harness-maintenance-auditlisted

Audit this plugin repo for two kinds of rot: documentation that no longer matches the shipped plugin, and internal bookkeeping that has leaked into files users receive. Derives every fact from the artifact itself — enums from the schema, counts from the filesystem, hook behavior by executing the hook — then fixes the docs and reports code defects separately. Use this whenever maintaining this repository: before a release or version bump, after removing/renaming/adding a skill, operation, hook or command, after any commit that touches `skills/`, `hooks/`, `commands/`, `schemas/` or `docs/`, and whenever the user asks to "check the docs are current", "audit for drift", "make sure the plugin is clean", "does the documentation match", "is anything out of date", or wants a consistency/parity check between code and documentation. Also use it proactively before committing a refactor that deletes or renames anything, because the blast radius of a cleanup commit is routinely wider than its message claims.
nguyenvanphituoc/shapeup-sdlc-plugin · ★ 2 · AI & Automation · score 68

Install: claude install-skill nguyenvanphituoc/shapeup-sdlc-plugin

# Harness maintenance audit ## What rots, and why it rots silently This repo has an unusual shape that produces two specific failure modes. **It is a product and its own blueprint.** `docs/` describes a plugin that `skills/`, `hooks/`, `commands/` and `oracles/` actually implement. Both are prose-heavy, both are edited by hand, and nothing mechanically ties a sentence in `docs/design/03-system-design.md` to the enum it describes. So the docs drift, and they drift *plausibly* — a doc that says "11 workers" over a 10-member enum reads perfectly. **Not everything in the repo is product.** Development artifacts — benchmark numbers, internal defect IDs, migration stage names, audit codenames, paths under `docs/`, `tests/`, `tools/`, `evals/` — belong in the repo but not in what a user reads as the product. They leak easily, because the person writing a code comment is holding all that context and it feels like useful rationale at the time. The leak that matters most is not in a code comment. `skills/*/SKILL.md` and `skills/tech-lead/references/*.md` are **loaded by the model at runtime**, so a dangling `docs/migration/...` pointer there is a broken instruction handed to the orchestrator mid-run — the file does not exist in an installed plugin. `references/forbidden-content.md` ranks the severity tiers and, importantly, defines what "shipped" means: there are **two delivery channels**, and the `files` allowlist governs only one of them. Both are invisible to the test suite an