💡 Agent Package Manager (apm.yml) Pilot for Vendored Agent Frameworks with Dependabot Updates

[github-actions[bot]]

Summary

Pilot Microsoft's Agent Package Manager (apm.yml plus apm.lock.yaml) in one downstream repo as the distribution channel for BMAD, personas and skills from .github-private/frameworks, replacing manual git-subtree refreshes. GitHub-native Dependabot apm version updates (GA Nov 3, 2026) would open the refresh PRs, and APM's install-time scanning and apm audit would catch hidden-Unicode tampering and hand-edits to the vendored copy.

Market Signal

On Nov 3, 2026 GitHub announced Dependabot version updates for Agent Package Manager, GA on all plans and regenerating apm.lock.yaml. microsoft/apm (about 4.3k stars) targets Claude Code, Copilot, Cursor and Codex, pins resolved sources with content hashes, scans every install for hidden Unicode, requires consent for transitive MCP servers, and exports CycloneDX/SPDX SBOMs.

User Signal

AGENTS.md mandates that BMAD is vendored as a git subtree, refreshed manually, with edits never made in the per-repo copy, and nothing enforces either rule. #1297 shows agents editing synced copies to 'fix' them. Related existing ideas #1026 (skill supply-chain vetting), #1027 (agent-config lockfile) and #1111 (agent config SBOM) asked for exactly the integrity, lockfile and SBOM properties APM now ships.

Technical Opportunity

standards/dependabot already templates per-ecosystem dependabot.yml, dependabot-automerge-reusable can gate apm PRs like any other ecosystem, and agent-shield can scan the lockfile-resolved output. apm.yml supports git shorthand with refs, so .github-private/frameworks can be the source with a scoped read token. apm audit in CI enforces 'never edit the per-repo copy' mechanically.

Assessment

Dimension	Score	Rationale
Feasibility	med	See Technical Opportunity
Impact	med	See User Signal
Urgency	med	See Market Signal

Adversarial Review

Strongest objection: APM is a young third-party tool from a competitor ecosystem. Adding it introduces a new supply-chain dependency (a pip-installed CLI) into the agent-config path you are trying to harden, and Dependabot covers version updates only, not security alerts.

Rebuttal: The pilot is scoped to one repo and is reversible, since the output is plain files equivalent to today's subtree. The CLI can be hash-pinned like every other pip tool here (pip-audit lock pattern). Version updates are exactly the missing piece, because the subtree has no update signal at all today. If the pilot fails (private-source auth, lockfile churn, Claude Code output fidelity), the result is a documented 'no' that closes #1027 and #1026 options cleanly.

Suggested Next Step

In a sandbox repo, write apm.yml pointing at .github-private/frameworks/bmad at a tag. Run apm install, diff against the current subtree, enable a Dependabot apm entry, and record auth, lockfile and audit behaviour in a short ADR under docs/initiatives/.