ph-inspector-seguridad
Access control, checks that fail open, credentials, database functions left executable by the public, secrets, endpoints with no rate limit, exposed personal data. Its yardstick is the OWASP Top 10:2025.
φρόνησις
Claude Code agents
Your project gets better every day, whether you look or not.
A technical team that looks where you can't: a different area every day, working out what hurts most, fixing it and checking nothing broke. It leaves you a PR and stops there. Merging is publishing, and that one is yours.
v2.5.0 · 11 October 2026
Where it comes from
Every rule in here cost a mistake.
Phronesis was born running a product in production: a marketplace with real users, real payments and daily deploys. For months these agents inspected it, fixed it and shipped it.
Every mistake they made ended up written into their instructions. When they were packaged up, the stack, the routes and the domain were stripped out; the judgement stayed.
- 161
- findings from the inspectors
- 181
- of 196 backlog items resolved
- 53
- deploys logged and verified
- 27
- lessons generalised
- 19
- rewrites of the deploy agent
That last number is the one that matters. An agent doesn't learn on its own: the only thing that persists is its instruction file. Every rewrite is a real mistake that got written down, and the agent reads it before every run: what it got wrong once, it doesn't get wrong again.
The name
φρόνησις in Greek, «FRÓ-nē-sis»
Knowing what to do, learned by doing.
Aristotle called it phronesis: practical wisdom, knowing what to do in a particular case. It doesn't come from a book; it is earned through experience, by getting things wrong and correcting them. That is what these agents keep in their instructions.
Aristotle, Nicomachean Ethics, Book VI
The cycle
A day's work, start to finish.
One run of /ph-ciclo does all of this end to end, and always finishes on a decision of yours.
- 01
Inspect
One area, following the day's rotation. If you've declared a business focus, it looks at that too.
- 02
Record
Findings go into a backlog versioned in your repo, after checking they're real.
- 03
Resolve
Up to four items on your integration branch, one commit each.
- 04
Validate
Typecheck, build and a smoke run with the server up. If something breaks, it fixes it or reverts the commit that caused it.
- 05
Leave you a PR
With everything that changed. You review, merge or reject. Merging is publishing; no agent does it for you.
The week
- MonSecurity
- TueSEO
- WedCode
- ThuUX
- FriAccessibility
- SatPerformance
- SunRest
If a day turns up nothing, it pays down a debt from your register instead. And if there's no debt it can pay on its own, it says so. It doesn't invent work to look busy.
One run
This is what a Wednesday looks like.
/ph-ciclo
wednesday · code · branch staging synced
ph-inspector-codigo: 6 findings, 2 dropped on opening the file
4 items resolved, one commit each
ph-validador-qa: typecheck ok · build ok · smoke ok
1 item needs a decision: it changes a visible price
PR #212 opened against main. Your turn.
The agents
Nineteen, across four plugins.
Install only the ones you need. The mejora plugin is the heart; the rest come in when they're needed.
mejora The continuous improvement loop
ph-inspector-seo
Per-route metadata, structured data, canonicals, sitemap and noindex agreeing with each other. Its yardstick is Google's documentation, not blogs.
ph-inspector-codigo
Your architecture, newborn duplication — the cheapest moment to unify — dead code, types.
ph-inspector-ux
Friction in the main flow, empty, loading and error states, microcopy. It works from Nielsen's heuristics and NN/g severity. It never decides product: that it leaves to you.
ph-inspector-a11y
WCAG 2.2 AA: contrast, focus lost when a modal closes, mouse-only controls, states that are never announced.
ph-inspector-performance
Core Web Vitals, bundle, images, N+1 queries, runtime CPU limits.
ph-inspector-negocio
Looks at what people did, not at the code. Bans percentages over fewer than 30 cases and delivers one finding, not a dashboard.
ph-validador-qa
Typecheck, build and a real smoke run. It holds a veto: fixes the obvious and reverts the rest.
ph-curador-memoria
Routes what was learned. Never copies, and keeps a ceiling of 20 active lessons.
ph-sintetizador-usabilidad
From notes of a user test to backlog items.
ops Deploys and routines
ph-gestor-deploy
The full protocol, with an inventory and a gate that waits for your word. Right before merging, it checks again whether anyone is still working, and if it lowers the risk, it tells you why.
ph-verificador-deploy
Checks that what's live is what you approved.
ph-vigilante-rutinas
Watches that the scheduled tasks are actually running.
ph-triage-correo
Sorts the project's mail by urgency and required action.
growth Getting users
ph-prospector
Prospects from public sources, categorised and with the address verified. It never invents a contact detail.
ph-copywriter
The personalised email, with an anti-blacklist checklist.
ph-estratega
Reviews the loop, watches sender reputation and delivers one to three improvements a day.
contenido What gets published
ph-director-arte
Checks every piece against the system and proposes how the style should evolve, with the results of what was already published in view.
ph-jefe-copy
Makes sure the text sounds like a person and not like generated marketing. It looks at which posts got saved and shared, not just liked.
The three rules
The three things none of them skip.
- A finding is a hypothesis, not a fact.
- Before reporting anything, the agent opens the file and checks the premise. A finding with all the right formatting can still be wrong.
- A finding is rarely alone.
- Before calling it unique, it looks for its siblings: the inverse action, the other copy of the same text, the other file with the same pattern.
- Hard constraints are off limits.
- Migrations, payments, authentication and permissions, deleting data. There the agent stops and asks you.
Honest limits
What it doesn't do, or does badly.
It's in the repo's README, and it's here for the same reason.
- It costs tokens. A cycle with inspection, resolution and build eats a real share of your plan. The four-item ceiling exists partly for that.
- GitHub's free runners run late. A cron can fire minutes or hours behind. Don't expect punctuality.
- Plenty of sites block datacentre IPs: a smoke run from GitHub Actions can come back falsely red.
- The agents read their configuration literally. An empty field produces abstention, not creativity. That's on purpose.
- It's written in Spanish. It works on projects in any language, but whoever moderates it has to read Spanish.
Install
It installs with one command.
It's added as a Claude Code plugin marketplace. Then /ph-iniciar reads your repo and writes the configuration.
/plugin marketplace add Clagoss/phronesis-v2