Build php-backend-sdlc plugin: package user-service AI setup as a repeatable full-SDLC Claude Code plugin

[dmytrocraft]

Motivation

VilnaCRM's user-service carries a mature AI engineering setup — 21 Claude skills, AGENTS.md/CLAUDE.md governance, a BMAD-method install managed by the bmalph CLI, and the Ralph autonomous implementation loop — but it is locked into that one repository. Every other PHP backend (core-service, crm, repos born from php-service-template) must copy and hand-edit these files.

Goal

Ship the php-backend-sdlc Claude Code plugin in this marketplace so that any PHP backend repo gets, from a single install plus a few-sentence task description, a fully automated SDLC:

1. GitHub issue creation with acceptance criteria
2. Planning via the BMAD method (brief → PRD → architecture → epics/stories → readiness gate)
3. Autonomous implementation via bmalph implement / bmalph run with the claude-code driver, plus parallel subagents
4. Multi-skill code review (architecture, quality, testing lenses) and the BMAD FR/NFR review gate, repeated until a full pass yields zero new findings
5. Manual-style QA verification against the running service
6. PR finishing: CI checks auto-fixed to green and every AI reviewer comment addressed
7. Self-critical loop: review + QA re-run on the final state until everything passes

Scope

• plugins/php-backend-sdlc/ with plugin.json, commands/ (/sdlc, /sdlc-setup, /sdlc-issue, /sdlc-plan, /sdlc-implement, /sdlc-review, /sdlc-qa, /sdlc-finish-pr), agents/ (php-implementer, code-quality-reviewer, fr-nfr-reviewer, qa-manual-tester, ci-fixer, pr-comment-resolver), skills/ (the 21 user-service skills generalized via a project profile .claude/php-sdlc.yml), scripts/, and docs
• Marketplace CI: manifest validation, markdown lint, shellcheck/bats, skill frontmatter checks

Design document: docs/superpowers/specs/2026-06-09-php-backend-sdlc-plugin-design.md

Acceptance criteria

• Plugin installs via claude plugin marketplace add VilnaCRM-Org/claude-plugins + claude plugin install php-backend-sdlc@vilnacrm-plugins, and all commands/agents/skills load
• All 21 skills generalized — no user-service-specific names, paths, or bounded contexts outside the project profile
• /sdlc-setup bootstraps a fresh clone of php-service-template (profile generation + bmalph init preflight)
• Every SDLC stage command documents its loop, failure path, and max-iteration guard
• BMAD planning artifacts for this build live in specs/
• CI green; PR review comments from AI reviewers all resolved
• Plugin docs cover install, usage, and the SDLC loop reference

[dmytrocraft]

PR #2 is ready for review/merge — all acceptance criteria are met:

• ✅ Plugin installs via claude plugin marketplace add VilnaCRM-Org/claude-plugins + claude plugin install php-backend-sdlc@vilnacrm-plugins; component inventory verified: 21 skills + 8 commands + 6 agents (evidence: plugins/php-backend-sdlc/docs/evidence/qa-install-setup.md)
• ✅ All 21 skills generalized through the .claude/php-sdlc.yml profile — CI generalization-audit denylist enforces zero user-service identifiers outside # profile-example fences
• ✅ /sdlc-setup surface bootstraps a fresh php-service-template clone (preflight 8/8, profile generation/validation, idempotent governance blocks; QA found and we fixed two real detection defects)
• ✅ Every SDLC stage command documents loop, failure path, and 5-iteration guard with a canonical escalation block
• ✅ BMAD planning artifacts in specs/autonomous/2026-06-09-php-backend-sdlc-plugin/ (PRD 20 FR / 8 NFR, architecture 11 ADRs, epics, readiness gate, retrospective)
• ✅ CI green (7/7 jobs + qlty + cubic); AI reviewer comments all resolved (11 threads: 10 fixed, 1 reasoned reply). CodeRabbit could not run — account usage credits exhausted; degrade documented in docs/evidence/finish-pr-run.md
• ✅ Docs cover install, setup walkthrough, profile schema, SDLC loop, permissions, degrade matrix, release process

Remaining (tracked in the retrospective action items): a full live G3 reference run (issue→PR on a real service repo via /sdlc) is the recommended post-merge validation once the plugin is installed org-wide.