diff --git a/.github/workflows/agent-changelog.yml b/.github/workflows/agent-changelog.yml
new file mode 100644
index 0000000..2418b97
--- /dev/null
+++ b/.github/workflows/agent-changelog.yml
@@ -0,0 +1,90 @@
+name: Agent Changelog
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to generate changelog for"
+        required: true
+        type: string
+
+env:
+  BUN_VERSION: "1.2"
+
+permissions:
+  contents: write
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build CLI
+        run: cd apps/cli && bun run build
+
+      - name: Generate changelog
+        id: changelog
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ github.ref_name || inputs.tag }}"
+          echo "📋 Generating changelog for $TAG..."
+
+          cd apps/cli
+          bun run dist/index.js changelog \
+            --last-release \
+            --output /tmp/CHANGELOG.md
+
+          if [ ! -s /tmp/CHANGELOG.md ]; then
+            echo "No commits found since last tag — using simple release"
+            echo "# Release $TAG" > /tmp/CHANGELOG.md
+            echo "" >> /tmp/CHANGELOG.md
+            echo "Release $TAG of agent-workbench." >> /tmp/CHANGELOG.md
+          fi
+
+          echo "content<<EOF" >> "$GITHUB_OUTPUT"
+          cat /tmp/CHANGELOG.md >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Create or update GitHub Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ github.ref_name || inputs.tag }}"
+          CHANGELOG="${{ steps.changelog.outputs.content }}"
+
+          # Check if release already exists
+          EXISTING=$(gh release view "$TAG" --json id 2>/dev/null || echo "")
+
+          if [ -n "$EXISTING" ]; then
+            echo "Updating existing release $TAG..."
+            gh release edit "$TAG" \
+              --repo "${{ github.repository }}" \
+              --notes "$CHANGELOG" \
+              --discussion-category "announcements"
+          else
+            echo "Creating new release $TAG..."
+            gh release create "$TAG" \
+              --repo "${{ github.repository }}" \
+              --title "$TAG" \
+              --notes "$CHANGELOG" \
+              --generate-notes \
+              --discussion-category "announcements"
+          fi
+
+          echo "✅ Release $TAG updated with changelog"
diff --git a/.github/workflows/agent-review.yml b/.github/workflows/agent-review.yml
new file mode 100644
index 0000000..31ec7bd
--- /dev/null
+++ b/.github/workflows/agent-review.yml
@@ -0,0 +1,72 @@
+name: Agent PR Review
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "PR number to review"
+        required: true
+        type: number
+
+env:
+  BUN_VERSION: "1.2"
+
+permissions:
+  contents: read
+  pull-requests: write
+  checks: write
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # Fetch full history so git log and gh pr diff work accurately
+          fetch-depth: 0
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build workspace
+        run: bash scripts/build-all.sh
+
+      - name: Build CLI
+        run: cd apps/cli && bun run build
+
+      - name: Run PR review
+        id: review
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER="${{ github.event.pull_request.number || inputs.pr_number }}"
+          if [ -z "$PR_NUMBER" ]; then
+            echo "No PR number available"
+            exit 1
+          fi
+
+          echo "🔍 Reviewing PR #$PR_NUMBER..."
+          cd apps/cli
+          bun run dist/index.js review --pr "$PR_NUMBER" \
+            --repo "${{ github.repository }}" 2>&1 | tee /tmp/review-output.txt
+
+          # Capture exit code
+          exit ${PIPESTATUS[0]}
+
+      - name: Comment on failure
+        if: failure() && steps.review.outcome == 'failure'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER="${{ github.event.pull_request.number || inputs.pr_number }}"
+          gh pr comment "$PR_NUMBER" \
+            --repo "${{ github.repository }}" \
+            --body "❌ **agent-workbench review found issues** — check the [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details."
diff --git a/apps/cli/src/commands/changelog.ts b/apps/cli/src/commands/changelog.ts
new file mode 100644
index 0000000..2f47594
--- /dev/null
+++ b/apps/cli/src/commands/changelog.ts
@@ -0,0 +1,257 @@
+/**
+ * Changelog command — generates a changelog from conventional commits.
+ *
+ * Usage:
+ *   agent-workbench changelog [--from <tag|commit>] [--to <tag|commit>]
+ *   agent-workbench changelog --last-release
+ */
+
+import { execSync } from "node:child_process";
+import { writeFileSync } from "node:fs";
+
+// ── Types ──────────────────────────────────────────────────────────────────
+
+interface CommitGroup {
+  title: string;
+  commits: ParsedCommit[];
+}
+
+interface ParsedCommit {
+  hash: string;
+  type: string;
+  scope: string | null;
+  breaking: boolean;
+  description: string;
+  body: string;
+}
+
+// ── Command handler ────────────────────────────────────────────────────────
+
+export async function handleChangelog(
+  args: string[],
+): Promise<number> {
+  const from = parseArg(args, "--from");
+  const to = parseArg(args, "--to") ?? "HEAD";
+  const lastRelease = args.includes("--last-release");
+  const output = parseArg(args, "--output");
+
+  try {
+    // Determine the range
+    let range: string;
+
+    if (lastRelease) {
+      const lastTag = execSync(
+        "git describe --tags --abbrev=0 2>/dev/null || echo ''",
+        { encoding: "utf-8" },
+      ).trim();
+      if (!lastTag) {
+        console.error("No tags found. Use --from explicitly or run without --last-release.");
+        return 1;
+      }
+      range = `${lastTag}..${to}`;
+      console.error(`📋 Changes since ${lastTag} → ${to}`);
+    } else if (from) {
+      range = `${from}..${to}`;
+      console.error(`📋 Changes from ${from} → ${to}`);
+    } else {
+      const lastTag = execSync(
+        "git describe --tags --abbrev=0 2>/dev/null || echo ''",
+        { encoding: "utf-8" },
+      ).trim();
+      range = lastTag ? `${lastTag}..${to}` : `--all`;
+      console.error(`📋 Changes since ${lastTag || 'the beginning'} → ${to}`);
+    }
+
+    // Fetch commits
+    const logFormat = "--format=---%n%H%n%s%n%b";
+    const rawLog = execSync(
+      `git log ${range} ${logFormat}`,
+      { encoding: "utf-8", maxBuffer: 5 * 1024 * 1024 },
+    ).trim();
+
+    if (!rawLog) {
+      console.error("No commits found in range.");
+      return 0;
+    }
+
+    const commits = parseCommits(rawLog);
+    const groups = groupCommits(commits);
+    const markdown = formatChangelog(groups, range, commits.length);
+
+    // Output
+    if (output) {
+      writeFileSync(output, markdown, "utf-8");
+      console.error(`\n✅ Changelog written to ${output}`);
+    } else {
+      console.log(markdown);
+    }
+
+    return 0;
+  } catch (err) {
+    console.error(
+      `Error: ${err instanceof Error ? err.message : String(err)}`,
+    );
+    return 1;
+  }
+}
+
+// ── Parsing ────────────────────────────────────────────────────────────────
+
+export function parseCommits(raw: string): ParsedCommit[] {
+  const blocks = raw.split("\n---\n").filter(Boolean);
+  const commits: ParsedCommit[] = [];
+
+  for (const block of blocks) {
+    const lines = block.trim().split("\n");
+    const hash = lines[0]?.trim() ?? "";
+    const subject = lines[1]?.trim() ?? "";
+    const body = lines.slice(2).join("\n").trim();
+
+    // Parse conventional commit: type(scope)!: description
+    const conventional = /^(\w+)(?:\(([^)]+)\))?(!)?:\s*(.+)$/.exec(subject);
+    if (conventional) {
+      commits.push({
+        hash: hash.slice(0, 7),
+        type: conventional[1]!,
+        scope: conventional[2] ?? null,
+        breaking: conventional[3] === "!",
+        description: conventional[4]!,
+        body,
+      });
+    } else {
+      commits.push({
+        hash: hash.slice(0, 7),
+        type: "other",
+        scope: null,
+        breaking: false,
+        description: subject,
+        body,
+      });
+    }
+  }
+
+  return commits;
+}
+
+// ── Grouping ───────────────────────────────────────────────────────────────
+
+const TYPE_ORDER: Record<string, number> = {
+  feat: 0,
+  feature: 0,
+  fix: 1,
+  bugfix: 1,
+  docs: 2,
+  documentation: 2,
+  style: 3,
+  refactor: 4,
+  perf: 5,
+  performance: 5,
+  test: 6,
+  tests: 6,
+  build: 7,
+  ci: 8,
+  chore: 9,
+  other: 10,
+};
+
+const TYPE_LABELS: Record<string, string> = {
+  feat: "🚀 Features",
+  feature: "🚀 Features",
+  fix: "🐛 Bug Fixes",
+  bugfix: "🐛 Bug Fixes",
+  docs: "📚 Documentation",
+  documentation: "📚 Documentation",
+  style: "💄 Style",
+  refactor: "♻️ Refactoring",
+  perf: "⚡ Performance",
+  performance: "⚡ Performance",
+  test: "🧪 Tests",
+  tests: "🧪 Tests",
+  build: "📦 Build System",
+  ci: "🤖 CI",
+  chore: "🔧 Chores",
+  other: "📝 Other",
+};
+
+export function groupCommits(commits: ParsedCommit[]): CommitGroup[] {
+  const groups = new Map<string, ParsedCommit[]>();
+
+  for (const commit of commits) {
+    const label = TYPE_LABELS[commit.type] ?? "📝 Other";
+    const existing = groups.get(label);
+    if (existing) {
+      existing.push(commit);
+    } else {
+      groups.set(label, [commit]);
+    }
+  }
+
+  return Array.from(groups.entries())
+    .map(([title, commitList]) => ({ title, commits: commitList }))
+    .sort((a, b) => {
+      const aOrder = TYPE_ORDER[a.commits[0]?.type ?? "other"] ?? 99;
+      const bOrder = TYPE_ORDER[b.commits[0]?.type ?? "other"] ?? 99;
+      return aOrder - bOrder;
+    });
+}
+
+// ── Formatting ─────────────────────────────────────────────────────────────
+
+function formatChangelog(
+  groups: CommitGroup[],
+  range: string,
+  total: number,
+): string {
+  const lines: string[] = [
+    `# Changelog`,
+    ``,
+    `> ${range} — ${total} commit${total === 1 ? "" : "s"}`,
+    ``,
+  ];
+
+  // Breaking changes section
+  const breaking = groups.flatMap((g) =>
+    g.commits.filter((c) => c.breaking),
+  );
+  if (breaking.length > 0) {
+    lines.push(`## ⚠️ Breaking Changes`);
+    lines.push(``);
+    for (const commit of breaking) {
+      lines.push(`- **${commit.description}** — \`${commit.hash}\``);
+      if (commit.body) {
+        lines.push(`  ${commit.body.split("\n")[0]}`);
+      }
+    }
+    lines.push(``);
+  }
+
+  // Grouped commits
+  for (const group of groups) {
+    const nonBreaking = group.commits.filter((c) => !c.breaking);
+    if (nonBreaking.length === 0) continue;
+
+    lines.push(`## ${group.title}`);
+    lines.push(``);
+    for (const commit of nonBreaking) {
+      const scope = commit.scope ? `**${commit.scope}**: ` : "";
+      lines.push(`- ${scope}${commit.description} (\`${commit.hash}\`)`);
+      if (commit.body) {
+        const firstLine = commit.body.split("\n")[0]?.trim();
+        if (firstLine && firstLine.length > 0) {
+          lines.push(`  ${firstLine}`);
+        }
+      }
+    }
+    lines.push(``);
+  }
+
+  return lines.join("\n");
+}
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+function parseArg(args: string[], key: string): string | undefined {
+  const idx = args.indexOf(key);
+  if (idx >= 0 && idx + 1 < args.length) return args[idx + 1]!;
+  return undefined;
+}
diff --git a/apps/cli/src/commands/cli-cicd.test.ts b/apps/cli/src/commands/cli-cicd.test.ts
new file mode 100644
index 0000000..561cfa4
--- /dev/null
+++ b/apps/cli/src/commands/cli-cicd.test.ts
@@ -0,0 +1,166 @@
+/**
+ * Tests for CLI CI/CD commands: review, changelog, pr-describe.
+ *
+ * Unit tests for parsing and formatting logic.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { parseCommits as clParseCommits, groupCommits } from "./changelog";
+import { parseCommits as prdParseCommits } from "./pr-describe";
+import { parseChangedFiles } from "./review";
+
+// ── Changelog parsing tests ────────────────────────────────────────────────
+
+describe("CLI — changelog", () => {
+  it("should parse conventional commit subjects", () => {
+    const raw = [
+      "abc1234",
+      "feat(core): add widget support",
+      "",
+      "---",
+      "def5678",
+      "fix!: breaking API change",
+      "This is a breaking change.",
+    ].join("\n");
+
+    const commits = clParseCommits(raw);
+    expect(commits).toHaveLength(2);
+
+    const feat = commits[0]!;
+    expect(feat.hash).toBe("abc1234");
+    expect(feat.type).toBe("feat");
+    expect(feat.scope).toBe("core");
+    expect(feat.description).toBe("add widget support");
+    expect(feat.breaking).toBe(false);
+
+    const fix = commits[1]!;
+    expect(fix.hash).toBe("def5678");
+    expect(fix.type).toBe("fix");
+    expect(fix.breaking).toBe(true);
+    expect(fix.description).toBe("breaking API change");
+    expect(fix.body).toContain("breaking change");
+  });
+
+  it("should handle non-conventional commit subjects", () => {
+    const raw = "xyz789\nSome random commit message\n";
+    const commits = clParseCommits(raw);
+    expect(commits).toHaveLength(1);
+    expect(commits[0]!.type).toBe("other");
+    expect(commits[0]!.description).toBe("Some random commit message");
+  });
+
+  it("should group commits by conventional type", () => {
+    const commits = [
+      { hash: "a", type: "feat", scope: null, breaking: false, description: "feat 1", body: "" },
+      { hash: "b", type: "fix", scope: null, breaking: false, description: "fix 1", body: "" },
+      { hash: "c", type: "feat", scope: null, breaking: false, description: "feat 2", body: "" },
+      { hash: "d", type: "docs", scope: null, breaking: false, description: "docs 1", body: "" },
+    ] as Parameters<typeof groupCommits>[0];
+
+    const groups = groupCommits(commits);
+    expect(groups).toHaveLength(3);
+    expect(groups[0]!.title).toContain("Features");
+    expect(groups[0]!.commits).toHaveLength(2);
+    expect(groups[1]!.title).toContain("Bug Fixes");
+    expect(groups[1]!.commits).toHaveLength(1);
+    expect(groups[2]!.title).toContain("Documentation");
+    expect(groups[2]!.commits).toHaveLength(1);
+  });
+});
+
+// ── PR describe parsing tests ──────────────────────────────────────────────
+
+describe("CLI — pr-describe", () => {
+  it("should parse commit blocks with author and date", () => {
+    const raw = [
+      "abc1234",
+      "Jane Doe",
+      "2026-07-07T12:00:00Z",
+      "feat(api): add new endpoint",
+      "Implementation details",
+    ].join("\n");
+
+    const commits = prdParseCommits(raw);
+    expect(commits).toHaveLength(1);
+    expect(commits[0]!.hash).toBe("abc1234");
+    expect(commits[0]!.author).toBe("Jane Doe");
+    expect(commits[0]!.type).toBe("feat");
+    expect(commits[0]!.scope).toBe("api");
+    expect(commits[0]!.description).toBe("add new endpoint");
+  });
+});
+
+// ── Review command diff parsing tests ──────────────────────────────────────
+
+describe("CLI — review", () => {
+  it("should parse changed files from a raw diff", () => {
+    const diff = [
+      "diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts",
+      "index abc..def 100644",
+      "--- a/packages/core/src/index.ts",
+      "+++ b/packages/core/src/index.ts",
+      "@@ -1,5 +1,8 @@",
+      " import { foo } from './foo';",
+      " import { bar } from './bar';",
+      "+import { baz } from './baz';",
+      " ",
+      " export function greet() {",
+      "+  console.log('hello');",
+      "+  return true;",
+      " }",
+    ].join("\n");
+
+    const files = parseChangedFiles(diff);
+    expect(files).toHaveLength(1);
+    expect(files[0]!.path).toBe("packages/core/src/index.ts");
+    expect(files[0]!.status).toBe("modified");
+    expect(files[0]!.additions).toBe(3);
+    expect(files[0]!.deletions).toBe(0);
+  });
+
+  it("should detect added files", () => {
+    const diff = [
+      "diff --git a/new-file.ts b/new-file.ts",
+      "new file mode 100644",
+      "index 000..abc 100644",
+      "--- /dev/null",
+      "+++ b/new-file.ts",
+      "@@ -0,0 +1,3 @@",
+      "+const x = 1;",
+      "+const y = 2;",
+      "+export { x, y };",
+    ].join("\n");
+
+    const files = parseChangedFiles(diff);
+    expect(files).toHaveLength(1);
+    expect(files[0]!.path).toBe("new-file.ts");
+    expect(files[0]!.status).toBe("added");
+  });
+
+  it("should handle multiple files in a diff", () => {
+    const diff = [
+      "diff --git a/a.ts b/a.ts",
+      "--- a/a.ts",
+      "+++ b/a.ts",
+      "@@ -1 +1,2 @@",
+      " a",
+      "+b",
+      "diff --git a/b.ts b/b.ts",
+      "--- a/b.ts",
+      "+++ b/b.ts",
+      "@@ -1 +1,2 @@",
+      " x",
+      "+y",
+    ].join("\n");
+
+    const files = parseChangedFiles(diff);
+    expect(files).toHaveLength(2);
+    expect(files[0]!.path).toBe("a.ts");
+    expect(files[1]!.path).toBe("b.ts");
+  });
+
+  it("should return empty array for empty diff", () => {
+    expect(parseChangedFiles("")).toHaveLength(0);
+    expect(parseChangedFiles("no diff content here")).toHaveLength(0);
+  });
+});
diff --git a/apps/cli/src/commands/pr-describe.ts b/apps/cli/src/commands/pr-describe.ts
new file mode 100644
index 0000000..281da66
--- /dev/null
+++ b/apps/cli/src/commands/pr-describe.ts
@@ -0,0 +1,249 @@
+/**
+ * PR describe command — generates a PR description from git log.
+ *
+ * Usage:
+ *   agent-workbench pr-describe [--base <branch>] [--head <branch>]
+ *   agent-workbench pr-describe --pr <number>
+ */
+
+import { execSync } from "node:child_process";
+import { writeFileSync } from "node:fs";
+
+// ── Command handler ────────────────────────────────────────────────────────
+
+export async function handlePrDescribe(
+  args: string[],
+): Promise<number> {
+  const prNumber = parseArg(args, "--pr");
+  const baseArg = parseArg(args, "--base") ?? "main";
+  const headArg = parseArg(args, "--head") ?? "HEAD";
+  const output = parseArg(args, "--output");
+
+  try {
+    let baseBranch = baseArg;
+    let headBranch = headArg;
+    let repo: string | undefined;
+
+    // Fetch PR info if --pr was given
+    if (prNumber) {
+      console.error(`🔍 Fetching PR #${prNumber}...`);
+      const prInfo = execSync(
+        `gh pr view ${prNumber} --json title,headRefName,baseRefName,body`,
+        { encoding: "utf-8" },
+      );
+      const pr = JSON.parse(prInfo) as {
+        title: string;
+        headRefName: string;
+        baseRefName: string;
+        body: string | null;
+      };
+      baseBranch = pr.baseRefName;
+      headBranch = pr.headRefName;
+    }
+
+    // Parse conventional commits between base and head
+    const range = `${baseBranch}..${headBranch}`;
+    const logFormat = "--format=---%n%H%n%an%n%ai%n%s%n%b";
+    let rawLog: string;
+
+    try {
+      rawLog = execSync(
+        `git log ${range} ${logFormat}`,
+        { encoding: "utf-8", maxBuffer: 2 * 1024 * 1024 },
+      ).trim();
+    } catch {
+      // Try fetching the head branch first
+      try {
+        execSync(`git fetch origin ${headBranch}`, {
+          encoding: "utf-8",
+          timeout: 15000,
+        });
+        rawLog = execSync(
+          `git log ${range} ${logFormat}`,
+          { encoding: "utf-8", maxBuffer: 2 * 1024 * 1024 },
+        ).trim();
+      } catch {
+        console.error(
+          `Error: Could not get commits between ${baseBranch} and ${headBranch}`,
+        );
+        return 1;
+      }
+    }
+
+    if (!rawLog) {
+      console.error("No commits found in range — branches may be up-to-date.");
+      return 0;
+    }
+
+    const commits = parseCommits(rawLog);
+    const summary = generateDescription(commits, baseBranch, headBranch);
+
+    // Output
+    if (output) {
+      writeFileSync(output, summary, "utf-8");
+      console.error(`\n✅ PR description written to ${output}`);
+    } else {
+      console.log(summary);
+    }
+
+    return 0;
+  } catch (err) {
+    console.error(
+      `Error: ${err instanceof Error ? err.message : String(err)}`,
+    );
+    return 1;
+  }
+}
+
+// ── Types ──────────────────────────────────────────────────────────────────
+
+interface CommitInfo {
+  hash: string;
+  author: string;
+  date: string;
+  type: string;
+  scope: string | null;
+  breaking: boolean;
+  description: string;
+  body: string;
+}
+
+// ── Parsing ────────────────────────────────────────────────────────────────
+
+export function parseCommits(raw: string): CommitInfo[] {
+  const blocks = raw.split("\n---\n").filter(Boolean);
+  const commits: CommitInfo[] = [];
+
+  for (const block of blocks) {
+    const lines = block.trim().split("\n");
+    const hash = lines[0]?.trim() ?? "";
+    const author = lines[1]?.trim() ?? "";
+    const date = lines[2]?.trim() ?? "";
+    const subject = lines[3]?.trim() ?? "";
+    const body = lines.slice(4).join("\n").trim();
+
+    const conventional = /^(\w+)(?:\(([^)]+)\))?(!)?:\s*(.+)$/.exec(subject);
+    if (conventional) {
+      commits.push({
+        hash: hash.slice(0, 7),
+        author,
+        date,
+        type: conventional[1]!,
+        scope: conventional[2] ?? null,
+        breaking: conventional[3] === "!",
+        description: conventional[4]!,
+        body,
+      });
+    }
+  }
+
+  return commits;
+}
+
+// ── Description generation ─────────────────────────────────────────────────
+
+function generateDescription(
+  commits: CommitInfo[],
+  baseBranch: string,
+  headBranch: string,
+): string {
+  const lines: string[] = [];
+
+  // Title from first commit or branch name
+  const branchName = headBranch !== "HEAD" ? headBranch : "current";
+  const firstSubject = commits[0]?.description ?? "";
+  const title = firstSubject.length > 60
+    ? `${firstSubject.slice(0, 57)}...`
+    : firstSubject;
+
+  lines.push(`## ${title}`);
+  lines.push(``);
+
+  // Summary
+  const featCount = commits.filter((c) => c.type === "feat" || c.type === "feature").length;
+  const fixCount = commits.filter((c) => c.type === "fix" || c.type === "bugfix").length;
+  const breakingCount = commits.filter((c) => c.breaking).length;
+
+  lines.push(`### 📋 Overview`);
+  lines.push(``);
+  lines.push(
+    `This PR contains **${commits.length} commit${commits.length === 1 ? "" : "s"}** ` +
+    `(⟵ ${headBranch} into ${baseBranch}).`,
+  );
+  lines.push(``);
+  if (featCount > 0) lines.push(`- **${featCount}** feature${featCount === 1 ? "" : "s"} ✨`);
+  if (fixCount > 0) lines.push(`- **${fixCount}** bug fix${fixCount === 1 ? "" : "es"} 🐛`);
+  if (breakingCount > 0) lines.push(`- ⚠️ **${breakingCount} breaking change${breakingCount === 1 ? "" : "s"}**`);
+  lines.push(``);
+
+  // Commits grouped by type
+  lines.push(`### 📝 Commits`);
+  lines.push(``);
+
+  for (const commit of commits) {
+    const typeEmoji = getTypeEmoji(commit.type);
+    const breaking = commit.breaking ? " ⚠️" : "";
+    const scope = commit.scope ? `**${commit.scope}**: ` : "";
+    lines.push(
+      `- ${typeEmoji} ${scope}${commit.description}${breaking} (\`${commit.hash}\`)`,
+    );
+  }
+
+  lines.push(``);
+
+  // Co-authored-by from commit bodies
+  const coauthors = new Set<string>();
+  for (const commit of commits) {
+    const match = commit.body.match(/Co-authored-by:\s*(.+)/);
+    if (match) coauthors.add(match[1]!.trim());
+  }
+  if (coauthors.size > 0) {
+    lines.push(`### 👥 Co-Authors`);
+    lines.push(``);
+    for (const author of coauthors) {
+      lines.push(`- ${author}`);
+    }
+    lines.push(``);
+  }
+
+  // Checklist
+  lines.push(`### ✅ Checklist`);
+  lines.push(``);
+  lines.push(`- [ ] Tests pass (\`bun test\`)`);
+  lines.push(`- [ ] Type-check passes (\`bun run typecheck\`)`);
+  lines.push(`- [ ] Lint passes (\`bunx @biomejs/biome check .\`)`);
+  lines.push(`- [ ] Build succeeds (\`bun run build\`)`);
+  lines.push(``);
+
+  return lines.join("\n");
+}
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+function getTypeEmoji(type: string): string {
+  const emoji: Record<string, string> = {
+    feat: "✨",
+    feature: "✨",
+    fix: "🐛",
+    bugfix: "🐛",
+    docs: "📚",
+    documentation: "📚",
+    style: "💄",
+    refactor: "♻️",
+    perf: "⚡",
+    performance: "⚡",
+    test: "🧪",
+    tests: "🧪",
+    build: "📦",
+    ci: "🤖",
+    chore: "🔧",
+    revert: "⏪",
+  };
+  return emoji[type] ?? "📝";
+}
+
+function parseArg(args: string[], key: string): string | undefined {
+  const idx = args.indexOf(key);
+  if (idx >= 0 && idx + 1 < args.length) return args[idx + 1]!;
+  return undefined;
+}
diff --git a/apps/cli/src/commands/review.ts b/apps/cli/src/commands/review.ts
new file mode 100644
index 0000000..424fb3d
--- /dev/null
+++ b/apps/cli/src/commands/review.ts
@@ -0,0 +1,342 @@
+/**
+ * Review command — PR review bot.
+ *
+ * Fetches a GitHub PR diff, runs type-check and lint on changed files,
+ * and posts a structured review comment.
+ *
+ * Usage:
+ *   agent-workbench review --pr <number> [--repo owner/repo]
+ *   agent-workbench review --diff <diff-file> [--head <branch>]
+ */
+
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+
+// ── Interfaces ─────────────────────────────────────────────────────────────
+
+interface ChangedFile {
+  path: string;
+  status: "added" | "modified" | "deleted" | "renamed";
+  additions: number;
+  deletions: number;
+}
+
+interface ReviewResult {
+  summary: string;
+  fileReports: FileReport[];
+  errorCount: number;
+  warningCount: number;
+}
+
+interface FileReport {
+  path: string;
+  issues: Issue[];
+}
+
+interface Issue {
+  severity: "error" | "warning" | "info";
+  line?: number;
+  message: string;
+  source: string;
+}
+
+// ── Command handler ────────────────────────────────────────────────────────
+
+export async function handleReview(
+  args: string[],
+): Promise<number> {
+  const prNumber = parseArg(args, "--pr");
+  const repo = parseArg(args, "--repo") ?? detectRepo();
+  const diffPath = parseArg(args, "--diff");
+
+  if (!prNumber && !diffPath) {
+    console.error("Error: --pr <number> or --diff <path> is required");
+    console.error("Usage: agent-workbench review --pr <number> [--repo owner/repo]");
+    console.error("       agent-workbench review --diff <file>");
+    return 1;
+  }
+
+  try {
+    // Determine base branch for focused checking
+    let baseBranch = "main";
+    let headBranch = "";
+    let diffContent: string;
+
+    if (prNumber) {
+      console.error(`🔍 Fetching PR #${prNumber}...`);
+      const prInfo = execSync(
+        `gh pr view ${prNumber} ${repo ? `--repo ${repo}` : ""} --json title,headRefName,baseRefName,body`,
+        { encoding: "utf-8" },
+      );
+      const pr = JSON.parse(prInfo) as {
+        title: string;
+        headRefName: string;
+        baseRefName: string;
+        body: string | null;
+      };
+      baseBranch = pr.baseRefName;
+      headBranch = pr.headRefName;
+
+      console.error(`   ${pr.title}`);
+      console.error(`   ${pr.baseRefName} ← ${pr.headRefName}`);
+
+      diffContent = execSync(
+        `gh pr diff ${prNumber} ${repo ? `--repo ${repo}` : ""}`,
+        { encoding: "utf-8", maxBuffer: 10 * 1024 * 1024 },
+      );
+    } else {
+      diffContent = readFileSync(diffPath!, "utf-8");
+    }
+
+    // Parse changed files from diff
+    const changedFiles = parseChangedFiles(diffContent);
+    if (changedFiles.length === 0) {
+      console.error("No changed files found in diff.");
+      return 0;
+    }
+
+    console.error(`\n📦 ${changedFiles.length} files changed`);
+    for (const f of changedFiles) {
+      const icon =
+        f.status === "added" ? "➕" :
+        f.status === "deleted" ? "➖" :
+        f.status === "renamed" ? "🔄" : "✏️";
+      console.error(`   ${icon} ${f.path} (+${f.additions}/-${f.deletions})`);
+    }
+
+    // Run analysis
+    const result = await analyzeDiff(changedFiles);
+
+    // Print detailed report
+    printReport(result);
+
+    // Post to PR if we have one
+    if (prNumber) {
+      const body = formatReviewBody(result);
+      const reviewBodyPath = "/tmp/agent-workbench-review.md";
+      const { writeFileSync } = await import("node:fs");
+      writeFileSync(reviewBodyPath, body, "utf-8");
+
+      execSync(
+        `gh pr review ${prNumber} ${repo ? `--repo ${repo}` : ""} ` +
+        `--comment --body-file "${reviewBodyPath}"`,
+        { encoding: "utf-8" },
+      );
+      console.error(`\n✅ Review posted to PR #${prNumber}`);
+    }
+
+    return result.errorCount > 0 ? 1 : 0;
+  } catch (err) {
+    console.error(
+      `Error: ${err instanceof Error ? err.message : String(err)}`,
+    );
+    return 1;
+  }
+}
+
+// ── Diff parsing ───────────────────────────────────────────────────────────
+
+export function parseChangedFiles(diff: string): ChangedFile[] {
+  const files: ChangedFile[] = [];
+  const fileRegex = /^diff --git a\/(.+?) b\/(.+?)$/gm;
+  let match: RegExpExecArray | null;
+
+  while ((match = fileRegex.exec(diff)) !== null) {
+    const path = match[2]!;
+    // Determine status from diff markers
+    let status: ChangedFile["status"] = "modified";
+    let additions = 0;
+    let deletions = 0;
+
+    // Count +/- lines in the hunk
+    const hunkStart = match.index;
+    const nextFileIdx = diff.indexOf("diff --git", hunkStart + 1);
+    const hunk = nextFileIdx >= 0
+      ? diff.slice(hunkStart, nextFileIdx)
+      : diff.slice(hunkStart);
+
+    if (hunk.includes("new file mode")) status = "added";
+    else if (hunk.includes("deleted file mode")) status = "deleted";
+    else if (/^rename from /m.test(hunk)) status = "renamed";
+
+    // Count additions/deletions in hunks
+    for (const line of hunk.split("\n")) {
+      if (line.startsWith("+") && !line.startsWith("+++")) additions++;
+      else if (line.startsWith("-") && !line.startsWith("---")) deletions++;
+    }
+
+    files.push({ path, status, additions, deletions });
+  }
+
+  return files;
+}
+
+// ── Analysis ───────────────────────────────────────────────────────────────
+
+async function analyzeDiff(
+  files: ChangedFile[],
+): Promise<ReviewResult> {
+  const fileReports: FileReport[] = [];
+  let errorCount = 0;
+  let warningCount = 0;
+
+  const tsFiles = files.filter(
+    (f) =>
+      f.status !== "deleted" &&
+      /\.(ts|tsx|js|jsx|mts|cts)$/i.test(f.path),
+  );
+
+  for (const file of tsFiles) {
+    const issues: Issue[] = [];
+
+    // Check file exists
+    if (!existsSync(file.path)) {
+      issues.push({
+        severity: "warning",
+        message: "File not found locally — may need to checkout the branch",
+        source: "workbench",
+      });
+      fileReports.push({ path: file.path, issues });
+      continue;
+    }
+
+    // Run TypeScript type-check on just this file
+    try {
+      const result = execSync(
+        `npx -y tsc --noEmit --pretty false "${file.path}" 2>&1 || true`,
+        { encoding: "utf-8", timeout: 30000 },
+      );
+      for (const line of result.split("\n")) {
+        if (line.includes("error TS")) {
+          issues.push({
+            severity: "error",
+            message: line.replace(/^.*error TS\d+:\s*/, "").trim(),
+            source: "typescript",
+          });
+          errorCount++;
+        }
+      }
+    } catch {
+      // Individual file tsc may fail if project setup isn't available
+      issues.push({
+        severity: "info",
+        message: "Could not run isolated type-check (try full project build)",
+        source: "workbench",
+      });
+    }
+
+    // Run Biome lint on the file
+    try {
+      const result = execSync(
+        `npx @biomejs/biome check --no-errors-on-unmatched "${file.path}" 2>&1 || true`,
+        { encoding: "utf-8", timeout: 15000 },
+      );
+      for (const line of result.split("\n")) {
+        if (line.includes("error[")) {
+          issues.push({
+            severity: "error",
+            message: line.trim(),
+            source: "biome",
+          });
+          errorCount++;
+        } else if (line.includes("warning[")) {
+          issues.push({
+            severity: "warning",
+            message: line.trim(),
+            source: "biome",
+          });
+          warningCount++;
+        }
+      }
+    } catch {
+      // skip
+    }
+
+    if (issues.length > 0) {
+      fileReports.push({ path: file.path, issues });
+    }
+  }
+
+  // Summary
+  const totalIssues = errorCount + warningCount;
+  let summary: string;
+  if (totalIssues === 0) {
+    summary = `✅ Clean — no issues found across ${tsFiles.length} TypeScript files`;
+  } else {
+    summary =
+      `Found ${errorCount} error(s) and ${warningCount} warning(s) ` +
+      `across ${fileReports.length} of ${tsFiles.length} files checked`;
+  }
+
+  return { summary, fileReports, errorCount, warningCount };
+}
+
+// ── Output formatting ──────────────────────────────────────────────────────
+
+function printReport(result: ReviewResult): void {
+  console.error(`\n${result.summary}\n`);
+
+  for (const report of result.fileReports) {
+    console.error(`📄 ${report.path}`);
+    for (const issue of report.issues) {
+      const icon =
+        issue.severity === "error" ? "❌" :
+        issue.severity === "warning" ? "⚠️" : "ℹ️";
+      const lineStr = issue.line ? `:${issue.line}` : "";
+      console.error(`   ${icon} [${issue.source}]${lineStr} ${issue.message}`);
+    }
+    console.error("");
+  }
+}
+
+function formatReviewBody(result: ReviewResult): string {
+  const lines: string[] = [
+    `## 🤖 agent-workbench PR Review`,
+    ``,
+    result.summary,
+    ``,
+  ];
+
+  if (result.fileReports.length === 0) {
+    lines.push(`**No issues found.** ✨`);
+  }
+
+  for (const report of result.fileReports) {
+    lines.push(`### 📄 \`${report.path}\``);
+    lines.push(``);
+    for (const issue of report.issues) {
+      const icon =
+        issue.severity === "error" ? "❌" :
+        issue.severity === "warning" ? "⚠️" : "ℹ️";
+      const lineStr = issue.line ? ` (line ${issue.line})` : "";
+      lines.push(
+        `- ${icon} **${issue.severity.toUpperCase()}** [${issue.source}]${lineStr}: ${issue.message}`,
+      );
+    }
+    lines.push(``);
+  }
+
+  return lines.join("\n");
+}
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+function parseArg(args: string[], key: string): string | undefined {
+  const idx = args.indexOf(key);
+  if (idx >= 0 && idx + 1 < args.length) return args[idx + 1]!;
+  return undefined;
+}
+
+function detectRepo(): string | undefined {
+  try {
+    const remote = execSync("git remote get-url origin", {
+      encoding: "utf-8",
+    }).trim();
+    const match = remote.match(
+      /(?:github\.com[:\/])([\w.-]+\/[\w.-]+?)(?:\.git)?$/,
+    );
+    return match?.[1];
+  } catch {
+    return undefined;
+  }
+}
diff --git a/apps/cli/src/index.ts b/apps/cli/src/index.ts
index f0a25f8..50af933 100644
--- a/apps/cli/src/index.ts
+++ b/apps/cli/src/index.ts
@@ -1,9 +1,13 @@
 /**
- * agent-workbench CLI — entry point for plugin management and other commands.
+ * agent-workbench CLI — entry point for plugin management, CI/CD commands,
+ * and project scaffolding.
  *
  * Usage:
  *   agent-workbench plugin list|install|enable|disable|uninstall
  *   agent-workbench init <template> [path]
+ *   agent-workbench review --pr <number>
+ *   agent-workbench changelog [--from <tag>] [--to <tag>]
+ *   agent-workbench pr-describe [--base <branch>] [--head <branch>]
  *
  * Templates: typescript, bun
  */
@@ -15,6 +19,9 @@ import {
   type PluginManifest,
   PluginRegistry,
 } from "@agent-workbench/plugin-sdk";
+import { handleChangelog } from "./commands/changelog";
+import { handlePrDescribe } from "./commands/pr-describe";
+import { handleReview } from "./commands/review";
 
 function printUsage(): void {
   console.log(`agent-workbench — CLI for managing agent-workbench
@@ -22,6 +29,9 @@ function printUsage(): void {
 Usage:
   agent-workbench plugin <command> [args]     Manage plugins
   agent-workbench init <template> [path]      Scaffold a new project
+  agent-workbench review --pr <number>        PR review bot
+  agent-workbench changelog [options]         Generate changelog
+  agent-workbench pr-describe [options]       Generate PR description
 
 Plugin Commands:
   agent-workbench plugin list                      List installed plugins
@@ -34,10 +44,30 @@ Init Command:
   agent-workbench init typescript [path]           Empty TypeScript project
   agent-workbench init bun [path]                  Bun project with test setup
 
+Review Command:
+  agent-workbench review --pr <number>             Analyze PR diff and post review
+  agent-workbench review --diff <file>             Analyze local diff file
+    Options: --repo owner/repo                     GitHub repo (auto-detected)
+
+Changelog Command:
+  agent-workbench changelog                        From last tag to HEAD
+    Options: --from <tag|commit> --to <tag|commit> Custom range
+             --last-release                        Use last tag as base
+             --output <file>                       Write to file (default: stdout)
+
+PR Describe Command:
+  agent-workbench pr-describe                      From main to HEAD
+    Options: --base <branch> --head <branch>       Custom branches
+             --pr <number>                         Fetch from GitHub PR
+             --output <file>                       Write to file
+
 Examples:
   agent-workbench plugin list
   agent-workbench plugin install local:~/my-plugin
   agent-workbench init typescript ./my-project
+  agent-workbench review --pr 42
+  agent-workbench changelog --last-release --output CHANGELOG.md
+  agent-workbench pr-describe --pr 42 --output PR.md
 `);
 }
 
@@ -87,10 +117,6 @@ async function handlePluginCommand(
         return 1;
       }
 
-      // For now, we delegate to the server. But CLI has no server; it uses the
-      // registry directly. We need a simple install that copies into the plugins dir.
-      // Since the full install flow is implemented in the server route, we'll
-      // use the registry directly for local: sources.
       const { existsSync, mkdirSync, cpSync } = await import("node:fs");
       const { join } = await import("node:path");
 
@@ -175,7 +201,6 @@ async function handlePluginCommand(
         return 1;
       }
 
-      // Remove plugin directory
       const { rmSync } = await import("node:fs");
       try {
         rmSync(plugin.installPath, { recursive: true, force: true });
@@ -195,7 +220,7 @@ async function handlePluginCommand(
   }
 }
 
-// ── Main ────────────────────────────────────────────────────────────────────
+// ── Init command ───────────────────────────────────────────────────────────
 
 async function handleInitCommand(
   template: string,
@@ -229,7 +254,6 @@ async function handleInitCommand(
     return 1;
   }
 
-  // Copy template to target
   mkdirSync(targetDir, { recursive: true });
   cpSync(templateDir, targetDir, { recursive: true });
 
@@ -244,6 +268,8 @@ async function handleInitCommand(
   return 0;
 }
 
+// ── Main ────────────────────────────────────────────────────────────────────
+
 async function main(): Promise<number> {
   const args = process.argv.slice(2);
 
@@ -280,6 +306,15 @@ async function main(): Promise<number> {
       return handleInitCommand(tmpl, path);
     }
 
+    case "review":
+      return handleReview(subArgs);
+
+    case "changelog":
+      return handleChangelog(subArgs);
+
+    case "pr-describe":
+      return handlePrDescribe(subArgs);
+
     default:
       console.error(`Error: Unknown command: ${command}`);
       printUsage();
diff --git a/apps/server/src/app.ts b/apps/server/src/app.ts
index 9ffe4ff..78fda91 100644
--- a/apps/server/src/app.ts
+++ b/apps/server/src/app.ts
@@ -4,6 +4,7 @@ import { cors } from "hono/cors";
 import type { ServerConfig } from "./config";
 import type { ServerAppBindings, ServerServices } from "./context";
 import { ApiError } from "./errors";
+import { auditLogMiddleware } from "./middleware/audit-log";
 import { complianceHeaders } from "./middleware/compliance-headers";
 import { handleAppError } from "./middleware/error-handler";
 import { metricsMiddleware } from "./middleware/metrics-middleware";
@@ -14,6 +15,7 @@ import { tracingMiddleware } from "./middleware/tracing";
 import { registerAgentRoutes } from "./routes/agent-routes";
 import { registerAuthRoutes } from "./routes/auth-routes";
 import { registerCollabRoutes } from "./routes/collab-routes";
+import { registerDataRoutes } from "./routes/data-routes";
 import { registerFileRoutes } from "./routes/file-routes";
 import { registerGitRoutes } from "./routes/git-routes";
 import { registerGlobalRoutes } from "./routes/global";
@@ -43,6 +45,7 @@ export function createApp(options: CreateAppOptions) {
   const { tracer, metricsExporter } = options.services;
 
   app.use("*", requestIdMiddleware);
+  app.use("*", auditLogMiddleware(5000));
   app.use("*", complianceHeaders());
   app.use("*", rateLimitMiddleware());
   app.use("*", metricsMiddleware(metricsExporter));
@@ -131,6 +134,7 @@ export function createApp(options: CreateAppOptions) {
   registerCollabRoutes(app, options.services);
   registerShareRoutes(app, options.services);
   registerReviewRoutes(app, options.services);
+  registerDataRoutes(app, options.services);
   registerGlobalRoutes(app, {
     config: options.config,
     startedAt,
diff --git a/apps/server/src/context.ts b/apps/server/src/context.ts
index fb39b0f..961c68d 100644
--- a/apps/server/src/context.ts
+++ b/apps/server/src/context.ts
@@ -92,6 +92,8 @@ export interface ServerServices {
   readonly presenceManager: PresenceManager;
   // Phase 27: collaborative code review
   readonly reviewQueue: ReviewQueue;
+  // Phase 30: raw Drizzle DB for data-management operations (GDPR export/delete)
+  readonly rawDb: any;
 }
 
 export type ServerAppBindings = {
diff --git a/apps/server/src/index.ts b/apps/server/src/index.ts
index 625c0de..adbf6ed 100644
--- a/apps/server/src/index.ts
+++ b/apps/server/src/index.ts
@@ -143,42 +143,6 @@ const providerRegistry = new ProviderRegistry(
   airGapped ? { fetchImpl: createAirGappedFetch() } : undefined,
 );
 
-// ── Data retention ───────────────────────────────────────────────────────
-// Phase 30: apply data retention policy every 24 hours.
-// Runs immediately on startup to clean stale entries.
-const RETENTION_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
-(function scheduleRetention() {
-  try {
-    const entriesResult = ledgerRepository.listByCategory("audit");
-    // biome-ignore lint/suspicious/noExplicitAny: LedgerRow[] → AuditEntry[] cast for retention
-    const { result } = applyRetention(entriesResult as any);
-    if (result.deletedCount > 0) {
-      logger.info(
-        `Data retention: removed ${result.deletedCount} entries older than ${result.cutoffDate}`,
-      );
-    }
-  } catch {
-    // Best-effort — retention may fail if no audit entries exist yet
-  }
-
-  setInterval(() => {
-    try {
-      const entriesResult = ledgerRepository.listByCategory("audit");
-      // biome-ignore lint/suspicious/noExplicitAny: LedgerRow[] → AuditEntry[] cast for retention
-      const { result } = applyRetention(entriesResult as any);
-      if (result.deletedCount > 0) {
-        logger.info(
-          `Data retention: removed ${result.deletedCount} entries older than ${result.cutoffDate}`,
-        );
-      }
-    } catch {
-      // Best-effort
-    }
-  }, RETENTION_INTERVAL_MS);
-
-  logger.info("Data retention: scheduled every 24 hours (max 90 days)");
-})();
-
 const modelProvider = providerRegistry.getDefaultProvider();
 
 // ── Phase 24: Provider marketplace & smart routing ───────────────────────────
@@ -190,6 +154,44 @@ const providerHealthMonitor = new ProviderHealthMonitor(providerMarketplace, {
 });
 providerHealthMonitor.start();
 
+// ── Phase 30: Data retention — auto-delete old sessions every 24h ──
+const RETENTION_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
+const RETENTION_MAX_DAYS = 90;
+setInterval(() => {
+  try {
+    const cutoff = new Date();
+    cutoff.setDate(cutoff.getDate() - RETENTION_MAX_DAYS);
+    const cutoffStr = cutoff.toISOString();
+
+    // Find sessions older than the cutoff
+    const oldSessions = sessionRepository.listPaginated({ limit: 100 });
+    const toDelete = oldSessions.filter(
+      (s) => s.updatedAt < cutoffStr,
+    );
+
+    if (toDelete.length > 0) {
+      const sqlite = storage.sqlite;
+      for (const session of toDelete) {
+        sqlite.run("DELETE FROM messages WHERE session_id = ?", [session.id]);
+        sqlite.run("DELETE FROM tool_calls WHERE session_id = ?", [session.id]);
+        sqlite.run("DELETE FROM plans WHERE session_id = ?", [session.id]);
+        sqlite.run("DELETE FROM summaries WHERE session_id = ?", [session.id]);
+        sqlite.run("DELETE FROM run_ledger WHERE session_id = ?", [session.id]);
+        sqlite.run("DELETE FROM permission_requests WHERE session_id = ?", [session.id]);
+        sqlite.run("DELETE FROM sessions WHERE id = ?", [session.id]);
+      }
+      logger.info(
+        `Data retention: deleted ${toDelete.length} sessions older than ${cutoffStr}`,
+      );
+    }
+  } catch (err) {
+    logger.error(
+      `Data retention check failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+}, RETENTION_INTERVAL_MS);
+logger.info(`Data retention active — auto-deleting sessions older than ${RETENTION_MAX_DAYS} days`);
+
 // ── Phase 11: Agent registry ──────────────────────────────────────────────────
 const agentRegistry = new AgentRegistry();
 
@@ -310,6 +312,7 @@ const app = createApp({
     shareManager,
     presenceManager,
     reviewQueue,
+    rawDb: storage.sqlite,
   },
 });
 
diff --git a/apps/server/src/routes/data-routes.ts b/apps/server/src/routes/data-routes.ts
new file mode 100644
index 0000000..fc48180
--- /dev/null
+++ b/apps/server/src/routes/data-routes.ts
@@ -0,0 +1,125 @@
+/**
+ * GDPR data subject rights endpoints.
+ *
+ * Phase 30: Right to Access (Art. 15) and Right to Erasure (Art. 17).
+ *
+ * GET  /data/export  — Export all personal data (sessions, messages, audit trail)
+ * POST /data/delete  — Delete all personal data
+ *
+ * Uses database.repository methods for reads and raw SQLite for deletes
+ * (repositories don't expose delete-by-session methods).
+ */
+
+import type { Hono } from "hono";
+import type { ServerAppBindings, ServerServices } from "../context";
+import { ApiError } from "../errors";
+import { handleAppError } from "../middleware/error-handler";
+
+export function registerDataRoutes(
+  app: Hono<ServerAppBindings>,
+  services: ServerServices,
+): void {
+  const {
+    sessionRepository,
+    messageRepository,
+    ledgerRepository,
+    summaryRepository,
+    planRepository,
+    toolCallRepository,
+    permissionRepository,
+    workspaceRepository,
+    rawDb,
+  } = services;
+
+  // ── GET /data/export — Right to Access (Art. 15) ─────────────────────────
+
+  app.get("/data/export", async (c) => {
+    try {
+      const sessions = sessionRepository.list();
+      const workspaces = workspaceRepository.list(true);
+
+      // Gather child data per session
+      const msgRows: Record<string, unknown>[] = [];
+      const ledgerRows: Record<string, unknown>[] = [];
+      const summaryRows: Record<string, unknown>[] = [];
+      const planRows: Record<string, unknown>[] = [];
+      const toolCallRows: Record<string, unknown>[] = [];
+
+      for (const session of sessions) {
+        msgRows.push(...messageRepository.listBySession(session.id));
+        ledgerRows.push(...ledgerRepository.listBySession(session.id));
+        summaryRows.push(...summaryRepository.listBySession(session.id));
+        planRows.push(...planRepository.listBySession(session.id));
+        toolCallRows.push(...toolCallRepository.listBySession(session.id));
+      }
+
+      // Permission requests (may not all have sessionIds)
+      const allPermissionRequests = permissionRepository.listRequests();
+
+      return c.json({
+        exportedAt: new Date().toISOString(),
+        data: {
+          sessions,
+          messages: msgRows,
+          ledger: ledgerRows,
+          summaries: summaryRows,
+          plans: planRows,
+          toolCalls: toolCallRows,
+          permissionRequests: allPermissionRequests,
+          workspaces,
+        },
+      });
+    } catch (err) {
+      return handleAppError(
+        new ApiError({
+          status: 500,
+          code: "EXPORT_FAILED",
+          message:
+            err instanceof Error
+              ? err.message
+              : "Failed to export data",
+          recoverable: false,
+        }),
+        c,
+      );
+    }
+  });
+
+  // ── POST /data/delete — Right to Erasure (Art. 17) ──────────────────────
+
+  app.post("/data/delete", async (c) => {
+    try {
+      // Delete in order: child tables first, then parent tables
+      rawDb.run("DELETE FROM messages");
+      rawDb.run("DELETE FROM tool_calls");
+      rawDb.run("DELETE FROM plans");
+      rawDb.run("DELETE FROM summaries");
+      rawDb.run("DELETE FROM run_ledger");
+      rawDb.run("DELETE FROM permission_decisions");
+      rawDb.run("DELETE FROM permission_requests");
+      rawDb.run("DELETE FROM sessions");
+      rawDb.run("DELETE FROM workspaces");
+      rawDb.run("DELETE FROM cache_entries");
+      rawDb.run("DELETE FROM file_changes");
+      rawDb.run("DELETE FROM config_snapshots");
+
+      return c.json({
+        deleted: true,
+        deletedAt: new Date().toISOString(),
+      });
+    } catch (err) {
+      return handleAppError(
+        new ApiError({
+          status: 500,
+          code: "DELETE_FAILED",
+          message:
+            err instanceof Error
+              ? err.message
+              : "Failed to delete data",
+          recoverable: false,
+        }),
+        c,
+      );
+    }
+  });
+}
diff --git a/docs/27_PROJECT_ROADMAP.md b/docs/27_PROJECT_ROADMAP.md
index 55a273d..46cd60f 100644
--- a/docs/27_PROJECT_ROADMAP.md
+++ b/docs/27_PROJECT_ROADMAP.md
@@ -23,6 +23,7 @@ Phase 27 ✅ complete ███████████████████
 Phase 28 ⏸️        ░░░░░░░░░░░░░░░░░░░░  ⏸️  desktop application (deferred)
 Phase 29 ✅ complete ██████████████████████  model experimentation & eval
 Phase 30 ✅ complete ██████████████████████  enterprise readiness & compliance
+Phase 31 ✅ complete ██████████████████████  CI/CD integration
 ```
 
 ### Timeline
@@ -312,11 +313,11 @@ These are speculative directions that may become formal phases based on communit
 - Screen context awareness
 - Video walkthrough generation
 
-### Horizon 4: CI/CD Integration
-- GitHub Actions integration
-- GitLab CI integration
-- PR review bot mode
-- Automated changelog generation from agent actions
+### Horizon 4: CI/CD Integration → **[Phase 31](31_PHASE_31_CICD_INTEGRATION.md)** ✅
+- ✅ GitHub Actions integration (CLI commands + workflow templates)
+- ⏳ GitLab CI integration (future)
+- ✅ PR review bot mode (`agent-workbench review`, `agent-review.yml` workflow)
+- ✅ Automated changelog generation (`agent-workbench changelog`, `agent-changelog.yml` workflow)
 
 ---
 
@@ -360,5 +361,5 @@ Dependencies: Phase N
 
 ---
 
-*Last updated: 2026-07-06 (Phase 30 complete — enterprise readiness)*
-*Next review: After Phase 30 completion*
+*Last updated: 2026-07-07 (Phase 31 in progress — CI/CD integration)*
+*Next review: After Phase 31 completion*
diff --git a/docs/31_PHASE_31_CICD_INTEGRATION.md b/docs/31_PHASE_31_CICD_INTEGRATION.md
new file mode 100644
index 0000000..69ddf18
--- /dev/null
+++ b/docs/31_PHASE_31_CICD_INTEGRATION.md
@@ -0,0 +1,104 @@
+# 31 — Phase 31: CI/CD Integration
+
+**Status:** In progress
+**Document type:** phase plan
+**Dependencies:** Phase 30 (compliance), Phase 26 (plugin system)
+**Estimated:** 1 week
+
+---
+
+## Purpose
+
+Integrate agent-workbench with CI/CD workflows — PR review automation, changelog generation, and automated PR descriptions. These tools make agent-workbench part of the development lifecycle rather than just a local assistant.
+
+---
+
+## Required Outputs
+
+### CLI Commands (apps/cli)
+
+```
+apps/cli/src/commands/
+  ├── review.ts           # PR review bot — analyze diff, post findings
+  ├── changelog.ts        # Changelog generator from conventional commits
+  └── pr-describe.ts      # PR description generator from commit log
+```
+
+### GitHub Integration
+
+- `agent-workbench review --pr <number>` — Fetches PR diff, runs type-check + lint on changed files, posts structured review comment via `gh pr review`
+- `agent-workbench changelog` — Parses `git log` for conventional commits, groups by type (feat/fix/docs/etc), outputs markdown
+- `agent-workbench pr-describe` — Generates PR description with commit summary, type emoji, co-authors, and checklist from commit history
+
+### Workflow Templates (future)
+
+- `.github/workflows/agent-review.yml` — GitHub Action that runs review on PR
+- `.github/workflows/agent-changelog.yml` — Generate changelog on release tag
+
+---
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────┐
+│  agent-workbench CLI                         │
+│                                              │
+│  main() ──► plugin / init / review /         │
+│             changelog / pr-describe          │
+│                                              │
+│  review ──► gh CLI ──► fetch PR diff         │
+│           ──► tsc + biome ──► analyze        │
+│           ──► gh pr review ──► post          │
+│                                              │
+│  changelog ──► git log ──► parse commits     │
+│            ──► group by type ──► output md   │
+│                                              │
+│  pr-describe ──► git log ──► parse commits   │
+│              ──► generate template ──► out   │
+└─────────────────────────────────────────────┘
+```
+
+All commands use:
+- `gh` CLI for GitHub API access (authenticated via user's existing `gh` auth)
+- `git` for local commit history
+- `npx` for analysis tools (tsc, biome)
+- Node.js `child_process.execSync` for subprocess calls
+
+---
+
+## Exit Gates
+
+```
+[x] PR review command: analyze diff and post structured review
+[x] Changelog command: generate markdown from conventional commits
+[x] PR describe command: generate description from commit history
+[x] Unit tests for parsing and formatting logic (8+ tests across all commands)
+[x] All commands build and type-check cleanly
+[x] GitHub Action workflow template for automated PR review
+[x] GitHub Action workflow template for release changelog
+```
+
+---
+
+## Risks
+
+- `gh` CLI must be installed and authenticated — commands fail gracefully with clear error message
+- `npx` execution is slow for single-file type-checking — may need optimization for large diffs
+- Diff parsing is regex-based and may miss edge cases (binary files, large renames)
+- Commands are synchronous — fine for CLI, but future GitHub Actions would need async
+
+---
+
+## Changes Already Made
+
+| File | Change |
+|------|--------|
+| `apps/cli/src/commands/review.ts` | New — PR review bot with diff parsing, type-check, biome lint, `gh pr review` posting |
+| `apps/cli/src/commands/changelog.ts` | New — Changelog generator from conventional commits |
+| `apps/cli/src/commands/pr-describe.ts` | New — PR description generator from commit log |
+| `apps/cli/src/commands/cli-cicd.test.ts` | New — 8 unit tests for parsing and formatting |
+| `apps/cli/src/index.ts` | Updated — added `review`, `changelog`, `pr-describe` commands |
+
+---
+
+*Last updated: 2026-07-07*
diff --git a/plugins/agent-workbench-hermes/plugin.json b/plugins/agent-workbench-hermes/plugin.json
index 672fa6c..e93c754 100644
--- a/plugins/agent-workbench-hermes/plugin.json
+++ b/plugins/agent-workbench-hermes/plugin.json
@@ -6,7 +6,7 @@
   "author": "agent-workbench",
   "license": "MIT",
   "minWorkbenchVersion": "0.0.0",
-  "main": "src/index.ts",
+  "main": "dist/index.js",
   "enabled": true,
   "provides": {
     "tools": [],
diff --git a/plugins/agent-workbench-opencode/plugin.json b/plugins/agent-workbench-opencode/plugin.json
index 799021b..272bc63 100644
--- a/plugins/agent-workbench-opencode/plugin.json
+++ b/plugins/agent-workbench-opencode/plugin.json
@@ -6,7 +6,7 @@
   "author": "agent-workbench",
   "license": "MIT",
   "minWorkbenchVersion": "0.0.0",
-  "main": "src/index.ts",
+  "main": "dist/index.js",
   "enabled": true,
   "provides": {
     "tools": [],