Epic: plugin fleet conformance audit — 50-plugin doctrine matrix and remediation waves

[kyle-sexton]

Fleet-wide conformance audit of all 50 plugins against the landed plugin doctrine (#257 doctrine wave, #292 topic-docs contract 2.0.0, #310 marketplace metadata wave). Every plugin was scored by an independent worker against a frozen 15-dimension rubric with anchored PASS/FAIL criteria; a 3-plugin blind double-score sample reconciled with exact agreement. Remediation is organized into the five wave sub-issues below; this epic is the index and the durable record.

Dimensions

1 boundary · 2 naming · 3 native-first · 4 component-stance · 5 hooks-exec-form · 6 userconfig · 7 version/changelog · 8 setup-contract · 9 prereq-degradation · 10 cross-platform · 11 registry · 12 pointer-discipline · 13 metadata · 14 freshness · 15 security. Cells: P pass · F fail · - not applicable.

Conformance matrix

Plugin	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15
actionlint	P	-	F	P	P	F	F	F	F	F	P	-	P	P	P
ai-briefing	P	P	P	P	-	P	P	F	P	F	-	-	P	F	P
architecture	P	P	P	P	-	-	P	P	P	P	P	P	P	-	P
bash-format	P	-	F	P	P	F	P	F	F	P	P	-	P	-	P
biome-format	P	-	P	P	P	P	F	F	P	P	P	-	P	-	P
bug-report	P	P	P	P	-	P	P	F	P	P	-	P	P	P	P
claude-config	P	F	P	P	-	P	P	F	P	P	P	-	P	P	P
claude-memory	P	F	P	P	-	P	P	P	P	P	P	P	P	P	P
claude-ops	P	F	P	P	P	P	P	F	P	P	P	P	P	F	P
code-tidying	P	F	P	P	-	P	P	F	P	F	F	P	P	-	P
codebase-health	P	F	P	P	-	P	P	F	P	P	P	-	P	-	P
context7	P	P	P	P	-	P	P	F	P	P	P	P	P	F	P
debugging	P	P	P	P	-	P	P	P	P	P	P	P	P	-	P
desktop-notification	P	-	F	P	P	F	F	F	F	P	P	-	P	F	P
discovery	P	P	P	P	-	P	P	F	P	P	P	-	P	-	P
disk-hygiene	P	P	F	P	P	F	F	F	P	P	P	-	P	P	P
docs-hygiene	P	P	P	P	-	P	P	P	F	P	P	P	P	-	P
domain-driven-design	P	F	P	P	-	-	P	P	P	P	P	P	P	-	P
education	P	P	P	P	-	P	F	P	P	F	-	P	P	-	P
eol-normalizer	P	-	F	P	P	F	F	F	F	P	P	-	P	-	P
event-storming	P	P	P	P	-	P	P	P	P	F	P	P	P	P	P
firecrawl	P	P	P	P	-	P	F	F	P	P	P	-	P	P	P
guardrails	P	-	F	P	P	F	F	F	P	P	P	-	P	P	P
implementation	P	P	P	P	-	P	P	P	P	P	P	P	P	-	P
kindle-dedrm	P	F	P	P	-	P	F	F	F	P	-	-	P	P	F
knowledge	P	P	F	P	-	F	P	F	F	P	P	P	P	P	P
machine-health	P	P	P	P	-	P	P	F	P	P	P	P	P	P	P
markdown-format	P	-	F	P	P	F	P	F	P	P	P	-	P	-	P
mcp-tools	P	P	P	P	-	-	F	P	P	F	-	-	P	P	P
miro	P	P	P	P	-	P	F	F	P	P	-	-	P	P	P
naming	P	P	P	P	-	-	P	P	-	P	P	P	P	-	P
planning	P	P	P	P	-	F	P	F	P	P	P	P	P	P	P
playbooks	P	F	P	P	-	P	P	P	P	P	-	P	P	P	P
playwright	P	P	P	P	-	P	F	F	P	P	-	P	P	P	P
powershell-format	P	P	F	P	P	F	F	F	P	P	P	-	P	-	P
prototype	P	F	P	P	-	P	P	P	P	F	P	P	P	-	P
re-anchor	P	P	P	P	-	-	P	P	P	P	P	P	P	-	P
repo-fleet-hygiene	P	P	P	P	-	P	P	F	P	P	P	-	P	P	P
repo-hygiene	P	P	F	P	P	F	F	P	P	F	P	-	P	-	P
review	P	P	P	P	-	P	P	P	F	P	P	-	P	P	P
ruff-format	P	-	F	P	P	F	F	F	F	P	P	-	P	-	P
session-flow	P	P	P	P	-	P	P	P	P	P	F	P	P	P	P
skill-quality	P	P	P	P	-	P	P	F	P	P	P	-	P	F	P
songwriting	P	F	P	P	-	P	P	F	P	P	-	-	P	F	P
source-control	P	P	F	P	-	F	P	F	F	P	P	P	P	P	P
tdd	P	P	P	P	-	-	P	P	-	P	-	-	P	-	P
testing	P	F	P	P	-	P	P	P	P	P	P	P	P	P	P
toolchain	P	P	P	P	-	P	P	F	P	P	P	-	P	-	P
verification	P	P	P	P	-	P	P	P	P	P	P	P	P	F	P
work-items	P	P	P	P	-	P	P	F	F	F	P	P	P	-	P

Fleet summary

• Fully conformant (0 FAIL): architecture, debugging, implementation, naming, re-anchor, tdd.
• FAIL counts by dimension: setup contract (dim 8): 31 · CHANGELOG absent (dim 7): 15 · env-channel config where userConfig fits (dims 3+6): 12 · naming grammar (dim 2): 11 · prereq silent-skip/undeclared (dim 9): 11 · cross-platform declaration (dim 10): 10 · freshness riders (dim 14): 7 · registry restating (dim 11): 2 · security (dim 15): 1.
• Zero FAILs fleet-wide on boundary (1), component stances (4), hook exec form (5), pointer discipline (12), and marketplace metadata (13) — the last two are the dimensions the docs(topic-docs): ship contract 2.0.0 — visibility guarantees + seam fixes R1-R6 #292 and docs(marketplace): metadata wave — relevance signals, default enablement, display names #310 waves just shipped.
• Blind double-score sample (3 plugins, independent workers): exact verdict agreement on all 45 dimension cells.

Doctrine-update findings (fix the doctrine, not the plugins)

1. Kill-switch tension: the philosophy doc mandates migrating env toggles to userConfig, while the migration playbook endorses HOOK_<PLUGIN>_ENABLED as the ecosystem norm and its security review checks that it exists. One line of reconciliation needed (which scalars migrate vs which gate stays) — the userConfig wave depends on it.
2. Registry row missing: the repository-standards convention (landed with feat: ground planning and review skills in consumer standards (V1 pilot) #291, with a live synced consumer in planning) is absent from the philosophy doc's convention-registry table.
3. Generated-surface wording: the topic-docs contract's ".claude/observability/ is the sole sanctioned generated surface under .claude/" is contradicted by the platform's native subagent memory: project|local feature (.claude/agent-memory[-local]/). Reconcile the contract wording.
4. Dependency-intent check: planning declares domain-driven-design as a hard dependency while its own README frames every skill as standalone — confirm hard-require intent or downgrade to presence-gated collaboration.

Windows sensitive userConfig — blocked upstream

Empirically verified on Windows 11 (Claude Code 2.1.212): a sensitive: true userConfig value persists as plaintext in ~/.claude/.credentials.json (pluginSecrets key); no Credential Manager entry is created (consistent with the documented no-supported-keychain fallback; the value is removed on uninstall). Consequence: secret-bearing scalars are excluded from the userConfig wave until upstream keychain support lands on Windows. Non-secret migrations proceed.

Deferred CI-gate backlog (automatable checks the audit surfaced)

Per-plugin CHANGELOG presence · no version in marketplace entries · no commands/ directories · no plugin settings.json agent · HOOK_*_ENABLED grep (post-migration regression guard) · frontmatter name = skill directory name · topic-docs delta-doc ↔ Implementers-table parity · README prerequisites section presence for plugins whose scripts call jq/gh/bash.

Wave sub-issues

Filed as sub-issues of this epic: setup-contract, userConfig, changelog+freshness, prereq+cross-platform, naming+convention-seam.

🤖 Generated with Claude Code