cohorte 1.0.0

package/install.sh

@@ -0,0 +1,301 @@
+#!/bin/sh
+#
+# install.sh — install the portable multi-agent pipeline.
+# POSIX sh (works with dash/bash/zsh).
+#
+#   Per-project install (default — bundles the core into <target>/.claude, committable):
+#     sh install.sh [target_dir]
+#     curl -fsSL <raw-url>/install.sh | sh
+#
+#   Global install (one core in ~/.claude, shared by every repo on this machine):
+#     sh install.sh --global
+#     curl -fsSL <raw-url>/install.sh | sh -s -- --global
+#
+#   Update the generic core in place (keeps any generated PIPELINE.md + rendered agents):
+#     sh install.sh --update [target_dir]
+#     sh install.sh --update --global
+#
+# Per-project install copies the core into <target>/.claude; global install copies it once
+# into ~/.claude and registers the gate hook there. Either way you then run `/init-pipeline`
+# in each repo to generate PIPELINE.md + render the surface agents. Update refreshes ONLY the
+# stack-agnostic files; generated profiles, rendered agents, gate-config.json and any project
+# settings.json are left untouched.
+
+set -eu
+
+REPO_URL="${PIPELINE_REPO:-https://github.com/TheBidouilleAgency/cohorte}"
+
+mode="install"
+scope="project"
+positional=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --update) mode="update"; shift ;;
+    --global) scope="global"; shift ;;
+    --)       shift; break ;;
+    -*)       echo "error: unknown flag: $1" >&2; exit 2 ;;
+    *)        positional="$1"; shift ;;
+  esac
+done
+target="${positional:-$PWD}"
+
+# --- locate the source (this checkout, or clone if piped via curl) ----------
+src=""
+self="${0:-}"
+self_dir=""
+case "$self" in
+  */*) self_dir=$(CDPATH= cd -- "$(dirname -- "$self")" && pwd) ;;
+esac
+if [ -n "$self_dir" ] && [ -d "$self_dir/core" ]; then
+  src="$self_dir"
+else
+  echo "→ fetching pipeline from $REPO_URL"
+  tmp=$(mktemp -d)
+  trap 'rm -rf "$tmp"' EXIT
+  git clone --depth 1 "$REPO_URL" "$tmp/pipeline" >/dev/null 2>&1
+  src="$tmp/pipeline"
+fi
+[ -d "$src/core" ] || { echo "error: pipeline source not found (no core/ in $src)" >&2; exit 1; }
+
+# --- resolve the destination .claude dir ------------------------------------
+if [ "$scope" = "global" ]; then
+  dest="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+else
+  dest="$target/.claude"
+fi
+mkdir -p "$dest"
+
+# version stamp so a per-repo pointer can record which core it expects:
+# the package.json semver, with the git sha for traceability on from-main installs
+semver=$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$src/package.json" 2>/dev/null | head -n 1)
+sha=$(git -C "$src" rev-parse --short HEAD 2>/dev/null || true)
+if [ -n "$semver" ] && [ -n "$sha" ]; then ver="$semver ($sha)"
+elif [ -n "$semver" ]; then ver="$semver"
+else ver="${sha:-unknown}"
+fi
+
+copy_core() {
+  cp -R "$src/core/commands"  "$dest/"
+  cp -R "$src/core/hooks"     "$dest/"
+  cp -R "$src/core/templates" "$dest/"
+  # 0.1.19 renamed questionnaire-domain-brief.md → research-brief.md; drop the stale copy.
+  rm -f "$dest/templates/questionnaire-domain-brief.md"
+  mkdir -p "$dest/pipeline/scripts"
+  cp "$src/profile/PIPELINE.template.md" "$dest/pipeline/"
+  cp "$src/profile/SCHEMA.md"            "$dest/pipeline/"
+  cp "$src/profile/cohorte.config.template.yaml" "$dest/pipeline/"
+  cp "$src"/scripts/*.template           "$dest/pipeline/scripts/"
+  cp "$src/core/agents/implementer.template.md" "$dest/pipeline/"
+  [ -f "$src/CHANGELOG.md" ] && cp "$src/CHANGELOG.md" "$dest/pipeline/"
+  printf '%s\n' "$ver" > "$dest/pipeline/VERSION"
+  chmod +x "$dest/hooks/gate.py" 2>/dev/null || true
+  scrub_tdd_gate
+}
+
+# The TDD gate was removed in 0.1.6. Older installs have hooks/tdd_gate.py on disk and
+# registered in settings.json — copy-over never deletes, and a registered hook whose file
+# is gone errors on every Write/Edit, so scrub both.
+scrub_tdd_gate() {
+  rm -f "$dest/hooks/tdd_gate.py"
+  [ -f "$dest/settings.json" ] || return 0
+  command -v python3 >/dev/null 2>&1 || return 0
+  python3 - "$dest/settings.json" <<'PY'
+import json, sys
+settings = sys.argv[1]
+try:
+    with open(settings) as fh:
+        data = json.load(fh)
+except Exception:
+    sys.exit(0)
+pre = data.get("hooks", {}).get("PreToolUse")
+if not isinstance(pre, list):
+    sys.exit(0)
+kept = [e for e in pre if not any(
+    h.get("command", "").strip().endswith("tdd_gate.py") for h in e.get("hooks", []))]
+if len(kept) != len(pre):
+    data["hooks"]["PreToolUse"] = kept
+    with open(settings, "w") as fh:
+        json.dump(data, fh, indent=2)
+        fh.write("\n")
+    print("  · removed the retired tdd_gate.py hook (file + settings registration)")
+PY
+}
+
+# the fixed (non-rendered) agents: the dev review/release pipeline agents
+copy_fixed_agents() {
+  mkdir -p "$dest/agents"
+  cp "$src/core/agents/review.md" "$src/core/agents/release.md" \
+     "$dest/agents/"
+  # 0.1.19 split the bi-mode questionnaire-researcher into research-agent + questionnaire-architect;
+  # copy-over never deletes, so scrub the retired agent lest a dead subagent_type linger.
+  rm -f "$dest/agents/questionnaire-researcher.md"
+  scrub_research_questionnaire
+}
+
+# The research + questionnaire capability was removed. Older installs have its agents, commands,
+# templates and template-step dirs on disk; copy-over never deletes, so scrub every orphan.
+scrub_research_questionnaire() {
+  rm -f "$dest/agents/research-agent.md" \
+        "$dest/agents/questionnaire-architect.md" \
+        "$dest/agents/questionnaire-writer.md" \
+        "$dest/agents/questionnaire-validator.md" \
+        "$dest/commands/research.md" \
+        "$dest/commands/questionnaire.md" \
+        "$dest/templates/research-brief.md" \
+        "$dest/templates/questionnaire-blueprint.md" \
+        "$dest/templates/questionnaire-declaration.md" \
+        "$dest/templates/questionnaire-verdict.md"
+  rm -rf "$dest/templates/steps/research" "$dest/templates/steps/questionnaire"
+}
+
+# pipeline capability config is USER-level (vault, Notion DB, kanban boards) — it lives in
+# ~/.claude regardless of install scope. Seed it only if neither the consolidated nor the
+# legacy copy exists. This piped installer is non-interactive: it seeds disabled defaults;
+# /init-pipeline + /update-pipeline wire it (npx's installer offers a quick interview instead).
+seed_config() {
+  base="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+  cfg="$base/cohorte.config.yaml"
+  legacy=""
+  for n in thebidouille.config.yaml; do
+    [ -f "$base/$n" ] && { legacy="$base/$n"; break; }
+  done
+  if [ -f "$cfg" ]; then
+    echo "  · kept your existing $cfg"
+  elif [ -n "$legacy" ]; then
+    echo "  · found legacy $legacy — kept as-is (read as a fallback)."
+    echo "    Run /update-pipeline to migrate it into cohorte.config.yaml + wire the kanban."
+  else
+    mkdir -p "$base"
+    cp "$src/profile/cohorte.config.template.yaml" "$cfg"
+    echo "  · seeded $cfg (disabled defaults — enable via /init-pipeline or /update-pipeline)"
+  fi
+}
+
+# Register the profile-driven gate hook in the GLOBAL settings.json. Idempotent: the
+# hook reads each repo's own .claude/gate-config.json (and no-ops where absent),
+# so one registration serves every project.
+register_global_hook() {
+  python3 - "$dest/settings.json" "$dest/hooks/gate.py" <<'PY'
+import json, sys
+settings, gate = sys.argv[1], sys.argv[2]
+# (hook path, PreToolUse matcher)
+hooks = [(gate, "Bash")]
+try:
+    with open(settings) as fh:
+        data = json.load(fh)
+    if not isinstance(data, dict):
+        data = {}
+except Exception:
+    data = {}
+pre = data.setdefault("hooks", {}).setdefault("PreToolUse", [])
+for path, matcher in hooks:
+    base = path.rsplit("/", 1)[-1]
+    already = any(
+        h.get("command", "").strip().endswith(base)
+        for entry in pre for h in entry.get("hooks", [])
+    )
+    if not already:
+        pre.append({"matcher": matcher,
+                    "hooks": [{"type": "command", "command": "python3 " + path}]})
+with open(settings, "w") as fh:
+    json.dump(data, fh, indent=2)
+    fh.write("\n")
+print("ok")
+PY
+}
+
+# Bump only the core_version in a repo's committed .claude/pipeline.json (bundled mode).
+# Leaves every other field intact; no-ops if the pointer is absent or has no core_version.
+bump_pointer_version() {
+  ptr="$1"; newver="$2"
+  [ -f "$ptr" ] || return 0
+  python3 - "$ptr" "$newver" <<'PY'
+import json, sys
+ptr, newver = sys.argv[1], sys.argv[2]
+try:
+    with open(ptr) as fh:
+        data = json.load(fh)
+except Exception:
+    sys.exit(0)
+if isinstance(data, dict) and "core_version" in data:
+    data["core_version"] = newver
+    with open(ptr, "w") as fh:
+        json.dump(data, fh, indent=2, ensure_ascii=False)
+        fh.write("\n")
+PY
+}
+
+if [ "$scope" = "global" ]; then
+  if [ "$mode" = "install" ]; then
+    echo "→ installing pipeline core GLOBALLY into $dest"
+  else
+    echo "→ updating pipeline core GLOBALLY in $dest (keeping global settings.json)"
+  fi
+  copy_fixed_agents
+  copy_core
+  hook_state=$(register_global_hook || echo "skipped")
+  seed_config
+  cat <<EOF
+
+✓ pipeline core installed globally into $dest  (version $ver)
+  gate hook: $hook_state  (reads each repo's .claude/gate-config.json; silent where absent)
+
+The commands (/init-pipeline, /brainstorm, /build …) and the review/release agents are now
+available in EVERY project on this machine — nothing is copied per repo.
+
+Per repo:
+  1. Open the project in Claude Code.
+  2. Run  /init-pipeline  — it generates PIPELINE.md, renders the surface agents, writes
+     .claude/gate-config.json, and drops a committed .claude/pipeline.json pointer so
+     teammates know to install the global core ($REPO_URL).
+  3. Commit PIPELINE.md + .claude/, then  /brainstorm  to start a feature.
+
+Code retrieval (Serena — the default provider /init-pipeline wires per repo):
+  uv tool install -p 3.13 serena-agent   # once per machine
+  Make sure ~/.local/bin is on PATH (uv tool update-shell) — otherwise the
+  registered MCP server silently fails to start.
+
+Global kanban config, user-scoped — optional:
+  · One consolidated file: ~/.claude/cohorte.config.yaml (don't hand-edit it).
+  · /init-pipeline (new project) and /update-pipeline (existing) wire it for you: creating +
+    syncing an Obsidian kanban board of the pipeline in your shared vault.
+EOF
+  exit 0
+fi
+
+if [ "$mode" = "install" ]; then
+  echo "→ installing pipeline core into $dest"
+  copy_fixed_agents
+  copy_core
+  seed_config
+  mkdir -p "$target/specs"
+  [ -f "$target/specs/_template.md" ] || cp "$src/core/templates/spec.template.md" "$target/specs/_template.md"
+  cat <<EOF
+
+✓ pipeline core installed into $dest  (version $ver)
+
+Next:
+  1. Open the project in Claude Code.
+  2. Run  /init-pipeline   — it detects your stack, asks the gaps, and generates
+     PIPELINE.md + renders one implementer agent per surface.
+  3. Commit PIPELINE.md, then  /brainstorm  to start a feature.
+
+Code retrieval (Serena — the default provider /init-pipeline wires per repo):
+  uv tool install -p 3.13 serena-agent   # once per machine
+  Make sure ~/.local/bin is on PATH (uv tool update-shell) — otherwise the
+  registered MCP server silently fails to start.
+
+Prefer one shared core across all your repos?  Re-run with  --global.
+EOF
+else
+  echo "→ updating pipeline core in $dest (keeping your PIPELINE.md + rendered agents)"
+  copy_core
+  copy_fixed_agents 2>/dev/null || true
+  seed_config
+  bump_pointer_version "$dest/pipeline.json" "$ver"
+  cat <<EOF
+
+✓ core refreshed to $ver. Your PIPELINE.md, rendered surface agents, gate-config.json and
+  settings.json were left as-is. Re-run /init-pipeline if your stack changed.
+EOF
+fi

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "cohorte",
+  "version": "1.0.0",
+  "description": "Portable, stack-agnostic multi-agent development pipeline for Claude Code — install the core, run /init-pipeline, and it adapts to your project's stack.",
+  "bin": {
+    "cohorte": "bin/cli.js"
+  },
+  "scripts": {
+    "build:dashboard": "npm --prefix dashboard/app ci && npm --prefix dashboard/app run build"
+  },
+  "files": [
+    "bin",
+    "core",
+    "profile",
+    "scripts",
+    "dashboard/server",
+    "dashboard/dist",
+    "dashboard/README.md",
+    "install.sh",
+    "install.ps1",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TheBidouilleAgency/cohorte.git"
+  },
+  "homepage": "https://github.com/TheBidouilleAgency/cohorte#readme",
+  "author": "Enzo Viry",
+  "license": "AGPL-3.0-only",
+  "keywords": [
+    "claude",
+    "claude-code",
+    "agents",
+    "pipeline",
+    "multi-agent"
+  ]
+}

package/profile/PIPELINE.template.md

@@ -0,0 +1,208 @@
+# PIPELINE.md — <PROJECT_NAME> profile
+
+> **Generated by `/init-pipeline`.** This is the project profile: the single place the
+> portable multi-agent pipeline reads for everything stack-specific. The pipeline core
+> under `.claude/` is generic and references THIS file by section — keep project facts
+> here, never hardcoded into agent prompts. Kept current by `/update-pipeline` (reconcile:
+> new fields are topped up, your values never overwritten). Rendered agent files are
+> regenerated from this profile on every reconcile — customize agents through §Conventions
+> here, never by editing the agent files. Free-form notes belong in `CLAUDE.md`.
+>
+> **Machine block first, prose after.** The fenced `yaml pipeline-profile` block below is
+> the deterministic contract (flags, surfaces, commands) — commands parse it and branch on
+> it. The prose sections carry conventions agents read.
+
+```yaml pipeline-profile
+# ── identity ────────────────────────────────────────────────────────────────
+name: <PROJECT_NAME>
+one_liner: <one sentence: what this product is>
+ui_language: <English | French | …>          # language of ALL user-facing copy
+package_manager: <pnpm | npm | yarn | bun | pip | cargo | go>
+
+# ── vcs ─────────────────────────────────────────────────────────────────────
+vcs:
+  host: <github | gitlab | none>
+  remote: <owner/repo>                        # e.g. acme/webapp
+  default_branch: <main>
+  feature_branch_prefix: feature/            # branch = <prefix><feature_id>
+
+# ── repo shape ──────────────────────────────────────────────────────────────
+repo:
+  layout: <monorepo | single>
+  workspace_tool: <turborepo | nx | none>
+
+# ── code retrieval (semantic navigation — cuts agent read time) ─────────────
+# Agents prefer symbol/graph MCP queries over grep-and-read when a provider is
+# wired. serena = live LSP symbol navigation (default, no index to maintain);
+# graphify = persistent tree-sitter knowledge graph over code + docs (needs an
+# index step + rescans); none = agents fall back to Grep/Glob/Read.
+# Registered by /init-pipeline as a project-scope MCP server (committed .mcp.json).
+retrieval:
+  provider: serena                            # serena | graphify | none
+
+# ── surfaces ────────────────────────────────────────────────────────────────
+# One entry per independently-implemented code area. /build dispatches ONE
+# implementer agent per surface, in parallel. Each surface is rendered by
+# /init-pipeline into its own agent file (agent field) with the tools listed.
+# This list GROWS automatically: /build §1.5 adds a surface (and renders its
+# agent) when a spec touches a tree no surface owns, or splits a bottleneck
+# surface into specialized sub-surfaces. Keep one owner per tree; shared code
+# (routing/state/DS) is its own single-owner surface. See SCHEMA.md §Specialization.
+surfaces:
+  - key: backend                              # short id, used as agent name + scope
+    path: apps/api                            # the ONLY tree this surface's agent may touch
+    label: backend (AdonisJS)
+    agent: backend                            # rendered agent file: .claude/agents/backend.md
+    tools: [Read, Write, Edit, Bash, Grep, Glob, mcp__serena]   # mcp__<provider> mirrors retrieval.provider
+    model: sonnet                             # frontmatter model tier: sonnet | haiku | inherit
+                                              #   sonnet = default (applies the frozen contract — cheap
+                                              #   vs the Opus lead); haiku = purely mechanical scaffolding;
+                                              #   inherit = only for surfaces with real design decisions
+    test_cmd: pnpm --filter api test
+    lint_cmd: pnpm --filter api lint
+    format_cmd: pnpm --filter api format
+    typecheck_cmd: pnpm --filter api exec tsc --noEmit
+    build_cmd: ""
+    uses_design: false
+  - key: frontend
+    path: apps/web
+    label: frontend (React/TanStack)
+    agent: frontend
+    tools: [Read, Write, Edit, Bash, Grep, Glob, DesignSync, mcp__serena]
+    model: inherit                            # this surface makes real design decisions ⇒ worth the lead's model
+    test_cmd: pnpm --filter web test
+    lint_cmd: pnpm --filter web lint
+    format_cmd: pnpm --filter web format
+    typecheck_cmd: pnpm check-types
+    build_cmd: pnpm --filter web build
+    uses_design: true
+
+# ── contract (the only cross-surface sync channel) ──────────────────────────
+contract:
+  enabled: <true | false>                     # false ⇒ no shared contract; skip §2 of /build
+  mechanism: <shared-types-zod | openapi | protobuf | json-schema | none>
+  path: packages/shared-types/src             # where <feature_id>.<ext> is authored
+  ext: ts
+  index: packages/shared-types/src/index.ts   # barrel to export from, or "" if none
+  authored_by: lead                           # NEVER the implementer agents
+
+# ── repo-wide commands (root unless noted) ──────────────────────────────────
+commands:
+  install: pnpm install
+  dev: pnpm dev
+  lint: pnpm lint
+  format: pnpm format
+  typecheck: pnpm check-types
+  test: pnpm test
+  # migration commands — omit / leave "" if the project has no DB migrations
+  migrate: "cd apps/api && node ace migration:run"
+  make_migration: "cd apps/api && node ace make:migration"
+
+# ── rbac (optional) ─────────────────────────────────────────────────────────
+rbac:
+  enabled: <true | false>
+  hierarchy: [super-admin, admin, editor, member]   # highest → lowest, or []
+  note: "the platform must serve EVERY role, not just admins"
+
+# ── design system (optional) ────────────────────────────────────────────────
+design:
+  enabled: <true | false>                     # false ⇒ /align-ds + design gates are no-ops
+  provider: <claude-design | figma | none>
+  design_system_project: <uuid-or-id>         # the UI-kit source of truth
+  design_project: none                        # legacy fallback for bare-filename design_files only; keep `none` — new specs use full links that carry their own project, so nothing here goes stale on a DS rebuild
+  snapshot_dir: apps/web/design-reference     # committed DS snapshot for /align-ds diff
+  direction: design-to-code                   # NEVER push code→design for a curated DS
+  ui_kit_path: apps/web/src/components/ui
+  tokens_path: apps/web/src/index.css
+
+# ── isolation / parallelism (optional) ──────────────────────────────────────
+isolation:
+  enabled: <true | false>                     # false ⇒ features run in the main checkout
+  unit: git-worktree
+  db_per_worktree: <true | false>
+  db_name_pattern: "<name>_<id>"              # e.g. myapp_<id>
+  port_base: { api: 3333, web: 5173 }         # each worktree gets base+slot
+  compose_file: docker-compose.yml
+  registry: .worktrees/slots.tsv
+
+# ── gate (drives .claude/hooks/gate.py + settings.json) ─────────────────────
+# Confirm-first or hard-deny on dangerous Bash, inspecting the FULL command
+# string (so chained `cd x && …` forms are caught).
+gate:
+  # Three tiers. `deny` = always hard-blocked. `ask` = always confirm (branch-independent risk).
+  # `ask_on_default_branch` = confirm ONLY when the checked-out branch is `default_branch`; on
+  # feature branches these run freely. gate.py resolves the branch at run time (git rev-parse);
+  # unknown branch (no repo / detached) ⇒ gated, to stay safe. Keep git + docker here so agents
+  # move fast on feature branches but main stays protected.
+  default_branch: main                        # the protected branch (mirror vcs.default_branch)
+  deny:                                       # never allowed, on any branch
+    - "node ace migration:fresh"
+    - "node ace migration:reset"
+    - "node ace migration:rollback"
+    - "node ace db:wipe"
+  ask:                                         # always confirm, on any branch
+    - "node ace migration:run"
+    - "node ace db:"
+    - "psql"
+  ask_on_default_branch:                        # free on feature branches, confirm on default_branch
+    - "git commit"
+    - "git push"
+    - "git merge"
+    - "git rebase"
+    - "git reset"
+    - "docker compose"
+
+```
+
+> **Note.** The **kanban** board link is **user-scoped** — NOT configured here. Its facts live in the
+> consolidated `~/.claude/cohorte.config.yaml`, read at runtime (the kanban board is keyed by this
+> profile's `name`). This project profile only governs the dev pipeline (`/brainstorm…/ship`).
+
+---
+
+## Conventions
+
+> Read by the implementer + review agents. Keep these terse and rule-shaped; the machine
+> block above holds the paths/commands they enforce against.
+
+### Shared
+
+- User-facing copy (API messages, UI text) in **<ui_language>**.
+- <e.g. Zod v4 syntax `z.email()`/`z.uuid()`; ESM `.js` import extensions — project-specific>
+
+### Surface: `backend` (`apps/api`)
+
+- <one-action controllers · validator on every write · standardized response envelope · base model / UUID PK · `#`-alias imports · additive-only migrations · …>
+
+### Surface: `frontend` (`apps/web`)
+
+- <file-based routes with loaders/guards · domain `lib/api` modules over the shared client · design-system primitives, `cn()`+CVA · **mobile-first, fully responsive** · consume contract types, never redefine · …>
+
+### Testing — strict TDD (red → green → refactor)
+
+- <backend test runner + what a contract test must cover (status, validation, auth, payload) · DB isolation per test>
+- <frontend test runner + what to cover (hooks, api modules, component behavior); note layout is not unit-testable>
+
+---
+
+## Design brief note (feeds `/spec` §8 and Claude Design)
+
+- <design system name + primitives to use · mobile-first · copy language · brand/theming constraints>
+- A feature lists its design pages in the spec front-matter `design_files` as **full links** of the form
+  `https://claude.ai/design/p/<projectId>?file=<file>` — each carries its own project (`/p/<projectId>`)
+  and page (`?file=`), so an agent extracts both and reads it via `DesignSync get_file(<projectId>,
+  <file>)`. Paste the link at `/build`'s design gate. No stored project id ⇒ a design-system rebuild
+  (new project) just means pasting the new links. (Bare file names are legacy, resolved in `design_project`.)
+
+---
+
+## Personas for `/brainstorm` (optional — the panel)
+
+<Panel members with a job AND a personality who challenge the idea from their angle and
+disagree with each other. Include a role-coverage guard if `rbac.enabled`. Example:>
+
+- **PM** (pragmatic, scope-cutting) — real value? what do we drop?
+- **Skeptical senior engineer** (blunt) — feasibility, edge cases, tech debt.
+- **UX/product designer** — mobile-first flows, accessibility, empty/error states.
+- **Security & RBAC** (paranoid) — permission leaks, cross-tenant exposure, least privilege.
+- <one persona per RBAC role so the feature serves every role, not just admins>