fix(development-codebase-tools): Opus 5 pass -- subagent_type, ceilings

[wkoutre]

Applies the Opus 5 config-migration audit to development-codebase-tools — 10 agents, 13 skills, 2 reference guides, and the plugin's own docs. Every .md under the plugin was read in full. No other plugin touched.

The highest-leverage fix: CLAUDE.md documented subagent_type wrong

The plugin's CLAUDE.md said:

Cross-plugin delegation uses `Task(subagent_type:plugin-name:skill-name)`

subagent_type names an AGENT, never a skill. Skills aren't dispatchable through Task at all — they're slash commands. This one line is why other files in the marketplace picked up the wrong cross-plugin syntax, so it matters beyond this plugin. Corrected to plugin-name:agent-name, with the added detail that the value must match an agent's frontmatter name: (not its filename — agents/context-loader.md declares name: context-loader-agent), plus the enumeration command so the next person checks instead of guessing.

Changes by delta

Delta 1 — Opus 5 self-verifies, so ceremony is dead weight

• mermaid-diagram: Rule 9 restated Rules 1-8 verbatim as a trailing self-check. With allowed-tools: [] there's no renderer, so it could not verify anything — it was a re-read of just-written output. Removed. The "Fixing Broken Diagrams" step that referenced it now states plainly that the corrected diagram is unverified.
• diagram-excalidraw: the same constraints appeared in three layers (upfront rules, a SKILL.md Validation Checklist, and Pre/During/Post-Generation checklists in references/validation.md). Collapsed to the single upfront statement, folding in the two constraints only the checklists carried. Kept the one real check — does the written JSON parse — since that is grounding, not self-review.
• code-generator-agent: dropped the "re-read every generated file and verify" pass; the standards now apply while writing. Noted that this agent has no Bash, so it must name the checks the caller should run rather than implying it ran them.
• performance-analyzer-agent: deleted the 15-item deliverables checklist, which mandated a completeness sweep.

Kept as grounding (constrains claims against reality, unlike re-reading your own work): debug-assistant's "reproduce before fixing"; pattern-learner/refactorer's "3+ examples before calling it a pattern"; strengthen-types' post-mutation tsc --noEmit.

Delta 2 — ceilings instead of floors, plus when-NOT-to-delegate

• agent-orchestrator-agent: added hard ceilings stated as ceilings (4 per parallel group, 8 dispatches per run, 2 levels of recursion, 1 meta-agent) and a when-NOT-to-delegate section. Softened "Launch all agents simultaneously… Maximum efficiency, minimum time", "Maximize parallel execution opportunities", and "Recursive Decomposition… Handles arbitrary depth". The meta-agent fleet was gated only on "when possible"; it is now opt-in and capped at 1.
• explore-codebase: delegated unconditionally, though its own advertised example ("where is the API rate limiting implemented?") is a single Grep. Now conditional.
• debug-issue Step 4, refactor-code (3 unconditional dispatches for "clean up this function"): now conditional.
• analyze-code: defaulted ambiguous depth to deep, the three-agent path. Now defaults to the one-agent overview and escalates on evidence. This also resolves a disagreement — explain-file-guide.md already documented default: overview.
• Dropped unused Task grants: bare Task from audit-accessibility and strengthen-types (neither body mentions delegation), and agent-orchestrator-agent from refactor-code (never dispatched).

Delta 3 — coverage first, filter downstream

• analyze-dead-code: vulture --min-confidence 80 filtered below the prompt layer entirely — unreachable by any wording. Removed. Step 4 already annotates false positives rather than dropping them, so the CLI floor was redundant suppression.
• analyze-test-coverage: --min-coverage 80 ran before the criticality scoring that exists to catch the 85%-covered file whose uncovered lines are the auth branch. Default is now off and it applies after ranking.
• strengthen-types: 7 grep categories truncated with head -N, only one counted. Added companion wc -l totals and a shown / total line in the report. Same fix for analyze-bundle's tree-shaking greps (its ls -lhS truncations are size-sorted and left alone).
• analyze-bundle: "List only findings with a concrete fix" dropped the biggest number on the page — a 90 KB dependency with no replacement. Now reported under "Known cost, no fix identified".
• analyze-migrations: its three pattern tables read as an exhaustive allowlist; now stated as a checklist, with instructions to report dangerous patterns found outside it. Kept the 20-most-recent scope cap (a scope choice, not a finding filter).
• Stripped decorative CRITICAL emphasis from style-enforcer.

Invented numbers

• analyze-tech-debt: ROI = (monthly_impact × 12) / effort — three layers of arithmetic over two fabricated seeds ("hours/month lost", "hours to fix"), mandated as required output. Replaced with impact/effort bands that must cite the signal justifying them (commit count, file size, nesting depth).
• agent-orchestrator: confidence percentages about its own judgment → qualitative Strong/Partial/Weak. "Overall Confidence: [0-100%]", "Coverage: [Percentage]", and "Execution Efficiency: [Parallel speedup]" → observed lists and counts.
• security-analyzer: "Estimated security debt in hours" removed.
• explain-file-guide: maintainability: number // Score 0-100 removed; coverage: number // Estimated test coverage → hasTests: boolean, pointing at analyze-test-coverage when a real number is wanted.
• analyze-code: "maintainability score" → the concrete complexity signals actually observed.

Kept (inputs are measured, which is the whole test): analyze-test-coverage's (100 - line_coverage) * 0.5 + …, fed by real coverage output; pattern-learner's "90% of files follow X", which is countable.

Delta 4 — length only comes down when asked

Added explicit length lines, prioritized by whether the output feeds another agent's context: context-loader-agent and explore-codebase (its output is input to /plan) capped at 100 lines; then agent-orchestrator, debug-assistant (was mandating a monitoring plan for a typo fix), performance-analyzer, security-analyzer (was producing a 6-month roadmap even on a targeted scope), style-enforcer (per-violation blocks over a full-codebase default), pattern-learner, analyze-tech-debt.

Kept: code-explainer's "a 30-line utility gets a short explanation".

Broken references

• agent-capability-analyst was referenced twice in agent-orchestrator.md and does not exist in any agent's frontmatter name: anywhere in the marketplace — it would fail at dispatch. Removed, along with the fabricated Agent Optimizer meta-agent. Prompt Engineer and Pattern Learner are real and now carry their actual dispatch names.
• explain-file-guide.md dispatched code-explainer / security-analyzer / performance-analyzer without the -agent suffix — three names that resolve to nothing. Fixed. It also listed refactorer-agent in the architectural path while refactorer-agent is absent from its allowed-tools, so that dispatch would have been blocked; removed with a note explaining why.

Version bump

MINOR, 2.6.3 → 2.7.0.

The two sources disagreed before this PR: plugin.json was already at 2.6.3 while the root CLAUDE.md table still read 2.6.2. Both now read 2.7.0. Also added the missing hooks/hooks.json to the plugin CLAUDE.md file tree.

Findings in the brief that do not exist here

Reported rather than fixed, since inventing a fix would be worse than saying so:

• references/analysis-rubric.md ("don't invent problems") — not in this plugin. find locates exactly one copy, in skill-management: packages/plugins/skill-management/skills/skill-doctor/references/analysis-rubric.md. The phrase "invent problems" appears nowhere under development-codebase-tools.
• agents/agent-tester.md (coverage ratios with unknowable denominators) — lives in development-productivity, not here.

Test plan

1. Every agent dispatch name in the marketplace (27 agents; dispatch name is frontmatter name:, never the filename):

$ find packages/plugins -path '*/agents/*.md' -exec sh -c 'printf "%s -> " "$(basename $1)"; grep -m1 "^name:" "$1"' _ {} \;
agent-orchestrator.md -> agent-orchestrator-agent
agent-tester.md -> agent-tester-agent
cicd-agent.md -> cicd-agent
claude-docs-initializer.md -> claude-docs-initializer-agent
code-explainer.md -> code-explainer-agent
code-generator.md -> code-generator-agent
comment-resolver.md -> comment-resolver-agent
commit-message-generator.md -> commit-message-generator-agent
context-loader.md -> context-loader-agent
debug-assistant.md -> debug-assistant-agent
documentation.md -> documentation-agent
execute-plan.md -> execute-plan-agent
infrastructure-agent.md -> infrastructure-agent
migration-assistant.md -> migration-assistant-agent
pattern-learner.md -> pattern-learner-agent
performance-analyzer.md -> performance-analyzer-agent
plan-reviewer.md -> plan-reviewer-agent
planner.md -> planner-agent
pr-creator.md -> pr-creator-agent
prompt-engineer.md -> prompt-engineer-agent
refactorer.md -> refactorer-agent
researcher.md -> researcher-agent
review-executor.md -> review-executor-agent
security-analyzer.md -> security-analyzer-agent
stack-splitter.md -> stack-splitter-agent
style-enforcer.md -> style-enforcer-agent
test-writer.md -> test-writer-agent

2. Every subagent_type this plugin dispatches resolves to a real agent:

$ comm -23 <dispatched names> <real agent names>
agent-name
plugin-name:agent-name

Only the two documentation placeholders in CLAUDE.md remain unmatched, which is correct — they are syntax templates. All 8 real dispatches (code-explainer-agent, context-loader-agent, debug-assistant-agent, performance-analyzer-agent, refactorer-agent, security-analyzer-agent, style-enforcer-agent, test-writer-agent) resolve.

3. No fabricated references or stale facts remain:

$ grep -rniE 'agent-capability-analyst|agent-optimizer|claude-agent-discovery|mcp__nx_mcp__|MultiEdit|budget_tokens|claude-haiku' packages/plugins/development-codebase-tools/
(no matches)

The only 80% left is performance-analyzer.md:184, the Pareto principle — not a stale pricing claim.

4. Plugin validation:

$ node scripts/validate-plugin.cjs packages/plugins/development-codebase-tools
  ✓ plugin.json: development-codebase-tools v2.7.0
  ✓ package.json: @uniswap/development-codebase-tools
  ✓ project.json: development-codebase-tools
  ✓ skills/: 13 item(s)
  ✓ agents/: 10 item(s)
  ✓ hooks/: 2 item(s)
Validation PASSED

5. Format and markdown lint:

$ bunx nx format:write --uncommitted
$ bunx markdownlint-cli2 --fix "packages/plugins/development-codebase-tools/**/*.md"
Linting: 200 file(s)
Summary: 0 error(s)

Decisions left open

Two items are genuine judgment calls and were deliberately not resolved:

1. security-analyzer.md:110 — the CVSS business-impact multiplier. "Apply business impact multipliers (revenue/reputation/regulatory/data sensitivity: 1.0-2.0x)." CVSS 3.1 itself is a real published rubric with defined inputs, and it stays. The multiplier is different: it takes a real CVSS base score and scales it by a factor nobody measured, producing a number that still looks like CVSS. Removing it loses genuine prioritization signal; keeping it launders a guess through a credible-looking score. Left as-is.
2. debug-assistant.md:29 — the 0–1 confidence score on root-cause hypotheses. Ranking competing hypotheses is real and useful, and debug-issue Step 4 consumes the ranking to pick which fix to try. But a numeric 0–1 score implies a calibration that does not exist, and "0.85" is not more informative than "most likely". A qualitative ranking would preserve the ordering without the false precision. Left as-is; debug-issue's wording still refers to confidence scores, so the two move together.

Also worth a decision, though outside the brief's explicit list: model: frontmatter across this plugin mixes pinned ids (claude-opus-5, claude-sonnet-5) with self-updating aliases (opus, sonnet). Aliases are generally preferable since they track model releases. Not changed — model: and effortLevel are yours to set.

🤖 Generated with Claude Code

AI-Generated Description

Applies the Opus 5 config-migration audit to development-codebase-tools — 10 agents, 13 skills, 2 reference guides, and the plugin's own docs. No other plugin touched.

Headline: CLAUDE.md documented subagent_type wrong

The plugin's CLAUDE.md said cross-plugin delegation uses Task(subagent_type:plugin-name:skill-name).
subagent_type names an AGENT, never a skill. Skills aren't dispatchable through Task at all — they're slash commands. That one line is why other files in the marketplace picked up the wrong syntax, so it matters beyond this plugin. Corrected to plugin-name:agent-name, with the detail that the value must match an agent's frontmatter name: and not its filename (agents/context-loader.md declares name: context-loader-agent), plus the enumeration command so the next person checks instead of guessing.

Changes by delta

Delta 1 — Opus 5 self-verifies, so ceremony is dead weight

• mermaid-diagram: Rule 9 restated Rules 1–8 verbatim as a trailing self-check. With allowed-tools: [] there is no renderer, so it verified nothing — it was a re-read of just-written output. Removed; the "Fixing Broken Diagrams" step now states plainly that the corrected diagram is unverified.
• diagram-excalidraw: the same constraints appeared in three layers (upfront rules, a SKILL.md Validation Checklist, and Pre/During/Post-Generation checklists in references/validation.md). Collapsed to the single upfront statement, folding in the two constraints only the checklists carried. Kept the one real check — does the written JSON parse.
• code-generator-agent: dropped the "re-read every generated file and verify" pass; the standards now apply while writing. Added that this agent has no Bash, so it must name the checks the caller should run rather than implying it ran them.
• performance-analyzer-agent: deleted the 15-item deliverables checklist that mandated a completeness sweep.
  Kept as grounding (constrains claims against reality, unlike re-reading your own work): debug-assistant's "reproduce before fixing"; pattern-learner/refactorer's "3+ examples before calling it a pattern"; strengthen-types' post-mutation tsc --noEmit.

Delta 2 — ceilings instead of floors, plus when-NOT-to-delegate

• agent-orchestrator-agent: ceilings stated as ceilings (4 per parallel group, 8 dispatches per run, 2 levels of recursion, 1 meta-agent) and a when-NOT-to-delegate section. Softened "Launch all agents simultaneously… Maximum efficiency, minimum time", "Maximize parallel execution opportunities", and "Recursive Decomposition… Handles arbitrary depth". The meta-agent fleet was gated only on "when possible"; now opt-in and capped at 1.
• explore-codebase: delegated unconditionally, though its own advertised example ("where is the API rate limiting implemented?") is a single Grep. Now conditional.
• debug-issue Step 4 and refactor-code (3 unconditional dispatches for "clean up this function"): now conditional. debug-issue Step 5 no longer assumes the fix came from an agent.
• analyze-code: defaulted ambiguous depth to deep, the three-agent path. Now defaults to one-agent overview and escalates on evidence — which also resolves a disagreement, since explain-file-guide.md already documented default: overview.
• Dropped unused Task grants: bare Task from audit-accessibility and strengthen-types (neither body mentions delegation), and agent-orchestrator-agent from refactor-code (never dispatched).

Delta 3 — coverage first, filter downstream

• analyze-dead-code: vulture --min-confidence 80 filtered below the prompt layer entirely — unreachable by any wording. Removed. Step 4 already annotates false positives rather than dropping them, so the CLI floor was redundant suppression.
• analyze-test-coverage: --min-coverage 80 ran before the criticality scoring that exists to catch the 85%-covered file whose uncovered lines are the auth branch. Default is now off, applied after ranking, with a count of what it removed.
• strengthen-types: 7 grep categories truncated with head -N, only one counted. Added companion wc -l totals plus a shown / total line — and an explicit unit rule, since the original paired a grep -l file listing with an occurrence count ("30 of 400" that was really 30 files of 400 occurrences).
• analyze-bundle: same head -N fix for the tree-shaking greps (the ls -lhS truncations are size-sorted and left alone). "List only findings with a concrete fix" dropped the biggest number on the page — a 90 KB dependency with no replacement — so those now report under "Known cost, no fix identified". A clean result must also say which modules were inspected.
• analyze-migrations: its three pattern tables read as an exhaustive allowlist; now a checklist, with instructions to report dangerous patterns found outside it. Kept the 20-most-recent scope cap (a scope choice, not a finding filter).
• Stripped decorative CRITICAL emphasis from style-enforcer.

Invented numbers

• analyze-tech-debt: ROI = (monthly_impact × 12) / effort — three layers of arithmetic over two fabricated seeds ("hours/month lost", "hours to fix"), mandated as required output. Replaced with impact/effort bands that must cite the signal justifying them (commit count, file size, nesting depth), and a roadmap grouped Mechanical / Structural / Architectural by observable blast radius instead of by guessed cost.
• agent-orchestrator: confidence percentages about its own judgment → qualitative Strong/Partial/Weak. "Overall Confidence: [0-100%]", "Coverage: [Percentage]", "Execution Efficiency: [Parallel speedup]" → observed lists and counts.
• security-analyzer: "Estimated security debt in hours" removed.
• explain-file-guide: maintainability: number // Score 0-100 removed; coverage: number // Estimated test coverage → hasTests: boolean, pointing at analyze-test-coverage when a real number is wanted.
• analyze-code: "maintainability score" → the concrete complexity signals actually observed.
  Kept (inputs are measured, which is the whole test): analyze-test-coverage's (100 - line_coverage) * 0.5 + …, fed by real coverage output; pattern-learner's "90% of files follow X", which is countable.

Delta 4 — length only comes down when asked

Explicit length lines, prioritized by whether the output feeds another agent's context: context-loader-agent and explore-codebase (its output is input to /plan) capped at 100 lines; then agent-orchestrator, debug-assistant (was mandating a monitoring plan for a typo fix), performance-analyzer, security-analyzer (was producing a 6-month roadmap even on a targeted scope), style-enforcer (per-violation blocks over a full-codebase default), pattern-learner, analyze-tech-debt.
Kept: code-explainer's "a 30-line utility gets a short explanation".

Broken references and unrunnable instructions

• agent-capability-analyst was referenced twice in agent-orchestrator.md and exists in no agent's frontmatter name: anywhere in the marketplace — it would fail at dispatch. Removed, along with the fabricated Agent Optimizer meta-agent. Prompt Engineer and Pattern Learner are real and now carry their actual dispatch names.
• explain-file-guide.md dispatched code-explainer / security-analyzer / performance-analyzer without the -agent suffix — three names that resolve to nothing. Fixed. It also listed refactorer-agent in the architectural path while that agent is absent from its allowed-tools, so the dispatch would have been blocked; removed with a note saying why.
• refactor-code validation was unrunnable, and is now mandatory. Step 6 said "confirm behavior is preserved" while allowed-tools granted no test runner, formatter, or linter — the only way to comply was to read your own diff. Added the runner prefixes those steps need (npm/yarn/pnpm/bun, nx, vitest, jest, tsc, eslint, prettier, pytest, go, cargo, mvn/gradle) and made the check binary: either the tests covering the touched code run and pass, or — when no test covers it — code-explainer-agent reviews the before/after pair for behavior equivalence. If neither can run, the refactor is reported unverified rather than complete.

Version bump

MINOR, 2.6.3 → 2.7.0.
The two sources disagreed before this PR: plugin.json was already at 2.6.3 while the root CLAUDE.md table still read 2.6.2. Both now read 2.7.0. Also added the missing hooks/hooks.json to the plugin CLAUDE.md file tree.

Findings in the brief that do not exist here

Reported rather than fixed, since inventing a fix would be worse than saying so:

• references/analysis-rubric.md ("don't invent problems") — not in this plugin. find locates exactly one copy, in skill-management: packages/plugins/skill-management/skills/skill-doctor/references/analysis-rubric.md. The phrase "invent problems" appears nowhere under development-codebase-tools.
• agents/agent-tester.md (coverage ratios with unknowable denominators) — lives in development-productivity, not here.

Test plan

1. Every subagent_type this plugin dispatches resolves to a real agent. Dispatch name is frontmatter name:, never the filename:

$ comm -23 <dispatched names> <real agent names across all 27 marketplace agents>
agent-name
plugin-name:agent-name

Only the two documentation placeholders in CLAUDE.md remain unmatched, which is correct — they are syntax templates. All 8 real dispatches (code-explainer-agent, context-loader-agent, debug-assistant-agent, performance-analyzer-agent, refactorer-agent, security-analyzer-agent, style-enforcer-agent, test-writer-agent) resolve.
2. No fabricated references or stale facts remain:

$ grep -rniE 'agent-capability-analyst|agent-optimizer|claude-agent-discovery|mcp__nx_mcp__|MultiEdit|budget_tokens|claude-haiku' \
    packages/plugins/development-codebase-tools/
(no matches)

The only 80% left is performance-analyzer.md:184, the Pareto principle — not a stale pricing claim.
3. Plugin validation:

$ node scripts/validate-plugin.cjs packages/plugins/development-codebase-tools
  ✓ plugin.json: development-codebase-tools v2.7.0
  ✓ skills/: 13 item(s)   ✓ agents/: 10 item(s)   ✓ hooks/: 2 item(s)
Validation PASSED

4. Format and markdown lint: bunx nx format:write --uncommitted, then bunx markdownlint-cli2 --fix over the plugin — 200 files, 0 errors.

Decisions left open

debug-assistant.md:33-34 — the 0–1 confidence score on root-cause hypotheses. Ranking competing hypotheses is real and useful, and debug-issue Step 4 consumes the ranking to pick which fix to try. But a numeric 0–1 score implies a calibration that does not exist, and "0.85" is not more informative than "most likely". A qualitative ranking would preserve the ordering without the false precision. Left as-is; debug-issue:101 still refers to confidence scores, so the two move together.
Also worth a decision, though outside the brief's list: model: frontmatter across this plugin mixes pinned ids (claude-opus-5, claude-sonnet-5) with self-updating aliases (opus, sonnet). Aliases track model releases and are generally preferable. Not changed — model: and effortLevel are yours to set.
For the record, one item listed as open in the first draft of this PR was resolved during review: security-analyzer.md's CVSS business-impact multiplier (1.0-2.0x) is gone. It scaled a real CVSS base score by a factor nobody measured and kept the CVSS label, so the output laundered a guess through a credible-looking number. Business impact is now prose in the finding's Impact field, and genuine severity context goes through CVSS 3.1's own temporal/environmental metrics with the full modified vector shown — reproducible, unlike a bare multiplier.
🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ai-toolkit-slack-oauth-backend	Ready	Preview	Aug 5, 2026 11:49pm

[github-actions]

📚 Documentation Check ✅

Verdict: Passed

Plugin version was bumped (2.6.3 → 2.7.0) alongside the functional changes, matching the minor-bump policy for backward-compatible behavior changes. Root CLAUDE.md and the plugin's own CLAUDE.md were updated in the same PR to stay in sync, including correcting a stale subagent_type contract and the hooks/ file tree (verified hooks.json already exists on disk). README.md's summaries remain accurate at their level of detail. Plugin inventory parity between packages/plugins/ and marketplace.json holds.

---

Documentation Check — PASS

Version bump (critical check): ✅ Satisfied

• packages/plugins/development-codebase-tools/.claude-plugin/plugin.json: 2.6.3 → 2.7.0
• Root CLAUDE.md version table: 2.6.2 → 2.7.0 (also fixes a pre-existing drift between the table and the actual plugin.json version)
• Minor bump is the right call: no skills/agents renamed or removed; changes are backward-compatible additions (delegation ceilings in agent-orchestrator, length/scope caps across several agents, removal of fabricated metrics like ROI/confidence-percentages/hour-estimates in favor of evidence-cited bands).

CLAUDE.md: ✅ Updated appropriately

• Plugin's CLAUDE.md was updated alongside the agent/skill rewrites (skill/agent one-liners, subagent_type contract correction, hooks/hooks.json added to the file tree). Verified hooks/hooks.json already exists on disk — this is a documentation catch-up for a pre-existing file, not a reference to something the PR claims to add but doesn't.

README.md: ✅ No update needed

• packages/plugins/development-codebase-tools/README.md wasn't touched by the PR. Checked its skill/agent one-line descriptions (analyze-tech-debt, agent-orchestrator, refactor-code, analyze-bundle, etc.) against the new behavior — they're general enough ("Identify and prioritize technical debt with remediation plans") to remain accurate; no stale references to removed concepts (ROI, confidence %, agent-capability-analyst, coverage estimates) were found.

Plugin inventory parity: ✅ Clean

• Both packages/plugins/ ↔ marketplace.json parity checks from .claude/rules/plugin-docs.md ran silent — no mismatches.

Changelog: None added — informational only per the validator config, not blocking.

No missing or incorrect documentation updates found for this PR.

✨ No Documentation Updates Needed

All documentation appears to be up to date with the code changes.

---

_{🤖 Generated by Claude Documentation Validator | Mode: suggest}

[github-actions]

_{● Reviewed · 2026-08-05 23:50 UTC · 2 reviews · view run ↗}

Approved — one info nit in the plugin CLAUDE.md.

Applies the Opus 5 migration audit to the development-codebase-tools plugin: removes invented metrics and fabricated agent references, adds output line budgets and delegation ceilings, and bumps the plugin to 2.7.0.

Suggestions

• The plugin CLAUDE.md's debug-issue bullet still describes the agent dispatch as unconditional, but this PR made it conditional — the sibling bullets for refactor-code and analyze-tech-debt were updated for their behavior changes in the same hunk.

[github-actions]

⚠️ warning · correctness — Steps 5 and 6 now instruct running the project's formatter, linter, and tests, but allowed-tools (line 3) grants only Bash(git diff:*) and Bash(git show:*). Before this diff step 5 dispatched style-enforcer-agent and step 6 only ran git diff HEAD — both permitted. Now the primary validation path is unrunnable and the agent fallbacks are conditional, so a refactor lands on disk with no behavior-preservation check. Either add the needed Bash(...) entries, or state that the caller runs these — code-generator.md in this diff handles the same constraint that way.

[github-actions]

🔵 info · correctness — The any listing command uses -l | head -30 (file paths) while the count command drops -l (occurrences), so shown / total mixes units in one cell — e.g. 30 files against 400 occurrences.

[github-actions]

Caution

⚠️ Changes requested — see full review in the sticky comment ↑

[wkoutre]

Rebased onto next (picks up #565) and addressed the review. No conflict on the root CLAUDE.md version table; both the merged uniswap-integrations 2.6.1 row and this branch's development-codebase-tools 2.7.0 row are present.

Finding 1 — the ROI ban was self-contradicting (analyze-tech-debt). Step 6 categorized items as "Quick Wins (high ROI, <4h effort)" one line after Step 5 banned ROI numbers and hour estimates, so following the skill literally re-emitted the exact metric this PR removed. The Prioritized Roadmap now groups by observable blast radius instead: Mechanical (one file, no interface change, area already has tests), Structural (multiple files or a changed interface, with the call-site count stated), Architectural (design-level, or no test coverage at all). Step 5 now records blast radius rather than an effort band, and the per-item format cites the signal behind both. Swept the file: the only surviving ROI/hour mentions are the prohibitions themselves.

Finding 2 — refactor-code validation was not runnable. Steps 5-6 instructed running the project's formatter, linter, and tests while allowed-tools granted only Bash(git diff:*) and Bash(git show:*), so a refactor could land with no behavior-preservation check at all. Fixed both ways: allowed-tools now includes the common formatter/linter/test-runner prefixes (npm/yarn/pnpm/bun/nx/vitest/jest/tsc/eslint/prettier/pytest/go/cargo/maven/gradle) plus Glob, and Step 6 is now labeled mandatory with exactly one of two paths required to pass — the tests covering the touched code, or, when none exist, a code-explainer-agent before/after behavior-equivalence review. If neither can run, the skill must report the refactor as unverified rather than complete.

Suggestion — debug-issue Step 5. It said "apply the agent's recommended fix" even on the self-fix path where no agent ran. Now: "The fix is whichever Step 4 produced: your own, if you diagnosed it directly, or the agent's recommendation, if you delegated."

Suggestion — strengthen-types unit mismatch. The explicit-any listing used grep -l (one line per file) while the total used a non--l occurrence count, so shown / total compared two different units. Both halves are occurrences now; the -l pipeline is kept as a separately-labeled "files affected" number, and the summary table calls out which unit each figure is in.

CVSS business-impact multiplier — removed. CVSS 3.1 base scoring stays, and the vector string is now published alongside the score. The 1.0-2.0x multiplier is gone: it scaled a real published score by an unmeasured factor while the output still read as CVSS. Business impact is now reported as prose in the finding's Impact field, and genuine contextual severity changes go through CVSS's own temporal/environmental metrics with the full modified vector shown. Nothing downstream referenced an adjusted score.

debug-assistant confidence score — kept, and verified nothing filters on it. Grepped the whole plugin for confidence thresholds, minimums, and early exits. There is no filter anywhere: debug-issue Step 4 uses the score only for ranking, and explicitly says to note both hypotheses when two are close, so nothing is dropped at discovery time. analyze-dead-code already forbids a --min-confidence floor on vulture for the same reason. No defect found, no change made.

No version bump — still 2.7.0, since these are fixes to that same unreleased change. nx format:write --uncommitted and markdownlint-cli2 both clean (0 errors, 200 files linted).

[wkoutre]

@request-claude-review

Superseded by new review

[github-actions]

Note

✅ Approved — see full review in the sticky comment ↑

[github-actions]

↻ Reviewing now · view run ↗

This comment will update when the review completes. Findings will appear in the sticky summary above.