docs(readme): drop zero-count badges (repo-standard BADGE-COUNT WARN)

Six badges was past the measured inflection of five where a badge row
reads as clutter rather than evidence. The two removed ones were
zero-counts (commands-0, hooks-0) carrying a fact README already states
in prose: this plugin ships no commands, agents, hooks, skills or MCP
servers. Four remain, all actionable: version, platform, deliverable,
license.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RsVD6Lq8oMRDCAEjg4HEHi

.gitignore

@@ -0,0 +1,12 @@
+
+# --- session/local state (gitignored per ~/.claude polyrepo-konvensjon) ---
+STATE.md
+REMEMBER.md
+ROADMAP.md
+TODO.md
+NEXT-SESSION-PROMPT*.local.md
+*.local.md
+*.local.json
+*.local.sh
+.DS_Store
+.claude/

README.md

@@ -1,19 +1,50 @@
-# Human-Friendly Output Style for Claude Code
+# human-friendly-style
+Shared Claude Code output style for the ktg-plugin-marketplace. Plain-language tone — explains what and why, hides paths/JSON/stack traces by default, matches the user's language.
 
-> A shared output style that gives every plugin in this marketplace a consistent, plain-language tone. Install it once, activate it via `/config`, and Claude Code starts explaining work the way a person would — not the way a console dump does.
+One Markdown file that changes how Claude *talks about* the work, not how the
+work is done. For anyone whose Claude Code sessions are read by someone other
+than a developer at a terminal — a colleague looking over your shoulder, a
+session you are documenting for someone else, or non-code work where console
+noise gets in the way.
 
 > **Solo-maintained, fork-and-own.** This plugin is a starting point, not a vendor product. Issues are welcome as signals; pull requests are not accepted. See [GOVERNANCE.md](GOVERNANCE.md) for the full model and what upstream provides.
 
-*AI-generated: all code produced by Claude Code through dialog-driven development. [Full disclosure →](../../README.md#ai-generated-code-disclosure)*
+*AI-generated: all code produced by Claude Code through dialog-driven development. Every change is human-directed, reviewed, and validated before commit.*
 
 ![Version](https://img.shields.io/badge/version-1.1.0-blue)
 ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
 ![Output style](https://img.shields.io/badge/output_style-1-green)
-![Commands](https://img.shields.io/badge/commands-0-lightgrey)
-![Hooks](https://img.shields.io/badge/hooks-0-lightgrey)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
 
-A Claude Code plugin that ships a single [output style](https://code.claude.com/docs/en/output-styles) used across the [ktg-plugin-marketplace](https://git.fromaitochitta.com/open/ktg-plugin-marketplace). The style modifies Claude Code's system prompt so responses default to prose instead of bullet lists, hide noisy details (long file paths, raw shell commands, JSON blobs, stack traces) until the user asks for them, match the user's language, and stay honest about uncertainty. Claude Code's built-in coding instructions stay intact (`keep-coding-instructions: true`), so testing discipline, careful edits, and verification still apply — only the way Claude *talks about* the work changes.
+## Install
+
+Use the `https://` form. The forge UI's clone button hands out an `ssh://` URL,
+and `marketplace add` answers it with `Invalid git URL`.
+
+```bash
+claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git
+claude plugin install human-friendly-style@ktg-plugin-marketplace
+```
+
+Inside a running session, `/plugin install human-friendly-style@ktg-plugin-marketplace` does the same thing. Or enable it directly in `~/.claude/settings.json`:
+
+```json
+{
+  "enabledPlugins": {
+    "human-friendly-style@ktg-plugin-marketplace": true
+  }
+}
+```
+
+Installing does not activate it — see [Activate](#activate).
+
+## Requirements
+
+| Requirement | Version |
+|-------------|---------|
+| Claude Code | recent versions with output style support |
+| Platform | macOS, Linux, Windows |
+| Network | None — output styles are local Markdown files |
 
 ---
 
@@ -34,6 +65,8 @@ This plugin solves that with one short Markdown file and the official Claude Cod
 
 ## What it does
 
+This plugin ships a single [output style](https://code.claude.com/docs/en/output-styles) used across the [ktg-plugin-marketplace](https://git.fromaitochitta.com/open/ktg-plugin-marketplace). The style modifies Claude Code's system prompt so responses default to prose instead of bullet lists, hide noisy details (long file paths, raw shell commands, JSON blobs, stack traces) until the user asks for them, match the user's language, and stay honest about uncertainty. Claude Code's built-in coding instructions stay intact (`keep-coding-instructions: true`), so testing discipline, careful edits, and verification still apply — only the way Claude *talks about* the work changes.
+
 The style file at `output-styles/human-friendly.md` declares nine directives that ride on top of Claude Code's normal system prompt:
 
 | # | Directive | What it changes |
@@ -105,33 +138,7 @@ One thing the style does *not* hide, even unprompted: **irreversible actions**.
 
 ---
 
-## Quick start
-
-### Install
-
-Add the marketplace once, then install the plugin:
-
-```bash
-claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git
-```
-
-In Claude Code:
-
-```
-/plugin install human-friendly-style@ktg-plugin-marketplace
-```
-
-Or enable directly in `~/.claude/settings.json`:
-
-```json
-{
-  "enabledPlugins": {
-    "human-friendly-style@ktg-plugin-marketplace": true
-  }
-}
-```
-
-### Activate
+## Activate
 
 ```
 /config
@@ -177,7 +184,7 @@ Removing the style is as simple: `/config` → **Output style** → **(default)*
 
 ---
 
-## What this plugin does *not* do
+## Non-goals
 
 By design, this plugin contains no commands, no agents, no hooks, no skills, no MCP servers. It ships exactly one file plus a manifest. That is the whole point — a shared conversational style should be a small, predictable thing that adds zero runtime overhead and zero surface area to audit.
 
@@ -202,12 +209,6 @@ The style is **optional**. Every plugin in the marketplace works without it. Thi
 
 ## Compatibility
 
-| Requirement | Version |
-|-------------|---------|
-| Claude Code | recent versions with output style support |
-| Platform | macOS, Linux, Windows |
-| Network | None — output styles are local Markdown files |
-
 Output styles are a first-class feature in Claude Code's plugin system. Older Claude Code releases without `/config` → Output style support will install the plugin without errors but will not apply the style. See [Claude Code Output Styles documentation](https://code.claude.com/docs/en/output-styles) for the canonical reference.
 
 ---
@@ -220,6 +221,12 @@ Output styles are a first-class feature in Claude Code's plugin system. Older Cl
 
 ---
 
+## Changelog
+
+See [CHANGELOG.md](CHANGELOG.md).
+
+---
+
 ## License
 
 [MIT](LICENSE). Fork it, modify it, ship your own version under your own name.

docs/review-2026-06-20.md

@@ -0,0 +1,29 @@
+# Plugin review — human-friendly-style (2026-06-20)
+
+> Full-depth review (part of the marketplace-wide sweep; pilot was okr). Tooling: config-audit
+> v5.4.0 scanners (from source) + llm-security posture assessor + structure/version checks.
+> Read-only; this file is the only artifact.
+
+## Verdict
+
+**Clean, grade A — essentially no attack surface.** A metadata-only manifest plus one output-style
+markdown; no commands, agents, skills, hooks, MCP, or dependencies. Nothing actionable.
+
+## Results by dimension
+
+| Dimension | Result |
+|-----------|--------|
+| config-audit posture | **A** (Feature Coverage F 17 — expected: an output-style uses almost no CC features; opportunity, not a defect) |
+| config-audit plugin-health | **0 findings** |
+| llm-security posture | **A** — no findings (1 INFO). The only real vector (an output-style edits the system prompt) was reviewed line-by-line + byte-scanned: tone-only, `keep-coding-instructions: true`, no hidden/encoded/scope-expanding directives. Hidden-char scan clean (only em-dashes). |
+| structure / hygiene | README ✓, CHANGELOG ✓, CLAUDE.md ✓, LICENSE ✓ |
+| version consistency | **OK** (gate) |
+
+## Findings
+
+- **INFO** — `output-styles/human-friendly.md:21-27` — hide-by-default directives reduce visibility
+  into routine tool output. This is the stated purpose, reversible on request (L29), and carved out
+  for irreversible actions (L32-33). Not a defect; no remediation.
+
+The irreversible-action carve-out (forces verbatim display of destructive commands) is a net
+security positive.