chore: apply qualify-ticket-refs.sh — rewrite bare ticket/tk refs to use shim (merge worktree-20260323-204247)

Author: JoeOakhartNava

CLAUDE.md

@@ -22,13 +22,13 @@ When no `tier_schema` is specified, default to `TRIVIAL`.
 ### Step 1: Load Context
 
 ```bash
-tk show <ticket-id>
+.claude/scripts/dso ticket show <ticket-id>
 ```
 
 Read the ticket title, description, type, acceptance criteria, and any done definitions or success criteria. If a parent epic exists (`parent` field), also load:
 
 ```bash
-tk show <parent-epic-id>
+.claude/scripts/dso ticket show <parent-epic-id>
 ```
 
 Note any preplanning split-candidate flags or risk register entries.

plugins/dso/agents/complexity-evaluator.md

@@ -275,9 +275,9 @@ When `ci.workflow_name` is set, `merge.ci_workflow_name` is silently ignored. Wh
 
 | | |
 |---|---|
-| **Description** | Jira project key used by `tk sync`. The `JIRA_PROJECT` environment variable takes precedence over this value. |
+| **Description** | Jira project key used by `.claude/scripts/dso ticket sync`. The `JIRA_PROJECT` environment variable takes precedence over this value. |
 | **Accepted values** | Jira project key string (e.g., `DIG`, `MYPROJ`) |
-| **Default** | No default — required when using `tk sync` |
+| **Default** | No default — required when using `.claude/scripts/dso ticket sync` |
 | **Used by** | the tk script (`.claude/scripts/dso tk`), `.claude/scripts/dso jira-reset-sync.sh`, `.claude/scripts/dso reset-tickets.sh` |
 
 ---
@@ -287,7 +287,7 @@ When `ci.workflow_name` is set, `merge.ci_workflow_name` is silently ignored. Wh
 | | |
 |---|---|
 | **Description** | Command to search for existing tickets by substring. Used by `plugins/dso/hooks/lib/pre-bash-functions.sh` (commit-failure-tracker) to detect duplicate tickets. |
-| **Accepted values** | Any shell command string (e.g., `grep -rl`, `ticket list --filter`) |
+| **Accepted values** | Any shell command string (e.g., `grep -rl`, `.claude/scripts/dso ticket list --filter`) |
 | **Default** | `grep -rl` |
 | **Used by** | `plugins/dso/hooks/lib/pre-bash-functions.sh` |
 
@@ -298,8 +298,8 @@ When `ci.workflow_name` is set, `merge.ci_workflow_name` is silently ignored. Wh
 | | |
 |---|---|
 | **Description** | Command to create a new tracking issue. Used when a validation failure has no existing ticket. |
-| **Accepted values** | Any shell command string (e.g., `ticket create`, `gh issue create`) |
-| **Default** | `ticket create` |
+| **Accepted values** | Any shell command string (e.g., `.claude/scripts/dso ticket create`, `gh issue create`) |
+| **Default** | `.claude/scripts/dso ticket create` |
 | **Used by** | `.claude/scripts/dso check-validation-failures.sh`, `plugins/dso/hooks/lib/pre-bash-functions.sh` |
 
 ---
@@ -745,7 +745,7 @@ When `ci.workflow_name` is set, `merge.ci_workflow_name` is silently ignored. Wh
 
 | | |
 |---|---|
-| **Description** | Jira project key for ticket sync. Only needed when using `tk sync` with Jira. Superseded by `jira.project` — prefer `jira.project` for new configurations. |
+| **Description** | Jira project key for .claude/scripts/dso ticket sync. Only needed when using `.claude/scripts/dso ticket sync` with Jira. Superseded by `jira.project` — prefer `jira.project` for new configurations. |
 | **Accepted values** | Jira project key string (e.g., `DTL`, `MYPROJ`) |
 | **Default** | Absent |
 | **Used by** | the tk script (`.claude/scripts/dso tk`) (sync subcommand) |
@@ -829,7 +829,7 @@ These variables are consumed by DSO hooks, scripts, and skills at runtime. They
 | | |
 |---|---|
 | **Description** | Base URL of the Jira instance (e.g., `https://myorg.atlassian.net`). Used by the tk script (`.claude/scripts/dso tk`) when adding remote links to Jira issues. |
-| **Required** | Required for `tk sync` remote-link features |
+| **Required** | Required for `.claude/scripts/dso ticket sync` remote-link features |
 | **Usage context** | the tk script (`.claude/scripts/dso tk`) (sync subcommand, remote link creation) |
 
 ---
@@ -839,7 +839,7 @@ These variables are consumed by DSO hooks, scripts, and skills at runtime. They
 | | |
 |---|---|
 | **Description** | Jira username (email address) for API authentication. Used with `JIRA_API_TOKEN` via HTTP Basic Auth. |
-| **Required** | Required for `tk sync` remote-link features |
+| **Required** | Required for `.claude/scripts/dso ticket sync` remote-link features |
 | **Usage context** | the tk script (`.claude/scripts/dso tk`) (sync subcommand) |
 
 ---
@@ -849,7 +849,7 @@ These variables are consumed by DSO hooks, scripts, and skills at runtime. They
 | | |
 |---|---|
 | **Description** | Jira API token for authentication. Generate at https://id.atlassian.com/manage-profile/security/api-tokens. Used with `JIRA_USER` via HTTP Basic Auth. |
-| **Required** | Required for `tk sync` remote-link features |
+| **Required** | Required for `.claude/scripts/dso ticket sync` remote-link features |
 | **Usage context** | the tk script (`.claude/scripts/dso tk`) (sync subcommand) |
 
 ---
@@ -858,8 +858,8 @@ These variables are consumed by DSO hooks, scripts, and skills at runtime. They
 
 | | |
 |---|---|
-| **Description** | Jira project key (e.g., `DIG`). Takes precedence over `jira.project` in `dso-config.conf`. Required by `tk sync` unless `jira.project` is configured. |
-| **Required** | Required for `tk sync` unless `jira.project` is set in config |
+| **Description** | Jira project key (e.g., `DIG`). Takes precedence over `jira.project` in `dso-config.conf`. Required by `.claude/scripts/dso ticket sync` unless `jira.project` is configured. |
+| **Required** | Required for `.claude/scripts/dso ticket sync` unless `jira.project` is set in config |
 | **Usage context** | the tk script (`.claude/scripts/dso tk`), `.claude/scripts/dso jira-reset-sync.sh`, `.claude/scripts/dso reset-tickets.sh` |
 
 ---
@@ -1002,7 +1002,7 @@ These variables are consumed by DSO hooks, scripts, and skills at runtime. They
 
 | | |
 |---|---|
-| **Description** | When set to `1`, suppresses the worktree push step during `tk sync`. Used internally by `.claude/scripts/dso reset-tickets.sh` when doing a bulk sync to prevent duplicate push operations. |
+| **Description** | When set to `1`, suppresses the worktree push step during `.claude/scripts/dso ticket sync`. Used internally by `.claude/scripts/dso reset-tickets.sh` when doing a bulk sync to prevent duplicate push operations. |
 | **Required** | Internal — set and unset by `.claude/scripts/dso reset-tickets.sh` |
 | **Usage context** | the tk script (`.claude/scripts/dso tk`) (sync subcommand), `.claude/scripts/dso reset-tickets.sh` |
 
@@ -1032,6 +1032,6 @@ These variables are consumed by DSO hooks, scripts, and skills at runtime. They
 
 | | |
 |---|---|
-| **Description** | Override for the ticket create command used by `plugins/dso/hooks/lib/pre-bash-functions.sh` (commit-failure-tracker). When set, takes precedence over `issue_tracker.create_cmd` from config. Used in tests. |
+| **Description** | Override for the .claude/scripts/dso ticket create command used by `plugins/dso/hooks/lib/pre-bash-functions.sh` (commit-failure-tracker). When set, takes precedence over `issue_tracker.create_cmd` from config. Used in tests. |
 | **Required** | Optional — testing override only |
 | **Usage context** | `plugins/dso/hooks/lib/pre-bash-functions.sh` |

plugins/dso/docs/CONFIGURATION-REFERENCE.md

@@ -125,7 +125,7 @@ except `version`. Below are the most commonly needed keys for initial setup:
 | `commands.format` | stack-derived | Auto-formatter command |
 | `dso.plugin_root` | set by `dso-setup.sh` | Absolute path to DSO plugin. Written by `dso-setup.sh`; rarely set manually. |
 | `ci.workflow_name` | absent | GitHub Actions workflow name for post-push CI trigger recovery (e.g. `CI`). Preferred over deprecated `merge.ci_workflow_name`. |
-| `jira.project` | absent | Jira project key for `tk sync` (e.g. `DIG`) |
+| `jira.project` | absent | Jira project key for `.claude/scripts/dso ticket sync` (e.g. `DIG`) |
 | `monitoring.tool_errors` | absent (disabled) | Set to `true` to enable tool error tracking and auto-ticket creation |
 
 For the full key reference including staging, CI, design, infrastructure, and worktree keys,
@@ -139,7 +139,7 @@ see **[docs/CONFIGURATION-REFERENCE.md](CONFIGURATION-REFERENCE.md)**.
 | `JIRA_USER` | Jira account email address |
 | `JIRA_API_TOKEN` | Jira API token (generate at https://id.atlassian.com/manage-profile/security/api-tokens) |
 
-These are only required when using `tk sync`. For the full environment variable reference, see
+These are only required when using `.claude/scripts/dso ticket sync`. For the full environment variable reference, see
 **[docs/CONFIGURATION-REFERENCE.md — Section 2](CONFIGURATION-REFERENCE.md#section-2--environment-variables)**.
 
 ---
@@ -148,7 +148,7 @@ These are only required when using `tk sync`. For the full environment variable
 
 ### acli (Atlassian CLI)
 
-`acli` enables Jira ticket management from the command line as part of `tk sync` remote link
+`acli` enables Jira ticket management from the command line as part of `.claude/scripts/dso ticket sync` remote link
 creation workflows. It is not required for core DSO functionality.
 
 Install:
@@ -190,18 +190,18 @@ prompt. No manual configuration is required.
 
 ---
 
-## tk sync-events Prerequisites
+## .claude/scripts/dso ticket sync Prerequisites
 
-`tk sync-events` syncs the tickets branch with a shared remote using a split-phase protocol
+`.claude/scripts/dso ticket sync` syncs the tickets branch with a shared remote using a split-phase protocol
 (fetch → lock → merge → unlock → push). It requires the following setup before first use:
 
 | Requirement | How to satisfy |
 |---|---|
-| `.tickets-tracker/` initialized | Run `ticket init` from the repo root (see `plugins/dso/scripts/ticket-init.sh`) |
+| `.tickets-tracker/` initialized | Run `.claude/scripts/dso ticket init` from the repo root (see `plugins/dso/scripts/ticket-init.sh`) |
 | `origin` remote configured | `git -C .tickets-tracker remote add origin <url>` |
 | `tickets` branch exists in remote | `git -C .tickets-tracker push origin tickets:tickets` (on first environment only) |
 
-If `.tickets-tracker/` has not been initialized, `tk sync-events` exits with:
+If `.tickets-tracker/` has not been initialized, `.claude/scripts/dso ticket sync` exits with:
 ```
 error: ticket tracker not initialized (.tickets-tracker/ not found)
 ```

plugins/dso/docs/INSTALL.md

@@ -2,7 +2,7 @@
 
 After a plan is approved via ExitPlanMode, do NOT begin implementation immediately. Do NOT prompt to clear context. Instead:
 
-1. **Create a ticket epic** (`ticket create epic "<plan title>"`) from the plan title and context description
+1. **Create a ticket epic** (`.claude/scripts/dso ticket create epic "<plan title>"`) from the plan title and context description
 2. **Run `/dso:preplanning`** on the newly created epic to decompose it into prioritized user stories with measurable done definitions
 3. **Validate issue health**: Run `validate-issues.sh --quick`
 4. **Report**: Epic ID, user story dependency graph, and which tasks are ready to work

plugins/dso/docs/PLAN-APPROVAL-WORKFLOW.md

@@ -21,13 +21,13 @@ The wrapper reads two keys from `dso-config.conf` via `read-config.sh`:
 | Key | Purpose | Default |
 |-----|---------|---------|
 | `session.artifact_prefix` | Prefix for `/tmp` artifact directories | `<repo-basename>-test-artifacts` |
-| `issue_tracker.create_cmd` | Command to create a tracking ticket (e.g., `ticket create`) | absent = skip ticket creation with warning |
+| `issue_tracker.create_cmd` | Command to create a tracking ticket (e.g., `.claude/scripts/dso ticket create`) | absent = skip ticket creation with warning |
 
 Example config:
 
 ```conf
 session.artifact_prefix=myproject-test-artifacts
-issue_tracker.create_cmd=ticket create
+issue_tracker.create_cmd=.claude/scripts/dso ticket create
 ```
 
 ## Timeout Detection

plugins/dso/docs/PRE-COMMIT-TIMEOUT-WRAPPER.md

@@ -63,7 +63,7 @@ git revert "$REF_SHA"
 Verify:
 
 ```bash
-grep -r 'tk show\|tk create\|tk list' plugins/dso/skills/ | head -5
+grep -r '.claude/scripts/dso ticket show\|tk create\|tk list' plugins/dso/skills/ | head -5
 ```
 
 ## Full Rollback (both commits)

plugins/dso/docs/ROLLBACK-PROCEDURE.md

@@ -6,7 +6,7 @@ Rules for all sub-agents dispatched by orchestrators (`/dso:sprint`, `/dso:debug
 
 Sub-agents must NOT:
 - `git commit`, `git push` — orchestrator handles all commits
-- `ticket transition <id> open closed`, `ticket link`, `ticket transition <id> <current> <status>` — orchestrator manages issue lifecycle
+- `.claude/scripts/dso ticket transition <id> open closed`, `.claude/scripts/dso ticket link`, `.claude/scripts/dso ticket transition <id> <current> <status>` — orchestrator manages issue lifecycle
 - Invoke `/dso:commit`, `/dso:review`, or any slash-command — sub-agents are workers, not orchestrators
 - Dispatch nested Task tool calls or code-review sub-agents
 - **NEVER set `isolation: "worktree"` on this sub-agent.** Code-review and fix-resolution
@@ -32,16 +32,16 @@ Sub-agents MUST:
 - Run `pwd` first to confirm working directory
 - Write code + tests (TDD: tests before implementation when possible)
 - Run `make format-check && make lint` from `app/`, then `$(git rev-parse --show-toplevel)/plugins/dso/scripts/validate.sh --ci` as final validation
-- Write checkpoint notes: `ticket comment {id} "CHECKPOINT N/6: ..."`
+- Write checkpoint notes: `.claude/scripts/dso ticket comment {id} "CHECKPOINT N/6: ..."`
 - Use absolute paths for scripts: `$(git rev-parse --show-toplevel)/scripts/`
 - Follow existing code patterns and naming conventions
 - Read code before modifying it
 
 ## Permitted Actions
 
 Sub-agents MAY:
-- `ticket create "..." --parent <parent-id> --type bug` for discovered bugs (use `--type bug` when filing defects, not `--type task`)
-- `ticket comment <id> "..."` for checkpoint progress notes
+- `.claude/scripts/dso ticket create "..." --parent <parent-id> --type bug` for discovered bugs (use `--type bug` when filing defects, not `--type task`)
+- `.claude/scripts/dso ticket comment <id> "..."` for checkpoint progress notes
 - Read any file in the repo to understand context
 - Write discovery files to `$ARTIFACTS_DIR/agent-discoveries/<task-id>.json` (resolve via: `source ${CLAUDE_PLUGIN_ROOT}/hooks/lib/deps.sh && get_artifacts_dir`) (atomic: write `.tmp`, then `mv`) when encountering bugs, missing dependencies, API changes, or convention violations during execution. Schema: `{"task_id": "<id>", "type": "<bug|dependency|api_change|convention>", "summary": "<one-line>", "affected_files": ["<path>", ...]}`. Discovery writing is non-fatal — failures must not block task completion.
 - Read `${TMPDIR:-/tmp}/dso-blackboard-<worktree-name>/blackboard.json` for file ownership awareness (written by orchestrator before dispatch). Respect ownership boundaries: only modify files listed under your ownership; report concerns for files owned by other agents. If a required modification falls outside your listed `files_owned`, add a checkpoint note explaining the deviation before proceeding.
@@ -77,7 +77,7 @@ Dispatch failure retries are sequential and do not count toward batch size limit
 
 ## Checkpoint Protocol
 
-Sub-agents write progress via `ticket comment {id} "CHECKPOINT N/6: ..."`:
+Sub-agents write progress via `.claude/scripts/dso ticket comment {id} "CHECKPOINT N/6: ..."`:
 
 | Checkpoint | Meaning |
 |-----------|---------|

plugins/dso/docs/SUB-AGENT-BOUNDARIES.md

@@ -508,8 +508,8 @@ claude
 Work normally -- write code, run tests, commit. Ticket commands work as usual:
 
 ```bash
-tk ready
-ticket transition <id> in_progress
+.claude/scripts/dso ticket list
+.claude/scripts/dso ticket transition <id> in_progress
 # ... do the work ...
 make lint && make test
 git add <files> && git commit -m "feat: auth redesign"

plugins/dso/docs/WORKTREE-GUIDE.md

@@ -19,7 +19,7 @@ Two constraints make a naive synchronous approach unworkable:
 - **SC9 (no local credentials)**: Jira API credentials must not be required on developer machines.
   Storing long-lived API tokens locally increases the blast radius of a compromised workstation.
 
-`tk sync` (the existing local synchronization command) runs the Atlassian CLI (ACLI) directly.
+`.claude/scripts/dso ticket sync` (the existing local synchronization command) runs the Atlassian CLI (ACLI) directly.
 This requires local Jira credentials and runs synchronously in the developer's shell session.
 It cannot satisfy SC1 (it is a pull, not a push trigger) or SC9 (credentials must be present
 locally).
@@ -98,18 +98,18 @@ fields (`event_type`, `jira_key`, `local_id`, `env_id`, `timestamp`, `run_id`) a
 
 ## Alternatives Considered
 
-### Alternative: Extend `tk sync` to run in CI
+### Alternative: Extend `.claude/scripts/dso ticket sync` to run in CI
 
-Run the existing `tk sync` command in a CI step instead of a dedicated bridge script.
+Run the existing `.claude/scripts/dso ticket sync` command in a CI step instead of a dedicated bridge script.
 
 **Rejected** because:
-- `tk sync` requires local ACLI credentials to be present on the runner or passed as environment
+- `.claude/scripts/dso ticket sync` requires local ACLI credentials to be present on the runner or passed as environment
   variables. While CI can supply secrets, this approach re-introduces credential management
   complexity that the bridge pattern avoids.
-- `tk sync` runs synchronously and performs a full incremental scan of the ticket store. The
+- `.claude/scripts/dso ticket sync` runs synchronously and performs a full incremental scan of the ticket store. The
   outbound bridge uses `git diff` to process only the events introduced by the triggering commit,
   which is significantly more efficient for large ticket stores.
-- `tk sync` does not emit SYNC events — it cannot serve as the emitter side of the
+- `.claude/scripts/dso ticket sync` does not emit SYNC events — it cannot serve as the emitter side of the
   outbound/inbound bridge contract.
 - Cannot satisfy SC1 (push-trigger) without additional wrapper logic equivalent to what the
   outbound bridge already provides.