yaml (scalars, arrays) is now rejected before crash (#2348)
• Legacy cleanup — pre-v6.2.0 wrapper skills (bmad-bmm-*, bmad-agent-bmm-*) are removed automatically on upgrade so they no longer error with missing-file warnings (#2315)

📚 Docs

• Complete Chinese (zh-CN) translations for named-agents.md and expand-bmad-for-your-org.md; localized BMad Ecosystem sidebar (CIS, BMB, TEA, WDS) across zh-cn, vi-vn, fr-fr, cs-cz (#2355)

🎁 Features

• Support for 18 new agent platforms: AdaL, Sourcegraph Amp, IBM Bob, Command Code, Snowflake Cortex Code, Factory Droid, Firebender, Block Goose, Kode, Mistral Vibe, Mux, Neovate, OpenClaw, OpenHands, Pochi, Replit Agent, Warp, Zencoder — bringing total supported platforms to 42 (#2313)
• All platforms that support the cross-tool .agents/skills/ standard now use it (#2313)

✨ Headline

Full agent and workflow customization across the entire BMad Method. Every agent and workflow in BMM, Core, CIS, GDS, and TEA can now be customized via TOML overrides in _bmad/custom/. Customize agents to apply tooling, version control, or behavior changes across whole groups of workflows. Drop in fine-grained per-workflow overrides where you need them. Built for power users who want BMad to fit their stack without forking.

Stable and bleeding-edge release channels, standardized across all modules. Pick stable or next per module, pin specific versions, and switch channels interactively or via CLI flags (--channel, --all-stable, --all-next, --next=CODE, --pin CODE=TAG). Same model across BMM, Core, and every external module.

💥 Breaking Changes

• Customization is now TOML-based; the briefly introduced YAML-based customization is no longer supported (#2284, #2283)

🎁 Features

Customization framework

• TOML-based agent and workflow customization with flat schema, structural merge rules (scalars, tables, code-keyed arrays, append arrays), and persistent_facts unification (#2284)
• Central _bmad/config.toml surface with four-file architecture (config.toml, config.user.toml, custom/config.toml, custom/config.user.toml) for agent roster and scope-partitioned install answers (#2285)
• customize.toml support extended to 17 bmm-skills workflows with flattened SKILL.md architecture and standardized [workflow] block (#2287)
• customize.toml extended to all six developer-execution workflows: bmad-dev-story, bmad-code-review, bmad-sprint-planning, bmad-sprint-status, bmad-quick-dev, bmad-checkpoint-preview (#2308)
• bmad-customize skill — guided authoring of TOML overrides in _bmad/custom/ with stdlib-only resolver verification (#2289)
• Wire on_complete hook into all 23 workflow terminal steps with full customize.toml documentation (#2290)

Release channels & installer

• Channel-based version resolution for external modules with interactive channel management (stable / next / pinned) and CLI flags (--channel, --all-stable, --all-next, --next=CODE, --pin CODE=TAG) (#2305)
• GitHub API as primary fetch with raw CDN fallback in installer registry client to support corporate proxies (#2248)

Other

• Kimi Code CLI support for installing BMM skills in .kimi/skills/ (#2302)
• bmad-create-story now reads every UPDATE-marked file before generating dev notes so brownfield stories preserve current behavior instead of improvising at implementation time (#2274)
• Sync sprint-status.yaml from quick-dev on epic-story implementation with idempotent writes tracking in-progress and review transitions (#2234)
• Enforce model parity for all code review subagents to match orchestrator session capability for improved rare-event detection (#2236)
• Set team: software-development on all six BMM agents for unified grouping in party-mode and retrospective skills (#2286)

🐛 Bug Fixes

• PRD workflow no longer silently de-scopes user requirements or invents MVP/Growth/Vision phasing; requires explicit confirmation before any scope reduction (#1927)
• Installer shows live npm version for external modules instead of stale cached metadata (#2307)
• Resolve external-module agents from cache during manifest write so agents land in config.toml (#2295)
• Fix installer version resolution for external modules with shared resolver preferring package.json > module.yaml > marketplace.json (#2298)
• Replace fs-extra with native node:fs to prevent file loss during multi-module installs from deferred retry-queue races (#2253)
• Add move() and overwrite support to fs-native wrapper for directory migrations during upgrades (#2253)
• Stop skill scanner from recursing into discovered skills to prevent spurious errors on nested template files (#2255)
• Source built-in modules locally in installer UI to preserve core and bmm in module list when registry is unreachable (#2251)
• Remove dead Batch-apply option from code-review patch menu and rename apply options for clarity (#2225)

♻️ Refactoring

• Remove 1,683 lines of dead code: three entirely dead files (agent-command-generator.js, bmad-artifacts.js, module-injections.js) and ~50 unused exports across installer modules (#2247)
• Remove dead template and agent-command pipeline from installer; SKILL.md directory copying is the sole installation path (#2244)

📚 Documentation

• Sync and update Vietnamese (vi-VN) docs with missing pages and refreshed translations (#2291, #2222)
• Sync French (fr-FR) translations with upstream, restore Amelia as dev agent, fix sidebar ordering (#2231)
• Add Czech (cs-CZ) analysis-phase.md translation; normalize typographic quotes (#2240, #2241, #2242)
• Add missing Chinese (zh-CN) translations for 3 documents (#2254)
• Update stale Analyst agent triggers and add PRFAQ link (#2238)
• Remove Bob from workflow map diagrams reflecting consolidation into Amelia in v6.3.0 (#2252)

💥 Breaking Changes

• Remove custom content installation feature; use marketplace-based plugin installation instead (#2227)
• Remove bmad-init skill; all agents and skills now load config directly from {project-root}/_bmad/bmm/config.yaml (#2159)
• Remove spec-wip.md singleton; quick-dev now writes directly to spec-{slug}.md with status field, enabling parallel sessions (#2214)
• Consolidate three agent personas into Developer agent (Amelia): remove Barry quick-flow-solo-dev (#2177), Quinn QA agent (#2179), and Bob Scrum Master agent (#2186)

🎁 Features

• Universal source support for custom module installs with 5-strategy PluginResolver cascade supporting any Git host (GitHub, GitLab, Bitbucket, self-hosted) and local file paths (#2233)
• Community module browser with three-tier selection: official, community (category drill-down from marketplace index), and custom URL with unverified source warning (#2229)
• Switch module source of truth from bundled config to remote marketplace registry with network-failure fallback (#2228)
• Add bmad-prfaq skill implementing Amazon's Working Backwards methodology as alternative Phase 1 analysis path with 5-stage coached workflow and subagent architecture (#2157)
• Add bmad-checkpoint-preview skill for guided, concern-ordered human review of commits, branches, or PRs (#2145)
• Epic context compilation for quick-dev step-01: sub-agent compiles planning docs into cached epic-{N}-context.md for story implementation (#2218)
• Previous story continuity in quick-dev: load completed spec from same epic as implementation context (#2201)
• Planning artifact awareness in quick-dev: selectively load PRD, architecture, UX, and epics docs for context-informed specs (#2185)
• One-shot route now generates lightweight spec trace file for consistent artifact tracking (#2121)
• Improve checkpoint-preview UX with clickable spec paths, external edit detection, and missing-file halt (#2217)
• Add Junie (JetBrains AI) platform support (#2142)
• Restore KiloCoder support with native-skills installation (#2151)
• Add bmad-help support for llms.txt general questions (#2230)

♻️ Refactoring

• Consolidate party-mode into single SKILL.md with real subagent spawning via Agent tool, replacing multi-file workflow architecture (#2160)

🐛 Bug Fixes

• Fix version display bug where marketplace.json walk-up reported wrong version (#2233)
• Fix checkpoint-preview step-05 advancing without user confirmation by adding explicit HALT (#2184)
• Address adversarial triage findings: clarify review_mode transitions, label walkthrough branches, fix terse commit handling (#2180)
• Preserve local custom module sources during quick update (#2172)
• Support skills/ folder as fallback module source location for bmb compatibility (#2149)

🔧 Maintenance

• Overhaul installer branding with responsive BMAD METHOD logo, blue color scheme, unified version sourcing from marketplace.json, and surgical manifest-based skill cleanup (#2223)
• Stop copying skill prompts to _bmad by default (#2182)
• Add Python 3.10+ and uv as documented prerequisites (#2221)

📚 Documentation

• Complete Czech (cs-CZ) documentation translation (#2134)
• Complete Vietnamese (vi-VN) documentation translation (#2110, #2192)
• Rewrite get-answers-about-bmad as 1-2-3 escalation flow, remove deprecated references (#2213)
• Add checkpoint-preview explainer page and workflow diagram (#2183)
• Update docs theme to match bmadcode.com with responsive logo and blue color scheme (#2176)