Repository navigation
feat: release PAACM 3.3.0 with an error-handling reviewer and companion plugins - #6
Merged
Merged
Conversation
…gins - Add paacm-silent-failure-hunter, adapted from Anthropic's silent-failure-hunter (Apache License 2.0): read-only, fed the reviewer's review-input.md, run in phase 8 and by paacm-review when a diff changes error handling, reporting only failures the changed code can hide. - High-stakes verification runs the claude-security scan of the changes when that plugin is installed. - Document claude-security and security-guidance as optional companions, including what security-guidance installs at runtime and which reviews duplicate PAACM's (ADR 0019). - Add an assessment of Anthropic's official plugins to the research addendum.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
PAACM 3.3.0 takes what fits from Anthropic's official plugin marketplace (
claude-plugins-official, read atea10b21), which the study of 14 October did not assess.paacm-silent-failure-hunter, adapted frompr-review-toolkit'ssilent-failure-hunter(Apache License 2.0, the kit's own licence; the file carries the attribution and what changed). It is read-only (Read, Grep, Glob, LSP), reads the samereview-input.mdaspaacm-reviewer, and runs in phase 8 and inpaacm-reviewwhen a diff changes error handling. It reports only failures the changed code can hide: swallowed errors, overly broad catches, unrequested fallbacks, retries that give up silently. The original's company-specific logging names and its "every instance, no matter how minor" instruction are removed, in line with the reviewer's report-only-real-findings rule. Core-layer installs get the same instructions inline.claude-securityfor high-stakes work: when the plugin is installed,07-verifyruns its scan of the changes at high effort, and confirmed findings are fixed within the plan or end inBLOCKED:. The plugin is proprietary, so the kit only points to it.security-guidanceis documented as an optional companion, not enabled. Its session-start hook installs the Claude Agent SDK into~/.claude/security/from the package index when the SDK is missing, whatever review switches are set; its pattern layer often duplicates a project's linters (for example RuffS, Biome security rules); and its turn-end review runs beside PAACM's stop gate. The guide says how to keep one review per turn (ENABLE_STOP_REVIEW=0).frontend-designandclaude-md-managementnot adopted, with reasons).Verification
node bin/paacm.mjs validate: exit 0node bin/paacm.mjs build --check: exit 0npm test: 89 of 89 pass (1 new; the plugin agent count updated from 3 to 4)markdownlint-cli2@0.23.3 "**/*.md": 0 issuesclaude plugin validate plugins/paacm --strictandclaude plugin validate .: passedpaacm-silent-failure-hunter;doctorreports 0 problems in eachAfter merging
Tag
v3.3.0on the merge commit.v3.1.0(089cd0c) andv3.2.0(the #5 merge commit) are not tagged yet either.