feat: ArcheFlow — multi-agent orchestration plugin for Claude Code

Zero-dependency Claude Code plugin using Jungian archetypes as
behavioral protocols for multi-agent orchestration.

- 7 archetypes (Explorer, Creator, Maker, Guardian, Skeptic, Trickster, Sage)
- ArcheHelix: rising PDCA quality spiral with feedback loops
- Shadow detection: automatic dysfunction recognition and correction
- 3 built-in workflows (fast, standard, thorough)
- Autonomous mode: unattended overnight sessions with full visibility
- Custom archetypes and workflows via markdown/YAML
- SessionStart hook for automatic bootstrap
- Examples for feature implementation and security review

examples/custom-workflow.yaml

@@ -0,0 +1,26 @@
+# Example: Custom workflow definition
+# Save as .archeflow/workflows/api-design.yaml in your project
+
+name: api-design
+description: "API-first workflow with contract validation and adversarial testing"
+
+# The ArcheHelix configuration
+archehelix:
+  plan:
+    archetypes: [explorer, creator]
+    parallel: false  # sequential: Explorer feeds Creator
+  do:
+    archetypes: [maker]
+    parallel: false
+  check:
+    archetypes: [guardian, skeptic, trickster]
+    parallel: true   # all reviewers run simultaneously
+  act:
+    exit_when: all_approved
+    max_cycles: 2
+    feedback_format: diff  # pass only the delta between cycles
+
+# Optional: final gate runs once after all cycles pass
+final_gate:
+  archetypes: [sage]
+  description: "Final holistic review before merge"

examples/feature-implementation.md

@@ -0,0 +1,44 @@
+# Example: Feature Implementation (Standard ArcheHelix)
+
+## Task
+"Add rate limiting to the API authentication endpoint"
+
+## How ArcheFlow Handles It
+
+### Cycle 1
+
+**Plan Phase:**
+1. Explorer researches: finds the auth handler, discovers no existing rate limit middleware, notes the Redis connection already exists, identifies 3 routes that need protection
+2. Creator proposes: use token bucket algorithm via Redis, add middleware at route level, 100 req/min per IP, return 429 with Retry-After header
+
+**Do Phase:**
+3. Maker implements in worktree: writes rate-limit middleware, adds tests (happy path, rate exceeded, Redis down fallback), commits incrementally
+
+**Check Phase (parallel):**
+4. Guardian reviews: APPROVED — finds no security issues, notes Redis fallback behavior is safe
+5. Skeptic challenges: WARNING — "What about distributed deployments with multiple Redis instances?" Suggests adding a note about Redis cluster configuration
+6. Sage reviews: REJECTED — test for Redis-down scenario doesn't actually simulate Redis failure, it mocks the entire middleware
+
+**Act:** Rejected (1 critical quality issue). Feed findings back.
+
+### Cycle 2
+
+**Plan Phase:**
+7. Creator revises: update test strategy to use actual Redis disconnect simulation, add Redis cluster note to README
+
+**Do Phase:**
+8. Maker implements fixes in new worktree: rewrites Redis-down test to kill the connection, adds documentation
+
+**Check Phase:**
+9. Guardian: APPROVED
+10. Skeptic: APPROVED (cluster concern addressed in docs)
+11. Sage: APPROVED (tests now simulate real failure)
+
+**Act:** All approved. Merge.
+
+## Result
+- 4 files changed, +180 -5 lines
+- 8 tests added (including real Redis failure simulation)
+- Rate limiting active on 3 auth routes
+- Documentation updated
+- 2 ArcheHelix cycles, standard workflow

examples/security-review.md

@@ -0,0 +1,58 @@
+# Example: Security Review (Thorough ArcheHelix)
+
+## Task
+"Review the new file upload endpoint for security issues"
+
+## Workflow: thorough (3 cycles max, all reviewers)
+
+### Cycle 1
+
+**Plan Phase:**
+1. Explorer maps the upload flow: multipart parsing → temp storage → virus scan → permanent storage → DB record
+2. Creator identifies review focus areas: file type validation, path traversal, size limits, content-type sniffing
+
+**Do Phase:**
+3. Maker writes security test suite covering all identified vectors
+
+**Check Phase (all 4 reviewers, parallel):**
+4. Guardian: REJECTED
+   - CRITICAL: No file extension allowlist — user can upload .php, .sh, .exe
+   - CRITICAL: Temp directory uses predictable naming (race condition for symlink attack)
+   - WARNING: Missing Content-Disposition header on download (XSS via HTML files)
+5. Skeptic: REJECTED
+   - CRITICAL: "What if the virus scanner is down?" — no circuit breaker, uploads just pass through
+6. Sage: APPROVED with warnings
+   - WARNING: Upload handler is 200 lines — should be split into validation, storage, and recording
+7. Trickster: REJECTED
+   - CRITICAL: Uploaded a 0-byte file with `.jpg` extension → 500 error (null pointer in image processor)
+   - CRITICAL: Uploaded file named `../../etc/passwd` → path traversal confirmed
+
+**Act:** 4 CRITICAL findings. Cycle again.
+
+### Cycle 2
+
+After Creator revises and Maker fixes all findings...
+
+4. Guardian: APPROVED — allowlist active, temp dir uses crypto random, Content-Disposition set
+5. Skeptic: APPROVED — circuit breaker added, uploads rejected when scanner is down
+6. Sage: APPROVED — handler refactored into 3 modules
+7. Trickster: REJECTED
+   - WARNING: Unicode filename normalization issue — `file\u202e.jpg` displays as `gpj.elif` in some UIs
+
+**Act:** No CRITICAL. One WARNING from Trickster. Cycle once more.
+
+### Cycle 3
+
+8. Maker adds Unicode normalization for filenames
+9. All reviewers: APPROVED
+
+**Act:** Merge. Upload endpoint is secure.
+
+## Result
+- Path traversal fixed
+- File type allowlist added
+- Virus scanner circuit breaker added
+- Zero-byte file handling added
+- Unicode filename normalization added
+- 3 ArcheHelix cycles, thorough workflow
+- 5 CRITICAL findings caught before production