Skip to content

Move architecting-solutions from bitwarden-tech-lead to bitwarden-delivery-tools#160

Open
trmartin4 wants to merge 9 commits into
mainfrom
move-architecting-solutions-to-delivery-tools
Open

Move architecting-solutions from bitwarden-tech-lead to bitwarden-delivery-tools#160
trmartin4 wants to merge 9 commits into
mainfrom
move-architecting-solutions-to-delivery-tools

Conversation

@trmartin4

@trmartin4 trmartin4 commented Jul 10, 2026

Copy link
Copy Markdown
Member

📔 Objective

Moves the architecting-solutions skill from bitwarden-tech-lead into bitwarden-delivery-tools so it can be invoked directly from delivery-lifecycle skills (breakdowns, initiative-funnel work, ownership transitions) without requiring users to install bitwarden-tech-lead. This also mirrors the shared organizational responsibility of designing solutions - it is not isolated to a tech lead role.

As written previously, it would require anyone to install the tech-lead agent, which - given that all engineers are not tech leads and solution design is not a tech lead responsibility - presents a dissonance that would inhibit its invocation when potentially useful.

Removes references to the initiative shepherd, as this is a human-to-human process engaged outside of the solution architecture process, but kept a callout to engage with Architecture if we identify solution changes that warrant it.

…n-delivery-tools

Lets delivery-lifecycle skills (breakdowns, initiative-funnel work,
ownership transitions) invoke architectural judgment directly without
requiring users to install bitwarden-tech-lead.

- bitwarden-delivery-tools 2.0.0 -> 2.1.0 (new skill; git rename)
- bitwarden-tech-lead 2.3.2 -> 3.0.0 (skill removed; AGENT.md
  points at new location)
- SKILL.md: dropped shepherd section, contributing-to-technical-strategy
  cross-reference, and two of five Architecture-involvement signals;
  repaired paragraph structure and voice in the Architecture-Group
  section; made Skill(threat-modeling) reference explicit
@trmartin4 trmartin4 added the ai-review Request a Claude code review label Jul 10, 2026
@github-actions

github-actions Bot commented Jul 10, 2026

Copy link
Copy Markdown

Plugin Validation Summary — PR #160

Result: ✅ PASS — no critical, major, or errors-that-must-fix issues found. Two optional minor observations are noted below.

This PR moves the architecting-solutions skill out of bitwarden-tech-lead and into bitwarden-delivery-tools, updates every cross-plugin reference, and bumps versions accordingly. All three validation passes (plugin structure, skill review, security) confirm the move is internally consistent.

What was validated

  • Plugin structure (plugin-validator) — bitwarden-delivery-tools, bitwarden-shepherd, bitwarden-tech-lead
  • Skill review (skill-reviewer) — 3 changed SKILL.md files
  • Security (reviewing-claude-config) — all 15 changed files

Note: the scripts/validate-*.sh helpers require a permission approval that was unavailable in this environment, so all checks were performed by reading files directly.


1. Plugin Structure — ✅ PASS (all three plugins)

Plugin plugin.json Version consistency (plugin.json / marketplace.json / README) CHANGELOG Agent frontmatter
bitwarden-delivery-tools ✅ name matches dir, 2.1.0 valid semver 2.1.0 everywhere [2.1.0] - 2026-07-10, Added — skill move n/a (skills-only)
bitwarden-shepherd ✅ name matches dir, 1.0.1 valid semver 1.0.1 everywhere [1.0.1] - 2026-07-10, Changed — reference updates ✅ valid (4 <example> blocks, model: opus, color: magenta, skills: list matches 7 on-disk dirs)
bitwarden-tech-lead ✅ name matches dir, 3.0.0 valid semver 3.0.0 everywhere [3.0.0] - 2026-07-10, Removed (BREAKING) — skill move ✅ valid (4 <example> blocks, model: opus, color: cyan, skills: reduced to contributing-to-technical-strategy — matches sole remaining dir)

Semver bumps are correct: MINOR for delivery-tools (added skill), MAJOR for tech-lead (breaking removal), PATCH for shepherd (reference-only). No hardcoded credentials in any plugin file.

Core move verification:

  • plugins/bitwarden-tech-lead/skills/ now contains only contributing-to-technical-strategy — the old architecting-solutions dir is genuinely gone.
  • plugins/bitwarden-delivery-tools/skills/architecting-solutions/ contains SKILL.md (frontmatter intact) + evals/.

2. Skill Review — ✅ PASS

Word counts all within the 1,000–3,000 target band: architecting-solutions 1,046, running-a-proof-of-concept 2,056, running-an-architectural-assessment 1,513.

  • bitwarden-delivery-tools/skills/architecting-solutions/SKILL.md — Valid frontmatter (name matches dir, description, allowed-tools). Strong third-person description with specific triggers. Lean, imperative style. Cross-reference Skill(bitwarden-security-engineer:bitwarden-security-context) resolves; WebFetch scoped to contributing.bitwarden.com matches the ADR fetch on line 19.
  • bitwarden-shepherd/skills/running-a-proof-of-concept/SKILL.md — Cross-references correctly updated to bitwarden-delivery-tools (lines 33, 147).
  • bitwarden-shepherd/skills/running-an-architectural-assessment/SKILL.md — Cross-references correctly updated to bitwarden-delivery-tools (lines 62, 134).

Repo-wide stale-reference sweep: every architecting-solutions reference in bitwarden-tech-lead (agents/AGENT.md, README.md) now points at bitwarden-delivery-tools. CHANGELOG mentions are historical records (expected). No reference still points the skill at its old bitwarden-tech-lead home.


3. Security — ✅ PASS (clean)

  • Secrets / credentials: none. Secret-pattern sweeps of READMEs/CHANGELOGs returned nothing; no settings.local.json tracked.
  • Tool/permission scoping: appropriate and least-privilege throughout.
    • architecting-solutions/SKILL.md:4allowed-tools: Skill, WebFetch(domain:contributing.bitwarden.com): domain-locked WebFetch (no Bash/Write/Edit) is a model example of tight scoping, and the domain lock mitigates the untrusted-content risk the skill itself warns about.
    • bitwarden-shepherd/agents/AGENT.md:42 and bitwarden-tech-lead/agents/AGENT.md:42Read, Write, Glob, Grep, Skill; Write justified (authors artifacts), no Bash.
  • Prompt-injection fixture: behavior-eval.json case Add Bitwarden Code Review plugin with agent-based architecture #9 (lines 71–76) embeds a simulated injection string. Confirmed as clearly-labeled test fixture (case named security-untrusted-external-content, wrapped in a fenced fetched-ticket block, expected_behavior states the model must NOT obey it) — not a real vulnerability.
  • No dangerous auto-approvals or broad file-access grants; no settings changes in this PR.

Optional minor observations (non-blocking, do not require action for this PR)

  • Minor / style: architecting-solutions/SKILL.md:39 — "As with ADR guidelines, When proposing" has a mid-sentence capital "When" after a comma. Pre-existing, not introduced by this PR.
  • Minor / consistency: the two shepherd skills still use the when_to_use frontmatter field (deprecated in favor of description-only). Pre-existing and out of scope for this move PR; consider a follow-up.

Recommendation: APPROVE. No changes are required for this PR to merge.

@github-actions

github-actions Bot commented Jul 10, 2026

Copy link
Copy Markdown

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the relocation of the architecting-solutions skill from bitwarden-tech-lead into bitwarden-delivery-tools. Verified the old SKILL.md is fully removed, the new SKILL.md and behavior eval are added, and the new skill's allowed-tools correctly drops the Atlassian MCP tools (it now uses only Skill and WebFetch). Confirmed all cross-plugin references — shepherd AGENT.md and skills, tech-lead AGENT.md/README, and both plugin READMEs — now point to the new home, with no stale architecting-solutions-in-bitwarden-tech-lead attributions remaining outside changelog history. Version bumps are semantically correct and consistent across marketplace.json, plugin.json, README, and CHANGELOG: tech-lead 3.0.0 (MAJOR, breaking skill removal), delivery-tools 2.1.0 (MINOR, added skill), shepherd 1.0.1 (PATCH, reference updates).

Code Review Details

No new findings.

The two prior suggestions on plugins/bitwarden-delivery-tools/README.md (Related Plugins section) have already been addressed in the current diff — the bitwarden-atlassian-tools line no longer attributes those MCP tools to architecting-solutions, and the bitwarden-security-engineer line now correctly references Skill(bitwarden-security-context) rather than threat-modeling.

- tech-lead README: drop architecting-solutions from Skills table;
  add it to the delivery-tools cross-plugin row; rewrite upgrade
  note to reflect the skill's new home
- delivery-tools README: add architecting-solutions to the Technical
  design table; extend the concern description; add a Related Plugins
  section covering the atlassian-tools and security-engineer
  cross-plugin dependencies
- tech-lead CHANGELOG 3.0.0: note the README updates
@trmartin4 trmartin4 changed the title llm: move architecting-solutions from bitwarden-tech-lead to bitwarden-delivery-tools Move architecting-solutions from bitwarden-tech-lead to bitwarden-delivery-tools Jul 10, 2026
Skill(architecting-solutions) moved from bitwarden-tech-lead to
bitwarden-delivery-tools in the sibling PR. Shepherd docs and skills
still resolved by name, but instructed users to reach for tech-lead
to get a skill it no longer provides.

- README, AGENT.md: move architecting-solutions from the tech-lead
  cross-plugin row into the delivery-tools row
- running-an-architectural-assessment, running-a-proof-of-concept:
  update inline and Related-links references
- 1.0.0 -> 1.0.1 (patch; docs-only)
@trmartin4
trmartin4 marked this pull request as ready for review July 10, 2026 19:26
@trmartin4
trmartin4 requested a review from a team as a code owner July 10, 2026 19:26
SaintPatrck
SaintPatrck previously approved these changes Jul 16, 2026

@SaintPatrck SaintPatrck left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a couple of questions that are byproducts of not having evals associated with any of this. I don't want to hold the PR, but there would be real value in adding evals in a follow-up. Without them, reviewers have no way to verify if changes are improving or regressing behavior, and no way to identify whether we can remove excess commentary. Like submitting code changes without unit tests. We trust, but we also want to verify.

allowed-tools: Skill, mcp__plugin_bitwarden-atlassian-tools_bitwarden-atlassian__get_issue, mcp__plugin_bitwarden-atlassian-tools_bitwarden-atlassian__get_issue_comments, mcp__plugin_bitwarden-atlassian-tools_bitwarden-atlassian__get_issue_remote_links, mcp__plugin_bitwarden-atlassian-tools_bitwarden-atlassian__search_issues, mcp__plugin_bitwarden-atlassian-tools_bitwarden-atlassian__get_confluence_page, mcp__plugin_bitwarden-atlassian-tools_bitwarden-atlassian__get_confluence_page_comments, mcp__plugin_bitwarden-atlassian-tools_bitwarden-atlassian__search_confluence, mcp__plugin_bitwarden-atlassian-tools_bitwarden-atlassian__search_confluence_cql
---

This skill applies architectural judgment during team-level delivery work: scoping tickets, drafting breakdowns, evaluating trade-offs, and choosing between approaches.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❓ How did adding this statement change Claude's behavior?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right. It doesn't meaningfully change it, it's not addressed to Claude but to a human. I removed it.

Teams have autonomy over decisions inside their domain. Architecture doesn't gate-keep team-level work. What Architecture does is maintain the holistic view — the portfolio of cross-cutting initiatives, the patterns that span teams, the decisions that will be expensive to change later. The job at the team level is to recognize when a choice has implications that benefit from that wider view, and pull Architecture in before — not after — the team ships.

Watch for the five signals that warrant Architecture involvement (from the [Architecture / Engineering Operating Model](https://bitwarden.atlassian.net/wiki/spaces/EN/pages/1286963201)):
Watch for signals that warrant Architecture involvement (from the [Architecture / Engineering Operating Model](https://bitwarden.atlassian.net/wiki/spaces/EN/pages/1286963201)):

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❓ Is Claude actually fetching this URL at any point, without explicit instruction to do so? Should it, so it is aware of the full decision model, or are we comfortable relying solely on the key points below? Is there concern with more drift between them? Does behavior degrade if this link is not present?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed the URL as it wasn't serving any meaningful purpose.

Comment thread plugins/bitwarden-delivery-tools/README.md Outdated
Comment thread plugins/bitwarden-delivery-tools/README.md Outdated
@trmartin4
trmartin4 requested a review from SaintPatrck July 18, 2026 17:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai-review Request a Claude code review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants