great-cto 2.73.1 → 2.74.0

package/dist/archetypes.js

@@ -1331,6 +1331,13 @@ export const REVIEWERS_BY_ARCHETYPE = {
     "gov-public": ["gov-reviewer", "security-officer"],
     "insurance": ["insurance-reviewer", "regulated-reviewer"],
     "defense-govcon": ["cmmc-reviewer", "gov-reviewer", "security-officer"],
+    // Product Builder archetypes (A1–A6) — lean reviewer sets; payments → pci.
+    "vertical-saas": ["security-officer"],
+    "booking": ["pci-reviewer", "security-officer"],
+    "crm": ["security-officer"],
+    "dashboard": ["security-officer"],
+    "content-platform": ["pci-reviewer", "security-officer"],
+    "marketplace-lite": ["pci-reviewer", "security-officer"],
     "greenfield": [],
 };
 /**
@@ -1367,6 +1374,14 @@ export const GATES_BY_ARCHETYPE = {
     "gov-public": ["plan", "qa", "gov-review", "security", "ship", "compliance"],
     "insurance": ["plan", "qa", "insurance-review", "security", "ship", "compliance"],
     "defense-govcon": ["plan", "qa", "cmmc-assessment", "security", "ship", "compliance"],
+    // Product Builder archetypes (A1–A6) — non-regulated baseline; the single CTO gate
+    // emerges at change_tier T1 (effectiveGates → [plan]).
+    "vertical-saas": ["plan", "qa", "ship"],
+    "booking": ["plan", "qa", "ship"],
+    "crm": ["plan", "qa", "ship"],
+    "dashboard": ["plan", "qa", "ship"],
+    "content-platform": ["plan", "qa", "ship"],
+    "marketplace-lite": ["plan", "qa", "ship"],
     "greenfield": ["plan"],
 };
 /**
@@ -1386,6 +1401,46 @@ export function gatesFor(archetype, size) {
     // large + enterprise → ensure compliance is included
     return all.includes("compliance") ? all : [...all, "compliance"];
 }
+/** Gates that form the non-negotiable floor for a *regulated* archetype. */
+const FLOOR_GATES = ["security", "compliance", "ship"];
+/**
+ * The human gates the pipeline opens for a change, given its archetype, the
+ * project size, AND the per-change risk tier. Composes with `gatesFor()`:
+ *
+ *  - T2 (default): the full size baseline, with `ship` guaranteed even if a
+ *    small project_size had stripped it. An irreversible change always gets a
+ *    final go/no-go. Nothing is ever removed → fail-safe for an unknown tier.
+ *  - T1: only `plan` (you review intent) PLUS the regulated floor. The standalone
+ *    qa/security-as-ceremony is dropped because CI + tests cover a reversible change.
+ *  - T0: the regulated floor only — for a plain archetype that is the empty set
+ *    (CI is the gate); for a regulated one, security+compliance+ship still fire.
+ *
+ * An archetype is "regulated" iff its baseline contains `security` or `compliance`.
+ * That is what keeps the downgrade sound: a fintech repo cannot ship an
+ * irreversible change unreviewed even when the change is labelled a fix.
+ *
+ * NOTE: change-specific T2 triggers (a migration, a new write-connector, a prod
+ * deploy) are resolved upstream by the classifier, which escalates such a change
+ * to T2 before this function sees it. Here we only map an already-decided tier.
+ */
+export function effectiveGates(archetype, size, tier = "T2") {
+    const base = gatesFor(archetype, size);
+    // T2 (and any unrecognized tier) → full baseline, never downgraded, ship forced.
+    if (tier !== "T0" && tier !== "T1") {
+        return base.includes("ship") ? base : [...base, "ship"];
+    }
+    // Regulated archetypes carry a floor that survives every downgrade.
+    const isRegulated = base.includes("security") || base.includes("compliance");
+    const floor = isRegulated ? base.filter((g) => FLOOR_GATES.includes(g)) : [];
+    if (tier === "T1") {
+        const keep = new Set(floor);
+        if (base.includes("plan"))
+            keep.add("plan");
+        return base.filter((g) => keep.has(g)); // preserve base order
+    }
+    // T0 — maintenance.
+    return floor;
+}
 /**
  * Returns the ordered list of reviewers for an archetype. Empty for
  * `greenfield`. Used by the orchestrator to spawn the right

package/dist/flow.js

@@ -31,6 +31,12 @@ const ARCHETYPE_TITLE = {
     "gov-public": "Government",
     "insurance": "Insurance",
     "regulated": "Regulated system",
+    "vertical-saas": "Vertical SaaS",
+    "booking": "Booking / scheduling",
+    "crm": "CRM",
+    "dashboard": "Dashboard / analytics",
+    "content-platform": "Content / media platform",
+    "marketplace-lite": "Marketplace",
     "greenfield": "New project",
 };
 // Gate id (StandardGate) → user label
@@ -76,8 +82,29 @@ const ARCHETYPE_COST = {
     "infra": [3, 8],
     "library": [0.5, 3],
     "cli-tool": [0.5, 3],
+    // Product Builder archetypes — cheap, high-automation builds.
+    "vertical-saas": [3, 8],
+    "booking": [3, 8],
+    "crm": [3, 8],
+    "dashboard": [3, 8],
+    "content-platform": [3, 8],
+    "marketplace-lite": [3, 8],
     "greenfield": [0.5, 3],
 };
+/**
+ * Archetypes that ship a user-facing interface and therefore get a
+ * `design-advisor` stage (plan-altitude, before pm). Backend/infra/library/CLI
+ * archetypes have no UI surface and skip it. design-advisor itself skips a
+ * change classified T0 at runtime (see scripts/lib/change-tier.mjs).
+ */
+export const UI_BEARING_ARCHETYPES = new Set([
+    "web-service", "mobile-app", "commerce", "marketplace", "cms",
+    "enterprise-saas", "edtech", "game", "browser-extension",
+    "healthcare", "fintech", "insurance", "gov-public", "web3",
+    // Product Builder archetypes (A1–A6) — all ship a UI.
+    "vertical-saas", "booking", "crm", "dashboard", "content-platform",
+    "marketplace-lite",
+]);
 // ── Main export ───────────────────────────────────────────────────────────
 /**
  * Compile all detection outputs into a single FlowResult.
@@ -96,6 +123,9 @@ export function compileFlow(archetype, size, detection, compliance, confidence)
     agentSet.add("architect");
     agentSet.add("senior-dev");
     agentSet.add("qa-engineer");
+    // Design-advisor for UI-bearing archetypes (plan-altitude, before pm).
+    if (UI_BEARING_ARCHETYPES.has(archetype))
+        agentSet.add("design-advisor");
     // ── Gates ────────────────────────────────────────────────────────────────
     const gateSet = new Set(gatesFor(archetype, size).map((g) => GATE_LABEL[g] ?? `gate:${g}`));
     for (const g of suggestPackGates(detection))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "2.73.1",
+  "version": "2.74.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",