{
  "markdown": "# cjbischoff-claude-code-tools\n\nClaude Code plugin marketplace — personal plugins for Christopher Bischoff.\n\n## Installation\n\n```\n/plugin marketplace add cjbischoff/cjbischoff-claude-code-tools\n/plugin install sec-overlay@cjbischoff-claude-code-tools\n```\n\n## Plugins\n\n- **sec-overlay**: agentic security-audit harness (static analysis, tool-receipt gate).\n\n## Development\n\n```bash\nclaude plugin validate .      # validate plugin + marketplace manifests\nprek run                      # run governance hooks\ncd plugins/sec-overlay/skills/sec-overlay/helpers && uv run pytest -q   # Python core tests\n```\n\n### OpenWiki\n\nFirst init is local (do not run `--init` in CI). From the repo root, with an Anthropic key in the environment:\n\n```bash\nexport OPENWIKI_PROVIDER=anthropic\nexport OPENWIKI_MODEL_ID=claude-sonnet-5\nexport OPENWIKI_TELEMETRY_DISABLED=1\nexport DO_NOT_TRACK=1\nopenwiki code --init --print\n```\n\nKeep `openwiki/INSTRUCTIONS.md` and `.openwikiignore`. The generated wiki under `openwiki/` is tracked; start at `openwiki/quickstart.md`. Later refreshes: `openwiki code --update --print`, or the `OpenWiki Update` workflow (set `ANTHROPIC_API_KEY` as a repository secret; weekly Monday 08:00 UTC plus manual dispatch).\n\nAn update run reads `.openwiki-history.md` to learn what changed since the last run, because `.openwikiignore` blocks the agent from running `git log`. CI regenerates it automatically; before a local `--update`, run it yourself:\n\n```bash\n./scripts/openwiki-history-digest.sh\n```\n\n## Directory Guide\n\nEach folder below has its own README.md describing what it holds, its naming convention, and who writes to it. A commit that changes a tracked file inside a folder that has a README.md must update that folder's README.md in the same commit; inside `plugins/`, this applies per plugin. The only exemption is a commit that stages exclusively a plugin's own `CHANGELOG.md`; any other staged file under that plugin still requires the immediate-folder README.md (see [CLAUDE.md](CLAUDE.md) for the exact routing).\n\n| Folder | Purpose |\n|--------|---------|\n| `plugins/` | One directory per distributed plugin |\n| `scripts/` | Repo-level tooling (git hook scripts) |\n| `docs/` | Design specs and planning documents |\n| `docs/decisions/` | Project architecture decisions, one file per decision |\n\n## Artifact inventory\n\n| Path | Purpose |\n|------|---------|\n| `.claude-plugin/marketplace.json` | Marketplace manifest; lists all plugins |\n| `.omp/` | omp-native context wrappers at repo-root, plugin, and skill depths. Each `.omp/AGENTS.md` uses `@import` to pull in the corresponding `CLAUDE.md` so omp discovers and respects marketplace, plugin, and skill governance rules at priority 100 (native). |\n| `.planning/` | GSD planning setup: PROJECT.md, ROADMAP.md, STATE.md, MILESTONES.md, synthesized intel from the 50 ingested design docs, the ingest conflict report, and the onboarding summary. Milestone v5.0 Hybrid Diff-Review Architecture shipped 2026-08-22 (7 phases, 30 plans, 32/32 requirements). Its roadmap, requirements, audit, and phase directories are archived under `.planning/milestones/`; `RETROSPECTIVE.md` holds the milestone retrospective. Milestone v5.1 Tech-Debt Cleanup shipped 2026-08-22 (2 phases, 7/7 requirements, PRs #32-#33): all six Phase 06 tech-debt items cleared and the ingest WARNING closed. Its roadmap, requirements, and phase directories are archived under `.planning/milestones/`; `MILESTONES.md` and `RETROSPECTIVE.md` carry the milestone records. Milestone v5.2 sec-overlay Defect Remediation completed 2026-09-05 (7 phases, 22 requirements, 26 defects fixed through all Phases 9-15). Next milestone not yet defined. |\n| `plugins/sec-overlay/.claude-plugin/plugin.json` | sec-overlay plugin manifest |\n| `plugins/sec-overlay/README.md` | sec-overlay user-facing README: install, prerequisites, quick start |\n| `plugins/sec-overlay/CHANGELOG.md` | sec-overlay Common Changelog |\n| `plugins/sec-overlay/CLAUDE.md` | sec-overlay maintainer manual: development commands, folder-README rule, history |\n| `plugins/sec-overlay/commands/` | Slash commands the plugin installs, including `/sec-overlay:audit`; a plugin-root `commands/` file is install payload, so a change there bumps the plugin version |\n| `plugins/sec-overlay/skills/sec-overlay/SKILL.md` | Skill playbook: agentic security-audit harness; links to the skill's `CLAUDE.md` for prerequisites and operating rules |\n| `plugins/sec-overlay/skills/sec-overlay/helpers/` | Python core (`sec_overlay` package) that runs tools and enforces gates |\n| `plugins/sec-overlay/skills/sec-overlay/agents/` | LLM subagent prompts for the investigate/validate/patch phases |\n| `docs/` | Design specs and implementation plans (see `docs/README.md`), including the sec-overlay defect-remediation design and its Plan A audit-driver, Plan B shared-vocabulary, Plan C coverage/accuracy, and Plan D report/telemetry/artifact-review implementation plans, and the architecture/threat-model standards design (C4/arc42 + derived DFD/STRIDE, CVSS v4.0, Mermaid caps, STE prose) with its Plans 1–3 (CVSS v4.0 migration, diagram/STE enforcement, phase rebuild), and the sec-overlay invocation design (one `/sec-overlay:audit` command, a `run.py` driver, scan-profile role inference feeding the correlation core) with its nine-task implementation plan, and the sec-overlay recall-gaps design (absence-rule pack, recall adversary, JSON dependency-sink catalog, catalog-gated proof tuples, policy-engine indicators, deterministic route census) with its three implementation plans (Plan 1 dependency-sink catalog and policy-engine indicators, Plan 2 absence detection and catalog-gated proof tuples, Plan 3 route census and recall adversary), and the sec-overlay improvements build spec (29 requirements in six ordered groups, a cite-verification record against plugin HEAD, and the opt-in proof-by-execution lane) with its Plan 1 contract layer (REQ-02, REQ-18, REQ-07, REQ-10, REQ-32 as five red/green commit pairs, the contract lint created in the first pair and extended by each later one, plus the three HEAD conflicts it resolves) and its Plan 2 data integrity (REQ-13, REQ-15, REQ-16, REQ-17, REQ-08 and the moved REQ-09 as six red/green commit pairs, plus the six rulings it takes against plugin HEAD) and its Plan 3 verification and scoring (REQ-21, REQ-22, REQ-06 with REQ-19, REQ-20, REQ-01, REQ-27 as six red/green commit pairs, plus the three tests it deliberately reverses) and its Plan 4 coverage and routing (REQ-04, REQ-11, REQ-25, REQ-24 as four red/green commit pairs, plus the corrected REQ-04 red test and the non-monotonic suite count the group produces) and its Plan 5 render and terminal gate (REQ-03, REQ-05, REQ-31 as three red/green commit pairs, plus the three-bucket next-action mapping and the narrowed REQ-05 scope) and its Plan 6 capability lanes (REQ-33, REQ-34, REQ-12, REQ-14, REQ-30 as five red/green commit pairs, plus the six rulings it takes against plugin HEAD and the opt-in prove lane it lands last), and the sec-overlay defect-repair spec (22 requirements in seven root-cause-ordered groups, a three-table cite-verification record against plugin 1.122.0, and three removals of unreachable capability that make the build a major version bump) with its Plan 1 phase/artifact contract (REQ-42, REQ-40, REQ-43, REQ-41, REQ-44 as five red/green commit pairs, plus the six rulings it takes against plugin 1.122.0 and the frozen-contract digest recomputation the `factcheck` deletion forces) and its Plan 2 dead-lever removal (REQ-45, REQ-46, REQ-47, REQ-48 as four red/green commit pairs, plus the five citation corrections and six rulings it takes against plugin 1.122.0, the redirect of REQ-47 from the live `scanscope.py` to the unreachable `scope.py`, and the four adjacent findings it records without fixing) and its Plan 3 constraint enforcers (REQ-49, REQ-50, REQ-51, REQ-52 as four red/green commit pairs, plus the five citation corrections and ten rulings it takes against plugin 1.122.0, the removal of the three `artifact-review` levers that closing the finding schema invalidates, and the four adjacent findings it records without fixing) and its Plan 4 population reconciliation (REQ-53, REQ-54, REQ-55, REQ-56, REQ-57, REQ-58 as six red/green commit pairs, plus the six citation corrections and twelve rulings it takes against plugin 1.122.0, the two tests it deliberately reverses, the shared triage-title helper that replaces an impossible `f.title` fix against a byte-pinned `models.py`, and the four adjacent findings it records without fixing) and its Plan 5 verify precision and document generation (REQ-59, REQ-60, REQ-61 as five red/green commit pairs, plus the seven citation corrections and fourteen rulings it takes against plugin 1.122.0, the narrowed REQ-59 acceptance criterion that a cross-file fix must stop reporting `not-fixed` rather than verify, the marker-driven `phase_docs.py` generator that collapses the roughly 18 documentation-drift entries into one generator plus one contract test, and the four adjacent findings it records without fixing), and the sec-overlay parked-findings spec (ten requirements, REQ-62 to REQ-71, repairing the eleven findings the five defect-repair plans parked in their git-ignored ledgers: three restated literals replaced by the constants that produce them, a mutating cluster reducer, a duplicated SARIF location, two behaviours an earlier specification mandated, a git-quoted diff path, a wall-clock concurrency test, and a whole-file STE100 rewrite of `sec_overlay/README.md` from a measured 125 lint errors to zero) with its Plan 1 parked code repairs (REQ-62 to REQ-70 as nine independent TDD tasks, one commit each, plus the four tasks whose shape the byte-frozen `models.py` and `evidence.py` force and the one deviation the 100-character ruff limit forces on REQ-62) and its Plan 2 package README STE rewrite (REQ-71 in eight tasks: a measured baseline with six text-anchored part boundaries, an acceptance test committed red, then six rewrite commits that each strictly reduce the test's reported error count until the last one turns it green) |\n| `docs/decisions/` | Project architecture decisions in the Decision / Context / Alternatives / Reasoning / Trade-offs / Supersedes form, one file per decision, listed in `docs/decisions/INDEX.md` (see `docs/decisions/README.md`). Holds the prove-lane execution boundary and the sec-overlay major-version decision that the `factcheck` deletion forces |\n| `docs/templates/plugin/` | New-plugin skeleton copied to `plugins/<name>/` and filled in per the root `CLAUDE.md` \"New plugin\" checklist |\n| `.pre-commit-config.yaml` | prek hook config: doc-update guard + commit message check |\n| `scripts/hooks/` | Hook scripts that enforce commit governance |\n| `scripts/openwiki-history-digest.sh` | Writes the bounded `.openwiki-history.md` change digest an OpenWiki update run reads in place of `git log` |\n| `CHANGELOG.md` | Common Changelog for repo-level changes; plugin changes live in `plugins/<name>/CHANGELOG.md` |\n| `SECURITY.md` | How to report vulnerabilities (GitHub private reporting) |\n| `.github/workflows/dependency-review.yml` | GitHub Dependency review on pull requests |\n| `.github/dependabot.yml` | Weekly Dependabot updates for Actions and pip |\n| `.github/codeql/codeql-config.yml` | CodeQL path exclusions (test fixtures, caches) |\n| `.github/workflows/sec-overlay-tests.yml` | sec-overlay pytest plus an offline detection-regression gate on pull requests |\n| `.gitignore` | Keeps caches, venvs, local secrets, and the vendored semgrep-rules clone out of git |\n| `.coderabbit.yaml` | CodeRabbit pull request review config: path rules, governance pre-merge checks, tool selection |\n| `.cursor/rules/codeguard-1-hardcoded-credentials.mdc` | Always-on Cursor rule: never commit secrets, API keys, or credentials |\n| `.openwikiignore` | Paths OpenWiki must not read during wiki init/update (separate from `.gitignore`) |\n| `openwiki/INSTRUCTIONS.md` | User-authored wiki brief for init and CI `--update`; OpenWiki does not rewrite it |\n| `.env.example` | Local OpenWiki provider, model, and telemetry-off settings (no secrets) |\n| `.github/workflows/openwiki-update.yml` | Weekly/manual OpenWiki `--update` that opens a PR using Anthropic Sonnet 5 |\n| `openwiki/` | Generated marketplace wiki (quickstart, marketplace, governance, sec-overlay, operations); do not hand-edit except `INSTRUCTIONS.md` |\n| `AGENTS.md` | OpenWiki pointer block for coding agents; the generated `<!-- OPENWIKI:START -->` region only |\n\n## Contributing\n\nAll changes go through feature branches with Conventional Commits. See [CLAUDE.md](CLAUDE.md) for detailed branching, commit, and code review processes. Root and plugin docs are split by audience: this README and the root `CHANGELOG.md` cover repo-level changes, while each plugin carries its own README, CHANGELOG, and maintainer CLAUDE.md under `plugins/<name>/`. Design specs and implementation plans for in-flight work live under `docs/superpowers/` (see [docs/README.md](docs/README.md)). CLAUDE.md's OpenWiki section covers when a generated page may be hand-edited.\n\n## License\n\nMIT\n",
  "bytes": 13177,
  "sha": "326d7707680100181f287a5ad9ad071034f273a51886dd06a716a87593d0ec1d",
  "repo_slug": "cjbischoff/cjbischoff-claude-code-tools",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/okf_cjbischoff_cjbischoff_claude_code_tools__ec3358c5/readme"
}