v1.8.0 — the review backlog, closed and checked

A six-lens review before publishing produced 33 findings. Twelve turned out to
have been fixed incidentally by other work, which was established by re-checking
each one against the current files rather than trusting the list. Six were still
open and are closed here. The rest were declined with reasons on the record.

Two statuses were unreachable. The finding standard defined CONFIRMED and
PLAUSIBLE; the walkthrough and the finding template asked for CLOSED and
ACCEPTED as well. An agent following the protocol could never emit two of the
statuses the template told it to fill in. Both now appear where they are
defined, marked as belonging to a finding's later life rather than to the audit
that raised it.

The gate listed what it does not read, and left out three files. One is
LICENSE — the only shipped file that carries a real identity on purpose, and
therefore the one exclusion a forker actually needs to know about.

CONTRIBUTING never mentioned versions while CI hard-fails a payload change
without a bump. overlays/ is payload and an overlay is the contribution this
project asks for first, so the most-wanted contribution arrived with red CI and
nothing explaining why. There is now a section that says what to bump and why
the rule exists.

Two advertisements became checks. The marketplace catalog's own version was
kept in lockstep by hand and guarded by nothing. The README's phase and overlay
badge counts sat unverified on the file every visitor reads first. Both are now
asserted against the repository, and both were mutation-tested before landing.

Install

claude plugin marketplace add sturec5/code-audit-protocol
claude plugin install audit-protocol@code-audit-protocol