verification: bare unguarded cross-plugin references to dotnet-*/cloudflare plugins in measure contexts

[kyle-sexton]

Plugin: verification · Categories: hardcoded opinion (1), missing seam guard (2)
Source: work-readiness sweep (read-only audit vs docs/PLUGIN-PHILOSOPHY.md + docs/MIGRATION-PLAYBOOK.md)

Findings

• plugins/verification/skills/measure/context/metrics.md:68-72 — dotnet-test:crap-score, dotnet-test:test-anti-patterns, dotnet-data:optimizing-ef-core-queries
• plugins/verification/skills/measure/context/performance.md:61-66 — dotnet-diag:analyzing-dotnet-performance, dotnet-diag:microbenchmarking, dotnet-msbuild:build-perf-baseline, cloudflare:web-perf

Why it breaks the repo's rules

PLUGIN-PHILOSOPHY "Design boundary": every cross-plugin reference must be declared (dependencies) or guarded behind an "if installed" check with a documented fallback — "a bare unguarded cross-plugin reference is a defect." These are named as available evidence sources with NO presence gate and NO fallback — unlike the correctly gated /toolchain:*, /testing:run-e2e, /review:quality-gate refs elsewhere in the same plugin. Compounding: they assume a .NET consumer, and none of these plugins exist in this marketplace (verified during this sweep — no plugins/dotnet*, no marketplace.json entries). Related pattern already filed for implementation (#405) and toolchain (#412).

Fix direction

Presence-gate each ("when the dotnet-diag plugin is installed …, else run the project's own harness") with a stack-neutral fallback, or demote to a generic "use the project's complexity/coverage/benchmark tooling" statement.

[kyle-sexton]

This was generated by AI during triage.

Triage → needs-human. Part of the dotnet-* existence cluster with #412 (and #405). The stated fix (presence-gate each ref, or demote to a generic "use the project's own tooling" statement) turns on a product-intent question that isn't codebase-derivable: do the dotnet-* plugins exist in a private/planned marketplace, or are the refs stale? Presence-gating a plugin that can never be installed is hollow, so the demote-to-generic path is likely right — but that's a judgment on dropping named tooling. Decide alongside #412. Priority: high.

[kyle-sexton]

This was generated by AI during triage. · Category: hardcoded opinion + missing seam guard · Priority: priority: high (verification is north-star; this is an actual PLUGIN-PHILOSOPHY rule violation, not just coupling). Self-labeled severity: higher than sibling #405/#412 — these refs are bare and unguarded, a defect by the repo's own rule. Routed status: ready.

Plan (fix pattern; 2 surfaces)

Unlike #405/#412 (correctly presence-gated), the measure context refs are bare — named as available evidence sources with NO "if installed" gate and NO fallback, which PLUGIN-PHILOSOPHY "Design boundary" defines as a defect. Fix each to match the correctly-gated /toolchain:*, /testing:run-e2e, /review:quality-gate refs already in the same plugin.

Sites + fix pattern:

• measure/context/metrics.md (dotnet-test:crap-score, dotnet-test:test-anti-patterns, dotnet-data:optimizing-ef-core-queries)
• measure/context/performance.md (dotnet-diag:*, dotnet-msbuild:build-perf-baseline, cloudflare:web-perf)
• Pattern: wrap each cross-plugin reference in a presence gate with a stack-neutral fallback — "when the <plugin> plugin is installed …, else run the project's own complexity/coverage/benchmark/perf harness" — or demote to the generic "use the project's own tooling" statement.

These dotnet-* names are forward references to the planned .NET plugin family (#501) — none exists in this marketplace yet — so the gate can only open once #501 lands; until then the stack-neutral fallback is what actually runs. Add a provenance note pointing at #501 so the refs read as anticipated, not stale.

Acceptance

• No bare cross-plugin reference remains in measure contexts; each is presence-gated with a documented stack-neutral fallback (or demoted to generic tooling language).
• A non-.NET consumer gets working measure guidance with zero dotnet-*/cloudflare plugin installed.

Decision defaulted: presence-gate each ref with a stack-neutral fallback (mirroring the plugin's already-correct gated refs), noting #501 as the forward-reference target — rather than deleting the .NET names outright — veto before merge