feat(compliance): add devflow-compliance optional plugin (Phases 1+2)

.claude-plugin/marketplace.json

@@ -257,6 +257,22 @@
         "ownership",
         "type-safety"
       ]
+    },
+    {
+      "name": "devflow-compliance",
+      "source": "./plugins/devflow-compliance",
+      "description": "Regulatory compliance patterns - GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, SOX code-level controls, audit trails, data retention",
+      "version": "1.8.3",
+      "keywords": [
+        "compliance",
+        "gdpr",
+        "hipaa",
+        "pci-dss",
+        "soc2",
+        "iso-27001",
+        "sox",
+        "audit"
+      ]
     }
   ]
 }

.devflow/features/index.md

@@ -4,3 +4,4 @@
 - **resolve-pipeline** — commands/resolve.mds, shared/agents/triager.md, shared/agents/coder.md, plugins/devflow-resolve, commands/code-review.mds — Use when modifying /resolve or /code-review convergence logic, adding or changing Triager disposition rules, adjusting Coder operating modes (issue-fix/validation-fix), touching the resolution-summary.md parser contract, changing the Verification Gate retry loop, or understanding how DIFF_FILES flows from git validate-branch into blast-radius triage. Keywords: resolve, triager, disposition matrix, blast-radius, FIX_NOW, FIX_SEPARATE, TECH_DEBT, FALSE_POSITIVE, BY_DESIGN, ESCALATED, resolution-summary, convergence parser, DIFF_FILES, issue-fix, validation-fix, Verification Gate, manage-debt.
 - **installer-shadowing** — src/cli/utils/installer.ts, src/cli/commands/init.ts, src/cli/commands/uninstall.ts, src/cli/commands/rules.ts, src/cli/commands/skills.ts, src/cli/plugins.ts — Use when modifying the install pipeline (installViaFileCopy, installAllRules, InstallReport), adding or changing skill/rule shadow override logic, touching uninstall scope or leftover-warning behavior, or extending the CLI skills/rules management commands. Keywords: installViaFileCopy, installAllRules, InstallReport, RuleInstallOutcome, SkillShadowState, RuleShadowState, shadow, unshadow, validateSkillShadow, validateRuleShadow, seedRuleShadow, prefixSkillName, unprefixSkillName, devflow:, skills, rules, uninstall, EISDIR, computeShadowLeftoverWarnings, ShadowWarning.
 - **learning-capture-system** — scripts/hooks, shared/agents/learning.md, src/cli/commands/learning.ts, src/cli/utils/feature-config.ts, src/cli/utils/learning-tuning-config.ts, src/cli/hud/components/learning-counts.ts, commands/_partials — Use when modifying capture hooks (capture-prompt/capture-turn/capture-question), the learning or memory pending-turns queues, the Learning agent (shared/agents/learning.md), the session-start-context learning directive, the feature-config toggles, the learning tuning config, the decisions content files (decisions.md/pitfalls.md/index.md) or their ledger ops, or the devflow learning CLI. Keywords: capture-prompt, capture-turn, capture-question, queue-append, pending-turns, memory-worker, Learning agent, learning directive, LEARNING MAINTENANCE, DEVFLOW_BG_UPDATER, learning-lock, queue_read_gates, decisions_load, DECISIONS_CONTEXT, feature-config, config.json, learning.json, decisions-ledger, assign-anchor, retire-anchor, render-decisions.
+- **compliance-plugin** — shared/skills/compliance, shared/rules/compliance.md, commands/_partials/_compliance.mds, plugins/devflow-compliance, commands/code-review.mds, commands/plan.mds, commands/implement.mds — Use when adding the devflow-compliance optional plugin to a project, implementing plugin-presence gates for future optional plugins, modifying the compliance reviewer/designer/coder integration surfaces, changing the CLAUDE.md Frameworks declaration convention, or adding new framework references to the compliance skill. Keywords: compliance, GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, SOX, compliance_gate, COMPLIANCE_ENABLED, plugin-presence gate, optional plugin, regulated data, audit trail.

CLAUDE.md

@@ -12,7 +12,7 @@ Devflow enhances Claude Code with intelligent development workflows. Modificatio
 
 ## Architecture Overview
 
-Plugin marketplace with 22 plugins (12 core + 9 optional language/ecosystem + 1 optional workflow), each following the Claude plugins format (`.claude-plugin/plugin.json`, `commands/`, `agents/`, `skills/`).
+Plugin marketplace with 23 plugins (12 core + 10 optional language/ecosystem + 1 optional workflow), each following the Claude plugins format (`.claude-plugin/plugin.json`, `commands/`, `agents/`, `skills/`).
 
 | Plugin | Purpose |
 |--------|---------|
@@ -38,6 +38,7 @@ Plugin marketplace with 22 plugins (12 core + 9 optional language/ecosystem + 1
 | `devflow-python` | Python language patterns (optional) |
 | `devflow-java` | Java language patterns (optional) |
 | `devflow-rust` | Rust language patterns (optional) |
+| `devflow-compliance` | Regulatory compliance patterns — GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, SOX (optional) |
 
 **Build-time asset distribution**: Skills and agents are stored once in `shared/skills/` and `shared/agents/`, then copied to each plugin at build time based on `plugin.json` manifests. This eliminates duplication in git.
 
@@ -57,7 +58,7 @@ Debug logs stored at `~/.devflow/logs/{project-slug}/`.
 
 **Feature Knowledge Bases**: Per-feature `.devflow/features/` directory containing KNOWLEDGE.md files that capture area-specific patterns, conventions, architecture, and gotchas. Uses a **write-through** model: load = direct file-I/O reading `.devflow/features/index.md` (regenerable cache) with frontmatter-glob fallback over `features/*/KNOWLEDGE.md` (source of truth) + verify-against-code on read; save = in-command write-through via a simplified Knowledge agent that writes `KNOWLEDGE.md` + the `index.md` line directly (no `.create-result.json`, no external scripts, no lock). **Git-tracked & shared (amends ADR-021 for `features/`)**: the root `.gitignore` carve-out (`.devflow/*` + level-by-level `!` re-includes, written byte-identically by `ensure-root-gitignore` / `ensureDevflowGitignore`) un-ignores `.devflow/features/index.md` + every `{slug}/KNOWLEDGE.md` while the rest of `.devflow/` stays local; after writing, the **Knowledge agent commits those two paths to the current worktree branch itself** by running git via its Bash tool (scoped `commit --only` pathspec, never `git add -A`, **never push, never force**, no commit script — per the LLM-vs-plumbing principle the commit is the agent's, not a deterministic helper). A user opts back out by re-adding `.devflow/features/` to their own `.gitignore`. Existing installs upgrade once via the versioned `.root-gitignore-configured-v2` marker. Freshness = write-through + verify-on-read (NO git-staleness, NO SessionEnd eval, NO Learning task). `index.md` line format: `- **{slug}** — {areas} — {Use-when description}`; frontmatter is authoritative if the line is lost. MDS module: `commands/_partials/_knowledge.mds` (defines/exports `knowledge_load` and `knowledge_writeback` partials) + 9 host `.mds` sources in `commands/` compiled to plugin commands at build time by `scripts/build-mds.ts` (`npm run build:mds`). `knowledge_load` is used up-front by: implement, plan, resolve, code-review, self-review, research, bug-analysis. `knowledge_writeback` is used at workflow end by: implement, resolve, self-review, explore, debug. explore/debug do NOT load up-front (intentional asymmetry). Config gate: single `knowledge: true|false` in feature config (default true) — gates write-back only; load is ungated. CLI: `devflow knowledge list` (read index.md / frontmatter glob), `devflow knowledge --enable/--disable/--status` (flip config). Note: `/debug` keeps FEATURE_KNOWLEDGE orchestrator-local (investigation workers examine code without pre-loaded context). Toggleable via `devflow knowledge --enable/--disable/--status` or `devflow init --knowledge/--no-knowledge`.
 
-**Rules**: Ultra-concise, always-on engineering principle files (~10-15 lines each) installed to `~/.claude/rules/devflow/` as flat `.md` files. Claude Code loads them automatically on every prompt — no hooks required — filling the guidance gap for quick edits that don't trigger a full skill pipeline. Rules flow through the same four-stage pipeline as skills: authored in `shared/rules/`, distributed to `plugins/*/rules/` at build time, installed (or shadowed) at runtime, and activated automatically. Unlike skills (which install universally from all plugins), rules are **plugin-scoped**: only rules belonging to selected plugins are installed. This keeps core rules (`security`, `engineering`, `quality`, `reliability` from `devflow-core-skills`) always present, and language/ecosystem rules (`typescript`, `react`, `go`, etc.) present only when the user has that plugin installed. Shadow overrides: `~/.devflow/rules/{name}.md` overrides the Devflow source. Shadow CLI: `devflow rules shadow <name>` (creates shadow from installed or built source), `devflow rules unshadow <name>` (removes shadow), `devflow rules list` (validity-annotated list). Toggleable via `devflow rules --enable/--disable/--status/--list` or `devflow init --rules/--no-rules`. Stored in manifest `features.rules: boolean` (self-heals to `true` on old manifests). Currently 12 rules: 4 core + 8 language/UI. `paths: []` YAML frontmatter must remain — it signals Claude Code to apply the rule globally.
+**Rules**: Ultra-concise, always-on engineering principle files (~10-15 lines each) installed to `~/.claude/rules/devflow/` as flat `.md` files. Claude Code loads them automatically on every prompt — no hooks required — filling the guidance gap for quick edits that don't trigger a full skill pipeline. Rules flow through the same four-stage pipeline as skills: authored in `shared/rules/`, distributed to `plugins/*/rules/` at build time, installed (or shadowed) at runtime, and activated automatically. Unlike skills (which install universally from all plugins), rules are **plugin-scoped**: only rules belonging to selected plugins are installed. This keeps core rules (`security`, `engineering`, `quality`, `reliability` from `devflow-core-skills`) always present, and language/ecosystem rules (`typescript`, `react`, `go`, etc.) present only when the user has that plugin installed. Shadow overrides: `~/.devflow/rules/{name}.md` overrides the Devflow source. Shadow CLI: `devflow rules shadow <name>` (creates shadow from installed or built source), `devflow rules unshadow <name>` (removes shadow), `devflow rules list` (validity-annotated list). Toggleable via `devflow rules --enable/--disable/--status/--list` or `devflow init --rules/--no-rules`. Stored in manifest `features.rules: boolean` (self-heals to `true` on old manifests). Currently 13 rules: 4 core + 8 language/UI + 1 global (compliance). `paths: []` YAML frontmatter must remain — it signals Claude Code to apply the rule globally.
 
 **One background pipeline** (toggleable):
 - `devflow learning --enable/--disable` — Learning pipeline (decision + pitfall detection, materialized by the directive-spawned Learning agent from the captured queue)
@@ -72,11 +73,11 @@ Knowledge write-back is in-command (not a background pipeline): gated by `devflo
 
 ```
 devflow/
-├── commands/               # MDS command sources (14 hosts + 8 partials in _partials/; compiled to plugins/*/commands/ by build:mds)
-├── shared/skills/          # 40 skills (single source of truth)
+├── commands/               # MDS command sources (14 hosts + 10 partials in _partials/; compiled to plugins/*/commands/ by build:mds)
+├── shared/skills/          # 41 skills (single source of truth)
 ├── shared/agents/          # 16 shared agents (single source of truth)
-├── shared/rules/           # 12 rules (single source of truth; flat .md files)
-├── plugins/devflow-*/      # 22 plugins (12 core + 9 optional language/ecosystem + 1 optional workflow)
+├── shared/rules/           # 13 rules (single source of truth; flat .md files)
+├── plugins/devflow-*/      # 23 plugins (12 core + 10 optional language/ecosystem + 1 optional workflow)
 ├── docs/reference/         # Detailed reference documentation
 ├── scripts/                # Helper scripts (statusline, docs-helpers)
 │   └── hooks/              # Capture + memory + learning + ambient hooks (capture-prompt, capture-turn, capture-question, queue-append, memory-worker, background-memory-update [Stop-hook worker], learning-lock, session-start-memory, session-start-context, session-start-orchestrator, pre-compact-memory, preamble, git-marker [sourced git-repo helper], get-mtime, hook-bootstrap, hook-log-init)

README.md

@@ -32,7 +32,7 @@ you: add rate limiting to the /api/upload endpoint
 ```
 
 ```
-/devflow:code-review     → 18 reviewers examine your changes in parallel
+/devflow:code-review     → up to 20 reviewers examine your changes in parallel
 /devflow:resolve         → all issues validated and fixed automatically
 /devflow:bug-analysis    → proactive bug finding before review
 ```
@@ -48,11 +48,11 @@ you: add rate limiting to the /api/upload endpoint
 
 **Skill shadowing.** Override any built-in skill with your own version. Drop a file into `~/.devflow/skills/{name}/` and the installer uses yours instead of the default — same activation, your rules.
 
-**Always-on rules.** 12 ultra-condensed engineering principles (~10 lines each) load on every prompt — security, quality, and language-specific guidance (TypeScript, React, Go, Python, Java, Rust). Rules install from your selected plugins only, so a Go project won't get React rules. Override any rule via `~/.devflow/rules/{name}.md` or `devflow rules shadow <name>`.
+**Always-on rules.** 13 ultra-condensed engineering principles (~10 lines each) load on every prompt — security, quality, and language-specific guidance (TypeScript, React, Go, Python, Java, Rust), plus a global compliance rule when the devflow-compliance plugin is installed. Rules install from your selected plugins only, so a Go project won't get React rules. Override any rule via `~/.devflow/rules/{name}.md` or `devflow rules shadow <name>`.
 
 **Full lifecycle.** `/devflow:plan` takes a feature idea through codebase exploration, gap analysis, design review, and outputs a plan document ready for `/devflow:implement`. `/devflow:implement` accepts that plan document (or an issue or task description directly) and drives it through coding, validation, and refinement to a PR. `/devflow:debug` investigates bugs with competing hypotheses in parallel. `/devflow:self-review` runs Simplifier + Scrutinizer quality passes.
 
-**Everything is composable.** 22 plugins (12 core + 9 language/ecosystem + 1 optional workflow recipes). Install only what you need.
+**Everything is composable.** 23 plugins (12 core + 10 language/ecosystem + 1 optional workflow recipes). Install only what you need.
 
 **HUD.** A persistent status line updates on every prompt — project, branch, diff stats, context usage, model, cost with weekly/monthly totals, quota reset timers, and configuration counts at a glance.
 
@@ -62,9 +62,9 @@ Context ████░░░░ 42% · 5h ████░░░░ 45% (2h 15m)
 Opus 4.6 (1M) · 3 MCPs 2 rules · $1.42 · $18.50/wk · $62.30/mo
 ```
 
-**18 parallel code reviewers.** Security, architecture, performance, complexity, consistency, regression, testing, and more. Each produces findings with severity, confidence scoring, and concrete fixes. Conditional reviewers activate when relevant (TypeScript for `.ts` files, database for schema changes). Every finding gets validated and resolved automatically.
+**Up to 20 parallel code reviewers.** Security, architecture, performance, complexity, consistency, regression, testing, and more. Each produces findings with severity, confidence scoring, and concrete fixes. Conditional reviewers activate when relevant (TypeScript for `.ts` files, database for schema changes, compliance when the devflow-compliance plugin is installed). Every finding gets validated and resolved automatically.
 
-**40 skills.** Most are grounded in expert material — backed by peer-reviewed papers, canonical books, and industry standards: security (OWASP, Shostack), architecture (Parnas, Evans, Fowler), performance (Brendan Gregg), testing (Beck, Meszaros), design (Wlaschin, Hickey), 200+ sources total.
+**41 skills.** Most are grounded in expert material — backed by peer-reviewed papers, canonical books, and industry standards: security (OWASP, Shostack), architecture (Parnas, Evans, Fowler), performance (Brendan Gregg), testing (Beck, Meszaros), design (Wlaschin, Hickey), compliance (GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, SOX, NIST SSDF, OWASP ASVS), 200+ sources total.
 
 **Security.** Deny lists block dangerous tool patterns out of the box — configurable during init and toggleable any time with `devflow security` (`--enable`/`--disable`/`--status`).
 

commands/_partials/_compliance.mds

@@ -0,0 +1,43 @@
+@define compliance_gate():
+### Compliance Plugin Gate
+
+Resolve `COMPLIANCE_ENABLED` **once per run** before Phase 1 begins, then reuse the cached value for every worktree. Silent — no prompts, no warnings emitted. Read-only: ≤3 file reads, no subprocess, no LLM call, never writes files.
+
+Resolve the worktree root using `devflow:worktree-support` (WORKTREE_PATH if provided, else cwd). All paths below are relative to `\{worktree\}`.
+
+**Step 1 — Manifest (scope-aware):**
+
+Attempt to read `\{worktree\}/.devflow/manifest.json`.
+- If the file parses: check whether its `plugins` array contains `"devflow-compliance"`.
+  - Yes → proceed to Step 2 using **local scope** paths.
+  - No → set `COMPLIANCE_ENABLED=false`. Stop.
+- If absent or unreadable: attempt to read `~/.devflow/manifest.json`.
+  - If the file parses: check whether its `plugins` array contains `"devflow-compliance"`.
+    - Yes → proceed to Step 2 using **home scope** paths.
+    - No → set `COMPLIANCE_ENABLED=false`. Stop.
+  - If also absent or unreadable → proceed to Step 3.
+
+**Step 2 — Asset verify (self-heals stale manifest):**
+
+Uninstall does not rewrite the `plugins` array, so a manifest hit can be stale. Verify the skill asset exists:
+- Local scope: check that `\{worktree\}/.claude/skills/devflow:compliance/SKILL.md` exists. Missing → `COMPLIANCE_ENABLED=false`. Stop.
+- Home scope: check that `~/.claude/skills/devflow:compliance/SKILL.md` exists. Missing → `COMPLIANCE_ENABLED=false`. Stop.
+
+If the skill asset exists → `COMPLIANCE_ENABLED=true`. Proceed to Step 4.
+
+**Step 3 — Fallback (no readable manifest):**
+
+Set `COMPLIANCE_ENABLED=true` if either of these files exists:
+- `~/.claude/rules/devflow/compliance.md`
+- `\{worktree\}/.claude/rules/devflow/compliance.md`
+
+If neither exists → `COMPLIANCE_ENABLED=false`. Stop.
+
+If either exists → `COMPLIANCE_ENABLED=true`. Proceed to Step 4.
+
+**Step 4 — Project opt-out (only when COMPLIANCE_ENABLED=true):**
+
+Read `\{worktree\}/CLAUDE.md`. If the file contains a `## Compliance` section whose body includes a `Frameworks: none` line, set `COMPLIANCE_ENABLED=false`.
+@end
+
+@export compliance_gate