review-bot plugin: track commits instead of a pinned version; document org-wide rollout

[Deco354]

Note

Written by Claude Code at @Deco354's direction.

What changes

• plugins/review-bot/.claude-plugin/plugin.json: drops "version": "1.0.0", so installs track this repo's commits.
• README, "The fast path":
  • Members of the Sentient Futures Claude organization may already have the plugin.
  • Anyone who adds the marketplace by hand needs to turn auto-update on, or run /plugin marketplace update sentfutures.
• README, new "Making the plugin available to every member": a one-time step for an Owner of the Sentient Futures Claude organization. It covers:
  • the managed-settings JSON that registers the sentfutures marketplace and enables review-bot@sentfutures for every member, with auto-update;
  • what members see, and how to check on a machine;
  • four caveats.
• CLAUDE.md: why plugin.json has no version, so nobody pins one again.

Why

Installs haven't been updating. Claude Code updates a plugin only when its computed version changes, and "a manifest that pins "version": "1.0.0" keeps every user on the cached copy until its author changes the string, however many commits they push" (code.claude.com/docs/en/plugins/loading, "Versions and updates").

• The version was set on 2026-08-20.
• install-review-bot changed four times after that: 32ebde2 (09-10, repos outside the org), 2a74a5c (09-21), f1e2e8a (09-29) and 27acf3f (09-30, the permission changes).
• Anyone who installed in August has had the August skill since.
• Auto-update is also off by default for marketplaces that aren't Anthropic's.
• I haven't checked this against a real install, because none was at hand. The docs are explicit about it.

Nobody can find the plugin. On 2026-10-09 this README was the only place that mentioned it:

• a code search of the org found no other repo naming it;
• no repo's .claude/settings.json registers the marketplace;
• the org has no profile page;
• the README had 4 unique visitors in the previous 14 days.

Members sign in through the Sentient Futures Claude Enterprise organization, so server-managed settings are the documented way to put the plugin in front of everyone. Two other routes don't fit:

• claude.ai's "Plugins & skills" sync requires the marketplace repository to be private or internal, and this repo must stay public.
• A repo's .claude/settings.json only loads the plugin in that repo, but /install-review-bot is needed in repos that don't have the bot yet.

How to test

• claude plugin validate . passes. Its one warning is "No version specified", which is the intended state.
• After merge, on a machine that installed the plugin before: run /plugin marketplace update sentfutures, then claude plugin list. The review-bot version changes from 1.0.0 to a commit-derived value, and install-review-bot's SKILL.md under ~/.claude/plugins/cache/sentfutures/review-bot/ matches main.
• After an Owner saves the managed settings: a member restarts Claude Code. /plugin lists review-bot@sentfutures as installed and managed, and claude doctor's Managed settings (remote) line says the settings loaded.

[claude]

This PR drops the pinned "version": "1.0.0" from the review-bot plugin.json so installs track commits. It adds a README runbook for rolling the plugin out org-wide through managed settings, and a matching note in CLAUDE.md.

I found no bugs or CLAUDE.md violations.

• Nothing else pins a version. marketplace.json and the rest of plugins/ have no version field, so removing it from plugin.json is enough for the commit-based version to take effect.
• The change doesn't touch .github/workflows/, callers/ or the skill paths that /install-review-bot fetches, so the v1 changelog rule doesn't apply.
• The managed-settings JSON is well-formed and uses the documented extraKnownMarketplaces and enabledPlugins keys. The caveats on strictKnownMarketplaces, the public-repo requirement and the CI-account scope are accurate and match the repo's constraints.

One thing to confirm before an Owner follows the new README section: the claims about no member approval dialog and about the one-hour refresh in running sessions are stated as fact. They can only be checked against the linked docs or on a real member machine.

[claude]

This PR removes the pinned version from plugin.json, so plugin installs track repo commits, and documents the org-wide managed-settings rollout in the README. Nothing it changes touches the workflows, the verify step, the allowlist or the input surface.

I found no bugs or CLAUDE.md violations. Removing version leaves plugin.json valid JSON: name, description and author remain, and the preceding line still ends in a comma. The new CLAUDE.md note explains why the version is gone and when it could return. The README additions use the dated, observed-incident style the repo asks for, and they keep the "this repo must stay public" constraint, which is why the claude.ai Plugins & skills sync is ruled out.

I couldn't check the managed-settings keys against Claude Code's current behavior (extraKnownMarketplaces with autoUpdate, enabledPlugins, and the claim that members see no approval dialog). It's worth confirming them once on a test member account before announcing the rollout.