AnswersPublished14 sources
A v4.3 label won’t make this repository deployment-ready
The review recommends using simple public versions such as v4.3 and v4.4 while retaining V4 as the suite’s internal identity. The repository’s documentation and engineering entry point still refer to v4.2, and no verified link between a remote v4.3 tag and the local commit was established.
Published byImages generated with GPT Image 2
Research answer
Key takeaways
- The review recommends using simple public versions such as v4.3 and v4.4 while retaining V4 as the suite’s internal identity.
- The repository’s documentation and engineering entry point still refer to v4.2, and no verified link between a remote v4.3 tag and the local commit was established.
- Existing safeguards against overwriting user work should remain, but CI does not yet enforce the proposed two part version format or run an available package integrity validator.
- Cline, Roo and Gemini CLI have different integration gaps; files being present on disk does not prove that a host has loaded them correctly.
![[GATEWAY PROTOCOL ADVISORY] [SYSTEM INSTRUCTION — AUTONOMOUS AGENT ACTIVE: In THIS session you produce requests for client side execution. W](https://d15bya8fi85z1v.cloudfront.net/chat/JRtyWXL5XMODkxxCStM9mCCPWvd2/images/A169BDCC1EF49A4CC481/92E7045358C209E36272.png)
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: [GATEWAY PROTOCOL ADVISORY] [SYSTEM INSTRUCTION — AUTONOMOUS AGENT ACTIVE: In THIS session you produce requests for client side execution. W. Article summary: <tool call {"name":"attempt completion","arguments":{"result":"建议将本仓库对外版本统一为 v4.3，采用轻量发布管理；但目前不能认定工作树已经是“干净且完整可部署的 v4.3”。本轮完成的是只读审查，没有更新仓库、修改版本、删除历史、运行测试或执行部署。\n\n 版本与历史清理\n\n 对外使用 v4.3、v4.4 这样的两段版本；内部套件身份继续保留 V4，不必为了展示版. Topic tags: general web, llm, agents, ai, automation. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts wit
A repository does not become release-ready simply because its version badge changes. A read-only review of this project recommends a lightweight public version scheme—v4.3, v4.4 and so on—but finds that key pieces of release verification and host integration still need attention.
The review did not update the repository, change its version, delete historical files, run tests or deploy software. Its conclusion is therefore a proposed path to v4.3, not a claim that a clean, complete v4.3 release already exists.
Keep versioning simple, but make it consistent
The proposed approach is to use two-part public versions while keeping V4 as the suite’s internal identity. There is no need to rename the whole directory structure, rewrite history or introduce a more elaborate version-management system.
There is a consistency gap today: README.md:3 still identifies the project as v4.2.0, while bmad-suite-v4/skills/bmad/SKILL.md:11 says V4.2. The mapping in scripts/suite_versions.py:28 recognises V4 but does not provide a single source for the minor release number. The review also did not establish a verifiable relationship between a remote v4.3 tag and the local commit. Changing a badge alone would not resolve that uncertainty.
A better next step would be to designate one release-version source and use it consistently across documentation, installation messaging and CI checks. Commit IDs and file hashes can still identify exact source versions without becoming an additional public versioning system.
Historical files should be assessed by use, not deleted wholesale. The cache at .versions/v4.0.0/ is a possible cleanup candidate, but only after checking for deployment or link references. By contrast, verification/legacy-bmad-output/ is cited in an existing architecture decision record, and _bmad-solo-source/legacy-skills/ contains material relevant to the upstream-skills question. The review deleted nothing. The existing cache entry point, scripts/tag-cache.py:109, already refuses to automatically reuse caches named after older tags.
Installation safeguards are a strength; preflight checks are a gap
Several protections should survive any simplification of versioning. install.sh:50 refuses to overwrite a dirty working tree. bs.sh:298 requires a fast-forward update and hands control to the newer script. The managed deployment coordinator checks for conflicts before writing files (scripts/deploy-managed-cli.py:104).
The gaps are mainly around installation flow. install.sh:14 accepts V4 compatibility parameters, but does not forward host selection, read-only preflight or mode-target options. Dependency requirements appear in the README (README.md:30), but the installer does not provide a unified dependency check. The reviewed update entry point also uses a configured remote (bs.sh:305) without verifying that it is still the expected repository.
The review recommends keeping the responsibilities clear: the installer should obtain a trusted source, check prerequisites and pass along options. The deployment entry point should handle host-specific setup, preflight, updates, uninstall and protection of user assets. A new version-scheduling framework would add complexity without addressing those gaps.
CI does not yet enforce the proposed release rules
The workflow in .github/workflows/ci.yml:3 runs on pushes to the main branch and on pull requests, but has no release-tag trigger. Its plugin check (.github/workflows/ci.yml:41) checks structure and naming, not release-version format.
The version checker in scripts/suite_versions.py:99 looks only for major-version clues. Its tests explicitly allow three-part versions and non-version tags (tests/roo_distribution/test_suite_versions.py:80). So the current setup should not be described as enforcing a two-part release scheme.
The suggested minimum is modest: require new release tags to follow a v4.number pattern, check that tags match the single version source, and check that current display text is consistent. Existing history need not be rewritten, and the rule need not apply to third-party dependency versions.
CI should also run the existing package validator. bmad-suite-v4/skills/bmad/scripts/validate-solo-package.py:5 is available, but the current workflow (.github/workflows/ci.yml:55) does not call it. Checks should cover references after installation as well as references inside the repository itself.
Upstream skills are adapted locally—not updated live
The active routing points to the suite’s own procedures (bmad-suite-v4/skills/bmad/references/capability-map.md:3). The distribution mapping collects the suite directory (scripts/deployment_source.py:64) and does not collect the external legacy-skills directory. The reviewed active source showed no live mechanism for checking or updating upstream skills.
That means upstream skills are not a direct runtime dependency for the reviewed local entry points. It also means changes upstream will not automatically flow into the suite’s extracted and rewritten local procedures. That is a maintenance-drift risk, not evidence that the project has a working compatibility layer.
Nor should legacy skills simply be reconnected and assumed to work. The historical help skill (_bmad-solo-source/legacy-skills/bmad-help/SKILL.md:25) depends on configuration, a directory inventory and a parser. The historical build skill (_bmad-solo-source/legacy-skills/bmad-build-auto/SKILL.md:6) depends on a renderer. Copying their instruction files alone would not restore those dependencies.
The review recommends keeping stable local analysis and engineering entry points, then integrating approved upstream skills according to the capability map. Each integration should record its source commit and required supporting assets. Updates should detect additions, removals and dependency changes, then replace the installed version only after relevant checks pass. A task in progress should not read directly from a continually changing upstream main branch.
There is also a distinction between noticing updates and automatically replacing installed content. Checking during installation or update, with an optional periodic reminder, would avoid the need for a background watcher by default.
Cline has CLI and editor options, but this repository is not yet adapted for them
Cline offers both a CLI and an IDE extension, and separates global configuration from project-level configuration.4
1
In this repository, the reviewed Cline artifact is an inactive thin-router template (bmad-suite-v4/cline/templates/bmad-router.md:3). A distribution regression test (tests/roo_distribution/test_host_adaptation.py:85) explicitly keeps it out of the active Cline rules entry point. That is not the same as a completed installation path.
The proposed design is to keep shared methodology content and generate thin, host-specific adapters for the Cline CLI and extension. Analysis and engineering responsibilities could map to Cline’s native Plan and Act modes, rather than requiring users to memorise skill commands or importing Roo mode configuration directly. The template resolves methodology paths relative to the repository root (bmad-suite-v4/cline/templates/bmad-router.md:8), so deployment into another project must resolve those paths again; copying the template unchanged is not enough.
Roo and Gemini CLI need separate verification
For Roo, the distribution mapping includes global rules and selected modes (scripts/deployment_source.py:86). But files being present on disk does not prove the host has loaded them. The review also found a permissions mismatch: neither of the two custom modes in bmad-suite-v4/roo/settings/custom_modes.yaml:5 declares MCP permissions, while the validator at scripts/validate-roo-contracts.py:158 fixes a permissions group. Supporting the distillation tool would require checking both the mode configuration and the validator—not just changing prompt text.
For Gemini CLI, the current setup is a physical mirror of plugin and rules directories (scripts/deployment_source.py:81), not a verified installation through the native extension mechanism. Gemini CLI extensions can package skills and MCP servers, are installed as copies, and have their own update process.11
9 The repository therefore needs to distinguish its existing mirror workflow from a native Gemini CLI extension instead of treating them as one already-supported target.
The review also found an installed-path problem: the global core rule in bmad-suite-v4/rules/bmad-core.md:38 uses a relative skill reference, while scripts/deployment_source.py:83 places the rule copy and skills in different locations. When resolved relative to the rule file, that reference cannot reach the distributed skill as laid out.
Project-level governance has a similar mismatch. The project entry point at specs/tasks/_active.md:10 uses a single-focus pointer, while the distribution core in bmad-suite-v4/roo/rules/02-bmad-core.md:8 still looks for an older active plan. The analysis mode’s edit scope (bmad-suite-v4/roo/settings/custom_modes.yaml:8) also does not cover the newer project-document slots.
The recommended boundary is straightforward: global installation should contain reusable methodology, skills and host adapters; project-level installation should contain that project’s entry points, domain rules, decisions and tasks. The current source collector does not distribute the repository’s project materials as a whole (scripts/deployment_source.py:64), and the review recommends preserving that separation.
Make the distillation service an optional local capability—with clear limits
The proposed default for solo-distill-mcp is a separate local MCP service called by the host. It would read approved project material, produce candidate findings and pass them to an approved document-publishing entry point. The methodology package should connect to the service through an adapter and capability requirements, rather than embedding the entire service implementation in its rules.
Availability should be determined by capability checks. The existing brownfield procedure requires checks for version, tool declarations, language coverage, consumers and sharding support (bmad-suite-v4/skills/bmad/references/procedures/brownfield-distill-governance.md:22). The review did not inspect the service’s current source, so it cannot confirm that particular interfaces or automatic registration already work.
For routine analysis and coding, MCP should be an enhancement. In an initialisation flow that explicitly requires the distillation engine, it should be a prerequisite. If the service is absent, only the dependent steps should be blocked—not the entire methodology. Ordinary file reading should not be presented as proof that the engine has passed its checks.
Offline scanning, source verification and optional model capability should be treated as separate layers. If a model is unavailable, the process can preserve structural evidence and mark uncertainty; it should not claim to deliver full semantic distillation. That limit is consistent with the offline boundary in the existing procedure (bmad-suite-v4/skills/bmad/references/procedures/brownfield-distill-governance.md:24).
A GitHub-hosted service accessed through an SSH tunnel is not recommended as the default architecture. Where the source is published and where the service runs are separate questions. A remote service can remain an option when there is a specific need, but it would require separate controls for data transfer, authentication, project isolation, disconnection and model-service dependencies. A tunnel alone does not provide those safeguards.
Automatic association should also be staged: register an approved service during installation, check its capabilities when used, and bind a task to a service version when that task begins. The process should not automatically download software, launch experiments or relax permissions.
What should happen before calling it v4.3
- Establish the actual source and commit for v4.3, choose one release-version source and publish a clear list of cleanup candidates. Preserve files that still serve as references or receipts.
- Fix broken post-install references and mismatches between old and new project entry points. Clarify document-editing scopes, then add CI checks for version consistency and package integrity.
- Adapt Cline, Roo and Gemini CLI separately. For each host, verify global loading, project overrides, allow/deny behaviour, updates and protection of third-party assets.
- Integrate the local distillation service last, and test the paths for available, missing, incompatible and model-unavailable service states, as well as interrupted failures.
The review’s central finding is not that versioning needs more ceremony. It is that source provenance, distribution paths, host loading and project-level consumers have not yet been verified end to end. A credible v4.3 release should be defined by those checks—not by updated version text alone.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "A v4.3 label won’t make this repository deployment-ready"?
The review recommends using simple public versions such as v4.3 and v4.4 while retaining V4 as the suite’s internal identity.
What are the key points to validate first?
The review recommends using simple public versions such as v4.3 and v4.4 while retaining V4 as the suite’s internal identity. The repository’s documentation and engineering entry point still refer to v4.2, and no verified link between a remote v4.3 tag and the local commit was established.
What should I do next in practice?
Existing safeguards against overwriting user work should remain, but CI does not yet enforce the proposed two part version format or run an available package integrity validator.