Skip to content

[AI-58] llm: add bitwarden-planning-tools plugin with consulting-adrs skill - #177

Open
SaintPatrck wants to merge 3 commits into
mainfrom
consulting-adrs-planning-tools
Open

[AI-58] llm: add bitwarden-planning-tools plugin with consulting-adrs skill#177
SaintPatrck wants to merge 3 commits into
mainfrom
consulting-adrs-planning-tools

Conversation

@SaintPatrck

@SaintPatrck SaintPatrck commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

🎟️ Tracking

AI-58

📔 Objective

Adds bitwarden-planning-tools, a new plugin housing pre-implementation planning and preparation skills.

Its first skill is consulting-adrs: it checks a design, change, plan, or threat model against Bitwarden's Architecture Decision Records, or locates and summarizes the catalog, returning structured findings (conflict, gap, stale-reference, aligned) with cited ADRs. WebFetch is scoped to contributing.bitwarden.com.

Ships a full eval harness per the AI Review Guidelines (triggering, structure, behavior) with baselines on claude-opus-4-8, recorded in skills/consulting-adrs/evals/.

#178 wires bitwarden-security-engineer's ADR-alignment checks to this skill and is stacked on this PR, which must land first.

@SaintPatrck SaintPatrck added the ai-review Request a Claude code review label Jul 31, 2026
@github-actions

Copy link
Copy Markdown

Claude Code is validating plugin components and security...

If this comment does not update with results, check the Actions log.

@github-actions

github-actions Bot commented Jul 31, 2026

Copy link
Copy Markdown

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the new bitwarden-planning-tools plugin and its consulting-adrs skill, including the eval harness (trigger, structure, behavior) and the synthetic ADR fixtures. Version 1.0.0 is consistent across marketplace.json, the plugin manifest, the root README catalog, and CHANGELOG.md; no agents exist so no agent version to sync. Security posture is sound: allowed-tools is scoped to WebFetch(domain:contributing.bitwarden.com), Read, Grep, the untrusted-fetched-content rule from the earlier round is now in place, and no secrets or settings files are touched. Prior round's findings are addressed — the marketplace em-dash churn is gone and the plugin README no longer claims a consumer integration that has not landed.

Code Review Details
  • ❓ : Two over-triggering negative cases were dropped and the recorded reliability figures recomputed; confirm scope decision or re-run
    • plugins/bitwarden-planning-tools/skills/consulting-adrs/evals/baseline.json:12-17

Comment thread plugins/bitwarden-planning-tools/skills/consulting-adrs/SKILL.md Outdated
Comment thread plugins/bitwarden-planning-tools/README.md Outdated
Establish bitwarden-planning-tools as the pre-implementation planning home
(counterpart to bitwarden-delivery-tools' post-implementation mechanics), and
land consulting-adrs here as its first skill.

consulting-adrs checks a design/change/plan/threat-model against Bitwarden's
ADRs (or locates/summarizes the catalog) and returns structured
conflict/gap/aligned findings with cited ADRs. Ships the full eval harness
(trigger/structure/behavior) with baselines on claude-opus-4-8: triggering
7/8 should-trigger, 6/6 should-not; behavior with-skill 1.00 vs baseline 0.78
over 9 cases. WebFetch scoped to contributing.bitwarden.com.

Proposed as the future home for tech breakdowns, initiative-funnel navigation,
and architecting-solutions as planning tools consolidate here.
Treat fetched ADR pages as untrusted data, matching the sibling
architecting-solutions skill's rule for the same domain. Drop the
Cross-Plugin Integration table's consumer inventory rather than
correct its premature claim — a skill has no need to track which
plugins call it, and the table's only other row duplicated the
Overview's own counterpart framing.
@SaintPatrck
SaintPatrck force-pushed the consulting-adrs-planning-tools branch from ce76862 to 8e05440 Compare August 5, 2026 12:41
@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown

Claude Configuration Validation — PR #177

Provisional: plugin-validator and skill-reviewer agents still running. This file will be replaced with the final report.

Direct checks completed so far on plugins/bitwarden-planning-tools:

  • plugin.json manifest valid, semver 1.0.0, version consistent across .claude-plugin/marketplace.json, plugin manifest, and root README.md catalog row; CHANGELOG.md has a matching 1.0.0 entry.
  • SKILL.md frontmatter parses; name matches directory; allowed-tools scoped to WebFetch(domain:contributing.bitwarden.com), Read, Grep.
  • No secrets or hardcoded credentials found; no settings files changed.
  • prettier --check and cspell pass on all changed files.

Comment thread .claude-plugin/marketplace.json Outdated
SaintPatrck added a commit that referenced this pull request Aug 5, 2026
Comment thread plugins/bitwarden-planning-tools/skills/consulting-adrs/SKILL.md Outdated
SaintPatrck added a commit that referenced this pull request Aug 5, 2026
@SaintPatrck
SaintPatrck force-pushed the consulting-adrs-planning-tools branch from d4374e1 to 928b0d5 Compare August 5, 2026 18:54
@SaintPatrck
SaintPatrck force-pushed the consulting-adrs-planning-tools branch from 928b0d5 to ab8303f Compare August 5, 2026 19:00
@SaintPatrck
SaintPatrck marked this pull request as ready for review August 5, 2026 19:03
@SaintPatrck
SaintPatrck requested a review from a team as a code owner August 5, 2026 19:03
Comment on lines +12 to +17
"should_not_trigger_pass": "4/4",
"reliability": {
"all_runs_agree_rate": 0.9166666666666666,
"should_trigger_reliable": "7/8",
"should_not_trigger_reliable": "4/4"
},

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

QUESTION: The two negative cases that over-triggered were dropped and the reliability figures recomputed — scope decision or worth re-running?

Details

ab8303f removed "Help me write a new ADR documenting the token-rotation decision we just landed on." and "What's an ADR and when should our team bother writing one?" from trigger-eval.json, and adjusted this block to match: should_not_trigger_pass 6/64/4, all_runs_agree_rate 0.7860.917, should_not_trigger_reliable 4/64/4. Those were the only two negative cases that failed (each fired 1/3), and the _notes line disclosing them was trimmed at the same time.

The remaining 12 per-query records are self-consistent with the new totals, so nothing here misreports. Two things worth confirming:

  1. If the removal was a scope call (authoring and conceptual asks are arguably ambiguous labels rather than skill defects), a one-line note in evals/README.md under "Known issues / boundaries" would keep that reasoning with the artifact — the under-trigger case is documented there, this one now isn't.
  2. If they are still in scope, ADR-authoring is the nearest over-trigger boundary for this skill and now has only partial coverage via "Update ADR-0012's status to superseded...".

Either resolution is fine; the ask is that the recorded baseline carries the reasoning, since it's what the next refresh will be compared against.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Scope decision. The dropped tests were flakey and not relevant until competing or complimentary skills are identified.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai-review Request a Claude code review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant