great-cto 3.48.0 → 3.49.1

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
-  "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 71 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.48.0",
+  "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 72 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
+  "version": "3.49.1",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"
@@ -469,6 +469,7 @@
     "./agents-full/regulated-reviewer.md",
     "./agents-full/security-officer.md",
     "./agents-full/senior-dev.md",
+    "./agents-full/smart-contract-auditor.md",
     "./agents-full/streaming-reviewer.md",
     "./agents-full/subscription-billing-engineer.md",
     "./agents-full/tax-reviewer.md",

package/board/packages/board/public/index.html

@@ -108,6 +108,7 @@
   --status-review-text: #00d97e;  /* bright on dark: the bed and the ink can be one colour */
   --status-done: #00d97e;
   --status-blocked: #ff5466;
+  --status-blocked-ink: #ff5466;   /* blocked-status TEXT on a tinted surface */
   --status-gate: #a78bfa;
 
   --p0-bg: rgba(255, 84, 102, 0.14);  --p0-fg: #fca5a5;
@@ -198,6 +199,7 @@
   --status-review-text: #097448;
   --status-done: #0a7d4d;
   --status-blocked: #c43030;
+  --status-blocked-ink: #a32626;   /* #c43030 reads 4.08:1 on the red-tinted banner; this is 5.45:1 */
   --status-gate: #7c3aed;
   --p0-bg: rgba(196, 48, 48, 0.12);   --p0-fg: #b91c1c;
   --p1-bg: rgba(180, 83, 9, 0.12);    --p1-fg: #a64c08;
@@ -921,7 +923,7 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   border-color: var(--status-blocked);
   background: var(--rail-fail-bg);
 }
-.project-fallback-banner strong { color: var(--status-blocked); }
+.project-fallback-banner strong { color: var(--status-blocked-ink); }
 .project-fallback-banner span   { color: var(--text); font-family: var(--sans); }
 
 /* ── Side panel ───────────────────────────────────────────────────────────── */
@@ -5975,7 +5977,7 @@ async function renderHarnesses() {
 
   body.innerHTML = `
     <div class="mp-card harness-hosts">
-      <div><span class="dot ok"></span><b>Claude Code</b> <span class="mono cap muted">host · v${esc(h.claude_code?.version || '')}</span><span class="cap muted" style="margin-left:auto" title="71 agents · commands · skills · hooks">full pipeline</span></div>
+      <div><span class="dot ok"></span><b>Claude Code</b> <span class="mono cap muted">host · v${esc(h.claude_code?.version || '')}</span><span class="cap muted" style="margin-left:auto" title="72 agents · commands · skills · hooks">full pipeline</span></div>
       <div><span class="${codexDot}"></span><b>OpenAI Codex</b> <span class="mono cap">${codexState}</span>${cx.version ? `<span class="mono cap muted">${esc(cx.version)}</span>` : ''}${cx.model ? `<span class="mono cap muted" style="margin-left:auto">${esc(cx.model)}</span>` : ''}</div>
     </div>
     <div class="mp-card" style="margin-top:12px">

package/board/packages/cli/dist/archetypes.js

@@ -1428,7 +1428,7 @@ export const REVIEWERS_BY_ARCHETYPE = {
     "marketplace": ["marketplace-reviewer", "pci-reviewer"],
     "fintech": ["pci-reviewer", "regulated-reviewer"],
     "healthcare": ["healthcare-reviewer", "security-officer"],
-    "web3": ["oracle-reviewer"],
+    "web3": ["oracle-reviewer", "smart-contract-auditor"],
     "iot-embedded": ["firmware-reviewer"],
     "regulated": ["regulated-reviewer"],
     "devtools": ["devtools-reviewer"],

package/board/scripts/lib/codex-role-profiles.mjs

@@ -31,6 +31,7 @@ export const CODEX_ROLE_PROFILES = Object.freeze({
   'ai-eval-engineer': 'Design representative, versioned evals with explicit rubrics, baselines, confidence treatment, regression thresholds and traceable failure analysis.',
   'db-migration-reviewer': 'Review schema evolution for compatibility, locking, data correctness, rollout ordering, backfill, observability and rollback risk.',
   'design-advisor': 'Define interaction hierarchy, states, accessibility, responsive behavior and design-system constraints that implementation can verify.',
+  'smart-contract-auditor': 'Audit Solidity/EVM contracts vector by vector: access control, reentrancy, rounding and share inflation, oracle and flash-loan economics, non-standard tokens, signatures and upgradeability. Report a finding only with file:line evidence, an unprivileged trigger and a material victim; name every analyzer that did not run as not checked, never clean. Return FAIL while any Critical or High is open.',
   'performance-engineer': 'Analyze hot paths, complexity, allocation, blocking, I/O, query shape and capacity evidence against explicit latency and throughput budgets.',
   'infra-provisioner': 'Specify infrastructure topology, identity, network, secrets, state, policy, observability, cost and reversible rollout controls.',
   'growth-engineer': 'Define an ethical, measurable growth experiment with target cohort, event contract, guardrails, power assumptions and decision thresholds.',

package/board/scripts/lib/required-reviewers.mjs

@@ -31,7 +31,7 @@ export const REVIEWERS_BY_ARCHETYPE = {
   "marketplace": ["marketplace-reviewer", "pci-reviewer"],
   "fintech": ["pci-reviewer", "regulated-reviewer"],
   "healthcare": ["healthcare-reviewer", "security-officer"],
-  "web3": ["oracle-reviewer"],
+  "web3": ["oracle-reviewer", "smart-contract-auditor"],
   "iot-embedded": ["firmware-reviewer"],
   "regulated": ["regulated-reviewer"],
   "devtools": ["devtools-reviewer"],

package/board/shared/pipeline.toml

@@ -305,6 +305,20 @@ on = ["DONE", "APPROVED"]
 produces = ["design"]
 next = ["senior-dev"]
 
+# Audits the Solidity/EVM contracts once they exist (web3, or /review --contracts).
+# PASS hands the audit to security-officer, which reads it before gate:ship; FAIL
+# (an open Critical/High) goes back to whoever wrote the contract, like a
+# performance REGRESSION does, instead of stopping the chain silently.
+[transitions.smart-contract-auditor]
+on = ["PASS", "DONE"]
+# the audit report its verdict rests on: docs/security/AUDIT-{slug}.md
+produces = ["report"]
+next = ["security-officer"]
+
+[transitions.smart-contract-auditor.FAIL]
+on = ["FAIL"]
+next = ["senior-dev"]
+
 [transitions.performance-engineer]
 on = ["DONE", "PASS"]
 next = ["qa-engineer"]

package/dist/archetypes.js

@@ -1428,7 +1428,7 @@ export const REVIEWERS_BY_ARCHETYPE = {
     "marketplace": ["marketplace-reviewer", "pci-reviewer"],
     "fintech": ["pci-reviewer", "regulated-reviewer"],
     "healthcare": ["healthcare-reviewer", "security-officer"],
-    "web3": ["oracle-reviewer"],
+    "web3": ["oracle-reviewer", "smart-contract-auditor"],
     "iot-embedded": ["firmware-reviewer"],
     "regulated": ["regulated-reviewer"],
     "devtools": ["devtools-reviewer"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.48.0",
+  "version": "3.49.1",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",