Agile V™ Agent Skills Library

🔬 Verifiable AI-Augmented Engineering - Stop AI Hallucinations with Formal Traceability

🎯 The Problem with AI Agents Today

AI agents hallucinate. They generate code without requirements, skip testing, make silent assumptions, and deploy to production without approval. Great for demos. Catastrophic for real products.

Real-World Failure Scenarios

Without formal verification frameworks, AI agents commonly produce:

• Orphaned Code: Functions and features appear with no documented requirement or business justification. Six months later, no one knows why they exist or if they can be safely removed.
• Silent Assumptions: An agent optimizes for cloud deployment without asking about target hardware, producing code that crashes on embedded devices with limited RAM.
• Self-Grading Bias: The same agent that writes code also writes its own tests, missing edge cases and security vulnerabilities a fresh perspective would catch.
• Deployment Disasters: Autonomous agents push changes to production at 2 AM without human review, breaking critical systems because they "passed all tests."
• Untraceable Bugs: When a feature breaks, there's no audit trail showing why design decisions were made, making debugging a archaeological expedition.
• Compliance Nightmares: Regulatory auditors ask "Where's your requirements traceability matrix?" and teams spend weeks manually reconstructing what should have been automated from day one.

✨ The Solution: Agile V Framework

Transform unreliable AI agents into Verifiable Engineering Systems with:

Core Protection Mechanisms

• ✅ Formal Traceability — Every line of code links to REQ-XXXX → ART-XXXX → TC-XXXX

  • Why it matters: When a bug appears in production, you can instantly trace it back to the original requirement, see which tests should have caught it, and understand the design rationale. No more archeological debugging.

• ✅ Independent Verification — Red Team Verifier tests what Build Agent creates (no self-grading)

  • Why it matters: Two separate agents with fresh contexts means bugs the Build Agent missed get caught before production. It's like having a dedicated QA engineer who hasn't seen the implementation details.

• ✅ Hardware Awareness — Agents ask about RAM/CPU/GPU before optimizing (no "works on my machine")

  • Why it matters: Code optimized for cloud servers crashes on Raspberry Pi. Code written for development laptops fails on production embedded devices. Agile V validates constraints upfront.

• ✅ Human Gates — Evidence Summaries before deployments (no autonomous production releases)

  • Why it matters: You get a comprehensive summary of what changed, what was tested, and what risks remain before approving deployment. No more surprise 2 AM production incidents.

• ✅ Halt on Ambiguity — Agents stop and ask when requirements are unclear (no silent assumptions)

  • Why it matters: "Make it faster" could mean response time, perceived UX speed, or infrastructure throughput. Agile V agents clarify before building, preventing wasted work.

• ✅ Compliance-Ready — Auto-generates ISO 9001, ISO 27001, GxP artifacts from day 1

  • Why it matters: When auditors ask "Show me your requirements traceability matrix," you have it. When regulators demand evidence of independent verification, you have it. Compliance becomes a byproduct of normal development.

• ✅ Multi-Platform — Works with Claude Code, Cursor, VS Code, GitHub Copilot

  • Why it matters: Your engineering standards stay consistent regardless of which IDE or AI provider your team uses. The quality framework is portable.

🚀 Quick Start

Prerequisites

Before installing Agile V skills, ensure you have:

• One of the supported AI coding tools (Claude Code, Cursor, VS Code, or GitHub Copilot)
• Basic familiarity with your chosen tool's agent/chat interface
• A project directory where you want to apply Agile V principles

Installation (Choose Your Platform)

Option 1: Claude Code (Simplest)

# Install via plugin marketplace
/plugin install agile-v-skills

What happens: Skills auto-activate when relevant. Type / in chat to manually invoke specific skills.

Option 2: Cursor

# 1. Clone this repository
git clone [email protected]:Agile-V/agile_v_skills.git

# 2. Copy skills to your project (project-specific)
cd /path/to/your/project
mkdir -p .cursor/skills
cp -r /path/to/agile_v_skills/agile-v-core .cursor/skills/
cp -r /path/to/agile_v_skills/build-agent .cursor/skills/
cp -r /path/to/agile_v_skills/requirement-architect .cursor/skills/

# OR install globally (all projects)
mkdir -p ~/.cursor/skills
cp -r /path/to/agile_v_skills/agile-v-core ~/.cursor/skills/
cp -r /path/to/agile_v_skills/build-agent ~/.cursor/skills/

What happens: Cursor auto-discovers skills in .cursor/skills/ or ~/.cursor/skills/. Each skill folder must contain a SKILL.md file.

Option 3: VS Code / GitHub Copilot

# 1. Clone this repository
git clone [email protected]:Agile-V/agile_v_skills.git

# 2. Copy skills to global directory (recommended)
mkdir -p ~/.copilot/skills
cp -r /path/to/agile_v_skills/agile-v-core ~/.copilot/skills/
cp -r /path/to/agile_v_skills/build-agent ~/.copilot/skills/

# OR to project directory
mkdir -p .github/skills
cp -r /path/to/agile_v_skills/agile-v-core .github/skills/

What happens: VS Code/Copilot scans ~/.copilot/skills/, .github/skills/, .claude/skills/, or .agents/skills/. Type / in chat to invoke skills.

Language-Specific Extensions

After installing core skills, add domain-specific build agents for your stack:

# For Python projects
cp -r /path/to/agile_v_skills/domains/build-agent-python <your-skills-dir>/

# For JavaScript/TypeScript projects
cp -r /path/to/agile_v_skills/domains/build-agent-js <your-skills-dir>/

# For NestJS projects
cp -r /path/to/agile_v_skills/domains/build-agent-nestjs <your-skills-dir>/

# For Dart/Flutter projects
cp -r /path/to/agile_v_skills/domains/build-agent-dart <your-skills-dir>/

# For embedded C/C++ projects
cp -r /path/to/agile_v_skills/domains/build-agent-embedded <your-skills-dir>/

Verification: Is It Working?

After installation, test that skills are active:

1. Open your AI coding assistant (Claude Code, Cursor, VS Code, etc.)
2. Type a vague request in the chat:

   "Add user authentication"
   

3. Look for Agile V behavior:
   • Agent should respond with ⚠️ HALT CONDITION: No requirement specification found
   • Agent should offer to invoke the requirement-architect skill
   • Agent should ask clarifying questions before writing code

If you see these behaviors, Agile V is active. If the agent immediately starts generating code without asking questions, see the Troubleshooting section below.

👉 See Installation Guide for detailed platform-specific instructions

Your First Verified Build

Here's what a typical Agile V workflow looks like in practice:

You: "Add user authentication"

Agent: ⚠️ HALT CONDITION: No requirement specification found

Before implementing, I'll invoke the Requirement Architect to:
1. Decompose "user authentication" into formal requirements
2. Define acceptance criteria
3. Identify security and compliance constraints

[Requirement Architect creates REQ-0001, REQ-0002...]

Build Agent: ✓ Implementation complete (ART-0001 → REQ-0001)
Red Team Verifier: Testing independently...
  - Found 2 security issues Build Agent missed
  - SECURITY-001: No max password length (DoS risk)
  
[Build Agent fixes issues based on Red Team feedback]

Red Team Verifier: ✓ All tests pass
Agent: Ready for Human Gate approval

Result: Production-ready code with full traceability and independent verification.

Understanding the Agile V Workflow

The framework follows a structured pipeline with built-in quality gates:

┌─────────────────┐
│  Human Intent   │  "Add user authentication"
└────────┬────────┘
         │
         ▼
┌─────────────────────────────┐
│  Requirement Architect      │  Decomposes into REQ-XXXX with acceptance criteria
└────────┬────────────────────┘
         │
         ▼
┌─────────────────────────────┐
│  Logic Gatekeeper           │  Validates for ambiguity & constraints
└────────┬────────────────────┘  Halts if unclear → asks for clarification
         │
         ▼
┌─────────────────────────────┐
│  HUMAN GATE 1               │  ⚠️ Approve requirements before building
└────────┬────────────────────┘
         │
         ├──────────┬──────────┐
         ▼          ▼          ▼
  ┌──────────┐ ┌──────────┐ ┌──────────┐
  │  Build   │ │   Test   │ │Schematic │  (Run in parallel)
  │  Agent   │ │ Designer │ │Generator │
  └─────┬────┘ └────┬─────┘ └────┬─────┘
        │           │            │
        └───────────┴────────────┘
                    │
                    ▼
         ┌──────────────────────┐
         │ Red Team Verifier    │  Independent verification
         └──────────┬───────────┘  (fresh context, no self-grading)
                    │
                    ▼
         ┌──────────────────────┐
         │  HUMAN GATE 2        │  ⚠️ Review Evidence Summary before deploy
         └──────────┬───────────┘
                    │
                    ▼
         ┌──────────────────────┐
         │  Production Deploy   │  Only after human approval
         └──────────────────────┘

Key Principles:

• Left Side (Requirements): Clarify what before how. Agents halt on ambiguity.
• Apex (Building): Multiple agents work in parallel, each focused on their domain.
• Right Side (Verification): Independent Red Team catches what Build Agent missed.
• Human Gates: You approve requirements and deployments. Agents never decide alone.

🌟 Why Agile V?

💡 What You Get

This repository contains the official collection of Agent Skills for the Agile V™ framework. These skills transform standard LLMs into specialized engineering agents capable of building, verifying, and auditing complex systems with mathematical rigor.

The Vision: From Manifesto to Execution

The Agile V™ Manifesto provides the philosophy; this repository provides the mechanics.

By deploying these skills, you move away from "unstructured prompting" and toward a formal Autonomous Quality Management System (AQMS). Every skill in this library is built to enforce:

• Traceability: Every action is linked to a Requirement ID.
• Verification: No artifact is created without a "Red Team" challenge.
• Human Curation: Automated stops at critical "Human Gates."

🛠 Repository Structure

The skills are organized following the Agile V™ Infinity Loop. Each skill lives at the root level (or under domains/ for language-specific extensions) for ease of use. You can reference skills directly with simple paths like ./agile-v-core/SKILL.md when configuring Cursor or other agent tools.

├── agile-v-core/           # Foundation: Core philosophy and operational logic
├── requirement-architect/  # Left Side: Intent and decomposition
├── logic-gatekeeper/       # Left Side: Ambiguity and constraint validation
├── build-agent/            # Apex: Core build agent (language-agnostic)
├── test-designer/          # Apex: Verification suite design
├── schematic-generator/    # Apex: Schematics, netlists, HDL
├── domains/                # Apex: Language-specific build agent extensions
│   ├── build-agent-dart/
│   ├── build-agent-embedded/
│   ├── build-agent-js/
│   ├── build-agent-nestjs/
│   └── build-agent-python/
├── red-team-verifier/      # Right Side: Verification and Red Teaming
├── compliance-auditor/     # Compliance: Audit and governance
├── documentation-agent/    # Documentation: Standards-based repo docs (ISO 9001, V-Model, ISO 27001)
├── venture-strategist/     # [Draft] Business Track: Vision, business model, product portfolio
├── rd-innovator/           # [Draft] Business Track: R&D pipeline, technology radar, prototyping
├── gtm-executor/           # [Draft] Business Track: Go-to-market, marketing, growth experiments
├── business-operations/    # [Draft] Business Track: Finance, OKRs, vendors, operational risk
├── chief-exec/             # [Draft] C-Suite: CEO orchestrator, strategic alignment, board, crisis
├── chief-tech/             # [Draft] C-Suite: CTO orchestrator, architecture, tech debt, platform
├── chief-finance/          # [Draft] C-Suite: CFO orchestrator, financial modeling, controls
├── chief-people/           # [Draft] C-Suite: CHRO orchestrator, org, hiring, compensation, culture
└── chief-ops/              # [Draft] C-Suite: COO orchestrator, processes, delivery, scaling

📦 Included Skills

Compliance Documentation

The repository includes a full compliance posture assessment under [docs/compliance/](https://github.com/Agile-V/agile_v_skills/blob/main/docs/compliance/). This documentation was generated from a clause-by-clause audit of the v1.3 skills against ISO 9001:2015, ISO 13485:2016, AS9100D, ISO 27001:2022, and GxP/GAMP 5.

[!NOTE] The skills claim "ISO 9001 / ISO 27001 Aligned (Design Phase); GxP-Aware". This is an honest scope -- the skills cover design and development controls, not production, manufacturing, or full organizational QMS. The compliance documentation tells you exactly what you get and what you still need to do for your regulatory context.

Skill Interaction Flow

sequenceDiagram
    participant Human
    participant RA as Requirement Architect
    participant LG as Logic Gatekeeper
    participant BA as Build Agent
    participant TD as Test Designer
    participant RTV as Red Team Verifier
    participant CA as Compliance Auditor
    participant DA as Documentation Agent

    Human->>RA: Product Intent
    RA->>RA: REQ-XXXX, Blueprint
    RA->>Human: Human Gate 1: Approve Blueprint
    Human->>LG: Approved Blueprint
    LG->>LG: Ambiguity and Constraint Check
    opt Unclear constraints or ambiguity
        LG->>Human: Halt: Clarify ambiguity or constraints
        Human->>LG: Clarification
    end
    LG->>BA: Approved Requirements
    LG->>TD: Same Requirements (parallel)

    par Apex
        BA->>BA: Generate Artifacts and Build Manifest
        opt Ambiguous requirement
            BA->>Human: Halt: Clarify requirement
            Human->>BA: Clarification
        end
        TD->>TD: Generate TC-XXXX from REQ only
    end

    BA->>RTV: Artifacts and Manifest
    TD->>RTV: Test Cases
    RTV->>RTV: Execute Tests (independent verification)
    RTV->>Human: Human Gate 2: Validation Summary
    CA->>CA: Decision Log, ATM, VSR (throughout)
    opt On request
        Human->>DA: Generate or refresh docs
        DA->>DA: docs/ suite (hub, standards, cross-ref)
    end

Business Track Interaction Flow [Draft]

[!NOTE] The Business Track skills below are draft additions and have not been officially released.

The Business Track operates as a parallel lifecycle alongside the Engineering Track, with defined integration points:

sequenceDiagram
    participant Human
    participant VS as Venture Strategist
    participant RDI as R&D Innovator
    participant GTM as GTM Executor
    participant BOP as Business Operations
    participant DA as Discovery Analyst
    participant RA as Requirement Architect
    participant RM as Release Manager
    participant OP as Observability Planner

    Human->>VS: Vision & Market Opportunity
    VS->>VS: VISION.md, BUSINESS_MODEL.md, PORTFOLIO.md
    VS->>Human: Business Gate 0: Approve Strategy

    par Business Execution
        Human->>RDI: R&D Direction (from PORTFOLIO.md)
        RDI->>RDI: TECH_RADAR.md, PROTOTYPE_LOG.md
        RDI->>Human: Business Gate 1 (R&D): Approve Portfolio

        Human->>GTM: GTM Direction (from BUSINESS_MODEL.md)
        GTM->>GTM: GTM_PLAN.md, CHANNEL_STRATEGY.md
        GTM->>Human: Business Gate 1 (GTM): Approve Strategy

        Human->>BOP: Operational Planning
        BOP->>BOP: FINANCIAL_PLAN.md, OKR.md
        BOP->>Human: Business Gate 2: Approve Budget
    end

    Note over RDI,DA: Product Transfer
    RDI->>DA: Transfer Package (validated prototypes)
    VS->>DA: PORTFOLIO.md (product intent)
    DA->>RA: Candidate Requirements

    Note over GTM,RM: Launch Coordination
    RM->>GTM: Deployment Confirmation
    GTM->>GTM: Execute Launch Plan

    Note over OP,VS: Feedback Loop
    OP->>VS: Production Metrics → Portfolio Decisions
    GTM->>DA: Market Feedback → Next Cycle Discovery

C-Suite Orchestrator Layer [Draft]

[!NOTE] The C-Suite layer below contains draft skills and has not been officially released.

The C-Suite layer adds executive-level governance agents that orchestrate the functional Business Track skills. They set policy and strategy; functional skills execute within their governance frameworks.

                        chief-exec (CEO)
                   Strategic Alignment & Board
                    ┌───────┼───────┬──────────┐
              chief-tech  chief-fin  chief-ppl  chief-ops
              (CTO)       (CFO)      (CHRO)     (COO)
                │           │          │           │
           rd-innovator  biz-ops   [standalone  biz-ops
           build-agent   (finance)  new domain] (ops)
           observability venture-               release-mgr
           threat-model  strategist             product-owner
                         (investors)            gtm-executor

Key design principles:

• Orchestrator pattern: C-suite skills delegate to existing functional skills; no functional skills are modified
• Executive Gates: New approval layer (Executive Gates 0-1) above existing Business Gates
• Backward compatible: All engineering and functional business skills work without C-suite layer
• CHRO is entirely new: chief-people introduces org design, hiring, compensation, culture, performance, DE&I, and talent development

Business Track artifacts (state persistence)

Business Track state lives in .agile-v/business/. Functional skill artifacts: VISION.md, BUSINESS_MODEL.md, PORTFOLIO.md, INVESTOR_LOG.md, RD_PIPELINE.md, TECH_RADAR.md, PROTOTYPE_LOG.md, IP_REGISTER.md, GTM_PLAN.md, LAUNCH_PLAN.md, CHANNEL_STRATEGY.md, GROWTH_METRICS.md, FINANCIAL_PLAN.md, OKR.md, OPERATIONS_LOG.md, VENDOR_REGISTER.md, BUSINESS_DECISION_LOG.md. C-Suite artifacts: EXEC_DASHBOARD.md, BOARD_REPORT.md, CRISIS_LOG.md, TECH_STRATEGY.md, ARCH_DECISIONS.md, TECH_DEBT_REGISTER.md, PLATFORM_PLAN.md, FINANCIAL_MODEL.md, CASH_MANAGEMENT.md, FINANCIAL_CONTROLS.md, BOARD_FINANCIALS.md, ORG_DESIGN.md, HIRING_PIPELINE.md, COMPENSATION_FRAMEWORK.md, CULTURE_CODE.md, PERFORMANCE_FRAMEWORK.md, TALENT_PLAN.md, OPS_PLAYBOOK.md, PROCESS_MAP.md, DELIVERY_DASHBOARD.md. All skills reference artifacts by file path for cross-track integration.

Requirements artifact (source of truth)

The Requirement Architect exports the approved Blueprint (after Human Gate 1) to a requirements file (default: REQUIREMENTS.md in the project root). The Logic Gatekeeper then reads that file, validates it (ambiguity, constraints, conflicts), and writes back any user-approved adjustments to the same file. All downstream agents (Build Agent, Test Designer, Red Team Verifier, Schematic Generator, Compliance Auditor) read requirements from this file, not from in-chat handoff. Using a single persisted file as the requirements source reduces context-window pressure, avoids carrying the full Blueprint in conversation, and lets parallel or sequential agent runs (e.g. build per feature) reference the same canonical artifact.

Documentation artifact (documentation-agent)

The Documentation Agent writes all output into the project's **docs/** directory (created if missing). The hub **docs/README.md** provides the document map, quick navigation and per-standard tables, cross-reference matrix (concerns × standards), repository structure reference, and applicable standards table. One subdirectory per selected standard, e.g. **iso9001/**, **iso27001/**, **v-model/** by default; (optionally **gamp5/** or other standards when the user requests it) contains numbered markdown documents for that standard. Every generated document (except the hub) includes a header (Document ID, Version, Date, Classification, Status), navigation (Back to Documentation Hub, Previous/Next when applicable), and a footer with a Document History table; any diagrams are Mermaid only, embedded in markdown. The default standards are ISO 9001, V-Model (lifecycle), and ISO 27001; additional standards (e.g. GAMP 5) are included only when the user specifies them.

Context Engineering and Orchestration (v1.2)

Version 1.2 introduces context engineering, orchestration pipeline, state persistence, and post-verification feedback patterns adapted from Get Shit Done (GSD) by Lex Christopherson (MIT License). These additions address how agents manage context windows, coordinate handoffs, persist project state across sessions, and iterate after verification failures.

Key additions:

• Context Engineering (agile-v-core, build-agent, all domain agents): Rules for managing context window quality -- thin orchestrator pattern, fresh context per task, task sizing to 50% of context, passing file paths instead of contents.
• Orchestration Pipeline (agile-v-core): Defines pipeline stages, handoff rules, wave-based parallel execution with dependency analysis, and checkpoint types (auto, human-verify, human-decision, human-action).
• State Persistence (agile-v-core): Standard .agile-v/ project directory structure for persisting requirements, build manifests, decision logs, traceability matrices, and session state across sessions.
• Pre-Execution Validation (build-agent): 5-dimension check before synthesis -- requirement coverage, artifact completeness, dependency order, scope sanity, and interface contracts.
• Post-Verification Feedback Loop (build-agent, red-team-verifier): Auto-fix rules, severity classification (CRITICAL/MAJOR/MINOR), 3-attempt limit per failure, and re-verification protocol with append-only records.
• Stub and Anti-Pattern Detection (red-team-verifier): 11-item detection checklist for placeholder returns, TODO markers, empty handlers, hardcoded secrets, and more.
• Model Tier Guidance (agile-v-core): Recommended model capability tiers per agent role (High for architecture decisions, Medium for code generation, Low for structured logging).

Iteration Lifecycle and Document Versioning (v1.3)

Version 1.3 introduces the multi-cycle V-loop -- the ability to run second and subsequent iterations while preserving full traceability, versioned documents, and audit evidence from prior cycles.

Key additions:

• Iteration Lifecycle (agile-v-core): Defines Cycle IDs (C1, C2, ...), cycle triggers, re-entry points, document versioning scheme, and cycle archival to .agile-v/cycles/CN/. Requirements carry per-REQ status tags (approved, modified, new, deprecated, superseded) with cycle references.
• Change Request Protocol (agile-v-core, requirement-architect): CR-XXXX records in .agile-v/CHANGE_LOG.md that formally track every requirement modification between cycles with rationale, impact analysis, and Human Gate approval.
• Multi-Cycle Re-Validation (logic-gatekeeper): Scoped re-validation -- only new and modified requirements go through full validation; unchanged requirements are skipped unless constraints shifted.
• Artifact Versioning (build-agent): ART-XXXX.N revision scheme -- unchanged artifacts carry forward without rebuild; modified artifacts get a revision bump with CR reference.
• Regression and Delta Testing (test-designer): Test cases classified as delta (new/modified REQs) or regression (unchanged REQs). Regression baseline carried forward from prior cycle. Retired tests preserved for traceability.
• Cycle-Aware Verification (red-team-verifier): Delta and regression results reported separately. Unexpected regression failures (no related CR) are automatically CRITICAL.
• Cycle-Aware ATM (compliance-auditor): Traceability matrix partitioned by cycle. CR end-to-end chain validation. Cycle boundary audit checklist. VSR extended with Cycle History table.

Runtime governance contracts (v1.4)

Version 1.4 adds Phase 1-2 adoption from the competitive analysis: machine-readable trace (TRACE_LOG.md), eval flywheel (EVAL_RESULTS.md + Human Gate 2 EvalGate block in VALIDATION_SUMMARY.md), policy-as-code (POLICY.yaml + templates), failure taxonomy (FT-* codes on every VER-* record), and durable Human Gate checkpoints (CHECKPOINTS.md with resume_token linked to APPROVALS.md). Normative schema: docs/agile-v-runtime/01_SCHEMAS.md; copy templates from templates/agile-v/.

Control Matrix (CONTROL_MATRIX.yaml + templates)

The agile-v-control-matrix skill and templates add an operating control record for agentic execution. The control matrix defines:

• Data classes allowed and forbidden per task scope
• Allowed tools, forbidden tools, and tools requiring Human Gate approval
• Model/vendor constraints and external vendor policy
• Log storage location, retention, and redaction rules
• Max permissions per access dimension (file, network, database, credentials)
• Human Gates with durable checkpoint and approval requirements
• Required tests per risk level (L0–L4)
• Cost limits per run, per day, per month with overflow action
• Rollback strategy, required risk levels, and max rollback time
• Owners (business, technical, security, reviewer)

Quick start:

mkdir -p .agile-v
cp templates/agile-v/CONTROL_MATRIX.example.yaml .agile-v/CONTROL_MATRIX.yaml
# Edit owner, vendor/model, data class, tool rules, cost limits, rollback, and gates before active use.

Normative spec: docs/agile-v-runtime/02_CONTROL_MATRIX.md. Schema: templates/agile-v/CONTROL_MATRIX.schema.json. Consuming runtimes (e.g., agentic_agile_v) enforce the matrix via CLI, hooks, and CI gates.

Release baseline (v1.6)

Version 1.6 consolidates runtime governance adoption by shipping the repository-level runtime schema spec + templates and aligning core routing/docs for Eval Gate evidence and durable HITL workflow. See v1.6 release notes.

Compliance Hardening (v1.3)

Version 1.3 also includes compliance hardening based on a clause-by-clause audit against ISO 9001:2015, ISO 13485:2016, AS9100D, ISO 27001:2022, and GxP/GAMP 5. The compliance metadata has been updated from "ISO/GxP-Ready" to "ISO 9001 / ISO 27001 Aligned (Design Phase); GxP-Aware" to accurately reflect the scope.

Key additions:

• Risk Management (agile-v-core): RISK_REGISTER.md with severity matrix, risk categories (technical, process, compliance, security), and assessment rules per pipeline stage. Addresses ISO 9001 6.1, AS9100D 8.1.1.
• CAPA Protocol (agile-v-core): CAPA_LOG.md with root cause analysis (5-Whys), corrective action, preventive action, and effectiveness verification. Addresses ISO 13485 8.5, ISO 9001 10.1/10.2.
• Human Gate Approval Records (agile-v-core): APPROVALS.md with approver identity, role/authority, signature method, and evidence reference. Minimum requirements by regulatory context (non-regulated through ISO 13485). Addresses 21 CFR Part 11, Annex 11.
• AI Agent Security Controls (agile-v-core): LLM provider documentation in config.json (data residency, retention, training usage, confidentiality certification), data classification rules, agent access controls, and file integrity verification. Addresses ISO 27001 A.5.23, A.8.3.
• Periodic Review and Revalidation (agile-v-core): REVALIDATION_LOG.md with defined triggers (model change, runtime change, skill change, accumulated CRs, 12-month interval). Model version tracking in config.json. Addresses GxP/GAMP 5 periodic review.
• Quality Metrics and KPIs (compliance-auditor): 7 defined metrics (first-pass verification rate, defect density, requirement coverage, regression pass rate, CR cycle time, open CAPA count, traceability completeness) with trend analysis. Addresses ISO 9001 9.1, AS9100D 9