chore(deps): update agent skills (plugins/agentic-engineering/skills/product-engineering)

.claude-plugin/marketplace.json

@@ -27,7 +27,7 @@
     {
       "name": "agentic-engineering",
       "description": "The autonomous engineering system for repository portfolios — engineer, read-only surveyor, and meta-engineer agents; portfolio, product, spend, and improvement workflows; cross-tool instruction architecture and skill discovery; configured by the consumer AGENTS.md",
-      "version": "6.6.1",
+      "version": "6.6.2",
       "source": "./plugins/agentic-engineering"
     },
     {

.github/plugin/marketplace.json

@@ -27,7 +27,7 @@
     {
       "name": "agentic-engineering",
       "description": "The autonomous engineering system for repository portfolios — engineer, read-only surveyor, and meta-engineer agents; portfolio, product, spend, and improvement workflows; cross-tool instruction architecture and skill discovery; configured by the consumer AGENTS.md",
-      "version": "6.6.1",
+      "version": "6.6.2",
       "source": "./plugins/agentic-engineering"
     },
     {

plugins/agentic-engineering/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agentic-engineering",
   "description": "The autonomous engineering system for repository portfolios — engineer, read-only surveyor, and meta-engineer agents; portfolio, product, spend, and improvement workflows; cross-tool instruction architecture and skill discovery; configured by the consumer AGENTS.md",
-  "version": "6.6.1",
+  "version": "6.6.2",
   "author": {
     "name": "devantler-tech",
     "url": "https://github.com/devantler-tech"

plugins/agentic-engineering/CHANGELOG.md

@@ -21,6 +21,10 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 new one before re-enabling unattended writes. Stopping early resumes writes with the retired FinOps
 schedule still armed, or with a schedule pointing at an entrypoint that no longer resolves.
 
+## 6.6.2 — 2026-10-18
+
+**Changed** — sync `product-engineering` from `https://github.com/devantler-tech/agent-skills` at `refs/tags/v1.27.0`.
+
 ## 6.6.1 — 2026-10-18
 
 **Changed** — sync `portfolio-maintenance` from `https://github.com/devantler-tech/agent-skills` at `refs/tags/v1.27.0`.

plugins/agentic-engineering/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agentic-engineering",
   "description": "The autonomous engineering system for repository portfolios — engineer, read-only surveyor, and meta-engineer agents; portfolio, product, spend, and improvement workflows; cross-tool instruction architecture and skill discovery; configured by the consumer AGENTS.md",
-  "version": "6.6.1",
+  "version": "6.6.2",
   "author": {
     "name": "devantler-tech",
     "url": "https://github.com/devantler-tech"

plugins/agentic-engineering/skills/product-engineering/SKILL.md

@@ -3,9 +3,9 @@ description: 'The ADVANCE playbook for an autonomous AI engineer — how to move
 license: Apache-2.0
 metadata:
     github-path: product-engineering
-    github-ref: refs/tags/v1.26.0
+    github-ref: refs/tags/v1.27.0
     github-repo: https://github.com/devantler-tech/agent-skills
-    github-tree-sha: 328d7937ebdbed48cc2e21282f4bab8be2d7560b
+    github-tree-sha: dd465837330087614a8f2f0d6e290db3cd82fe8e
 name: product-engineering
 ---
 # Product engineering — moving products forward
@@ -246,6 +246,12 @@ Docs are part of the product.
 Treat live security findings as first-class advance work, with the same evidence discipline as
 coverage and performance.
 
+For hosted security and code-quality findings and feature-adoption drift, use the existing
+portfolio intake's [posture procedure](../portfolio-maintenance/references/security-and-quality-posture.md).
+It supplements this fix-versus-except policy without creating another priority queue.
+If the companion reference is unavailable, resolve the consumer's maintained equivalent before
+activation or posture claims; missing cost, privacy or coverage evidence remains unknown.
+
 - **Ingest liveness-first.** Findings come from the product's live scanners/gates (named in its
   card). **A zero/empty reading is a broken scanner until proven otherwise** — a broken scanner and
   a compliant system read identically, so verify the scanner produces data before trusting any