Checks (i) and (j) decided what counts as "shipped content" from a hardcoded
list of local-only file names (REMEMBER.md, TODO.md, NEXT-SESSION-PROMPT.local.md).
That list was written before the STATE.md convention replaced those three, so
STATE.md fell through it and was scanned as if it shipped. It does not: it is
gitignored and has zero tracked entries.
The resulting false positive was self-reproducing. Any STATE.md note explaining
why the check was red had to name the banned token, which made the check red.
Removing the offending line closed nothing; the next session that documented
the finding recreated it.
Two fixes were considered:
(a) add STATE.md to the exclude list. One name, but the list stays a name
list -- it rots again the next time a local-only file is renamed, which
is precisely how this defect arrived.
(b) derive the scope from git. No gitignored file can reopen the hole,
whatever it is called.
(b) is implemented, via `git check-ignore` rather than `git ls-files`. Both
answer "is this shipped", but ls-files also drops untracked Markdown that is
NOT ignored -- new content on its way into the plugin, which is exactly when a
leak check should be looking. check-ignore keeps that in scope and excludes
only what git ignores. When git cannot answer (no repo, no binary) every file
is treated as shipped, so the checks fail loudly instead of passing on an
empty file list.
Verified both directions, denominators reported:
known-positive: a real shipped reference/*.md carrying the banned token
-> FAIL, exit 1 (proves the check can still fire)
known-negative: STATE.md, gitignored, carrying the same token
-> not flagged
check (j) known-positive: shipped .md with Norwegian diacritics -> WARN
scope: 22 shipped Markdown files of 31 on disk (9 gitignored: STATE.md +
8 under .claude/)
validate-plugin.sh: Pass 16 / Fail 0 / Warn 0, exit 0 (was 14 / 1 / 23, exit 1)
verify.sh roll-up: Pass 41 / Fail 0 / Warn 1, exit 0
Both re-run under /bin/bash 3.2.57 as well as bash 5.3.
The 23 warnings that disappeared were all STATE.md diacritics; they were never
shipped content, and check (j) carried the same name-list defect that (i) did.
Closes ORDRE 64.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ToLVakwASPe3pXsdEiothC
Repo had no SECURITY.md; adds one with a reachable contact address,
canonical repository URL, response process, and a version-support
table matching the actual 0.1.0 release line.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AX8SWgnoExWzZFKsxpg5N4
Flat H2-only list, placed after the intro paragraph before Install.
Anchors machine-validated against actual headings (16/16 match,
zero dead links); a deliberately broken anchor confirmed the check
fires before trusting the clean run.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018mi5sCfmJKdePnSZ6dKUDo
Two judgement findings from the repo-standard skill that its script cannot
measure, both on the presentation surface:
- Verification named the whole-suite command but not the fact that nothing
runs it automatically. The skill treats a stated single command plus that
admission as the honest substitute for a CI badge; this repo has no CI
config of any kind, so say so.
- The Changelog section sent a public reader to `REMEMBER.md` for the v1.0
readiness criteria. That file is gitignored, is not present, and is a
retired local-continuity mechanism — so the pointer resolved to nothing
for every reader. The criteria were already inline in the same sentence;
keep them and drop the pointer.
Gate: repo-standard v0.2.0 reports OK, 14/14, no SKIP.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B4DrFX1ubxrmswAH3rwSeN
repo-standard v0.2.0 flagged BADGE-COUNT (WARN): 7 badges is past the
measured inflection of 5, where a badge row reads as clutter rather than
evidence (Trockman et al., ICSE 2018).
Dropped the two zero-count lightgrey badges (hooks-0, commands-0) — a
reader takes no action on them, and README:190 already states the plugin
ships no commands, agents, hooks or MCP servers. Kept version, platform,
skills-1, references-13 and license; the catalog version gate reads the
skills and references badges as its source of truth, so those stay.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B4DrFX1ubxrmswAH3rwSeN
Run the repo-standard gate (plugin class) and fix every ERROR:
- README opening line now matches the forge description verbatim, so
description == catalog == README is machine-checkable
- H1 `# claude-design` matches the repo name (was a title-cased drift)
- `## Installation` -> `## Install`, moved onto the first screen, with the
single-argument `claude plugin marketplace add <https-url>` form used by
every other plugin in the org (the two-argument form pointed the gate at
the marketplace name instead of its URL)
- `## What this plugin is NOT` -> `## Non-goals`
- `## Recent versions` -> `## Changelog`, deduplicated the release-history link
- AI-disclosure link pointed at `../../README.md`, dead since the polyrepo
split, and at an anchor the catalog README no longer carries -> GOVERNANCE.md
- Stale monorepo path `plugins/claude-design/verify.sh` -> `verify.sh` in
README and .coverage.md
Gate: 13/13 pass, 0 ERROR, 0 WARN, 0 SKIP. verify.sh unchanged at 39 pass /
1 pre-existing fail (validate-plugin.sh flags the gitignored STATE.md).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B4DrFX1ubxrmswAH3rwSeN
Grade A — non-agentic; one v0.1.0 maturity nit (no permissions block). Part of the marketplace-wide review (config-audit v5.4.0 + llm-security + structure + version). Read-only; this file is the only artifact.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
Add three sections to bring README depth closer to marketplace standard
(was 206 lines, smallest in marketplace; now 298):
- "Why this exists" — names the convergent-middle-ground problem in Claude
Design, cites Anthropic's frontend-aesthetics cookbook as primary source,
explains the five-layer prompt scaffold and the plugin's interactive role
- "Workflow example: from idea to prompt" — realistic 8-phase walkthrough
against the slides preset (Q1 results all-hands deck), including a ~30-line
sample prompt block showing what Phase 6 actually delivers
- "Recent versions" — v0.1.0 summary + CHANGELOG.md pointer + v1.0
readiness criteria pointer to REMEMBER.md
No feature changes; pure docs polish. verify.sh passes 41/0/1 (the 1 warn
is the expected SC1 dogfood-missing advisory until operator runs first
real Claude Design session).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
CLAUDE.md and README.md previously named the forbidden tokens
literally when describing the validate-plugin.sh assertion (i) and
test-sc3-citations.sh negative grep. The recursive scans then flagged
the documentation itself as a leak. Rewords both descriptions to
describe the policy without using the banned literals.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Pre-trekexecute snapshot of in-progress CLAUDE.md/SKILL.md edits and
extracted docs/ files. Captured as one commit so /trekexecute claude-design
can run against a clean working tree.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Standardize named-markdown-link guidance across all plugins so file://
references render as independently clickable links in terminals like
Ghostty (bare file:// URLs only make the first clickable).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
