chore(template): wire 9 new guardrail/skill plugins into defaults; PM + Security Auditor get role extras - #70
Merged
Conversation
… + Security Auditor get role extras PR #63 just merged 12 new modular plugins (split from a single guardrails bundle) and the audit pipeline (Security/UIUX/QA crons) is now producing PRs continuously. Time to wire the new plugins into the molecule-dev template so every workspace + every cron tick benefits. ## Defaults — universal additions (was 3, now 9) - molecule-careful-bash — refuse rm -rf, push --force main, DROP TABLE - molecule-prompt-watchdog — warn on destructive user prompts - molecule-audit-trail — append every Edit/Write to .claude/audit.jsonl - molecule-session-context — auto-load cron learnings + PR/issue counts on SessionStart - molecule-skill-cron-learnings — per-tick learning JSONL format (pairs with session-context) - molecule-skill-update-docs — keep architecture/README/edit-history aligned Kept: ecc, molecule-dev, superpowers. ## Per-role overrides - PM: defaults + molecule-workflow-triage + molecule-workflow-retro (the /triage and /retro slash commands match PM's coordination role) - Security Auditor: defaults + molecule-skill-code-review + molecule-skill-cross-vendor-review + molecule-skill-llm-judge (security PRs benefit from multi-criteria review, adversarial cross-vendor second opinion, and an LLM-judge gate that catches "agent shipped the wrong thing") - Research Lead + 3 researchers + UIUX Designer: defaults + browser-automation (existing override; just synced to the new default set) Other 5 dev roles (Dev Lead, BE, FE, DevOps, QA) inherit defaults — the new universal set is rich enough for them; code-review skill is a runtime opt-in if Dev Lead decides per-PR. ## REPLACE-semantics verbosity `platform/internal/handlers/org.go:~345` treats per-workspace plugins as REPLACE not UNION. Every override has to re-list the 9 defaults to add 1 extra. Tracked as #68 with a union-proposal; once that lands the per-role lists shrink to just the additions. ## Test plan - [x] YAML valid (`python -c "import yaml; yaml.safe_load(...)"`) - [x] defaults.plugins count = 9 - [ ] After merge + re-import: every workspace's /configs/plugins/ contains the full set; PM has /triage and /retro commands; Security Auditor can invoke cross-vendor-review on its findings.
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Apr 14, 2026
- docs/edit-history/2026-04-14.md — append tick-5 section covering PR #69 (PLAN.md backlog stale-ref cleanup) and PR #70 (wire 12 modular plugins from PR #63 into the default molecule-dev org template; defaults 3 → 9 plus PM + Security Auditor role extras). - PLAN.md — add tick-5 entries under "Recently launched" noting PR #70 activated the tick-4 plugins and PR #69 cleaned up stale backlog refs. Both merges are docs/template-only. No code surface moved, no new env vars, no test-count drift. CLAUDE.md, .env.example, README.md, and README.zh-CN.md unchanged. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2 tasks
HongmingWang-Rabbit
added a commit
that referenced
this pull request
Apr 14, 2026
Merged after 7-gate verification. Gates: 1 (CI 6/6 + 1 skip) pass, 2 (build/vet) pass, 3 (5 new TestPlugins_* + backward-compat) pass, 4 (security) pass, 5 (design) pass with 1 yellow, 6 (line review) pass, 7 N/A. Backward-compat verified: molecule-dev/org.yaml re-lists [ecc, molecule-dev, superpowers, browser-automation] in each role; under new UNION+dedupe the merged set is identical to the prior REPLACE result. PR #70's 1 yellow (REPLACE verbosity / re-listing chore) is now closed by this change — orgs can drop the re-listing once confident. Cross-vendor-review: second-model tooling unavailable in this worktree; Claude-only review applied per standing rule fallback. Yellow (non-blocking, follow-up): opt-out semantics (`!plugin` / `-plugin`) are documented only in the code comment. Safety plugins like `molecule-careful-bash` can be disabled by an org.yaml using `!molecule-careful-bash` — this is operator-controlled config per I-2 and therefore acceptable, but docs/plugins/ should get an "overriding defaults" page in a follow-up. noteworthy: plugin-semantics-change
HongmingWang-Rabbit
added a commit
that referenced
this pull request
Apr 14, 2026
…tics #71 just merged — per-workspace `plugins:` now UNIONs with `defaults.plugins` instead of replacing it. Simplifies every override in molecule-dev/ from "defaults+1 = list 10 items" to "defaults+1 = list 1 item": PM: 11 items → 2 (workflow-triage + workflow-retro) Research Lead: 10 items → 1 (browser-automation) Market Analyst: 10 items → 1 Technical Researcher: 10 items → 1 Competitive Intel: 10 items → 1 Security Auditor: 12 items → 3 (code-review + cross-vendor-review + llm-judge) UIUX Designer: 10 items → 1 (browser-automation) Every workspace still receives the full 9-plugin default set (ecc, molecule-dev, superpowers, careful-bash, prompt-watchdog, audit-trail, session-context, cron-learnings, update-docs) — verified by reading mergePlugins() in platform/internal/handlers/org.go:645. Also drops the stale "REPLACE not UNION" warning comments and points defaults' header comment at the new union behaviour. Net diff: ~30 lines removed, ~10 added. Template is now meaningfully easier to extend — each new defaults.plugin propagates everywhere without sweeping per-role lists. Closes follow-up scope from PR #70.
4 tasks
molecule-ai Bot
pushed a commit
that referenced
this pull request
Apr 21, 2026
chore(template): wire 9 new guardrail/skill plugins into defaults; PM + Security Auditor get role extras
molecule-ai Bot
pushed a commit
that referenced
this pull request
Apr 21, 2026
- docs/edit-history/2026-04-14.md — append tick-5 section covering PR #69 (PLAN.md backlog stale-ref cleanup) and PR #70 (wire 12 modular plugins from PR #63 into the default molecule-dev org template; defaults 3 → 9 plus PM + Security Auditor role extras). - PLAN.md — add tick-5 entries under "Recently launched" noting PR #70 activated the tick-4 plugins and PR #69 cleaned up stale backlog refs. Both merges are docs/template-only. No code surface moved, no new env vars, no test-count drift. CLAUDE.md, .env.example, README.md, and README.zh-CN.md unchanged. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
molecule-ai Bot
pushed a commit
that referenced
this pull request
Apr 21, 2026
Merged after 7-gate verification. Gates: 1 (CI 6/6 + 1 skip) pass, 2 (build/vet) pass, 3 (5 new TestPlugins_* + backward-compat) pass, 4 (security) pass, 5 (design) pass with 1 yellow, 6 (line review) pass, 7 N/A. Backward-compat verified: molecule-dev/org.yaml re-lists [ecc, molecule-dev, superpowers, browser-automation] in each role; under new UNION+dedupe the merged set is identical to the prior REPLACE result. PR #70's 1 yellow (REPLACE verbosity / re-listing chore) is now closed by this change — orgs can drop the re-listing once confident. Cross-vendor-review: second-model tooling unavailable in this worktree; Claude-only review applied per standing rule fallback. Yellow (non-blocking, follow-up): opt-out semantics (`!plugin` / `-plugin`) are documented only in the code comment. Safety plugins like `molecule-careful-bash` can be disabled by an org.yaml using `!molecule-careful-bash` — this is operator-controlled config per I-2 and therefore acceptable, but docs/plugins/ should get an "overriding defaults" page in a follow-up. noteworthy: plugin-semantics-change
molecule-ai Bot
pushed a commit
that referenced
this pull request
Apr 21, 2026
…tics #71 just merged — per-workspace `plugins:` now UNIONs with `defaults.plugins` instead of replacing it. Simplifies every override in molecule-dev/ from "defaults+1 = list 10 items" to "defaults+1 = list 1 item": PM: 11 items → 2 (workflow-triage + workflow-retro) Research Lead: 10 items → 1 (browser-automation) Market Analyst: 10 items → 1 Technical Researcher: 10 items → 1 Competitive Intel: 10 items → 1 Security Auditor: 12 items → 3 (code-review + cross-vendor-review + llm-judge) UIUX Designer: 10 items → 1 (browser-automation) Every workspace still receives the full 9-plugin default set (ecc, molecule-dev, superpowers, careful-bash, prompt-watchdog, audit-trail, session-context, cron-learnings, update-docs) — verified by reading mergePlugins() in platform/internal/handlers/org.go:645. Also drops the stale "REPLACE not UNION" warning comments and points defaults' header comment at the new union behaviour. Net diff: ~30 lines removed, ~10 added. Template is now meaningfully easier to extend — each new defaults.plugin propagates everywhere without sweeping per-role lists. Closes follow-up scope from PR #70.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Wires the 12 new modular plugins (from PR #63) into the molecule-dev template. Defaults grow from 3 → 9 plugins (universal guardrails + safety hooks + operational memory + docs hygiene). PM gets workflow tools; Security Auditor gets review skills.
Changes
defaults.plugins(was 3, now 9):eccmolecule-devsuperpowersmolecule-careful-bashrm -rf,git push --force main,DROP TABLEmolecule-prompt-watchdogmolecule-audit-trail.claude/audit.jsonlmolecule-session-contextmolecule-skill-cron-learningsmolecule-skill-update-docsPer-role overrides:
molecule-workflow-triage+molecule-workflow-retro(PM owns the/triageand/retroslash-command flows)molecule-skill-code-review+molecule-skill-cross-vendor-review+molecule-skill-llm-judge(multi-criteria + adversarial + judge gate; matches the role's "no critical without linked issue" definition of done)browser-automation(existing wiring, synced to new default set)Other 5 dev roles (Dev Lead, BE, FE, DevOps, QA) inherit defaults — code-review skill is available via runtime opt-in if a per-PR need arises.
Why platform-level fix is also needed
Every per-role override has to re-list the 9 defaults to add 1 plugin. With each new plugin landing in
plugins/, this gets worse. Platform-level fix tracked in #68 — proposes union semantics (plugins: { add: […], remove: […] }) so future template editors don't duplicate the default set. Once #68 lands, the role overrides in this PR can be simplified to just the additions.Notes on plugin scoping rationale
molecule-skill-code-review) — added only to Security Auditor, since the universaleccplugin already includes asecurity-reviewskill./triage,/retro) — PM only; tied to project-management role.Test plan
python -c "import yaml; yaml.safe_load(open('org-templates/molecule-dev/org.yaml'))"→ YAML validdefaults.pluginscount = 9 (verified)/configs/plugins/contains the full set/triageand/retroslash commandsmolecule-skill-cross-vendor-reviewon critical findingsRelated
plugins:should UNION withdefaults.plugins, not REPLACE #68 (open) — platform-level union semantics for plugins. Will simplify this PR once landed.🤖 Generated with Claude Code