Merge pull request 'fix: audit fixes — metadata.json, stale profiles, canonical paths, validation' (#441 ) from fix/audit-metadata-profiles-validation into development

Reviewed-on: #441
fix: audit fixes — metadata.json, stale profiles, canonical paths, validation
2026-02-05 02:39:17 +00:00 · 2026-02-04 21:36:49 -05:00 · 2026-02-04 23:13:00 +00:00 · 2026-02-04 23:12:46 +00:00 · 2026-02-04 18:11:43 -05:00
7 changed files with 91 additions and 40 deletions
--- a/.claude-plugin/marketplace-full.json
+++ b/.claude-plugin/marketplace-full.json
@@ -6,12 +6,12 @@
  },
  "metadata": {
    "description": "Project management plugins with Gitea and NetBox integrations",
-    "version": "7.0.0"
+    "version": "7.1.0"
  },
  "plugins": [
    {
      "name": "projman",
-      "version": "3.4.0",
+      "version": "7.1.0",
      "description": "Sprint planning and project management with Gitea integration",
      "source": "./plugins/projman",
      "author": {
@@ -27,7 +27,7 @@
    },
    {
      "name": "doc-guardian",
-      "version": "1.1.0",
+      "version": "7.1.0",
      "description": "Automatic documentation drift detection and synchronization",
      "source": "./plugins/doc-guardian",
      "author": {
@@ -43,7 +43,7 @@
    },
    {
      "name": "code-sentinel",
-      "version": "1.0.1",
+      "version": "7.1.0",
      "description": "Security scanning and code refactoring tools",
      "source": "./plugins/code-sentinel",
      "author": {
@@ -59,7 +59,7 @@
    },
    {
      "name": "project-hygiene",
-      "version": "0.1.0",
+      "version": "7.1.0",
      "description": "Post-task cleanup hook that removes temp files and manages orphaned files",
      "source": "./plugins/project-hygiene",
      "author": {
@@ -75,7 +75,7 @@
    },
    {
      "name": "cmdb-assistant",
-      "version": "1.2.0",
+      "version": "7.1.0",
      "description": "NetBox CMDB integration with data quality validation and machine registration",
      "source": "./plugins/cmdb-assistant",
      "author": {
@@ -91,7 +91,7 @@
    },
    {
      "name": "claude-config-maintainer",
-      "version": "1.2.0",
+      "version": "7.1.0",
      "description": "CLAUDE.md and settings.local.json optimization for Claude Code projects",
      "source": "./plugins/claude-config-maintainer",
      "author": {
@@ -107,7 +107,7 @@
    },
    {
      "name": "clarity-assist",
-      "version": "1.2.0",
+      "version": "7.1.0",
      "description": "Prompt optimization and requirement clarification with ND-friendly accommodations",
      "source": "./plugins/clarity-assist",
      "author": {
@@ -123,7 +123,7 @@
    },
    {
      "name": "git-flow",
-      "version": "1.2.0",
+      "version": "7.1.0",
      "description": "Git workflow automation with intelligent commit messages and branch management",
      "source": "./plugins/git-flow",
      "author": {
@@ -139,7 +139,7 @@
    },
    {
      "name": "pr-review",
-      "version": "1.1.0",
+      "version": "7.1.0",
      "description": "Multi-agent pull request review with confidence scoring and actionable feedback",
      "source": "./plugins/pr-review",
      "author": {
@@ -155,7 +155,7 @@
    },
    {
      "name": "data-platform",
-      "version": "1.3.0",
+      "version": "7.1.0",
      "description": "Data engineering tools with pandas, PostgreSQL/PostGIS, and dbt integration",
      "source": "./plugins/data-platform",
      "author": {
@@ -171,7 +171,7 @@
    },
    {
      "name": "viz-platform",
-      "version": "1.1.0",
+      "version": "7.1.0",
      "description": "Visualization tools with Dash Mantine Components validation, Plotly charts, and theming",
      "source": "./plugins/viz-platform",
      "author": {
@@ -187,7 +187,7 @@
    },
    {
      "name": "contract-validator",
-      "version": "1.2.0",
+      "version": "7.1.0",
      "description": "Cross-plugin compatibility validation and Claude.md agent verification",
      "source": "./plugins/contract-validator",
      "author": {
--- a/.claude-plugin/marketplace-lean.json
+++ b/.claude-plugin/marketplace-lean.json
@@ -6,12 +6,12 @@
  },
  "metadata": {
    "description": "Project management plugins with Gitea and NetBox integrations",
-    "version": "7.0.0"
+    "version": "7.1.0"
  },
  "plugins": [
    {
      "name": "projman",
-      "version": "3.4.0",
+      "version": "7.1.0",
      "description": "Sprint planning and project management with Gitea integration",
      "source": "./plugins/projman",
      "author": {
@@ -27,7 +27,7 @@
    },
    {
      "name": "git-flow",
-      "version": "1.2.0",
+      "version": "7.1.0",
      "description": "Git workflow automation with intelligent commit messages and branch management",
      "source": "./plugins/git-flow",
      "author": {
@@ -43,7 +43,7 @@
    },
    {
      "name": "pr-review",
-      "version": "1.1.0",
+      "version": "7.1.0",
      "description": "Multi-agent pull request review with confidence scoring and actionable feedback",
      "source": "./plugins/pr-review",
      "author": {
@@ -59,7 +59,7 @@
    },
    {
      "name": "clarity-assist",
-      "version": "1.2.0",
+      "version": "7.1.0",
      "description": "Prompt optimization and requirement clarification with ND-friendly accommodations",
      "source": "./plugins/clarity-assist",
      "author": {
@@ -75,7 +75,7 @@
    },
    {
      "name": "code-sentinel",
-      "version": "1.0.1",
+      "version": "7.1.0",
      "description": "Security scanning and code refactoring tools",
      "source": "./plugins/code-sentinel",
      "author": {
@@ -91,7 +91,7 @@
    },
    {
      "name": "doc-guardian",
-      "version": "1.1.0",
+      "version": "7.1.0",
      "description": "Automatic documentation drift detection and synchronization",
      "source": "./plugins/doc-guardian",
      "author": {
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).

 ## [Unreleased]

+### Fixed
+
+- Confirmed projman `metadata.json` exists with gitea MCP mapping
+- Synced `marketplace-full.json` and `marketplace-lean.json` to current version (were stale)
+- Added `metadata.json` validation to `validate-marketplace.sh` — rejects `mcp_servers` in `plugin.json`, verifies MCP server references
+- Updated `CANONICAL-PATHS.md` to current version
+
+### Changed
+
+- Deprecated `switch-profile.sh` in favor of `claude-launch.sh`
+
 ---

 ## [7.1.0] - 2026-02-04
@@ -17,13 +28,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
  - Profiles: sprint (default), review, data, infra, full
  - Reduces token overhead from ~22K to ~4-6K tokens
  - Enables `ENABLE_TOOL_SEARCH=true` for MCP lazy loading
- **marketplace:** Lean/full profile switching to reduce token overhead
-  - New script: `scripts/switch-profile.sh` to toggle between profiles
-  - Lean profile: 6 plugins (projman, git-flow, pr-review, clarity-assist, code-sentinel, doc-guardian)
-  - Lean MCP: gitea only (reduces ~12k tokens of MCP server overhead)
-  - Full profile: all 12 plugins and 5 MCP servers
-  - New files: `.mcp-lean.json`, `.mcp-full.json`, `marketplace-lean.json`, `marketplace-full.json`
-  - Default is now lean profile for reduced daily overhead
+- **marketplace:** Lean/full profile config files for manual switching (superseded by `claude-launch.sh`)
+  - Files: `.mcp-lean.json`, `.mcp-full.json`, `marketplace-lean.json`, `marketplace-full.json`
+  - Script `scripts/switch-profile.sh` available but `claude-launch.sh` is the recommended approach
+  - Full profile remains the default baseline; launcher handles selective loading
 - **projman:** Token usage estimation reporting at sprint workflow boundaries
  - New skill: `token-budget-report.md` with MCP overhead and skill loading estimation model
  - Token report displayed at end of `/sprint-plan` and `/sprint-close`
--- a/README.md
+++ b/README.md
@@ -47,7 +47,7 @@ AI-guided sprint planning with full Gitea integration. Transforms a proven 15-sp

 **Commands:** `/sprint-plan`, `/sprint-start`, `/sprint-status`, `/sprint-close`, `/labels-sync`, `/pm-setup`, `/pm-review`, `/pm-test`, `/pm-debug`, `/suggest-version`, `/proposal-status`, `/rfc`

-#### [git-flow](./plugins/git-flow) *NEW in v3.0.0*
+#### [git-flow](./plugins/git-flow)
 **Git Workflow Automation**

 Smart git operations with intelligent commit messages and branch management.
@@ -60,7 +60,7 @@ Smart git operations with intelligent commit messages and branch management.

 **Commands:** `/git-commit`, `/git-commit-push`, `/git-commit-merge`, `/git-commit-sync`, `/branch-start`, `/branch-cleanup`, `/git-status`, `/git-config`

-#### [pr-review](./plugins/pr-review) *NEW in v3.0.0*
+#### [pr-review](./plugins/pr-review)
 **Multi-Agent PR Review**

 Comprehensive pull request review using specialized agents.
@@ -79,7 +79,7 @@ Analyze, optimize, and create CLAUDE.md configuration files. Audit and optimize

 **Commands:** `/analyze`, `/optimize`, `/init`, `/config-diff`, `/config-lint`, `/config-audit-settings`, `/config-optimize-settings`, `/config-permissions-map`

-#### [contract-validator](./plugins/contract-validator) *NEW in v5.0.0*
+#### [contract-validator](./plugins/contract-validator)
 **Cross-Plugin Compatibility Validation**

 Validate plugin marketplaces for command conflicts, tool overlaps, and broken agent references.
@@ -94,7 +94,7 @@ Validate plugin marketplaces for command conflicts, tool overlaps, and broken ag

 ### Productivity

-#### [clarity-assist](./plugins/clarity-assist) *NEW in v3.0.0*
+#### [clarity-assist](./plugins/clarity-assist)
 **Prompt Optimization with ND Accommodations**

 Transform vague requests into clear specifications using structured methodology.
@@ -137,7 +137,7 @@ Full CRUD operations for network infrastructure management directly from Claude

 ### Data Engineering

-#### [data-platform](./plugins/data-platform) *NEW in v4.0.0*
+#### [data-platform](./plugins/data-platform)
 **pandas, PostgreSQL/PostGIS, and dbt Integration**

 Comprehensive data engineering toolkit with persistent DataFrame storage.
@@ -152,7 +152,7 @@ Comprehensive data engineering toolkit with persistent DataFrame storage.

 ### Visualization

-#### [viz-platform](./plugins/viz-platform) *NEW in v4.0.0*
+#### [viz-platform](./plugins/viz-platform)
 **Dash Mantine Components Validation and Theming**

 Visualization toolkit with version-locked component validation and design token theming.
@@ -196,7 +196,7 @@ Full Gitea API integration for project management.
 | Wiki | `list_wiki_pages`, `get_wiki_page`, `create_wiki_page`, `update_wiki_page`, `create_lesson`, `search_lessons` |
 | Milestones | `list_milestones`, `get_milestone`, `create_milestone`, `update_milestone`, `delete_milestone` |
 | Dependencies | `list_issue_dependencies`, `create_issue_dependency`, `remove_issue_dependency`, `get_execution_order` |
-| **Pull Requests** | `list_pull_requests`, `get_pull_request`, `get_pr_diff`, `get_pr_comments`, `create_pr_review`, `add_pr_comment` *(NEW in v3.0.0)* |
+| **Pull Requests** | `list_pull_requests`, `get_pull_request`, `get_pr_diff`, `get_pr_comments`, `create_pr_review`, `add_pr_comment` |
 | Validation | `validate_repo_org`, `get_branch_protection` |

 ### NetBox MCP Server (shared)
@@ -211,7 +211,7 @@ Comprehensive NetBox REST API integration for infrastructure management.
 | Virtualization | Clusters, VMs, Interfaces |
 | Extras | Tags, Custom Fields, Audit Log |

-### Data Platform MCP Server (shared) *NEW in v4.0.0*
+### Data Platform MCP Server (shared)

 pandas, PostgreSQL/PostGIS, and dbt integration for data engineering.

@@ -222,7 +222,7 @@ pandas, PostgreSQL/PostGIS, and dbt integration for data engineering.
 | PostGIS | `st_tables`, `st_geometry_type`, `st_srid`, `st_extent` |
 | dbt | `dbt_parse`, `dbt_run`, `dbt_test`, `dbt_build`, `dbt_compile`, `dbt_ls`, `dbt_docs_generate`, `dbt_lineage` |

-### Viz Platform MCP Server (shared) *NEW in v4.0.0*
+### Viz Platform MCP Server (shared)

 Dash Mantine Components validation and visualization tools.

@@ -234,7 +234,7 @@ Dash Mantine Components validation and visualization tools.
 | Theme | `theme_create`, `theme_extend`, `theme_validate`, `theme_export_css`, `theme_list`, `theme_activate` |
 | Page | `page_create`, `page_add_navbar`, `page_set_auth`, `page_list`, `page_get_app_config` |

-### Contract Validator MCP Server (shared) *NEW in v5.0.0*
+### Contract Validator MCP Server (shared)

 Cross-plugin compatibility validation tools.

--- a/docs/CANONICAL-PATHS.md
+++ b/docs/CANONICAL-PATHS.md
@@ -2,7 +2,7 @@

 **This file defines ALL valid paths in this repository. No exceptions. No inference. No assumptions.**

-Last Updated: 2026-01-30 (v5.4.1)
+Last Updated: 2026-02-04 (v7.1.0)

 ---

@@ -12,10 +12,18 @@ Last Updated: 2026-01-30 (v5.4.1)
 leo-claude-mktplace/
 ├── .claude/                    # Claude Code local settings
 ├── .claude-plugin/             # Marketplace manifest
-│   └── marketplace.json
+│   ├── marketplace.json
+│   ├── marketplace-lean.json   # Lean profile (6 core plugins)
+│   └── marketplace-full.json   # Full profile (all plugins)
+├── .mcp-lean.json              # Lean profile MCP config (gitea only)
+├── .mcp-full.json              # Full profile MCP config (all servers)
 ├── .scratch/                   # Transient work (auto-cleaned)
 ├── docs/                       # All documentation
 │   ├── architecture/           # Draw.io diagrams and specs
+│   ├── prompts/                # Shared prompt templates
+│   │   └── INDEX.md            # Prompt template index
+│   ├── project-lessons-learned/ # Project-level lessons (not sprint-specific)
+│   │   └── INDEX.md            # Lessons index
 │   ├── CANONICAL-PATHS.md      # This file - single source of truth
 │   ├── COMMANDS-CHEATSHEET.md  # All commands quick reference
 │   ├── CONFIGURATION.md        # Centralized configuration guide
@@ -150,7 +158,9 @@ leo-claude-mktplace/
 │   ├── validate-marketplace.sh # Marketplace compliance validation
 │   ├── verify-hooks.sh         # Verify all hooks use correct event types
 │   ├── setup-venvs.sh          # Setup MCP server venvs (create only, never delete)
-│   └── release.sh              # Release automation with version bumping
+│   ├── release.sh              # Release automation with version bumping
+│   ├── claude-launch.sh        # Task-specific launcher with profile selection
+│   └── switch-profile.sh       # DEPRECATED: use claude-launch.sh instead
 ├── CLAUDE.md
 ├── README.md
 ├── LICENSE
@@ -168,6 +178,7 @@ leo-claude-mktplace/
 |---------|---------|---------|
 | Plugin location | `plugins/{plugin-name}/` | `plugins/projman/` |
 | Plugin manifest | `plugins/{plugin-name}/.claude-plugin/plugin.json` | `plugins/projman/.claude-plugin/plugin.json` |
+| Plugin MCP mapping (optional) | `plugins/{plugin-name}/.claude-plugin/metadata.json` | `plugins/projman/.claude-plugin/metadata.json` |
 | Plugin commands | `plugins/{plugin-name}/commands/` | `plugins/projman/commands/` |
 | Plugin agents | `plugins/{plugin-name}/agents/` | `plugins/projman/agents/` |
 | Plugin skills | `plugins/{plugin-name}/skills/` | `plugins/projman/skills/` |
@@ -305,6 +316,7 @@ All MCP servers are defined in `.mcp.json` at repository root:

 | Date | Change | By |
 |------|--------|-----|
+| 2026-02-04 | v7.1.0: Added profile configs, prompts/, project-lessons-learned/, metadata.json, deprecated switch-profile.sh | Claude Code |
 | 2026-01-30 | v5.5.0: Removed plugin-level mcp-servers symlinks - all MCP config now in root .mcp.json | Claude Code |
 | 2026-01-26 | v5.0.0: Added contract-validator plugin and MCP server | Claude Code |
 | 2026-01-26 | v4.1.0: Added viz-platform plugin and MCP server | Claude Code |
--- a/scripts/switch-profile.sh
+++ b/scripts/switch-profile.sh
@@ -4,6 +4,8 @@

 set -euo pipefail

+echo "⚠️  DEPRECATED: use scripts/claude-launch.sh instead." >&2
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT_DIR="$(dirname "$SCRIPT_DIR")"
 MARKETPLACE_DIR="$ROOT_DIR/.claude-plugin"
--- a/scripts/validate-marketplace.sh
+++ b/scripts/validate-marketplace.sh
@@ -206,6 +206,35 @@ for plugin_dir in "$PLUGINS_DIR"/*/; do
    echo "✓ $plugin_name valid"
 done

+echo ""
+echo "=== Validating Plugin Metadata (MCP Mappings) ==="
+
+for plugin_dir in "$PLUGINS_DIR"/*/; do
+    plugin_name=$(basename "$plugin_dir")
+    metadata_json="$plugin_dir.claude-plugin/metadata.json"
+
+    if jq -e '.mcp_servers' "$plugin_dir.claude-plugin/plugin.json" >/dev/null 2>&1; then
+        echo "ERROR: $plugin_name/plugin.json contains 'mcp_servers' — move to metadata.json"
+        exit 1
+    fi
+
+    if [[ -f "$metadata_json" ]]; then
+        if ! jq empty "$metadata_json" 2>/dev/null; then
+            echo "ERROR: Invalid JSON in $plugin_name/.claude-plugin/metadata.json"
+            exit 1
+        fi
+        mcp_servers=$(jq -r '.mcp_servers // [] | .[]' "$metadata_json" 2>/dev/null)
+        for server in $mcp_servers; do
+            if [[ ! -d "$ROOT_DIR/mcp-servers/$server" ]]; then
+                echo "ERROR: $plugin_name metadata.json references '$server' but mcp-servers/$server/ missing"
+                exit 1
+            fi
+            echo "  ✓ $plugin_name → $server"
+        done
+    fi
+done
+echo "✓ Plugin metadata validation passed"
+
 # CRITICAL: Validate marketplace.json file references
 echo ""
 echo "=== Validating Marketplace File References (CRITICAL) ==="
Author	SHA1	Message	Date
Leo Miranda	faafbd56f5	Merge pull request 'fix: audit fixes — metadata.json, stale profiles, canonical paths, validation' (#441 ) from fix/audit-metadata-profiles-validation into development Reviewed-on: #441	2026-02-05 02:39:17 +00:00
lmiranda	7380b07312	fix: audit fixes — metadata.json, stale profiles, canonical paths, validation - Confirmed/created projman metadata.json with gitea mapping - Synced profile JSONs to current version - Added metadata.json validation to validate-marketplace.sh - Updated CANONICAL-PATHS.md to current version - Deprecated switch-profile.sh in favor of claude-launch.sh Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-04 21:36:49 -05:00
Leo Miranda	4cbcc7d391	Merge pull request 'development' (#440 ) from development into main Reviewed-on: #440	2026-02-04 23:13:00 +00:00
Leo Miranda	4baad6c2b5	Merge pull request 'docs: remove stale NEW markers and fix changelog accuracy' (#439 ) from docs/cleanup-stale-markers into development Reviewed-on: #439	2026-02-04 23:12:46 +00:00
lmiranda	398fc50099	docs: remove stale NEW markers and fix changelog accuracy - Remove 10 stale "NEW in vX.X.X" markers from README.md - Fix CHANGELOG [7.1.0] to clarify switch-profile.sh is superseded - Correct that full profile is the default baseline (not lean) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-02-04 18:11:43 -05:00