claude-code-kit 0.16.0__tar.gz → 0.17.1__tar.gz

{claude_code_kit-0.16.0 → claude_code_kit-0.17.1}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.16.0",
+      "version": "0.17.1",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.16.0 → claude_code_kit-0.17.1}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.16.0",
+  "version": "0.17.1",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.16.0 → claude_code_kit-0.17.1}/CHANGELOG.md

@@ -4,6 +4,96 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.17.1] — 2026-06-17
+
+**Fix: the plugin's hooks now load.** `.claude-plugin/plugin.json` points its `hooks` field at a file
+(`./hooks/hooks.json`), and Claude Code requires a *referenced* hooks file to be shaped like a
+settings fragment — a top-level `hooks` record mapping events to matcher groups. The kit had shipped
+that file as a **flat** event map since 0.7.0, so the plugin loader rejected it (`invalid_type … path:
+["hooks"] … expected record, received undefined`) and **none of the plugin's hooks loaded** (the
+destructive-command guards, context loaders, capture, and learning-detection). This affected only the
+**plugin** channel; the pip CLI was always fine because it builds `.claude/settings.json` from
+`HOOK_REGISTRY` (`src/claude_kit/hooks.py`), a separate source. Run `/reload-plugins` then `/doctor`
+after upgrading to confirm the error is gone.
+
+### Fixed
+- **`hooks/hooks.json`** is now wrapped under a top-level `hooks` key (inner content otherwise
+  byte-identical — every matcher group and prompt preserved). This matches every other Claude Code
+  plugin that references a hooks file (superpowers, hookify, vercel, …).
+
+### Added
+- **`tests/test_plugin.py`** — a regression guard asserting the plugin hooks file is wrapped and
+  well-formed (known events, non-empty `hooks` lists, `command`/`prompt` entry types), so a flat file
+  can't ship again. Suite now 99 passing.
+
+### Not adopted (deliberately)
+- **Inlining the hooks into `plugin.json`** (the other valid shape) — kept the external file because the
+  `UserPromptSubmit` routing and learning-detection prompts are long and read far better in a dedicated
+  file than inlined in the manifest.
+
+## [0.17.0] — 2026-06-17
+
+**Make agent-side learning capture an init-time, cost-aware choice — and make it actually remember.**
+The kit can now reflect on what *Claude itself* changed during a session and record durable learnings
+into `.claude/agent-memory/` (recalled next session by `load-learnings.sh`), via a fully-detached
+background `claude` job that **never blocks your session or next prompt**. How often that runs is the
+token-cost knob, so it is now a question at `claude-kit init` (`capture_mode`) rather than a fixed
+behavior — "everyone has their own way to memorize." Four modes (see `catalog/capture.yaml`):
+
+- **`off`** — no auto-capture; record with `/remember` when you choose (zero background cost).
+- **`session-end`** — one background capture when a session ends (~1/session). Lost on abrupt close.
+- **`session-end-catchup`** *(default, recommended)* — adds a SessionStart **catch-up** that, on the
+  next launch, captures any prior session that ended *without* being captured — i.e. one closed
+  abruptly with Ctrl-C / a hard kill / a closed terminal, where `SessionEnd` never ran. ~1/session,
+  robust to abrupt close.
+- **`per-task`** — capture after each file-editing task (Stop), scoped to that task's edits via a
+  line-count sentinel. Most resilient, highest token cost.
+
+One script (`hooks/scripts/capture-learnings.sh`) backs all of it, dispatched by an argument
+(`end`/`stop`/`catchup`); a per-transcript "done" marker lets a clean exit tell catch-up "already
+handled," so a session is never captured twice.
+
+**Two correctness fixes folded in (the previous SessionEnd capture looked done but did not actually
+remember):**
+- **Recall now works.** The background agent wrote the learning file but could not index it in
+  `MEMORY.md`, which is the *only* file `load-learnings.sh` reads — so learnings were invisible to
+  future sessions. Root cause: `.claude/` is a Claude-Code-protected path that `--permission-mode
+  acceptEdits` cannot write from a detached, no-TTY background agent. The capture child now runs with
+  `--permission-mode bypassPermissions` (safe here: file tools only, no shell, prompt-confined to
+  `.claude/agent-memory/`), and the prompt makes indexing in `MEMORY.md` mandatory + self-verified.
+  Round-trip (write → index → recall) verified end-to-end.
+- **`load-learnings.sh` zero-entry crash** — `grep -c … || echo 0` emitted `"0\n0"` → `integer
+  expected`; fixed with `|| true` + `${ENTRIES:-0}`.
+
+Conservative + safe by construction (golden rule #1 — stack-agnostic, fail-safe): every mode degrades
+to a silent no-op without `jq`/`claude`/a transcript or when the project has no `agent-memory/`, and
+only spawns when there were actual file edits. The job inherits the user's logged-in auth, runs
+hook-free (`--settings '{"disableAllHooks":true}'`); recursion is broken by `CLAUDE_KIT_NO_AUTOCAPTURE=1`
+(passed to the child), which doubles as the user opt-out. `CLAUDE_KIT_CAPTURE_MODEL` optionally pins a
+model (default: inherit the user's).
+
+### Added
+- **`capture_mode` init choice** — new `catalog/capture.yaml` (the four modes → hook sets, default
+  `session-end-catchup`); a `Selection.capture_mode` field; an interactive prompt (profile-aware
+  default: **lean → off**, otherwise the recommended catch-up); `--config` / `--defaults` support;
+  `catalog.capture_mode_options()` + a branch-free `catalog._apply_capture_mode()` that swaps the
+  capture hooks for the chosen mode (golden rule #6 — pure data + set op).
+- **Three capture triggers** in `HOOK_REGISTRY`, all backed by the one `capture-learnings.sh`:
+  `capture-learnings` (SessionEnd, `end`), `capture-learnings-catchup` (SessionStart, `catchup`),
+  `capture-learnings-stop` (Stop, `stop`). The recommended default is wired into the plugin
+  (`hooks/hooks.json`) and the no-pip fallback (`templates/settings.json`).
+
+### Changed
+- `catalog/profiles.yaml` — the standard profile no longer hard-lists `capture-learnings`; capture is
+  installed by `capture_mode`, not profile membership (`load-learnings` recall stays profile-driven).
+- **Docs** — `README.md`, `rules/agent-memory.md`, `docs/agentic-patterns.md` (Ch. 9),
+  `docs/coverage-audit.md`, `skills/remember/SKILL.md`, and `CONTRIBUTING.md` describe the configurable,
+  abrupt-close-robust capture.
+
+### Fixed
+- Background capture now reliably **indexes** learnings in `MEMORY.md` (was write-only → unrecalled).
+- `load-learnings.sh` no longer errors on a zero-entry index.
+
 ## [0.16.0] — 2026-06-16
 
 **Adopt a full React/Tailwind/Radix design-system rule set as always-on React overlay rules.** Three

{claude_code_kit-0.16.0 → claude_code_kit-0.17.1}/CONTRIBUTING.md

@@ -39,7 +39,10 @@ locally, and how to release.
 - **Rule** → add `rules/<name>.md`; cross-reference siblings as `.claude/rules/<name>.md`.
 - **Hook** → add a script to `hooks/scripts/`, register it in the `HOOK_REGISTRY` in
   `src/claude_kit/hooks.py`, wire it in `hooks/hooks.json` (plugin), and list its id in the relevant
-  profile's `hooks:`.
+  profile's `hooks:`. (Exception: the agent-side capture hooks `capture-learnings[-catchup|-stop]` are
+  **not** profile-listed — they're installed by the init-time `capture_mode` choice via
+  `catalog/capture.yaml` + `catalog._apply_capture_mode`. One script, three triggers, dispatched by an
+  arg.)
 - **Stack** (framework / database) → a **data change**: add an entry to `catalog/stacks.yaml`
   (`label`, `overlay_rules`, optional `overlay_agents`, `skills`, `stack_dir`, `commands`) and create
   `templates/stacks/<stack_dir>/rules/<name>.md` (+ `agents/` for a database). Mark not-yet-ready

{claude_code_kit-0.16.0 → claude_code_kit-0.17.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.16.0
+Version: 0.17.1
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -41,7 +41,7 @@ with a quality gate between every phase. **No application code. No Docker. Confi
 [![CI](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml)
 [![Changelog](https://img.shields.io/badge/changelog-md-blue.svg)](CHANGELOG.md)
 
-🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
+✨ [Features](#features) · 🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
 
 </div>
 
@@ -49,33 +49,45 @@ with a quality gate between every phase. **No application code. No Docker. Confi
 
 ## What is this?
 
-claude-kit installs a **complete software-delivery lifecycle** into Claude Code. Instead of one
-assistant doing everything in a single pass, your work flows through a pipeline of focused agents —
-a spec writer, a story planner, reviewers, a developer, code reviewers, testers, security scanners,
-and a PR raiser — coordinated by an **Orchestrator** that runs independent work in parallel and
-refuses to advance a phase until its **quality gate** passes. You drive it all with one command:
+Claude Code is brilliant at single tasks — but a real change is never just one task. It's a spec, a
+plan, code, review, tests, a security pass, a PR. **claude-kit turns that whole lifecycle into a
+pipeline of focused agents and installs it into Claude Code as configuration.**
+
+Instead of one assistant doing everything in a single pass, your request flows through specialists — a
+spec writer, a story planner, a developer, independent reviewers, testers, security scanners, a PR
+raiser — coordinated by an **Orchestrator** that runs independent work in parallel and **refuses to
+advance until each phase's quality gate passes**. You drive it all with one command:
 **`/sdlc <your task>`**.
 
-**At a glance:**
-
-- 🧱 **Stack-agnostic** — the pipeline assumes no language or framework. Pick a stack at `init` and it
-  installs matching overlay rules (React · FastAPI · Go/net-http · PostgreSQL · MongoDB) and your exact
-  lint/test/build commands. Picking React also installs a full design-system rule set (design tokens,
-  UX patterns, mobile/Capacitor guidelines) that the UI skills and `ui-designer` agent read. It never
-  writes your app code and never needs Docker.
-- 🎚️ **Dial the rigor with profiles** — `lean ⊊ standard ⊊ enterprise` decide how many agents, skills,
-  hooks, and gates are active, from "fast track" to "full audit".
-- 👥 **Scope to your team** — `individual` / `team` (default) / `organization`. Org scope adds a
-  vibe-coding layer so PMs, designers, QA, support, and founders can drive work safely too.
-- 🧠 **Remembers across sessions** — working memory (`CONTINUITY.md`) survives context compaction, and a
-  learnings loop (`agent-memory/`) means the same mistake isn't made twice.
-- 📦 **Two channels, one source** — a first-class Claude Code **plugin** *and* a **pip** scaffolder.
+It ships **no application code and needs no Docker** — only the rules, agents, skills, and gates that
+govern *how* the work gets done. Choose your stack, rigor, and team scope at `init`; everything else
+adapts.
 
 > Inspired by the autonomous-SDLC idea, rebuilt from the ground up **for Claude Code**, and kept small
 > by a **reuse-first** policy — see [what we adopted](#influences--what-we-adopted) and from where.
 
 ---
 
+## Features
+
+The whole product at a glance — one line each. Expand **[Feature details](#feature-details)** (below
+Quick start) for the full breakdown of any row.
+
+| Area | What you get |
+|------|--------------|
+| 🔁 **Pipeline & quality gates** | Gate-enforced progression (zero open Critical/High/Medium to advance), per-profile gate sets, a fast-track for small changes, and an anti-sycophancy `devils-advocate` pass |
+| 🤖 **Agent roster** | **28** tiered agents + per-database overlays + **6** org personas, led by an Orchestrator that never writes code |
+| 🔍 **Self-verification & review** | RARV green-Verify (real commands, not imagined), blind parallel review, and read-only risk classification |
+| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **51** context-activated skills |
+| 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
+| 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
+| 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
+| 🛠️ **Hooks & guards** | **16** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
+| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **9** ready MCP fragments, and edit-preserving `upgrade` |
+| ♻️ **Reuse-first by design** | Adopt-only-the-new reviews, opt-in LLM/AI security (OWASP LLM Top 10), a worked example + self-test matrix |
+
+---
+
 ## Quick start
 
 <details open>
@@ -167,6 +179,166 @@ README.claude-sdlc.md
 
 ---
 
+## Feature details
+
+Each area from the [Features](#features) table, expanded — the README stays short; open only what you
+need.
+
+<details>
+<summary><b>🔁 Pipeline & quality gates</b></summary>
+
+<br>
+
+- **Gate-enforced progression** — every phase ends in a quality gate that passes *only* with zero open
+  Critical/High/Medium findings; no silent advancement (see [the pipeline](#the-pipeline)).
+- **Profile-scoped gates** — `lean` runs `code-review · build-green`; `standard` adds spec / EM /
+  coverage / security / contract; `enterprise` adds `pipeline-green · observability-ready · acceptance`.
+- **Fast-track mode** — changes under 5 files collapse to Developer → Code Reviewer → Tester → PR,
+  skipping the heavyweight stages.
+- **Anti-sycophancy guard** — a *unanimous* PASS is treated as suspicious and triggers an adversarial
+  `devils-advocate` pass before the gate may close.
+
+</details>
+
+<details>
+<summary><b>🤖 The agent roster</b></summary>
+
+<br>
+
+- **28 specialized agents** in [`agents/`](agents/), each tagged with a `tier`
+  (orchestrator · stage-lead · specialist · review) and installed per profile.
+- **An Orchestrator that never writes code** — it decomposes work, runs independent lanes in parallel,
+  and blocks each phase on its gate.
+- **Database overlay agents** layer in per database — PostgreSQL adds
+  `postgres-specialist · migration-specialist · db-performance-reviewer`; MongoDB adds
+  `mongodb-specialist · migration-specialist`.
+- **6 organization personas** (`pm-copilot` · `founder-prototype-agent` · `support-ticket-engineer` ·
+  `data-workflow-agent` · `internal-tools-builder` · `staff-pm-reviewer`) unlock in org scope so
+  non-engineers can drive work safely.
+
+</details>
+
+<details>
+<summary><b>🔍 Self-verification & review</b></summary>
+
+<br>
+
+- **RARV self-check** — every agent runs Reason → Act → Reflect → Verify and must show a *green Verify*
+  (real commands run, not imagined) before handing off.
+- **Blind parallel review** — independent reviewers judge a work stream separately, and a
+  `merge-reviewer` reconciles parallel lanes at every join point.
+- **Risk-classified work** — a read-only `risk-classifier` labels each task low/medium/high/restricted
+  and names the gates it requires (enterprise + org).
+
+</details>
+
+<details>
+<summary><b>📐 Rules & skills</b></summary>
+
+<br>
+
+- **23 stack-agnostic core rules** in [`rules/`](rules/) — `mandatory-workflow`, `quality-gates`,
+  `rarv-cycle`, `continuity`, plus eight agent-operation rules and `autonomy-levels` +
+  `risk-classification` (see [`docs/agentic-patterns.md`](docs/agentic-patterns.md)).
+- **51 on-demand skills** in [`skills/`](skills/) — spec-driven dev, planning, TDD, debugging, code
+  review, threat modeling, and more — activated by context and led by the `sdlc` entrypoint.
+- **Profile-subset install** — each profile installs a strict subset of agents, skills, hooks, and
+  rules (`lean ⊂ standard ⊂ enterprise`), from fast track to full audit.
+
+</details>
+
+<details>
+<summary><b>🧱 Stacks & overlays</b></summary>
+
+<br>
+
+- **Stack-agnostic core** — the pipeline assumes no language or framework; it never writes your app
+  code and never needs Docker.
+- **10 stack overlay rules** layer matching guidance on top — React, FastAPI, Go/net-http, PostgreSQL,
+  MongoDB — wired to your exact lint/test/build commands.
+- **A full React design system** — picking React installs design tokens, UX patterns, and
+  mobile/Capacitor guidelines that the UI skills and `ui-designer` agent read.
+
+</details>
+
+<details>
+<summary><b>🎚️ Profiles, scopes & the org layer</b></summary>
+
+<br>
+
+- **3 rigor profiles** — `lean ⊊ standard ⊊ enterprise` decide how many agents, skills, hooks, and
+  gates are active.
+- **3 usage scopes** — `individual` / `team` (default) / `organization`, with a vibe-coding layer in
+  org scope.
+- **5 autonomy levels** — from Advisory (plan & review only) through Autonomous (PR) to
+  Enterprise-controlled, each adding deterministic guardrail hooks.
+- **7 capability packs + 10 org policy rules** under [`templates/org/`](templates/org/) (secrets, PII,
+  compliance, production-data) install only in organization scope (see
+  [`docs/org-capabilities.md`](docs/org-capabilities.md)).
+
+</details>
+
+<details>
+<summary><b>🧠 Memory & continuous learning</b></summary>
+
+<br>
+
+- **Working memory across sessions** — `CONTINUITY.md` survives context compaction so the pipeline
+  never loses its place.
+- **A learnings loop** — `agent-memory/` captures fixes from your corrections *and*, in a non-blocking
+  background job, from what Claude changed, so the same mistake isn't made twice.
+- **Cost-aware capture** — how aggressively learnings are captured (`capture_mode`: off · on clean
+  exit · + catch-up · per task) is a choice at `init`.
+
+</details>
+
+<details>
+<summary><b>🛠️ Hooks & deterministic guards</b></summary>
+
+<br>
+
+- **16 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
+  `guard-secrets`, `guard-destructive-git`, `lint-fix`, `type-check`, and `validate-settings` run
+  deterministically.
+- **Advisory, never-blocking warnings** — `warn-llm-io`, `warn-large-edits`, `warn-missing-tests`, and
+  `warn-sensitive-files` flag risk without halting work.
+- **Graceful degradation** — hooks need a POSIX shell + `jq` and silently no-op when absent, so the
+  kit still functions everywhere.
+
+</details>
+
+<details>
+<summary><b>📦 Distribution & lifecycle</b></summary>
+
+<br>
+
+- **Two channels, one source** — a first-class Claude Code **plugin** *and* a `pip` scaffolder
+  (`claude-kit` / `ckit` / `claude-sdlc`) generate identical config.
+- **Catalog-driven extensibility** — adding a stack, framework, database, profile, MCP server, or org
+  pack is a [`catalog/`](catalog/) YAML edit, never a code change; 9 MCP server fragments ship ready.
+- **Safe, edit-preserving upgrades** — `upgrade` refreshes kit/overlay files via per-file `owner` +
+  checksum, never clobbers your edits, backs up changes, and restores deleted files (`diff` previews
+  first).
+
+</details>
+
+<details>
+<summary><b>♻️ Reuse-first by design</b></summary>
+
+<br>
+
+- **Adopt only the genuinely-new** — each external review fetches the real source, adversarially maps
+  it against existing files, and ships only the non-duplicative gaps (see
+  [what we adopted](#influences--what-we-adopted)).
+- **Opt-in LLM/AI security** — `security-and-hardening` covers the OWASP LLM Top 10 (input/output
+  guardrails, PII vault) as bypassable guidance, distinct from the mandatory appsec gate.
+- **A worked example + self-test matrix** — [`examples/`](examples/) shows an end-to-end run, and a
+  profile×stack×scope test matrix backs the stack-agnostic claim.
+
+</details>
+
+---
+
 ## How it works
 
 ```mermaid
@@ -302,7 +474,7 @@ It is **not** a runtime, an orchestration engine, or a code library. That framin
 | **[wshobson/agents](https://github.com/wshobson/agents)** & similar agent collections | Large libraries of individual subagent prompts you pick from | claude-kit ships a **smaller, opinionated set wired into a sequenced pipeline with owned quality gates** — agents aren't a menu, they're stages that hand off and block on each other. Adopt-by-reuse, not by accumulation. |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | A spec-driven workflow (constitution → spec → tasks → analyze) | claude-kit **absorbed spec-kit's coverage-gate idea** (the `story-planner` 1f gate + `task-tracker-sync`) into a **broader** lifecycle that also covers review, security, build, test, release, and observability gates. Complementary, wider scope. |
 | **claude-flow / multi-agent runtimes** | Runtime orchestrators that *execute* swarms of agents | claude-kit produces **portable configuration**, not a running process — the orchestration is described in rules the host (Claude Code) executes. No daemon, no lock-in, no app code. |
-| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, ~28 agents, ~52 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
+| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 51 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
 
 **Choose claude-kit when** you want a consistent, reviewable, **gate-enforced** autonomous-SDLC setup
 that's the same across every repo and stack, installs in seconds, ships nothing you have to run, and
@@ -349,7 +521,7 @@ that's the same across every repo and stack, installs in seconds, ships nothing
 | `incident-responder` | Production-incident triage, mitigation, and postmortem (enterprise scope) |
 | `pr-raiser` | Final checks, commit hygiene, and PR creation |
 | **DB overlays** | installed for the selected database — PostgreSQL → `postgres-specialist` · `migration-specialist` · `db-performance-reviewer`; MongoDB → `mongodb-specialist` · `migration-specialist` |
-| **Org personas** | `pm-copilot` · `founder-prototype-agent` · `support-ticket-engineer` · `data-workflow-agent` · `internal-tools-builder` (organization scope only) |
+| **Org personas** | `pm-copilot` · `founder-prototype-agent` · `support-ticket-engineer` · `data-workflow-agent` · `internal-tools-builder` · `staff-pm-reviewer` (organization scope only) |
 
 </details>