docs(plugins): drop unreachable repo-root LICENSE pointer from final 13 READMEs (wave 3)

[kyle-sexton]

Closes #537 — final wave; repo-wide repro grep (at the root of|root of (the )?melodic) returns zero across all plugins/*/README.md on this branch.

Same recipe as waves 1–2 (PR #755, #758): delete the dangling pointer sentence, keep inline MIT (SPDX-License-Identifier: MIT), patch bump + CHANGELOG per plugin. Guardrails (0.9.2→0.9.3) and work-items (0.17.1→0.17.2) stack above entries that landed on main mid-flight (#759 home-gate fix; #753 linked-PR pagination) — conflicts resolved by stacking, both manifests match their CHANGELOG top entry. Songwriting's Pattison methodology-attribution note preserved; only the pointer sentence removed.

Related

• docs(plugins): 39 plugin READMEs still point at unreachable repo-root LICENSE (fleet-wide follow-up to #426) #537 (wave 3 of 3 — closes)
• docs(plugins): drop unreachable repo-root LICENSE pointer from 13 READMEs (wave 1) #755 / docs(plugins): drop unreachable repo-root LICENSE pointer from 13 READMEs (wave 2) #758 (waves 1–2)
• markdown-format + playwright: README points at marketplace-repo LICENSE the installed consumer cannot reach #426 (the two-plugin fix this mirrors)

🤖 Generated with Claude Code

[claude]

Claude finished @kyle-sexton's task in 1m 55s —— View job

---

PR Review — wave 3 LICENSE-pointer cleanup

• Gather context and understand the request
• Diff the PR changes (git diff origin/main...HEAD)
• Sample README changes — verify pointer sentence removed, inline MIT retained
• Sample CHANGELOG entries — format, version consistency
• Sample plugin.json version bumps — patch level correct
• Verify special cases (guardrails, work-items stacking; songwriting Pattison note)
• Repo-wide grep: confirm no residual pointer sentences remain on branch
• Post review findings

---

Findings

LGTM — clean, mechanical, no issues found.

Scope & shape

39 files across 13 plugins, each following the same 3-file pattern (README, CHANGELOG, plugin.json). No files outside this pattern were touched.

README pointer removal

All 13 READMEs correctly:

• Remove the See the LICENSE file at the root of the melodic-software/claude-code-plugins repository pointer sentence.
• Retain MIT (SPDX-License-Identifier: MIT) inline — confirmed via grep across all 13 files.

Repo-wide grep (at the root of / root of (the )?melodic) returns zero matches on this branch. The wave-1/2/3 series is now complete.

Version bumps

All 13 plugins receive a patch-level bump only (last component +1), consistent with a documentation-only change:

Plugin	Before	After
guardrails	0.9.2	0.9.3
playbooks	0.2.0	0.2.1
powershell-format	0.4.2	0.4.3
prototype	0.3.0	0.3.1
repo-hygiene	0.4.3	0.4.4
review	0.14.7	0.14.8
ruff-format	0.4.1	0.4.2
songwriting	0.6.0	0.6.1
tdd	0.2.0	0.2.1
testing	0.2.4	0.2.5
toolchain	0.4.3	0.4.4
verification	0.2.4	0.2.5
work-items	0.17.1	0.17.2

CHANGELOG entries

All 13 entries are worded identically (documentation-only rationale, explains the isolated plugin cache can't reach the repo root), which is appropriate for a uniform mechanical change. The entries sit at the top of each file as expected.

Special cases

• guardrails / work-items stacking — confirmed correct: the 0.9.3 and 0.17.2 entries are inserted at the top of their respective CHANGELOGs, above the 0.9.2 and 0.17.1 entries that landed on main mid-flight. No conflicts.
• songwriting Pattison note — preserved. Only the pointer sentence was removed; the attribution text (Pat Pattison's books are cited as methodology sources…) remains on the same paragraph. Verified here.

CLAUDE.md / process alignment

• Branch name docs/537-license-pointer-wave3 follows <type>/<description> convention. ✓
• PR title follows Conventional Commits (docs(plugins): …). ✓
• Patch bump + CHANGELOG per plugin per CLAUDE.md guidelines. ✓
• No hardcoded paths, no PII, no functional behavior change. ✓

Ready to merge.

[claude]

Claude finished @kyle-sexton's task in 58s —— View job

---

Security Review — PR #766

• Fetch PR diff
• Review changed files for security issues
• Analyze plugin.json version bumps
• Analyze CHANGELOG and README changes
• Post findings

---

Findings

No security issues found.

This PR makes three mechanical changes across 13 plugins:

1. README.md — removes one prose sentence from the License section (the dangling pointer to a file unreachable from an installed plugin cache). No templated content, no embedded commands, no URLs introduced.

2. CHANGELOG.md — prepends a new version entry, identical in structure to all prior entries. Plain prose only.

3. plugin.json — increments the "version" field (patch bump only). No new permissions, no new MCP server registrations, no new tool grants, no new hooks defined, no dependency pins changed.

Checked against all requested threat categories:

Category	Result
Logic flaws / authorization gaps	Not applicable — no executable logic changed
Injection surfaces (command, SQL, path, template)	None introduced — changes are prose only
Unsafe token / credential handling	None — no auth material present
Dangerous GitHub Actions patterns	Not applicable — no workflow files touched
pull_request_target / workflow_run with secrets	Not applicable
Script injection via github context in run:	Not applicable
Permission-widening in workflow permissions:	Not applicable
Supply-chain risk (loosened/unpinned action or dep pins)	None — no dependency pins changed

Version alignment between plugin.json and CHANGELOG.md is consistent across all 13 plugins (every bumped version has a matching top-level CHANGELOG entry). The two stacked plugins (guardrails, work-items) correctly place the new entry above the entries that landed on main mid-flight, which is an ordering concern only — no security implication.

[kyle-sexton]

Superseded by the rebased replacement PR (same 39-file change, re-stacked over #737's toolchain 0.5.0 / verification 0.3.0 mid-flight bumps as 0.5.1 / 0.3.1). Force-push to this branch is blocked by the local permission posture, so the resolution ships on a sibling branch.