docs(plugins): drop unreachable repo-root LICENSE pointer from final 13 READMEs (wave 3)

[kyle-sexton]

Closes #537 — final wave; repo-wide repro grep (at the root of|root of (the )?melodic) returns zero across all plugins/*/README.md on this branch.

Supersedes #766 (identical change, rebased): #737 landed toolchain 0.5.0 / verification 0.3.0 mid-grace, so those two stack as 0.5.1 / 0.3.1; guardrails (0.9.2→0.9.3) and work-items (0.17.1→0.17.2) stack above their own mid-flight entries as before. All 13 manifests match their CHANGELOG top entry; songwriting's methodology-attribution note preserved.

Related

• docs(plugins): 39 plugin READMEs still point at unreachable repo-root LICENSE (fleet-wide follow-up to #426) #537 (wave 3 of 3 — closes)
• docs(plugins): drop unreachable repo-root LICENSE pointer from final 13 READMEs (wave 3) #766 (superseded — pre-rebase head of this same change)
• docs(plugins): drop unreachable repo-root LICENSE pointer from 13 READMEs (wave 1) #755 / docs(plugins): drop unreachable repo-root LICENSE pointer from 13 READMEs (wave 2) #758 (waves 1–2)
• markdown-format + playwright: README points at marketplace-repo LICENSE the installed consumer cannot reach #426 (the two-plugin fix this mirrors)

🤖 Generated with Claude Code

[claude]

Claude finished @kyle-sexton's task in 2m 45s —— View job

---

PR Review

• Gather PR context
• Review diff (READMEs, plugin.json versions, CHANGELOGs)
• Verify version bump consistency across all 13 plugins
• Verify CHANGELOG entries match plugin.json versions
• Verify no lingering LICENSE pointer text in changed READMEs
• Final summary

---

Summary

The core change is correct and complete: all 13 READMEs drop the unreachable repo-root LICENSE pointer, the repo-wide grep (at the root of|root of (the )?melodic) is clean, version bumps are mechanically consistent, songwriting's methodology-attribution note is preserved, and the 11 "simple" plugin CHANGELOGs are uniform and clean.

However, there is one encoding bug introduced in the two more-complex changelogs that needs a fix before merge.

---

Issue: Em-dash mojibake in toolchain and verification CHANGELOGs

Both plugins/toolchain/CHANGELOG.md and plugins/verification/CHANGELOG.md have had their existing em dashes corrupted. In origin/main these files contain proper UTF-8 em dashes (U+2014 = bytes e2 80 94); on this branch those bytes are replaced with the mojibake sequence c3 a2 e2 82 ac e2 80 9d (the UTF-8 encoding of â€", which is what you get when the UTF-8 bytes of — are decoded as Latin-1 then re-encoded as UTF-8).

Counts:

File	Proper em dashes on main	Proper em dashes on this branch
plugins/toolchain/CHANGELOG.md	9	0
plugins/verification/CHANGELOG.md	8	0

The corruption affects every existing changelog entry in both files (everything from ## [0.5.0] downward in toolchain, and ## [0.3.0] downward in verification). The new ## [0.5.1] / ## [0.3.1] entries themselves are fine because they contain no em dashes.

Example corrupted line in the diff:

- by each lifecycle plugin's own setup — `/discovery:setup`, `/planning:setup`, and the new
+ by each lifecycle plugin's own setup â€" `/discovery:setup`, `/planning:setup`, and the new

Affected permalinks:

• plugins/toolchain/CHANGELOG.md (current HEAD)
• plugins/verification/CHANGELOG.md (current HEAD)

Fix: Replace the mojibake sequences with proper em dashes in both files. The simplest approach is to sed or programmatically substitute the garbled bytes back to — while leaving everything else untouched, then re-commit. Fix this →

---

Everything else looks good

• READMEs (13/13): LICENSE pointer correctly removed. Replacement line (MIT (SPDX-License-Identifier: MIT).) is uniform. Songwriting's Pat Pattison attribution sentence is correctly preserved on the same line.
• plugin.json versions (13/13): All patch bumps are correct and match the top CHANGELOG entry in each file.
• CHANGELOG entries (11 simple plugins): Identical, accurate documentation-only description; ## [x.y.z] / ### Changed / bullet matches the exact README edit.
• Toolchain / verification new entries (## [0.5.1] / ## [0.3.1]): Content is correct; no em dashes present so those blocks are unaffected by the encoding bug.
• Version stacking: Guardrails 0.9.2→0.9.3, work-items 0.17.1→0.17.2, toolchain 0.5.0→0.5.1, verification 0.3.0→0.3.1 all align with the PR description's stacking explanation.

[claude]

Claude finished @kyle-sexton's task in 1m 10s —— View job

---

Security Review — PR #771

• Gather context and understand request
• Fetch and inspect PR diff
• Review plugin.json changes
• Review README.md changes
• Review CHANGELOG.md changes
• Post security findings

---

No security issues found.

This PR is documentation-only across all 39 changed files. A full read of the diff confirms:

plugin.json (13 files): The only field changed in every manifest is version (patch bump). No permissions, hooks, MCP server registrations, dependencies, or executable surfaces were added or modified.

README.md (13 files): The License section drops the dead cross-repo path pointer (See the LICENSE file at the root of the melodic-software/claude-code-plugins repository) and replaces it with the inline SPDX identifier alone. No templating, script content, or anything that could be an injection surface.

CHANGELOG.md (13 files): Adds a changelog entry describing the documentation change. The toolchain and verification changelogs also reflow encoding of em-dashes that was incidental to the rebase — cosmetic only, no behavior change.

There are no GitHub Actions workflow changes, no dependency pin changes, no credential or secret handling, no command execution surfaces, and no path traversal risk introduced. The PR is safe to merge from a security standpoint.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e73433e9d4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 56s —— View job

---

Security Review — PR #771

• Gather context and understand request
• Fetch PR diff
• Review plugin.json changes for security issues
• Review README.md changes for security issues
• Review CHANGELOG.md changes for security issues
• Post security findings

---

No security issues found.

This PR is documentation-only across all 39 changed files. Full diff inspection confirms:

plugin.json (13 files): The only field changed in every manifest is version (patch bump). No permissions, hooks, mcpServers, dependencies, command surfaces, or trust-delegation fields were added or modified.

README.md (13 files): The License section drops the dead cross-repo path pointer (See the LICENSE file at the root of the melodic-software/claude-code-plugins repository) and retains only the inline SPDX identifier. No templating, script content, URLs, or injection surfaces introduced.

CHANGELOG.md (13 files): Adds a uniform changelog entry describing the documentation change. Content is static prose with no executable content, external references, or credential material.

There are no GitHub Actions workflow changes, no dependency pin changes, no credential or secret handling, no command execution surfaces, no path traversal risk, and no supply-chain risk introduced. Safe to merge from a security standpoint.

[claude]

Claude finished @kyle-sexton's task in 2m 8s —— View job

---

PR Review — Encoding Fix Verified ✓

• Gather context (new commit 88c418e — "fix(plugins): restore UTF-8 punctuation in rebuilt changelogs")
• Verify em-dash encoding is restored in plugins/toolchain/CHANGELOG.md
• Verify em-dash encoding is restored in plugins/verification/CHANGELOG.md
• Confirm no new issues introduced in the fixup commit
• Final summary

---

Summary

The encoding fix in 88c418e is correct and complete.

What the fix does: The conflict-resolution rebuild of both changelogs had decoded git output using a legacy codepage and re-encoded as UTF-8, corrupting every em dash (— → â€") and the ≥ sign in verification. The fixup commit replaces each mojibake sequence with the correct UTF-8 codepoint.

Verification:

• plugins/toolchain/CHANGELOG.md: 9 corrupted sequences (â€") → proper —. Hexdump confirms e2 80 94 bytes present; no mojibake bytes remain.
• plugins/verification/CHANGELOG.md: 8 corrupted em dashes + 1 corrupted ≥ (≥) → proper UTF-8. All 9 affected lines clean.
• Scope of the fixup is exact — only the two CHANGELOG files changed, no unrelated edits.

Overall PR status: All issues from the prior review are resolved. The PR is clean:

• 13/13 READMEs correctly drop the unreachable repo-root LICENSE pointer
• 13/13 plugin.json version bumps are correct
• 13/13 CHANGELOG entries accurately describe the documentation-only change
• Songwriting's methodology-attribution note is preserved
• Repo-wide grep (at the root of|root of (the )?melodic) returns zero across all plugins/*/README.md
• No security concerns (documentation-only, no permissions/hooks/MCP changes)

Ready to merge.