v0.2.0 — Claude Code plugin support

AgentNexus is now installable in Claude Code via a single command.

```
/plugin install scalefirstai/AgentNexus
```

That installs all eight skills directly. No clone, no script.

What's new

• `.claude-plugin/plugin.json` — plugin manifest listing all eight skills (`grill-me`, `grill-design`, `grill-security`, `grill-privacy`, `code-graph`, `code-knowledge-graph`, `security-review`, `software-security`).
• `skills/` directory committed to the repo as a Claude Code skill format mirror of `workflows/`. Source of truth remains `workflows/`; sync via `scripts/sync-skills.sh`.
• CI sync gate — runs `sync-skills.sh` and fails if `skills/` is out of sync with `workflows/`.
• Plugin manifest validation — every skill referenced in `plugin.json` must have a real `SKILL.md`.
• `scripts/install-claude-code.sh` simplified — skills mode now copies `skills/` directly (deterministic, no inline frontmatter rewrite at install time).

Quick start (Claude Code)

```
/plugin install scalefirstai/AgentNexus

or pin to this release:

/plugin install scalefirstai/AgentNexus@v0.2.0
```

Quick start (Windsurf, unchanged)

```bash
git clone https://github.com/scalefirstai/AgentNexus.git
cd AgentNexus
./scripts/install.sh /path/to/your/project
```

Repo layout (new)

Path	Purpose
`workflows/.md`	Canonical workflow source (Windsurf format). Edit here.
`skills//SKILL.md`	Generated mirror in Claude Code skill format. Don't hand-edit.
`.claude-plugin/plugin.json`	Plugin manifest consumed by `/plugin install`.

See docs/claude-code.md for the full Windsurf↔Claude Code mapping.

Honest caveats

• The plugin manifest only lists skills, not slash commands. If you'd rather have `code-graph` as a slash command than a skill, run `./scripts/install-claude-code.sh --commands` against your project after the plugin install.
• `software-security` skill bundles all 23 CodeGuard rules — large context. Per-language splitting is on the roadmap.
• The `/plugin install` command syntax is whatever the current Claude Code version uses; if it differs in your version, the manifest is at `.claude-plugin/plugin.json` for any plugin manager that reads the standard format.

Breaking changes

None. `workflows/` is still canonical and the Windsurf installer is unchanged.

v0.1.0 — initial release

First public release of AgentNexus — drop-in Windsurf workflows for enterprise-grade AI-assisted coding.

What's in the box

Workflows (8)

• /grill-me — orchestrator that triages scope and runs the right axis grills
• /grill-design — scope · architecture fit · reliability/ops · change management · cost · dependencies → emits a design-review / RFC artifact
• /grill-security — STRIDE threat model · authn/authz · secrets · attack surface · crypto · supply chain · IR → emits a threat model & security review
• /grill-privacy — data inventory · lawful basis · residency · retention · DSAR · sub-processors · DPIA trigger → emits a PIA/DPIA + ROPA notes
• /code-graph — drives the local Kuzu-backed code knowledge graph CLI
• /code-knowledge-graph — markdown-only narrative graph (KNOWLEDGE-GRAPH.md)
• /security-review — full security review of a target repo against Project CodeGuard rules
• /software-security — apply the 23 Project CodeGuard rules during code generation

code-graph CLI

• Single dependency: Kuzu embedded graph DB
• Regex JS/TS parser (extracts modules, imports, top-level symbols)
• Git hooks: post-commit (incremental update) + pre-push (impact warning)
• Subcommands: init · index · update · impact · map · neighbors · query · install-hooks

Documentation

• Hero README with badges
• docs/getting-started.md — five minutes to your first grill
• docs/workflow-reference.md — every workflow in detail
• docs/mcp-integration.md — JIRA / GitLab / GitHub / SonarQube example configs
• docs/walkthrough.md — end-to-end developer story shipping a GDPR Art 15 endpoint with JIRA + GitLab + SonarQube MCP

Adoption

• scripts/install.sh — symlink (default, follows upstream) or --copy mode
• CI green: shellcheck + node syntax + install-script smoke test (symlink + copy + idempotency)

Attribution

• 24 files under workflows/software-security/ and workflows/security-review/ are derived from Project CodeGuard (CC BY 4.0) — see NOTICE.
• code-graph CLI architectural pattern is inspired by GitNexus; no code copied.

Known limitations

• code-graph parser is regex-based, JS/TS only. No CALLS/EXTENDS edges yet — needs a real AST parser. Tracked in the roadmap.
• MCP tool names in the walkthrough are illustrative; substitute names that match your team's chosen MCP server implementations.
• The grills are opinionated toward GDPR / SOC 2 / common enterprise norms. Fork freely if your regime differs.

Quick start

```bash
git clone https://github.com/scalefirstai/AgentNexus.git
cd AgentNexus
./scripts/install.sh /path/to/your/project
```

In Windsurf, type `/grill-me` to begin. See docs/getting-started.md for the full setup.