From 9ed12426bf534a92d864cedf32a1827c2fb87556 Mon Sep 17 00:00:00 2001
From: Kjell Tore Guttormsen <hello@fromaitochitta.com>
Date: Thu, 18 Jun 2026 10:21:12 +0200
Subject: [PATCH 1/2] chore(gitignore): add session/local-state baseline
 (polyrepo split)

---
 .gitignore | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 .gitignore

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..687aa2f
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,12 @@
+
+# --- session/local state (gitignored per ~/.claude polyrepo-konvensjon) ---
+STATE.md
+REMEMBER.md
+ROADMAP.md
+TODO.md
+NEXT-SESSION-PROMPT*.local.md
+*.local.md
+*.local.json
+*.local.sh
+.DS_Store
+.claude/

From a4b55fc1687f5869c7f56b490fdf1baae2e170ba Mon Sep 17 00:00:00 2001
From: Kjell Tore Guttormsen <hello@fromaitochitta.com>
Date: Sat, 20 Jun 2026 09:14:05 +0200
Subject: [PATCH 2/2] docs: add full-depth plugin review (2026-06-20)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Grade A — no attack surface, no findings. Part of the marketplace-wide review (config-audit v5.4.0 + llm-security + structure + version). Read-only; this file is the only artifact.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
---
 docs/review-2026-06-20.md | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 docs/review-2026-06-20.md

diff --git a/docs/review-2026-06-20.md b/docs/review-2026-06-20.md
new file mode 100644
index 0000000..3e2ac06
--- /dev/null
+++ b/docs/review-2026-06-20.md
@@ -0,0 +1,29 @@
+# Plugin review — human-friendly-style (2026-06-20)
+
+> Full-depth review (part of the marketplace-wide sweep; pilot was okr). Tooling: config-audit
+> v5.4.0 scanners (from source) + llm-security posture assessor + structure/version checks.
+> Read-only; this file is the only artifact.
+
+## Verdict
+
+**Clean, grade A — essentially no attack surface.** A metadata-only manifest plus one output-style
+markdown; no commands, agents, skills, hooks, MCP, or dependencies. Nothing actionable.
+
+## Results by dimension
+
+| Dimension | Result |
+|-----------|--------|
+| config-audit posture | **A** (Feature Coverage F 17 — expected: an output-style uses almost no CC features; opportunity, not a defect) |
+| config-audit plugin-health | **0 findings** |
+| llm-security posture | **A** — no findings (1 INFO). The only real vector (an output-style edits the system prompt) was reviewed line-by-line + byte-scanned: tone-only, `keep-coding-instructions: true`, no hidden/encoded/scope-expanding directives. Hidden-char scan clean (only em-dashes). |
+| structure / hygiene | README ✓, CHANGELOG ✓, CLAUDE.md ✓, LICENSE ✓ |
+| version consistency | **OK** (gate) |
+
+## Findings
+
+- **INFO** — `output-styles/human-friendly.md:21-27` — hide-by-default directives reduce visibility
+  into routine tool output. This is the stated purpose, reversible on request (L29), and carved out
+  for irreversible actions (L32-33). Not a defect; no remediation.
+
+The irreversible-action carve-out (forces verbatim display of destructive commands) is a net
+security positive.