great-cto 3.71.1 → 3.72.0

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 72 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.71.1",
+  "version": "3.72.0",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/agents/architect.md

@@ -376,7 +376,7 @@ constraint in the new ARCH doc — document why this design choice was not taken
      ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); ARCHETYPE=${ARCHETYPE:-web-service}
      PROJECT_SIZE=$(grep "^project_size:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); PROJECT_SIZE=${PROJECT_SIZE:-medium}
      SECURITY_GATE=$(grep "^security-gate:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); SECURITY_GATE=${SECURITY_GATE:-conditional}
-     COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //' || echo "[]")
+     COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //'); COMPLIANCE=${COMPLIANCE:-[]}
      ```
      Read ARCHETYPES.md for QA strategy, deploy method, and thresholds matching `$ARCHETYPE`. Use these as constraints for the architecture design.
    - **Greenfield check** — determines how deep to read existing code:

package/board/agents/db-migration-reviewer.md

@@ -48,8 +48,9 @@ fi
 echo "Migrations to review:"
 echo "$MIGRATIONS"
 
-DB_ENGINE=$(grep "^db:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}' || \
-            grep -rn "postgresql\|mysql\|sqlite\|aurora\|cockroach\|planetscale" .great_cto/PROJECT.md 2>/dev/null | head -1 | grep -oE "postgresql|mysql|sqlite|aurora|cockroach|planetscale" | head -1 || echo "unknown")
+DB_ENGINE=$(grep "^db:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
+[ -n "$DB_ENGINE" ] || DB_ENGINE=$(grep -oE "postgresql|mysql|sqlite|aurora|cockroach|planetscale" .great_cto/PROJECT.md 2>/dev/null | head -1)
+DB_ENGINE=${DB_ENGINE:-unknown}
 
 # Slug from latest ARCH doc; date fallback must be an explicit branch —
 # `|| echo` after a pipeline never fires (basename "" exits 0 with empty output)

package/board/agents/design-advisor.md

@@ -1,6 +1,6 @@
 ---
 name: design-advisor
-description: Use after architect, before/parallel to pm, for any UI-bearing feature (landing pages, dashboards, admin panels, web apps, React Native apps). Picks a design system, enumerates the component inventory, writes text-form wireframes, and locks the a11y + responsive + (mobile) platform-integration contract. Outputs docs/design/DESIGN-{slug}.md. Plan altitude only — never writes implementation code.
+description: Use after architect and before pm, for any UI-bearing feature (landing pages, dashboards, admin panels, web apps, React Native apps). Picks a design system, enumerates the component inventory, writes text-form wireframes, and locks the a11y + responsive + (mobile) platform-integration contract. Outputs docs/design/DESIGN-{slug}.md. Plan altitude only — never writes implementation code.
 model: claude-opus-5
 authority: autonomous
 tools: Read, Write, Glob, Grep, WebFetch, Bash(git:*), Bash(bd:*), Bash(ls:*), Bash(cat:*), Bash(find:*), Bash(touch:*), Bash(head:*), Bash(tail:*), Bash(grep:*), Bash(wc:*), Bash(date:*), Bash(printf:*), Bash(echo:*), Bash(mkdir:*), memory_20250929, advisor_20260301

package/board/agents/devops.md

@@ -572,7 +572,7 @@ step for that condition before proceeding to Step 1 (gate:ship check).
      ESTIMATED=${ESTIMATED_RAW:-0}
      CONSOLE_URL=$(grep "console-url:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
      SERVICE=$(grep "^service:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}' || basename "$PWD")
-     FEATURE=$(basename "$ARCH_DOC" .md 2>/dev/null | sed 's/^ARCH-//' || echo "unknown")
+     FEATURE=$(basename "$ARCH_DOC" .md 2>/dev/null | sed 's/^ARCH-//'); FEATURE=${FEATURE:-unknown}
 
      COST_LOG=.great_cto/cost-history.log
      [ ! -f "$COST_LOG" ] && printf '# Cost history — append only. Format: ISO8601 | service | estimated_usd_month | actual_usd_month | source | feature\n' > "$COST_LOG"

package/board/agents/growth-engineer.md

@@ -91,7 +91,7 @@ ARCH_FILE=$(ls -t docs/architecture/ARCH-*.md 2>/dev/null | head -1)
 SLUG=$(basename "$ARCH_FILE" .md | sed 's/^ARCH-//')
 
 ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
-GROWTH_GOAL=$(grep "^growth-goal:" .great_cto/PROJECT.md 2>/dev/null | sed 's/growth-goal: //' || echo "not specified")
+GROWTH_GOAL=$(grep "^growth-goal:" .great_cto/PROJECT.md 2>/dev/null | sed 's/growth-goal: //'); GROWTH_GOAL=${GROWTH_GOAL:-not specified}
 # Is there an analytics/connector layer we can read from?
 CONNECT=$(ls docs/connectors/CONNECT-*.md 2>/dev/null | head -1)
 echo "slug=$SLUG archetype=$ARCHETYPE goal='$GROWTH_GOAL' connector=${CONNECT:-none}"

package/board/agents/knowledge-extractor.md

@@ -28,7 +28,7 @@ Run in parallel:
 cat .great_cto/lessons.md 2>/dev/null || echo "(no lessons yet)"
 
 # Cross-project decisions (supplement)
-cat ~/.great_cto/decisions.md 2>/dev/null | head -300 || echo "(none)"
+D=$(head -300 ~/.great_cto/decisions.md 2>/dev/null); [ -n "$D" ] && printf '%s\n' "$D" || echo "(none)"
 
 # Session log pattern lines across all sessions
 grep -h "^## pattern:" .great_cto/logs/session-*-end.md 2>/dev/null \

package/board/agents/l3-support.md

@@ -327,7 +327,7 @@ node "$PLUGIN_DIR/scripts/lib/pattern-lookup.mjs" --role incident
 
    # Priority 4: systemd / journalctl
    if [ -z "$LOG_PATH" ] && [ -z "$APP_CONTAINER" ]; then
-     journalctl --since "30 min ago" -p err 2>/dev/null | tail -50 || \
+     { J=$(journalctl --since "30 min ago" -p err 2>/dev/null | tail -50); [ -n "$J" ] && printf '%s\n' "$J"; } || \
      echo "No log source found. Add 'error-log: /path/to/log' to PROJECT.md L3 section."
    fi
 

package/board/agents/performance-engineer.md

@@ -76,7 +76,7 @@ ARCH_FILE=$(ls -t docs/architecture/ARCH-*.md 2>/dev/null | head -1)
 [ -z "$ARCH_FILE" ] && { echo "BLOCKED: no ARCH doc" >&2; exit 1; }
 SLUG=$(basename "$ARCH_FILE" .md | sed 's/^ARCH-//')
 
-PERF_SLA=$(grep "^performance-sla:" .great_cto/PROJECT.md 2>/dev/null | sed 's/performance-sla: //' || echo "not specified")
+PERF_SLA=$(grep "^performance-sla:" .great_cto/PROJECT.md 2>/dev/null | sed 's/performance-sla: //'); PERF_SLA=${PERF_SLA:-not specified}
 MONTHLY_RPS=$(grep "^expected-rps:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); MONTHLY_RPS=${MONTHLY_RPS:-unknown}
 
 # Check for existing baseline

package/board/agents/pm.md

@@ -115,6 +115,10 @@ PHASE=$(grep "^phase:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); PH
 TEAM_SIZE=$(grep "^team-size:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); TEAM_SIZE=${TEAM_SIZE:-1}
 MONTHLY_BUDGET=$(grep "^monthly-budget-llm-usd:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
 
+# Design contract — design-advisor runs before pm on UI features; plan UI tasks against it
+DESIGN_DOC=$(ls -t docs/design/DESIGN-*.md 2>/dev/null | head -1)
+[ -n "$DESIGN_DOC" ] && echo "=== DESIGN CONTRACT: $DESIGN_DOC (components, a11y, responsive — one task per screen/component group) ==="
+
 # Past lessons — calibrate cost/time estimates against actuals
 if [ -f .great_cto/lessons.md ]; then
   COST_LESSONS=$(grep -B1 -A4 "shape: B" .great_cto/lessons.md 2>/dev/null | head -20)
@@ -138,7 +142,7 @@ FEATURE_SLUG=$(basename "$ARCH_FILE" .md | sed 's/^ARCH-//' | tr '[:upper:]' '[:
 
 # Goal ancestry (Paperclip pattern) — injected into every bd create call.
 # Built AFTER FEATURE_SLUG is known (it interpolates the slug).
-COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //' || echo "")
+COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //')
 _COMP_CLEAN=$(echo "$COMPLIANCE" | sed 's/^\[none\]$//;s/^\[none, *\]//;s/, *\[none\]//')
 GOAL_ANCESTRY="[archetype:${ARCHETYPE}]$([ -n "$_COMP_CLEAN" ] && echo " [compliance:${_COMP_CLEAN}]") [feature:${FEATURE_SLUG}] [phase:${PHASE}] | Why: see docs/plans/PLAN-${FEATURE_SLUG}.md"
 

package/board/agents/qa-engineer.md

@@ -286,9 +286,9 @@ PROJECT_SIZE=$(grep "^project_size:" .great_cto/PROJECT.md 2>/dev/null | awk '{p
 
 ```bash
 ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); ARCHETYPE=${ARCHETYPE:-web-service}
-COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //' || echo "[]")
-QA_EXTRAS=$(grep "^qa-extras:" .great_cto/PROJECT.md 2>/dev/null | sed 's/qa-extras: //' || echo "[]")
-PERF_SLA=$(grep "^performance-sla:" .great_cto/PROJECT.md 2>/dev/null | sed 's/performance-sla: //' || echo "")
+COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //'); COMPLIANCE=${COMPLIANCE:-[]}
+QA_EXTRAS=$(grep "^qa-extras:" .great_cto/PROJECT.md 2>/dev/null | sed 's/qa-extras: //'); QA_EXTRAS=${QA_EXTRAS:-[]}
+PERF_SLA=$(grep "^performance-sla:" .great_cto/PROJECT.md 2>/dev/null | sed 's/performance-sla: //')
 ```
 
 Read ARCHETYPES.md → find QA strategy row for `$ARCHETYPE`. This gives base QA plan.
@@ -362,7 +362,7 @@ PII column additions) that functional tests miss by design — the
 specialist agent owns this.
 
 ```bash
-BASE=$(git rev-parse --abbrev-ref --symbolic-full-name @{u} 2>/dev/null | sed 's|.*/||' || echo "main")
+BASE=$(git rev-parse --abbrev-ref --symbolic-full-name @{u} 2>/dev/null | sed 's|.*/||'); BASE=${BASE:-main}
 MIGRATION_HIT=$(git diff "$BASE"...HEAD --name-only 2>/dev/null | \
   grep -E '(^|/)(migrations|alembic/versions|db/migrate|prisma/migrations|flyway|knex/migrations)/.*\.(sql|py|ts|js|rb)$' | head -5)
 

package/board/agents/security-officer.md

@@ -424,7 +424,7 @@ Continues from the original Workflow below — produces `CSO-{slug}-{date}.md`,
 1b. **Read** `.great_cto/PROJECT.md` → get `archetype`, `type`, `stack`, and `compliance` params:
    ```bash
    ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); ARCHETYPE=${ARCHETYPE:-web-service}
-   COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //' || echo "[]")
+   COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //'); COMPLIANCE=${COMPLIANCE:-[]}
    ```
    Read ARCHETYPES.md → find security rules for `$ARCHETYPE`.
    The `compliance:` list in PROJECT.md determines which checklists to run (see Step 5).
@@ -670,7 +670,7 @@ Observations (signal < 2 or no direct evidence): record in a separate `## Observ
    the pipeline dispatcher and the board parse this line):
    ```bash
    bash scripts/log-verdict.sh security-officer <APPROVED|BLOCKED> auto \
-     findings=P0:<n>,P1:<n>,P2:<n> triaged=<n> valid=<n> invalid=<n> feature=<slug> need=<implementer|decision> finding=<id>
+     findings=P0:<n>,P1:<n>,P2:<n> triaged=<n> valid=<n> invalid=<n> feature=<slug> report=docs/security/CSO-<YYYY-MM-DD>.md need=<implementer|decision> finding=<id>
    ```
    On BLOCKED, `need` mirrors the report's `need` line: `implementer` for
    "senior-dev fix <finding>", `decision` for "CTO waive risk on <finding>".

package/board/agents/smart-contract-auditor.md

@@ -318,7 +318,7 @@ REPORT=docs/security/AUDIT-{slug}.md
 [ -s "$REPORT" ] || { echo "STOP: no audit report at $REPORT — write it first." >&2; exit 1; }
 
 bash scripts/log-verdict.sh smart-contract-auditor <PASS|FAIL|BLOCKED> auto \
-  feature=<slug> "audit=$REPORT" findings=C:<n>,H:<n>,M:<n> not_checked=<n> need=<implementer|decision> finding=<id>
+  feature=<slug> "report=$REPORT" findings=C:<n>,H:<n>,M:<n> not_checked=<n> need=<implementer|decision> finding=<id>
 ```
 
 In prepare mode add `package=docs/security/audit-package-{slug}` and

package/board/scripts/lib/approval-level.mjs

@@ -64,13 +64,15 @@ export const DEFAULT_LEVEL = 'gates-only';
 
 /**
  * Archetypes where a compliance/security sign-off is not the operator's to skip.
- * SKILL.md already states these carry a `strict` minimum; encoding it here means
- * a new level cannot become a bypass by omission.
+ * The floor is gate:security + gate:compliance (with gate:ship) at every level, so
+ * a new level cannot become a bypass by omission. It is not `strict`: it adds no
+ * gate:code. reference/approval-level.md lists this set and a test holds the two equal.
  */
 const REGULATED = new Set([
   'ai-system', 'agent-product', 'commerce', 'web3', 'iot-embedded', 'regulated',
   'fintech', 'healthcare', 'insurance', 'legal', 'gov-public', 'defense-govcon',
 ]);
+export const REGULATED_ARCHETYPES = Object.freeze([...REGULATED]);
 const REGULATED_FLOOR = ['security', 'compliance'];
 
 /**

package/board/shared/pipeline.toml

@@ -303,7 +303,13 @@ next = ["qa-engineer"]
 on = ["DONE", "APPROVED"]
 # DESIGN-{slug}.md — the design + a11y contract
 produces = ["design"]
-next = ["senior-dev"]
+# Into pm, not senior-dev. Both used to lead to senior-dev with no join, and the
+# routing table ran design-advisor alongside pm, so each success opened the edge
+# and senior-dev could start twice. A join cannot fix it: design-advisor runs only
+# for UI features, and pm would wait for a stage that never starts. One path into
+# senior-dev does; pm also plans the UI tasks against the finished contract — the
+# order the Codex controller already runs (design-advisor-prebuild).
+next = ["pm"]
 
 # Audits the Solidity/EVM contracts once they exist (web3, or /review --contracts).
 # PASS hands the audit to security-officer, which reads it before gate:ship; FAIL

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.71.1",
+  "version": "3.72.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",