[PM-35116] feat: Add architect, delivery-tools, and workflows plugins

[SaintPatrck]

🎟️ Tracking

PM-35116: Cross-repo PIR workflow
PM-35361: Delivery tools
PM-35362: Workflows plugin

📔 Objective

WIP — Active development. Publishing early to share direction and
prevent duplicate work across the team.

Introduces an architect agent and supporting plugins that discover platform
context dynamically at runtime, plus a workflows plugin that demonstrates how
to compose marketplace agents into multi-agent pipelines.

New plugins

bitwarden-architect — Software architect agent with three bundled skills
covering the planning lifecycle: architecting-solutions (think: security
posture, blast radius, trade-offs), creating-implementation-plan (produce the
plan artifact), and creating-work-breakdown (decompose phases into
ticket-ready tasks). Agent workflow defaults to stopping after the "think"
step unless the human explicitly asks for a plan or tickets. Discovers
planning-related skills under <repo>/.claude/skills/ and defers to them when
present; otherwise uses the plugin's built-in templates.

bitwarden-delivery-tools — Generic delivery skills (committing-changes,
creating-pull-request, labeling-changes, perform-preflight) that derive
platform-specific details from each repo's CLAUDE.md.

bitwarden-workflows — Multi-agent orchestration workflows composed from
marketplace agents via Teams and task dependencies. Ships with
plan-implement-review as the first workflow: an end-to-end pipeline
(requirements → per-repo architecture → implementation → 4-reviewer gauntlet)
that dynamically creates per-repo architects and implementers based on what the
requirements spec identifies as in scope.

Updated plugins

bitwarden-software-engineer — Adjusted to be more generic: adds context
discovery via CLAUDE.md, autonomous implementation lifecycle with self-review
protocol, and decision-making framework. All skills discovered dynamically at
runtime.

Design principle

Agents own process. Repos own platform specifics. The plan-implement-review
workflow in bitwarden-workflows is both a functional pipeline and a reference
for how to compose agents into complex, multi-step, multi-repo workflows using
Teams and task dependencies.

Follow-up: relocate repo-specific skills

The bitwarden-software-engineer plugin currently contains 5 skills that are
repo-specific implementation conventions rather than process:
writing-server-code, writing-client-code, writing-database-queries,
implementing-dapper-queries, implementing-ef-core. Per the design principle,
these belong in their respective repos' .claude/skills/ directories (server,
clients) — not the marketplace. Relocating them makes the software-engineer
a pure process agent with zero repo-specific content, consistent with how the
architect and delivery-tools plugins already work. This will be a separate PR
touching the server and clients repos.

---

Testing

Prerequisites

Install all plugins from this branch. Verify with /reload-plugins:

• bitwarden-architect, bitwarden-delivery-tools, bitwarden-workflows (new)
• bitwarden-software-engineer (updated)
• bitwarden-product-analyst, bitwarden-security-engineer, bitwarden-code-review, bitwarden-atlassian-tools (existing, required by the pipeline)

Ensure bitwarden-atlassian-tools is configured and functional (Jira/Confluence access required for ticket-based workflows).

Test 1: Architect workflow (Think → Plan → Break down)

The architect agent bundles three skills auto-loaded into context: architecting-solutions, creating-implementation-plan, creating-work-breakdown. Default behavior stops after the "think" step; plan and work-breakdown artifacts are only produced on explicit request.

Think-only (default):

1. Open a new session in a target repo directory
2. Dispatch bitwarden-architect:architect with a brief feature request (no mention of planning or tickets)
3. Observe: agent reads CLAUDE.md, explores the codebase for pattern anchors, and returns architectural reasoning (security posture, blast radius, trade-offs, red flags). It should not produce a plan or work-breakdown document.

Think + Plan:

1. Repeat with a request that explicitly asks for an implementation plan
2. Observe: agent applies architecting-solutions, then produces ${CLAUDE_PLUGIN_DATA}/plans/{slug}-IMPLEMENTATION-PLAN.md with the template sections (Current State / Blast Radius / Design / Phases / Risks & Open Questions)

Think + Plan + Break down:

1. Repeat with a request that explicitly asks for the plan to be broken into tickets
2. Observe: agent produces both {slug}-IMPLEMENTATION-PLAN.md and {slug}-WORK-BREAKDOWN.md, paired by slug

Per-repo planning skill precedence:

1. Run in a repo that has its own planning-related skill under .claude/skills/ (e.g., android's planning-android-implementation)
2. Observe: agent defers the plan artifact's shape to the repo skill rather than using the plugin's default template

Fallback test:

1. Run in a repo with CLAUDE.md but no repo-local planning skill (e.g., server, sdk-internal)
2. Observe: agent uses the default template from creating-implementation-plan

Test 2: Software-engineer context discovery

1. Open a new session in a repo with implementation skills
2. Dispatch bitwarden-software-engineer:bitwarden-software-engineer with a small implementation task
3. Observe: does it read CLAUDE.md, find the Skills & Commands table, and invoke the implementation skill via Skill tool?

Test 3: Delivery skills

1. Make a small change in any repo
2. Invoke bitwarden-delivery-tools:committing-changes — verify it follows the commit format and invokes labeling-changes for type selection
3. Invoke bitwarden-delivery-tools:creating-pull-request — verify it prompts for AI review label via AskUserQuestion and creates a draft PR

Test 4: End-to-end pipeline

Setup

Create an isolated experiment workspace with worktrees on the companion PR branches (android, ios) and origin/main for other repos. This prevents agents from discovering old local agents in the main checkouts.

mkdir -p ~/development/bitwarden/experiment

# Repos with companion PRs — branch from the PR branch
cd ~/development/bitwarden/android
git worktree add ~/development/bitwarden/experiment/android \
  -b llm/pm-XXXXX-experiment llm/generic-architect-updates

cd ~/development/bitwarden/ios
git worktree add ~/development/bitwarden/experiment/ios \
  -b llm/pm-XXXXX-experiment llm/generic-architect-updates

# Other repos — branch from origin/main
for repo in server clients sdk-internal; do
  cd ~/development/bitwarden/$repo
  git fetch origin main
  git worktree add ~/development/bitwarden/experiment/$repo \
    -b llm/pm-XXXXX-experiment origin/main
done

Execution

1. Open a new session (fresh context) with working directory ~/development/bitwarden/experiment/
2. Run: Skill(bitwarden-workflows:plan-implement-review) <Jira ticket or task description>
3. Do not intervene unless the pipeline crashes. If gated-mode prompts appear, approve.

Single-blind protocol: The agents are the test subjects. They receive only the task — no mention of testing, no evaluation criteria, no expected outcomes. The evaluator reviews artifacts after the run.

Evaluation criteria

Category	What to check
Context discovery	Did agents read CLAUDE.md and invoke skills via Skill tool (not file reads)?
Multi-repo awareness	Did the pipeline identify multiple in-scope repos and create per-repo agents?
Plan quality	Do plans reference specific existing files, follow platform patterns, include concrete tasks?
Implementation quality	Does code follow the plan, include tests, pass builds?
Pipeline mechanics	Were teams/tasks created correctly, did reviewers wait for commits?

Cleanup

Remove experiment worktrees after evaluation. Verify no commits were pushed to remotes.

[github-actions]

Checkmarx One – Scan Summary & Details – 4e486384-5c3f-4210-8a96-cf79a370f45c

Great job! No new security vulnerabilities introduced in this pull request

[Banrion]

❓ Is this an environment variable to be setup