backlog: triage the 32 deferred findings — 15 fixed, 13 already closed

.claude-plugin/marketplace.json

@@ -2,13 +2,19 @@
   "name": "deepgrade-marketplace",
   "description": "Developer toolkit for codebase auditing, AI-readiness scanning, structured planning, and operational readiness. Four plugins, one lockstep release. Works on any stack.",
   "owner": {
-    "name": "Kyle Whynot",
-    "email": "krwhynot@github.com"
+    "name": "Kyle Whynot"
   },
   "plugins": [
     {
       "name": "deepgrade",
       "description": "9-phase planning with an adversarial verifier-first audit gate, plan-linked troubleshooting, and documentation generation.",
+      "category": "development",
+      "tags": [
+        "planning",
+        "audit-gate",
+        "troubleshooting",
+        "documentation"
+      ],
       "source": {
         "source": "git-subdir",
         "url": "https://github.com/krwhynot/deepgrade.git",
@@ -20,6 +26,12 @@
     {
       "name": "deepgrade-readiness",
       "description": "AI-readiness scanning: 52 checks, 9 categories, composite letter grade, generated scaffolding for the gaps.",
+      "category": "development",
+      "tags": [
+        "ai-readiness",
+        "codebase-grading",
+        "scanning"
+      ],
       "source": {
         "source": "git-subdir",
         "url": "https://github.com/krwhynot/deepgrade.git",
@@ -31,6 +43,13 @@
     {
       "name": "deepgrade-audit",
       "description": "Severity-graded codebase audits, security scans, delta/KPI tracking, characterization tests, generated CI gates.",
+      "category": "development",
+      "tags": [
+        "audit",
+        "codebase",
+        "security",
+        "quality-gates"
+      ],
       "source": {
         "source": "git-subdir",
         "url": "https://github.com/krwhynot/deepgrade.git",
@@ -42,6 +61,13 @@
     {
       "name": "deepgrade-guard",
       "description": "Always-on safety hooks: force-push and DB-deploy blocking, migration protection, change/test tracking, session summaries.",
+      "category": "development",
+      "tags": [
+        "safety",
+        "hooks",
+        "git-guard",
+        "migration-guard"
+      ],
       "source": {
         "source": "git-subdir",
         "url": "https://github.com/krwhynot/deepgrade.git",

CHANGELOG.md

@@ -10,6 +10,29 @@
   single long command loses its later phases after context compaction in
   exactly the long sessions a nine-phase workflow produces. Tests that read
   Phase 5 content now point at `phases/phase-5-audit.md`.
+- The `(deepgrade)` description prefix is stripped from all 23 commands and
+  skills. After the monorepo split it mislabelled 11 files owned by
+  deepgrade-audit and deepgrade-readiness.
+- Marketplace entries carry `category` and `tags`; the non-deliverable
+  owner email is removed.
+
+### Fixed
+- Backlog triage of the 32 low/info findings recorded against 4.31.0: 13 were
+  already closed by the hardening work; 15 fixed here. Scanner "Output"
+  sentences un-garbled in all 8 readiness scanners; database-scanner check 9.1
+  name matches its contract; plan-auditor steps renumbered 1-7 and its subagent
+  count corrected to 5; gate-generator's duplicate Step 4.5 is now 4.6; every
+  `<valid_commands>` block regenerated from the real 17-entry surface; help.md
+  drops the dead `/tp`, lists the plan skill, and namespaces its documentation
+  examples; the phantom `plan-review.js` reference is gone; two agents no longer
+  read a `$ARGUMENTS` that is never substituted; the documentation skill no
+  longer carries a literal positional placeholder in its body; the two long
+  templates have a Contents list; mcp-research drops a baked-in date;
+  METHODOLOGY.md stops describing the removed bash PATH preamble as current.
+- Stop hooks (guard session-stop, deepgrade subagent-stop) exit silently when
+  `stop_hook_active` is set, so a continued turn cannot re-post the summary.
+  The session-stop hook also sweeps tracker files from other sessions older
+  than a day; before this they accumulated in TMPDIR forever.
 
 ### Internal
 - CR-7 (owner-ratified): the U7 compatibility-floor requirement is descoped.

METHODOLOGY.md

@@ -980,7 +980,7 @@ Node gives real `JSON.parse`, so a named field can be extracted rather than gues
 
 The concern that motivated the old design still stands: a security guard that fails to install is worse than no guard, because it creates a false sense of safety. v5.0.0 answers it differently. Rather than degrade quietly to a weaker parser, a host that cannot run the guards produces a visible hook error on every guarded event. You are told the safety layer is absent instead of being left to assume it is working.
 
-On Windows, where Claude Code runs in Git Bash, `jq` installed via `winget` lands in `$LOCALAPPDATA/Microsoft/WinGet/Links/`, a path Git Bash does not include by default. Every hook starts with `export PATH="$PATH:$LOCALAPPDATA/Microsoft/WinGet/Links:/usr/local/bin"` to ensure `jq` is discoverable regardless of installation method.
+Since v5.0.0 every hook is a Node script launched in exec form (`node ${CLAUDE_PLUGIN_ROOT}/scripts/dg-*.js`), so there is no shell PATH preamble and no `jq` dependency. The v4.x hooks were bash one-liners that prepended `$LOCALAPPDATA/Microsoft/WinGet/Links` to PATH so a winget-installed `jq` could be found under Git Bash; that preamble also broke under Git Bash because the Windows path contains a colon.
 
 ### Security Guards Must Never Fail-Open
 
@@ -1731,7 +1731,7 @@ That is the failure mode we designed the current system to prevent.
 
 ### The Current Solution: Graceful Degradation
 
-The architecture that shipped in v4.27 uses a three-layer fallback chain. Every hook follows the same pattern.
+The architecture that shipped in v4.27 used a three-layer fallback chain, described here for the record. v5.0.0 replaced it with Node handlers and no preamble; the fail-closed principle survived, the mechanism did not.
 
 ```mermaid
 flowchart TD
@@ -1766,7 +1766,7 @@ flowchart TD
 
 The PATH preamble is the first key insight. On Windows, `winget` installs binaries to `$LOCALAPPDATA/Microsoft/WinGet/Links`, which Git Bash does not include in its default PATH. On macOS/Linux, `/usr/local/bin` is the standard location for user-installed tools. By prepending both before every `jq` call, we cover the most common "installed but invisible" scenarios.
 
-Source: [`.claude-plugin/plugin.json`](https://github.com/krwhynot/deepgrade/blob/main/.claude-plugin/plugin.json) -- every hook command begins with the PATH preamble.
+Source (historical, v4.x): the inline hook commands in `.claude-plugin/plugin.json` at that time. Current hooks live in `plugins/*/hooks/hooks.json` and `plugins/*/scripts/`.
 
 ### The Five Design Rules
 

plugins/deepgrade-audit/agents/characterization-generator.md

@@ -37,7 +37,7 @@ appropriate test project directory.
 <workflow>
 ## Step 1: Understand the Target
 
-Read $ARGUMENTS to determine what to characterize. The user may specify:
+Read the task description you were given to determine what to characterize. The user may specify:
 - A module name: "BusinessLogic" -> characterize all public methods
 - A file path: "POSetcPOS/ReportsDB.vb" -> characterize key functions in file
 - A specific function: "ReportsDB.GetSalesReport" -> characterize that function

plugins/deepgrade-audit/agents/gate-generator.md

@@ -255,7 +255,7 @@ IMPORTANT: The DO_NOT_TOUCH_ZONES array must be populated with ACTUAL paths
 from risk-assessment.md. Read the HIGH-risk modules and do-not-touch zones
 from the audit data. Do not use placeholder paths.
 
-## Step 4.5: Generate Baseline Tracker Script
+## Step 4.6: Generate Baseline Tracker Script
 
 Create .claude/scripts/baseline-tracker.sh:
 

plugins/deepgrade-audit/commands/codebase-audit.md

@@ -1,5 +1,5 @@
 ---
-description: (deepgrade) Run a full DeepGrade codebase audit using a team of specialized agents working in parallel. Produces a standardized report with severity-classified findings that any engineer can act on. Works on any stack (React/TypeScript, C#/.NET, Python, Rust, Go).
+description: Run a full DeepGrade codebase audit using a team of specialized agents working in parallel. Produces a standardized report with severity-classified findings that any engineer can act on. Works on any stack (React/TypeScript, C#/.NET, Python, Rust, Go).
 allowed-tools: Read, Write, Grep, Glob, Bash, Task
 ---
 

plugins/deepgrade-audit/commands/codebase-characterize.md

@@ -1,5 +1,5 @@
 ---
-description: (deepgrade) Generate golden master / characterization tests that capture current behavior of a module BEFORE refactoring. These tests verify that refactored code produces identical outputs. Critical for monolith decomposition. Pass a module name, file path, function name, or domain as the argument.
+description: Generate golden master / characterization tests that capture current behavior of a module BEFORE refactoring. These tests verify that refactored code produces identical outputs. Critical for monolith decomposition. Pass a module name, file path, function name, or domain as the argument.
 argument-hint: "[module|file|function|domain]"
 allowed-tools: Read, Write, Grep, Glob, Bash, Task
 ---

plugins/deepgrade-audit/commands/codebase-delta.md

@@ -1,5 +1,5 @@
 ---
-description: (deepgrade) Re-measure the codebase against previous audit baselines. Shows what improved, what regressed, tracks KPIs over time, and flags stale findings. Quick check (2-3 min) without running a full scan. Use after making changes to see if scores improved.
+description: Re-measure the codebase against previous audit baselines. Shows what improved, what regressed, tracks KPIs over time, and flags stale findings. Quick check (2-3 min) without running a full scan. Use after making changes to see if scores improved.
 allowed-tools: Read, Write, Grep, Glob, Bash, Task
 ---
 

plugins/deepgrade-audit/commands/codebase-gates.md

@@ -1,5 +1,5 @@
 ---
-description: (deepgrade) Generate CI quality gates, Claude Code hooks, and baseline maintenance nudges from DeepGrade audit findings. Creates automated checks that warn when HIGH-risk modules are modified, track file change counts, and nudge you when audit baselines go stale. Requires a Phase 2 audit to have been run first.
+description: Generate CI quality gates, Claude Code hooks, and baseline maintenance nudges from DeepGrade audit findings. Creates automated checks that warn when HIGH-risk modules are modified, track file change counts, and nudge you when audit baselines go stale. Requires a Phase 2 audit to have been run first.
 allowed-tools: Read, Write, Grep, Glob, Bash, Task
 disable-model-invocation: true
 ---

plugins/deepgrade-audit/commands/codebase-security.md

@@ -1,5 +1,5 @@
 ---
-description: (deepgrade) Run a security-focused scan on the codebase. Checks dependency vulnerabilities, hardcoded secrets, SSL configuration, injection risks, and permission patterns. Security is a separate control loop from the general audit. Pass an optional focus area to narrow the scan.
+description: Run a security-focused scan on the codebase. Checks dependency vulnerabilities, hardcoded secrets, SSL configuration, injection risks, and permission patterns. Security is a separate control loop from the general audit. Pass an optional focus area to narrow the scan.
 argument-hint: "[focus-area]"
 allowed-tools: Read, Write, Grep, Glob, Bash, Task
 ---

plugins/deepgrade-audit/skills/deepgrade-knowledge/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: deepgrade-knowledge
-description: (deepgrade) Knowledge about the DeepGrade methodology for codebase audit and documentation. Covers enterprise best practices for discovery, risk assessment, and report generation. Use when auditing a codebase, assessing module risk, classifying finding severity, writing an audit report, or deciding phase boundaries for remediation work.
+description: Knowledge about the DeepGrade methodology for codebase audit and documentation. Covers enterprise best practices for discovery, risk assessment, and report generation. Use when auditing a codebase, assessing module risk, classifying finding severity, writing an audit report, or deciding phase boundaries for remediation work.
 ---
 
 # DeepGrade Methodology

plugins/deepgrade-audit/skills/governance-knowledge/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: governance-knowledge
-description: (deepgrade) Knowledge about enterprise governance patterns, DORA metrics, quality gates, confidence decay, delta tracking, and characterization testing. Use when comparing a codebase against a previous baseline, setting up CI quality gates or pre-commit hooks, running a security scan, generating golden-master tests before a refactor, or deciding whether an old finding is still trustworthy.
+description: Knowledge about enterprise governance patterns, DORA metrics, quality gates, confidence decay, delta tracking, and characterization testing. Use when comparing a codebase against a previous baseline, setting up CI quality gates or pre-commit hooks, running a security scan, generating golden-master tests before a refactor, or deciding whether an old finding is still trustworthy.
 ---
 
 # Enterprise Governance Knowledge

plugins/deepgrade-audit/skills/self-audit-knowledge/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: self-audit-knowledge
-description: (deepgrade) Knowledge about LLM epistemic transparency, claim verification tiers, failure mode flags, cascade risk classification, and evidence basis formatting. Use when stating how confident a finding is, labelling a claim as verified or unverified, flagging an assumption, assessing whether one wrong conclusion invalidates others, or writing the evidence basis for an audit or plan review.
+description: Knowledge about LLM epistemic transparency, claim verification tiers, failure mode flags, cascade risk classification, and evidence basis formatting. Use when stating how confident a finding is, labelling a claim as verified or unverified, flagging an assumption, assessing whether one wrong conclusion invalidates others, or writing the evidence basis for an audit or plan review.
 ---
 
 # LLM Self-Audit Framework

plugins/deepgrade-guard/scripts/dg-session-stop.js

@@ -21,6 +21,9 @@ function notify(message) {
 
 let payload = null;
 try { payload = JSON.parse(fs.readFileSync(0, 'utf8')); } catch { payload = null; }
+// A Stop fired because a previous Stop hook already continued the turn. Emitting again
+// would re-post the same summary every cycle; exit before doing anything.
+if (payload && payload.stop_hook_active === true) quiet();
 
 
 // A session id is interpolated into a filename, so it is validated before use.
@@ -35,6 +38,19 @@ function safeSessionId(v) {
 const sessionId = safeSessionId(payload && payload.session_id);
 const tmp = process.env.TMPDIR || process.env.TEMP || os.tmpdir();
 
+// Tracker files (dg-baseline/dg-test/dg-build-<session>) were never removed, so they
+// accumulated in TMPDIR forever. This session's files stay (Stop fires per turn and the
+// runtime proof reads them afterwards); anything from other sessions older than a day
+// is swept. Fail-open: a sweep error must never affect the Stop verdict.
+try {
+  const cutoff = Date.now() - 24 * 60 * 60 * 1000;
+  for (const name of fs.readdirSync(tmp)) {
+    if (!/^dg-(baseline|test|build)-/.test(name) || name.endsWith('-' + sessionId)) continue;
+    const full = path.join(tmp, name);
+    try { if (fs.statSync(full).mtimeMs < cutoff) fs.unlinkSync(full); } catch {}
+  }
+} catch {}
+
 let text = '', obj = null;
 try { text = fs.readFileSync(path.join(tmp, `dg-baseline-${sessionId}`), 'utf8'); } catch { quiet(); }
 if (!text) quiet();

plugins/deepgrade-readiness/agents/baseline-scanner.md

@@ -62,8 +62,8 @@ find . -name "dependency-map.*" -o -name "feature-inventory.*" -o -name "api-sur
 Score: 0 = no machine-readable data, 1 = at least one structured data file
 
 **Output:**
-Write results as JSON to docs/audit/readability/baseline-scan.json following the COPY THE CHECK ID AND NAME FIELDS EXACTLY from the check list above. Do NOT rename any check. Fill in only score, evidence, and remediation values.
-standard scanner output schema with all 4 checks.
+Write results as JSON to docs/audit/readability/baseline-scan.json following the standard scanner output schema with all 4 checks.
+COPY THE CHECK ID AND NAME FIELDS EXACTLY from the check list above. Do NOT rename any check. Fill in only score, evidence, and remediation values.
 
 **Constraints:**
 - Read-only. Do not modify any source files.

plugins/deepgrade-readiness/agents/budget-scanner.md

@@ -425,8 +425,8 @@ Scoring:
 - 0 = 3+ anti-patterns (significant context waste)
 
 **Output:**
-Write results as JSON to docs/audit/readability/context-budget-scan.json following COPY THE CHECK ID AND NAME FIELDS EXACTLY from the check list above. Do NOT rename any check. Fill in only score, evidence, and remediation values.
-the standard scanner output schema with all 8 checks.
+Write results as JSON to docs/audit/readability/context-budget-scan.json following the standard scanner output schema with all 8 checks.
+COPY THE CHECK ID AND NAME FIELDS EXACTLY from the check list above. Do NOT rename any check. Fill in only score, evidence, and remediation values.
 
 Each check must include:
 - id, name, status, points, max, evidence, details, remediation

plugins/deepgrade-readiness/agents/context-scanner.md

@@ -263,8 +263,8 @@ Step 8 - Context coverage ratio (Check 2.4):
   ```
 
 **Output:**
-Write results as JSON to docs/audit/readability/context-scan.json following the COPY THE CHECK ID AND NAME FIELDS EXACTLY from the check list above. Do NOT rename any check. Fill in only score, evidence, and remediation values.
-standard scanner output schema with all 10 checks.
+Write results as JSON to docs/audit/readability/context-scan.json following the standard scanner output schema with all 10 checks.
+COPY THE CHECK ID AND NAME FIELDS EXACTLY from the check list above. Do NOT rename any check. Fill in only score, evidence, and remediation values.
 
 Each check must include:
 - id, name, status, points, max, evidence, details, remediation

plugins/deepgrade-readiness/agents/convention-scanner.md

@@ -96,8 +96,8 @@ ls .mcp.json mcp.json .claude/mcp.json 2>/dev/null
 Score: 0 = no MCP config, 1 = MCP config present
 
 **Output:**
-Write results as JSON to docs/audit/readability/convention-scan.json following the COPY THE CHECK ID AND NAME FIELDS EXACTLY from the check list above. Do NOT rename any check. Fill in only score, evidence, and remediation values.
-standard scanner output schema with all 7 checks.
+Write results as JSON to docs/audit/readability/convention-scan.json following the standard scanner output schema with all 7 checks.
+COPY THE CHECK ID AND NAME FIELDS EXACTLY from the check list above. Do NOT rename any check. Fill in only score, evidence, and remediation values.
 
 **Constraints:**
 - Read-only. Do not modify any source files.

plugins/deepgrade-readiness/agents/database-scanner.md

@@ -567,8 +567,8 @@ Scoring:
 ---
 
 **Output:**
-Write results as JSON to docs/audit/readability/database-scan.json following the COPY THE CHECK ID AND NAME FIELDS EXACTLY from the check list above. Do NOT rename any check. Fill in only score, evidence, and remediation values.
-standard scanner output schema.
+Write results as JSON to docs/audit/readability/database-scan.json following the standard scanner output schema.
+COPY THE CHECK ID AND NAME FIELDS EXACTLY from the check list above. Do NOT rename any check. Fill in only score, evidence, and remediation values.
 
 ```json
 {
@@ -585,7 +585,7 @@ standard scanner output schema.
   "checks": [
     {
       "id": "9.1",
-      "name": "Schema source of truth",
+      "name": "Schema source of truth exists",
       "priority": "critical",
       "status": "pass|partial|fail|skipped",
       "points": 0,

plugins/deepgrade-readiness/agents/entry-scanner.md

@@ -91,8 +91,8 @@ Score 4.5: 0 = no agents, 1 = 1-2 agents, 2 = 3+ agents
 - For route files, note whether routes are annotated with descriptions/docs
 
 **Output:**
-Write results as JSON to docs/audit/readability/entry-point-scan.json following the COPY THE CHECK ID AND NAME FIELDS EXACTLY from the check list above. Do NOT rename any check. Fill in only score, evidence, and remediation values.
-standard scanner output schema with all 5 checks.
+Write results as JSON to docs/audit/readability/entry-point-scan.json following the standard scanner output schema with all 5 checks.
+COPY THE CHECK ID AND NAME FIELDS EXACTLY from the check list above. Do NOT rename any check. Fill in only score, evidence, and remediation values.
 
 **Constraints:**
 - Read-only. Do not modify any source files.