bump(adobe-for-creativity): 253f5690 → a5a5e4e4

bump(data-agent-kit-starter-pack): b47cae53 → c125eaea (#2571 )
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-06-10 18:23:36 +00:00 · 2026-06-10 18:02:01 +00:00 · 2026-06-10 07:59:42 -05:00 · 2026-06-10 07:59:20 -05:00 · 2026-06-10 07:58:57 -05:00 · 2026-06-10 07:58:34 -05:00
19 changed files with 1131 additions and 155 deletions
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -19,7 +19,7 @@
        "url": "https://github.com/42Crunch-AI/claude-plugins.git",
        "path": "plugins/api-security-testing",
        "ref": "v1.5.5",
-        "sha": "db2fb7e53e3d93a863930b6f6b7895be5ee01f21"
+        "sha": "b7e131e30ff033be2176faf796c94c151a68c63a"
      },
      "homepage": "https://42crunch.com"
    },
@@ -35,7 +35,7 @@
        "url": "https://github.com/adobe/skills.git",
        "path": "plugins/creative-cloud/adobe-for-creativity",
        "ref": "main",
-        "sha": "e23271f65aa7572f567d085d6baec5c2408e2ad5"
+        "sha": "a5a5e4e401029cf85fa4b4bb452d0f039900ad43"
      },
      "homepage": "https://github.com/adobe/skills/tree/main/plugins/creative-cloud/adobe-for-creativity"
    },
@@ -67,7 +67,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/endorlabs/ai-plugins.git",
-        "sha": "975f0ce422b1f2677681ffd085aef34ea1826b70"
+        "sha": "a6737fcf72336399e212e45cd25a250c2df3b7b4"
      },
      "homepage": "https://www.endorlabs.com"
    },
@@ -93,7 +93,7 @@
        "url": "https://github.com/Airtable/skills.git",
        "path": "plugins/airtable",
        "ref": "main",
-        "sha": "21d2fe52774d861e2f2f997eeac2bf965e8590b8"
+        "sha": "295ab93b7d765912ee1a0dc7f1abb0ecaf73f138"
      },
      "homepage": "https://www.airtable.com"
    },
@@ -109,7 +109,7 @@
        "url": "https://github.com/airwallex/airwallex-marketplace.git",
        "path": "plugins/airwallex",
        "ref": "master",
-        "sha": "a903ab7693a5f6d46f2fab6f895a2f96a879ee0f"
+        "sha": "a49ef1ec801fd776adc4db9f2bb4a78463981bc9"
      },
      "homepage": "https://www.airwallex.com/docs"
    },
@@ -150,7 +150,7 @@
        "url": "https://github.com/awslabs/agent-plugins.git",
        "path": "plugins/amazon-location-service",
        "ref": "main",
-        "sha": "fc54dfa24a1f05095b9fcbb4baa4750996bb171d"
+        "sha": "b13ce7f008c52be10c3fcccce25d64ec614e76be"
      },
      "homepage": "https://github.com/awslabs/agent-plugins"
    },
@@ -223,7 +223,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/astronomer/agents.git",
-        "sha": "7ce4a12d3cabb506294134c91a1b876d4b166a70"
+        "sha": "789b4544b85a989694501e4f405b522f2d711cf6"
      },
      "homepage": "https://github.com/astronomer/agents"
    },
@@ -244,7 +244,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/atlassian/atlassian-mcp-server.git",
-        "sha": "9b52fb18e184edc307ce33f8bf4cdf148dedf1f2"
+        "sha": "f4911dba81f25782c88815b03deabf444cd46e0d"
      },
      "homepage": "https://github.com/atlassian/atlassian-mcp-server"
    },
@@ -291,7 +291,7 @@
        "url": "https://github.com/aws/agent-toolkit-for-aws.git",
        "path": "plugins/aws-agents",
        "ref": "main",
-        "sha": "df13dea64baaa1b7031b25d1b2f380756131efec"
+        "sha": "c0991f463b54ac94af32a730d6d13293dcff98cf"
      },
      "homepage": "https://github.com/aws/agent-toolkit-for-aws"
    },
@@ -304,7 +304,7 @@
        "url": "https://github.com/awslabs/agent-plugins.git",
        "path": "plugins/aws-amplify",
        "ref": "main",
-        "sha": "fc54dfa24a1f05095b9fcbb4baa4750996bb171d"
+        "sha": "b13ce7f008c52be10c3fcccce25d64ec614e76be"
      },
      "homepage": "https://github.com/awslabs/agent-plugins"
    },
@@ -320,7 +320,7 @@
        "url": "https://github.com/aws/agent-toolkit-for-aws.git",
        "path": "plugins/aws-core",
        "ref": "main",
-        "sha": "df13dea64baaa1b7031b25d1b2f380756131efec"
+        "sha": "c0991f463b54ac94af32a730d6d13293dcff98cf"
      },
      "homepage": "https://github.com/aws/agent-toolkit-for-aws"
    },
@@ -336,7 +336,7 @@
        "url": "https://github.com/aws/agent-toolkit-for-aws.git",
        "path": "plugins/aws-data-analytics",
        "ref": "main",
-        "sha": "df13dea64baaa1b7031b25d1b2f380756131efec"
+        "sha": "c0991f463b54ac94af32a730d6d13293dcff98cf"
      },
      "homepage": "https://github.com/aws/agent-toolkit-for-aws"
    },
@@ -365,7 +365,7 @@
        "url": "https://github.com/awslabs/agent-plugins.git",
        "path": "plugins/aws-serverless",
        "ref": "main",
-        "sha": "fc54dfa24a1f05095b9fcbb4baa4750996bb171d"
+        "sha": "b13ce7f008c52be10c3fcccce25d64ec614e76be"
      },
      "homepage": "https://github.com/awslabs/agent-plugins"
    },
@@ -381,7 +381,7 @@
        "url": "https://github.com/awslabs/startups.git",
        "path": "advisor/plugins/aws-startup-advisor",
        "ref": "main",
-        "sha": "1dd909352dc228f978c2685724cb38e64efe6be4"
+        "sha": "3c5d6a7deb24c3318be8b78ef75545539ab1bbcd"
      },
      "homepage": "https://github.com/awslabs/startups"
    },
@@ -392,7 +392,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/microsoft/azure-skills.git",
-        "sha": "02a614f6ee1f052826f834d65c61e430ad152c8e"
+        "sha": "966330ee4fc61978b6e324993687e917125a1f36"
      },
      "homepage": "https://github.com/microsoft/azure-skills"
    },
@@ -472,7 +472,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/brightdata/skills.git",
-        "sha": "3e6d0838285cbc107b86d61e2e1a943baf7ead29"
+        "sha": "bd5bd76bc889f54b744bab3db3cbd42751a1e5b0"
      },
      "homepage": "https://docs.brightdata.com"
    },
@@ -502,7 +502,7 @@
        "url": "https://github.com/carta/plugins.git",
        "path": "plugins/carta-cap-table",
        "ref": "main",
-        "sha": "0227331a2f2e5bc34485f3473d1046a3a52084d7"
+        "sha": "4b60ca6616ce614dacb306c2e3433aeca6ce3b5b"
      },
      "homepage": "https://carta.com"
    },
@@ -518,7 +518,7 @@
        "url": "https://github.com/carta/plugins.git",
        "path": "plugins/carta-crm",
        "ref": "main",
-        "sha": "0227331a2f2e5bc34485f3473d1046a3a52084d7"
+        "sha": "4b60ca6616ce614dacb306c2e3433aeca6ce3b5b"
      },
      "homepage": "https://carta.com"
    },
@@ -534,7 +534,7 @@
        "url": "https://github.com/carta/plugins.git",
        "path": "plugins/carta-investors",
        "ref": "main",
-        "sha": "0227331a2f2e5bc34485f3473d1046a3a52084d7"
+        "sha": "4b60ca6616ce614dacb306c2e3433aeca6ce3b5b"
      },
      "homepage": "https://carta.com"
    },
@@ -561,7 +561,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/ChromeDevTools/chrome-devtools-mcp.git",
-        "sha": "7afd01673f99126e3cd98eb7f62190d7784ef71a"
+        "sha": "4f8eb7ad6beecc58f56ec383f9ff43549a5604d4"
      },
      "homepage": "https://github.com/ChromeDevTools/chrome-devtools-mcp"
    },
@@ -752,7 +752,7 @@
    },
    {
      "name": "code-modernization",
-      "description": "Modernize legacy codebases (COBOL, legacy Java/C++, monolith web apps) with a structured assess / map / extract-rules / reimagine / transform / harden workflow and specialist review agents",
+      "description": "Modernize legacy codebases (COBOL, legacy Java/C++, monolith web apps) with a structured preflight / assess / map / extract-rules / brief / reimagine / transform / harden workflow, an interactive topology viewer, and specialist review agents",
      "author": {
        "name": "Anthropic",
        "email": "support@anthropic.com"
@@ -804,7 +804,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/CodSpeedHQ/codspeed.git",
-        "sha": "9793aaf9c8198eec58a5fa63d940712bf33b3fc5"
+        "sha": "c6112f168b405df8e7310b12a9b80484cd01ac14"
      },
      "homepage": "https://codspeed.io"
    },
@@ -872,7 +872,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/CrowdStrike/foundry-skills.git",
-        "sha": "c542c932956fd19177a62b94577f288c832d4680"
+        "sha": "0a651a1472e4c03603780517374c654236bcce8b"
      },
      "homepage": "https://github.com/CrowdStrike/foundry-skills"
    },
@@ -929,7 +929,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/astronomer/agents.git",
-        "sha": "7ce4a12d3cabb506294134c91a1b876d4b166a70"
+        "sha": "789b4544b85a989694501e4f405b522f2d711cf6"
      },
      "homepage": "https://github.com/astronomer/agents"
    },
@@ -943,7 +943,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/gemini-cli-extensions/data-agent-kit-starter-pack.git",
-        "sha": "fb9086456d5fbc780edf86f0ac413345ba628173"
+        "sha": "c125eaea039b9440b306b428ee2068d79123ddb7"
      },
      "homepage": "https://github.com/gemini-cli-extensions/data-agent-kit-starter-pack"
    },
@@ -953,7 +953,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/astronomer/agents.git",
-        "sha": "7ce4a12d3cabb506294134c91a1b876d4b166a70"
+        "sha": "789b4544b85a989694501e4f405b522f2d711cf6"
      },
      "homepage": "https://github.com/astronomer/agents"
    },
@@ -966,7 +966,7 @@
        "url": "https://github.com/awslabs/agent-plugins.git",
        "path": "plugins/databases-on-aws",
        "ref": "main",
-        "sha": "fc54dfa24a1f05095b9fcbb4baa4750996bb171d"
+        "sha": "b13ce7f008c52be10c3fcccce25d64ec614e76be"
      },
      "homepage": "https://github.com/awslabs/agent-plugins"
    },
@@ -1008,7 +1008,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/gemini-cli-extensions/dataproc.git",
-        "sha": "20eec06eee7683311689f4a1437cbb14ac8cd33e"
+        "sha": "80d126d27d84ded752c84668472dd6f75896fc59"
      },
      "homepage": "https://github.com/gemini-cli-extensions/dataproc"
    },
@@ -1022,7 +1022,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/datarobot-oss/datarobot-agent-skills.git",
-        "sha": "b5a8f7a4bc4d31a1f139a232efbba6127af0474a"
+        "sha": "ec2ecdd49d54ef490b344a850cff1feb1230c409"
      },
      "homepage": "https://datarobot.com"
    },
@@ -1035,7 +1035,7 @@
        "url": "https://github.com/microsoft/Dataverse-skills.git",
        "path": ".github/plugins/dataverse",
        "ref": "main",
-        "sha": "2d50cf65f80efc17ac50632222d61fb374115a70"
+        "sha": "2c37394346be1afc1db12cc5b89f5dee3617c45c"
      },
      "homepage": "https://github.com/microsoft/Dataverse-skills"
    },
@@ -1048,7 +1048,7 @@
        "url": "https://github.com/awslabs/agent-plugins.git",
        "path": "plugins/deploy-on-aws",
        "ref": "main",
-        "sha": "fc54dfa24a1f05095b9fcbb4baa4750996bb171d"
+        "sha": "b13ce7f008c52be10c3fcccce25d64ec614e76be"
      },
      "homepage": "https://github.com/awslabs/agent-plugins"
    },
@@ -1126,7 +1126,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/exa-labs/exa-mcp-server.git",
-        "sha": "f08388256c5806f457fae777b5528eb02a48e703"
+        "sha": "9ea4ba3e67f87c462c3e06b192470e837ed9009e"
      },
      "homepage": "https://exa.ai/docs/reference/exa-mcp"
    },
@@ -1150,7 +1150,7 @@
        "url": "https://github.com/expo/skills.git",
        "path": "plugins/expo",
        "ref": "main",
-        "sha": "145a923cce95c2cef20643302e8811363fa2e51d"
+        "sha": "c38860242118df93d4ec4381a34f4144fff61928"
      },
      "homepage": "https://github.com/expo/skills/blob/main/plugins/expo/README.md"
    },
@@ -1166,7 +1166,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/fastly/fastly-agent-toolkit.git",
-        "sha": "6bd17d685a1b361a2b368bf0236f39efb1be62d6"
+        "sha": "73af5b94a98448ffeed6e2993495dc83c9a597be"
      },
      "homepage": "https://github.com/fastly/fastly-agent-toolkit/blob/main/README.md"
    },
@@ -1198,7 +1198,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/figma/mcp-server-guide.git",
-        "sha": "a742f0a700a7772ff5ed85f7c9fc1dad5afa9fcc"
+        "sha": "54ad156019d7362a56d8024b9adbe99952aa29b6"
      },
      "homepage": "https://github.com/figma/mcp-server-guide"
    },
@@ -1216,7 +1216,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/firecrawl/firecrawl-claude-plugin.git",
-        "sha": "6768fb78185aab9e5b5a04777f84703863fb025b"
+        "sha": "b33447585ac521b091eae672bd4cad4ec1d093f6"
      },
      "homepage": "https://github.com/firecrawl/firecrawl-claude-plugin.git"
    },
@@ -1244,7 +1244,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/atlassian/forge-skills.git",
-        "sha": "02103cca4addb4c42d64d4e18a9d1a7f186edf6c"
+        "sha": "c7df956176eb1c2a10ffabc4eaacc5d843d8bede"
      },
      "homepage": "https://developer.atlassian.com/platform/forge/"
    },
@@ -1347,7 +1347,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/hunter-io/claude-plugin.git",
-        "sha": "494b0bd6ac252c7c8d78402cb51c7f635b1469ad"
+        "sha": "06bcb94a4e6498d8557a4543f8d5c4ea429b0c0a"
      },
      "homepage": "https://hunter.io"
    },
@@ -1361,7 +1361,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/heygen-com/hyperframes.git",
-        "sha": "1fd1b3164a87221fbb5c9e01557125d13e829554"
+        "sha": "81416ab3c9b04ca87d399e9b558ec7227b7d641c"
      },
      "homepage": "https://hyperframes.heygen.com"
    },
@@ -1415,7 +1415,7 @@
        "source": "github",
        "repo": "jfrog/claude-plugin",
        "commit": "259c8e718266c16e99b4f30ae9b1ed0f9f00d98d",
-        "sha": "8324c7fc9a5561398fe57b8a56db53bdbf1e2cda"
+        "sha": "6788fe15d4a63d47f038c05e58ae533aeb2dadb6"
      },
      "homepage": "https://jfrog.com"
    },
@@ -1540,7 +1540,7 @@
        "url": "https://github.com/pydantic/skills.git",
        "path": "plugins/logfire",
        "ref": "main",
-        "sha": "e412b6d8d4b6199ac577c5ee8653dcff840b3e92"
+        "sha": "ddc7d00569458f3838c6cf489f5be6c59afaf8c1"
      },
      "homepage": "https://github.com/pydantic/skills/tree/main/plugins/logfire"
    },
@@ -1708,7 +1708,7 @@
        "url": "https://github.com/awslabs/startups.git",
        "path": "migrate/plugins/migration-to-aws",
        "ref": "main",
-        "sha": "1dd909352dc228f978c2685724cb38e64efe6be4"
+        "sha": "3c5d6a7deb24c3318be8b78ef75545539ab1bbcd"
      },
      "homepage": "https://github.com/awslabs/startups"
    },
@@ -1759,7 +1759,7 @@
        "url": "https://github.com/neondatabase/agent-skills.git",
        "path": "plugins/neon-postgres",
        "ref": "main",
-        "sha": "bd9ec7ff273ce54bdd3ebe581d5b0802a3479618"
+        "sha": "9695a225d56ea55569a8b3a0b7294fb01c23b4ff"
      },
      "homepage": "https://github.com/neondatabase/agent-skills/tree/main/plugins/neon-postgres"
    },
@@ -1770,7 +1770,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/netlify/context-and-tools.git",
-        "sha": "5f777ba63df12f4eb189be4c58bd35d0c8316505"
+        "sha": "22025ef6c9dc9ef88d0c9c047980c10cacb178ee"
      },
      "homepage": "https://github.com/netlify/context-and-tools"
    },
@@ -1839,7 +1839,7 @@
        "url": "https://github.com/NVIDIA/skills.git",
        "path": "plugins/nvidia-skills",
        "ref": "main",
-        "sha": "e29b3c65dd0292e3f9f851b15eefe5a7c2023dd7"
+        "sha": "24806dbdb4f45b9d8c476c0e7a9b223b8c9e7197"
      },
      "homepage": "https://github.com/NVIDIA/skills"
    },
@@ -1855,7 +1855,7 @@
        "url": "https://github.com/oracle-samples/oracle-aidp-samples.git",
        "path": "ai/claude-code-plugins/oracle-ai-data-platform-workbench-spark-connectors",
        "ref": "main",
-        "sha": "04cc355fbb01402402dd69a4a425a078413a28ea"
+        "sha": "00cedef34c99d642d969f87965736768de01cbd6"
      },
      "homepage": "https://docs.oracle.com/en/cloud/paas/ai-data-platform/index.html"
    },
@@ -1885,7 +1885,7 @@
        "url": "https://github.com/growthxai/output.git",
        "path": "coding_assistants/claude/plugins/outputai",
        "ref": "main",
-        "sha": "2cc4685ebadfba9586f01890df48e1b25bd1049a"
+        "sha": "83742db514fc4ab1d18b1277cd9cc1e28a95e732"
      },
      "homepage": "https://output.ai"
    },
@@ -1995,7 +1995,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/PostHog/ai-plugin.git",
-        "sha": "9105eb4d6f00623ea782fbf61257f1ce94ba7dac"
+        "sha": "db4a86632293ca66eec9a6d278786ddb22c1787e"
      },
      "homepage": "https://posthog.com/docs/model-context-protocol"
    },
@@ -2050,7 +2050,7 @@
        "url": "https://github.com/pydantic/skills.git",
        "path": "plugins/ai",
        "ref": "main",
-        "sha": "e412b6d8d4b6199ac577c5ee8653dcff840b3e92"
+        "sha": "ddc7d00569458f3838c6cf489f5be6c59afaf8c1"
      },
      "homepage": "https://github.com/pydantic/skills/tree/main/plugins/ai"
    },
@@ -2088,7 +2088,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/qdrant/skills.git",
-        "sha": "11df00a7b62b0cd1a552baac63ac821df1aa9eed"
+        "sha": "0814a0875db7a31bf29e46821668ef1b07f9f696"
      },
      "homepage": "https://skills.qdrant.tech"
    },
@@ -2127,7 +2127,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/quarkusio/quarkus-agent-mcp.git",
-        "sha": "e711107a1171507212dd0edd17b5a922212c3a97"
+        "sha": "f5c0dd4c4387531a1d5fcc2717030f2c5f41db85"
      },
      "homepage": "https://quarkus.io"
    },
@@ -2140,7 +2140,7 @@
        "url": "https://github.com/railwayapp/railway-skills.git",
        "path": "plugins/railway",
        "ref": "main",
-        "sha": "1df604ebd18f528ff16b84975125ecff944cc036"
+        "sha": "72299c62ad19a5b1e7646262f3ba9cdd96d6e2a3"
      },
      "homepage": "https://docs.railway.com/ai/claude-code-plugin"
    },
@@ -2163,7 +2163,7 @@
        "source": "url",
        "url": "https://github.com/RevenueCat/rc-claude-code-plugin.git",
        "path": "revenuecat",
-        "sha": "b34f9bebe02ceb7e3f32e6d7d081cdfb2e7c37a6"
+        "sha": "473fd504bf13d25e76bf4a0267b42be3794f6266"
      },
      "homepage": "https://www.revenuecat.com"
    },
@@ -2215,7 +2215,7 @@
        "source": "url",
        "url": "https://github.com/RevenueCat/rc-claude-code-plugin.git",
        "path": "revenuecat",
-        "sha": "b34f9bebe02ceb7e3f32e6d7d081cdfb2e7c37a6"
+        "sha": "473fd504bf13d25e76bf4a0267b42be3794f6266"
      },
      "homepage": "https://www.revenuecat.com"
    },
@@ -2300,7 +2300,7 @@
        "url": "https://github.com/awslabs/agent-plugins.git",
        "path": "plugins/sagemaker-ai",
        "ref": "main",
-        "sha": "fc54dfa24a1f05095b9fcbb4baa4750996bb171d"
+        "sha": "d8243e5f8f3933d656b3bdfe09cd658a5d9b9fac"
      },
      "homepage": "https://github.com/awslabs/agent-plugins"
    },
@@ -2348,7 +2348,7 @@
        "url": "https://github.com/SAP/open-ux-tools.git",
        "path": "packages/fiori-mcp-server",
        "ref": "main",
-        "sha": "f6e9ae1f44a45886c14f6c2c6f31fc06e256c3e2"
+        "sha": "81b88637563446eb747ac93a31b8b3faee44a78d"
      },
      "homepage": "https://github.com/SAP/open-ux-tools/tree/main/packages/fiori-mcp-server"
    },
@@ -2415,7 +2415,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/getsentry/sentry-for-claude.git",
-        "sha": "030b01fb76b21f5d7ef6af5a3c3dfa658a9b5024"
+        "sha": "9780bfc111f97b359893169e79c33d1e393891e5"
      },
      "homepage": "https://github.com/getsentry/sentry-for-claude/tree/main"
    },
@@ -2431,7 +2431,7 @@
        "url": "https://github.com/getsentry/cli.git",
        "path": "plugins/sentry-cli",
        "ref": "main",
-        "sha": "329f5c5d2e0d97f26a121fb636b58b7eb81d3a8e"
+        "sha": "18111b95ac8819d58e4f0334d4b8ee8f72513d1e"
      },
      "homepage": "https://sentry.io"
    },
@@ -2534,7 +2534,7 @@
        "url": "https://github.com/Snowflake-Labs/snowflake-ai-kit.git",
        "path": "plugins/cortex-code",
        "ref": "main",
-        "sha": "6a22eb1ff3b451c35e40468a118bbee54610c9bd"
+        "sha": "7d2c7e7e0788e255019a64a8690aa5f85d073a2c"
      },
      "homepage": "https://docs.snowflake.com/en/user-guide/cortex-code"
    },
@@ -2548,7 +2548,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/SonarSource/sonarqube-agent-plugins.git",
-        "sha": "712b93281f4e67c16ed9b81dde090e1f73f8bfc8"
+        "sha": "8c46904b2c21eb98d827c185e15ef5f6dd820312"
      },
      "homepage": "https://www.sonarsource.com"
    },
@@ -2608,7 +2608,7 @@
        "url": "https://github.com/stripe/ai.git",
        "path": "providers/claude/plugin",
        "ref": "main",
-        "sha": "b8f6adcb5d05f6ff01334411561ee8cb1ec014c6"
+        "sha": "d076d0558c3b3d86149c2dddc84054fe9c6dd3e0"
      },
      "homepage": "https://github.com/stripe/ai/tree/main/providers/claude/plugin"
    },
@@ -2620,7 +2620,7 @@
        "source": "url",
        "url": "https://github.com/sumup/sumup-skills.git",
        "path": "providers/claude/plugin",
-        "sha": "715464b459def2d16e930e9ec8008f60e18a8b4d"
+        "sha": "5b9b2d72c63fefd9038db0a9c571d3d64ff6353c"
      },
      "homepage": "https://www.sumup.com/"
    },
@@ -2707,7 +2707,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/togethercomputer/skills.git",
-        "sha": "fb94cc1402900eb608c31e7102fc23566f8b0363"
+        "sha": "8aa08ca126a50d5e76f6d378f47386cee4267984"
      },
      "homepage": "https://www.together.ai"
    },
@@ -2769,7 +2769,7 @@
        "url": "https://github.com/UI5/plugins-coding-agents.git",
        "path": "plugins/ui5",
        "ref": "main",
-        "sha": "9b3d7d80356f687725f9584988e4038dbead0d53"
+        "sha": "6d72751f0b2983c379aaa457fe4c7cf4a075a66d"
      },
      "homepage": "https://github.com/UI5/plugins-coding-agents"
    },
@@ -2787,7 +2787,7 @@
        "url": "https://github.com/UI5/plugins-coding-agents.git",
        "path": "plugins/ui5-typescript-conversion",
        "ref": "main",
-        "sha": "9b3d7d80356f687725f9584988e4038dbead0d53"
+        "sha": "6d72751f0b2983c379aaa457fe4c7cf4a075a66d"
      },
      "homepage": "https://github.com/UI5/plugins-coding-agents"
    },
@@ -2803,7 +2803,7 @@
        "url": "https://github.com/val-town/plugins.git",
        "path": "plugin",
        "ref": "main",
-        "sha": "a3e884685d1914f28ce029e4f35acd17442e883f"
+        "sha": "02631f998eda9b88d73d699703b062db059d506b"
      },
      "homepage": "https://val.town"
    },
@@ -2881,7 +2881,7 @@
      "source": {
        "source": "url",
        "url": "https://github.com/wix/skills.git",
-        "sha": "8ed898abcfa5fb3ff8e43c4c1c39d7a55d9cedef"
+        "sha": "cda44c29c9155f6e7b3440f953969721aed246be"
      },
      "homepage": "https://dev.wix.com/docs/wix-cli/guides/development/about-wix-skills"
    },
@@ -2907,7 +2907,7 @@
        "url": "https://github.com/workos/skills.git",
        "path": "plugins/workos",
        "ref": "main",
-        "sha": "e8900cc504fd759407d1a963d13f59383fa39ebc"
+        "sha": "2c3acef61ea29296cb6e73e0c59fb5e98f0b1847"
      },
      "homepage": "https://workos.com"
    },
--- a/plugins/code-modernization/.claude-plugin/plugin.json
+++ b/plugins/code-modernization/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
  "name": "code-modernization",
-  "description": "Modernize legacy codebases (COBOL, legacy Java/C++, monolith web apps) with a structured assess → map → extract-rules → brief → reimagine/transform → harden workflow and specialist review agents",
+  "description": "Modernize legacy codebases (COBOL, legacy Java/C++, monolith web apps) with a structured preflight / assess / map / extract-rules / brief / reimagine / transform / harden workflow, an interactive topology viewer, and specialist review agents",
  "author": {
    "name": "Anthropic",
    "email": "support@anthropic.com"
--- a/plugins/code-modernization/README.md
+++ b/plugins/code-modernization/README.md
@@ -7,7 +7,7 @@ A structured workflow and set of specialist agents for modernizing legacy codeba
 Legacy modernization fails most often not because the target technology is wrong, but because teams skip steps: they transform code before understanding it, reimagine architecture before extracting business rules, or ship without a harness that would catch behavior drift. This plugin enforces a sequence:

 ```
-assess → map → extract-rules → brief → reimagine | transform → harden
+preflight → assess → map → extract-rules → brief → reimagine | transform → harden
 ```

 The discovery commands (`assess`, `map`, `extract-rules`) build artifacts under `analysis/<system>/`. The `brief` command synthesizes them into an approval gate. The build commands (`reimagine`, `transform`) write new code under `modernized/`. The `harden` command audits the legacy system and produces a reviewable remediation patch. Each step has a dedicated slash command, and specialist agents (legacy analyst, business rules extractor, architecture critic, security auditor, test engineer) are invoked from within those commands — or directly — to keep the work honest.
@@ -20,25 +20,40 @@ Commands take a `<system-dir>` argument and assume the system being modernized l
 mkdir -p legacy && ln -s /path/to/your/legacy/codebase legacy/billing
 ```

-## Optional tooling
+## What to give Claude

-`/modernize-assess` works best with [`scc`](https://github.com/boyter/scc) (LOC + complexity + COCOMO) or [`cloc`](https://github.com/AlDanial/cloc), and falls back to `find`/`wc` if neither is installed. Portfolio mode also benefits from [`lizard`](https://github.com/terryyin/lizard) (cyclomatic complexity). The commands degrade gracefully without them, but the metrics will be coarser.
+The commands degrade gracefully, but each of these makes the output meaningfully better — run `/modernize-preflight <system-dir>` to check all of them at once and get a readiness report:
+
+- **Analysis tools**: [`scc`](https://github.com/boyter/scc) (LOC + complexity + COCOMO) or [`cloc`](https://github.com/AlDanial/cloc); [`lizard`](https://github.com/terryyin/lizard) for portfolio mode. Without them, metrics fall back to `find`/`wc` and get coarser.
+- **A working build toolchain** for the legacy stack (e.g. GnuCOBOL for COBOL) — required before `/modernize-transform` can prove behavioral equivalence, and verified by preflight with a real smoke compile against your code.
+- **The whole system in the tree**: deployment descriptors (JCL, CICS definitions, route configs), copybooks/includes, and DDL/schemas. Entry-point detection and data lineage in `/modernize-map` are guesswork without them.
+- **Production telemetry** (optional): an observability MCP server or batch job logs enable the runtime overlay in `/modernize-assess` and timing annotations on critical paths.
+
+## Secret handling
+
+Legacy systems routinely contain live credentials, and assessment artifacts get committed and shared. **Every agent in this plugin masks credential values** — findings, rule-card parameters, architecture notes, and test fixtures cite `file:line` with a masked preview (`AKIA****`), never the value. When credentials are found, a per-credential inventory (type, location, blast radius, rotation recommendation) is written to `analysis/<system>/SECRETS.local.md`, which the commands gitignore before writing; on non-git projects the quarantine file goes to `~/.modernize/<system>/` instead. `/modernize-harden` splits its remediation diff so credential-removal hunks (which necessarily contain the raw value) land in a gitignored `security_remediation.local.patch`, never the shareable patch. Pass `--show-secrets` to include raw values in the quarantine file (and only there). If you ran an earlier version of this plugin on a real system, check whether `analysis/` artifacts containing credentials were committed or shared, and rotate anything that was.

 ## Commands

 The commands are designed to be run in order, but each produces a standalone artifact so you can stop, review, and resume.

+### `/modernize-preflight <system-dir> [target-stack]`
+Environment readiness check, meant to run first: detects the legacy stack, checks analysis tooling, **smoke-compiles a real source file** with the legacy toolchain (the errors this surfaces — missing copybooks, wrong dialect flags — are the ones that otherwise appear mid-transform), inventories missing includes / deployment descriptors / binary-only artifacts, and probes for telemetry. Produces `analysis/<system>/PREFLIGHT.md` with a per-command Ready / Ready-with-gaps / Not-ready verdict.
+
 ### `/modernize-assess <system-dir>`  — or — `/modernize-assess --portfolio <parent-dir>`
 Inventory the legacy codebase: languages, line counts, complexity, build system, integrations, technical debt, security posture, documentation gaps, and a COCOMO-derived effort estimate. Produces `analysis/<system>/ASSESSMENT.md` and `analysis/<system>/ARCHITECTURE.mmd`. Spawns `legacy-analyst` (×2) and `security-auditor` in parallel for deep reads. With `--portfolio`, sweeps every subdirectory of a parent directory and writes a sequencing heat-map to `analysis/portfolio.html`.

 ### `/modernize-map <system-dir>`
-Build a dependency and topology map of the **legacy** system: program/module call graph, data lineage (programs ↔ data stores), entry points, dead-end candidates, and one traced critical-path business flow. Writes a re-runnable extraction script and produces `analysis/<system>/topology.json` (machine-readable), `analysis/<system>/TOPOLOGY.html` (rendered Mermaid + architect observations), and standalone `call-graph.mmd`, `data-lineage.mmd`, and `critical-path.mmd`.
+
+![Interactive topology map of AWS CardDemo — domains as containers, modules sized by lines of code, dependency edges colored by kind, entry points ringed](assets/topology-viewer-screenshot.jpg)
+
+Build a dependency and topology map of the **legacy** system: program/module call graph, data lineage (programs ↔ data stores), entry points, dead-end candidates, and 2–4 traced business flows each anchored to a persona (the claimant, the operator, the auditor — not the maintainer). Writes a re-runnable extraction script and produces `analysis/<system>/topology.json` plus `analysis/<system>/TOPOLOGY.html` — an **interactive zoomable map** (circle-pack of domains/modules sized by LOC, dependency edges with per-kind toggles, search, click-for-details sidebar, and a walkthrough mode that plays each persona flow as a numbered path with a plain-language narrative). Built from a template shipped with the plugin, so it works on systems far too dense for a static diagram. Small domain-level `call-graph.mmd`, `data-lineage.mmd`, and `critical-path.mmd` are still exported for docs and PRs.

 ### `/modernize-extract-rules <system-dir> [module-pattern]`
 Mine the business rules embedded in the legacy code — calculations, validations, eligibility, state transitions, policies — into Given/When/Then "Rule Cards" with `file:line` citations and confidence ratings. Spawns three `business-rules-extractor` agents in parallel (calculations, validations, lifecycle). Produces `analysis/<system>/BUSINESS_RULES.md` and `analysis/<system>/DATA_OBJECTS.md`.

 ### `/modernize-brief <system-dir> [target-stack]`
-Synthesize the discovery artifacts into a phased **Modernization Brief** — the single document a steering committee approves and engineering executes: target architecture, strangler-fig phase plan with entry/exit criteria, behavior contract, validation strategy, open questions, and an approval block. Reads `ASSESSMENT.md`, `TOPOLOGY.html`, and `BUSINESS_RULES.md` and **stops if any are missing** — run the discovery commands first. Produces `analysis/<system>/MODERNIZATION_BRIEF.md` and enters plan mode as a human-in-the-loop gate.
+Synthesize the discovery artifacts into a phased **Modernization Brief** — the single document a steering committee approves and engineering executes: target architecture, strangler-fig phase plan with entry/exit criteria, persona-based business walkthroughs (the section non-technical approvers actually read), behavior contract, validation strategy, open questions, and an approval block. Reads `ASSESSMENT.md`, `TOPOLOGY.html`, and `BUSINESS_RULES.md` and **stops if any are missing** — run the discovery commands first. Produces `analysis/<system>/MODERNIZATION_BRIEF.md` and enters plan mode as a human-in-the-loop gate.

 ### `/modernize-reimagine <system-dir> <target-vision>`
 Greenfield rebuild from extracted intent rather than a structural port. Mines a spec (`analysis/<system>/AI_NATIVE_SPEC.md`), designs a target architecture and has it adversarially reviewed (`analysis/<system>/REIMAGINED_ARCHITECTURE.md`), then **scaffolds services with executable acceptance tests** under `modernized/<system>-reimagined/` and writes a `CLAUDE.md` knowledge handoff for the new system. Two human-in-the-loop checkpoints. Spawns `business-rules-extractor`, `legacy-analyst` (×2), `architecture-critic`, and general-purpose scaffolding agents.
@@ -46,6 +61,9 @@ Greenfield rebuild from extracted intent rather than a structural port. Mines a
 ### `/modernize-transform <system-dir> <module> <target-stack>`
 Surgical, single-module strangler-fig rewrite. Plans first (HITL gate), then writes characterization tests via `test-engineer`, then an idiomatic target implementation under `modernized/<system>/<module>/`, proves equivalence by running the tests, and produces `TRANSFORMATION_NOTES.md` mapping legacy → modern with deliberate deviations called out. Reviewed by `architecture-critic`.

+### `/modernize-status <system-dir>`
+Read-only progress report: artifact inventory with timestamps per workflow stage, staleness flags (e.g. a brief older than the assessment it was built from), secrets-hygiene checks (quarantine file gitignored and never committed), and the single most useful next command. Run it anytime you come back to a modernization after a break.
+
 ### `/modernize-harden <system-dir>`
 Security hardening pass on the **legacy** system: OWASP/CWE scan, dependency CVEs, secrets, injection. Spawns `security-auditor`. Produces `analysis/<system>/SECURITY_FINDINGS.md` ranked Critical / High / Medium / Low and a reviewed `analysis/<system>/security_remediation.patch` with minimal fixes for the Critical/High findings. The patch is reviewed by a second `security-auditor` pass before you see it. **Never edits `legacy/`** — you review and apply the patch yourself when ready, then re-run to verify. Useful as a pre-modernization step when the legacy system will keep running in production during the migration.

@@ -81,17 +99,21 @@ This plugin ships commands and agents, but modernization projects benefit from a
      "Edit(modernized/**)"
    ],
    "deny": [
-      "Edit(legacy/**)"
+      "Edit(legacy/**)",
+      "Write(legacy/**)"
    ]
  }
 }
 ```

-Adjust `legacy/` and `modernized/` to match your actual layout. The key invariants: `Edit` under `legacy/` is denied, and writes are scoped to `analysis/` (for documents) and `modernized/` (for the new code). Every command in this plugin respects this — `/modernize-harden` writes a patch to `analysis/` rather than editing `legacy/` in place.
+Adjust `legacy/` and `modernized/` to match your actual layout. The key invariants: `Edit`/`Write` under `legacy/` are denied, and writes are scoped to `analysis/` (for documents) and `modernized/` (for the new code). Note this guards the file tools — shell commands that mutate files (`sed -i`, `git apply`) still go through the normal Bash permission prompt, so review those prompts with the same invariant in mind. Every command in this plugin respects this — `/modernize-harden` writes a patch to `analysis/` rather than editing `legacy/` in place.

 ## Typical Workflow

 ```bash
+# 0. Check the environment is ready (tools, toolchain, source completeness)
+/modernize-preflight billing
+
 # 1. Inventory the legacy system (or sweep a portfolio of them)
 /modernize-assess billing

@@ -112,6 +134,9 @@ Adjust `legacy/` and `modernized/` to match your actual layout. The key invarian

 # 6. Security-harden the legacy system that's still in production
 /modernize-harden billing
+
+# Anytime: where am I, what's stale, what's next
+/modernize-status billing
 ```

 ## License
--- a/plugins/code-modernization/agents/architecture-critic.md
+++ b/plugins/code-modernization/agents/architecture-critic.md
@@ -29,6 +29,12 @@ For **transformed code**:
 - Does the test suite actually pin behavior, or just exercise code paths?
 - What would the on-call engineer need at 3am that isn't here?

+## Secret handling (mandatory)
+
+When a finding quotes code containing a credential, key, token, or
+connection string, mask the value (`'Pr0d****'`) and cite `file:line` —
+findings get appended verbatim to committed notes files.
+
 ## Output

 Findings ranked **Blocker / High / Medium / Nit**. Each with: what, where,
--- a/plugins/code-modernization/agents/business-rules-extractor.md
+++ b/plugins/code-modernization/agents/business-rules-extractor.md
@@ -40,6 +40,15 @@ of the technology, skip it.
   from structure/names), **Low** (ambiguous; needs SME).
 6. If confidence < High, write the exact question an SME must answer.

+## Secret handling (mandatory)
+
+Rule parameters sometimes *are* credentials — hardcoded passwords in auth
+checks, API keys in partner-service calls, connection strings in batch
+routines. Record the **rule**, never the **value**: write the parameter as
+`<credential — masked, see file:line>` with at most a 2–4 character
+preview. Rule cards flow into briefs and steering decks; a raw credential
+in a parameter list is a leak.
+
 ## Output format

 One "Rule Card" per rule (see the format in the `/modernize-extract-rules`
--- a/plugins/code-modernization/agents/legacy-analyst.md
+++ b/plugins/code-modernization/agents/legacy-analyst.md
@@ -32,6 +32,15 @@ and explain it in terms a modern engineer can act on.
 - **Note what's missing.** Unhandled error paths, TODO comments, commented-out
  blocks, magic numbers — these are signals about history and risk.

+## Secret handling (mandatory)
+
+Legacy code is full of live credentials, and your findings get copied into
+shareable reports. When the evidence for a finding — hardcoded config,
+dead code, debt, an interface payload — includes a credential, API key,
+token, connection string, or private key, **never reproduce the value**.
+Cite `file:line` with a masked preview (`VALUE 'Pr0d****'`,
+`password=****`). The finding is the practice, not the value.
+
 ## Output format

 Default to structured markdown: tables for inventories, Mermaid for graphs,
--- a/plugins/code-modernization/agents/security-auditor.md
+++ b/plugins/code-modernization/agents/security-auditor.md
@@ -39,7 +39,30 @@ terminal/screen items don't apply to a SPA. Work through what's relevant:

 Use available SAST where it helps (npm audit, pip-audit, grep for known-bad
 patterns) but **read the code** — tools miss logic flaws. Show tool output
-verbatim, then add your manual findings.
+verbatim — except secret values, which you redact (see below) — then add
+your manual findings.
+
+## Secret handling (mandatory)
+
+Legacy codebases routinely contain live production credentials, and your
+findings get pasted into decks, tickets, and committed markdown. Copying a
+secret into a report multiplies the exposure you were hired to find.
+
+When you discover a hardcoded credential, API key, token, connection
+string, or private key:
+
+- **Never write the secret's value into any output** — no finding table,
+  no report, no quoted code excerpt, no echoed tool output. Mask it to the
+  first 2–4 identifying characters plus `****` (`AKIA****`,
+  `postgres://app_user:****@db-prod…`). If a scanner prints a secret,
+  redact it before including the excerpt.
+- Cite `file:line`. The source file is the canonical location — anyone who
+  legitimately needs the value can open it there.
+- State what the credential appears to grant access to (database, queue,
+  cloud account, third-party API) and whether it looks like a production
+  or test credential.
+- Recommend rotation for anything that looks live — exposure in source
+  means it is already compromised, independent of any modernization plan.

 ## Reporting standard

--- a/plugins/code-modernization/agents/test-engineer.md
+++ b/plugins/code-modernization/agents/test-engineer.md
@@ -28,6 +28,15 @@ someone thinks it should do) so that a rewrite can be proven equivalent.
  `@Disabled("pending RULE-NNN")` / `@pytest.mark.skip` / `it.todo()` — never
  deleted.

+## Secret handling (mandatory)
+
+Never copy credential-like literals — passwords, API keys, tokens,
+connection strings — from legacy code into test fixtures. Tests live in
+the deliverable codebase and get committed. Substitute clearly-fake values
+of the same shape and length and note the substitution in a comment.
+Anything a test genuinely needs live (e.g. a real database connection for
+a dual-run harness) is read from an environment variable, never inlined.
+
 ## Output

 Idiomatic tests for the requested target stack (JUnit 5 / pytest / Vitest /
--- a/plugins/code-modernization/assets/topology-viewer-screenshot.jpg
+++ b/plugins/code-modernization/assets/topology-viewer-screenshot.jpg
--- a/plugins/code-modernization/assets/topology-viewer.html
+++ b/plugins/code-modernization/assets/topology-viewer.html
--- a/plugins/code-modernization/commands/modernize-assess.md
+++ b/plugins/code-modernization/commands/modernize-assess.md
@@ -1,11 +1,13 @@
 ---
 description: Full discovery & portfolio analysis of a legacy system — inventory, complexity, debt, effort estimation
-argument-hint: <system-dir> | --portfolio <parent-dir>
+argument-hint: <system-dir> [--show-secrets] | --portfolio <parent-dir>
 ---

 **Mode select.** If `$ARGUMENTS` starts with `--portfolio`, run **Portfolio
 mode** against the directory that follows. Otherwise run **Single-system
-mode** against `legacy/$1`.
+mode** against the system dir. Parse flags positionally-independently:
+`--show-secrets` may appear before or after the system dir — the system
+dir is the first non-flag token.

 ---

@@ -108,12 +110,16 @@ Spawn three subagents **in parallel**:
 2. **legacy-analyst** — "Identify technical debt in legacy/$1: dead code,
   deprecated APIs, copy-paste duplication, god objects/programs, missing
   error handling, hardcoded config. Return the top 10 findings ranked by
-   remediation value, each with file:line evidence."
+   remediation value, each with file:line evidence. If evidence contains a
+   credential value, mask it per your secret-handling rules — never quote
+   it."

 3. **security-auditor** — "Scan legacy/$1 for security vulnerabilities:
   injection, auth weaknesses, hardcoded secrets, vulnerable dependencies,
   missing input validation. Return findings in CWE-tagged table form with
-   file:line evidence and severity."
+   file:line evidence and severity. Mask every discovered credential value
+   per your secret-handling rules — file:line plus a 2–4 character masked
+   preview, never the value itself."

 Wait for all three. Synthesize their findings.

@@ -141,6 +147,31 @@ need explained.

 ## Step 6 — Write the assessment

+**Secrets quarantine first.** The assessment gets shared and committed —
+discovered credential values must never appear in it. If the
+security-auditor found any hardcoded credentials:
+
+1. Ensure `analysis/.gitignore` exists and contains the lines
+   `SECRETS.local.md` and `*.local.patch` (create or append as needed —
+   the patch pattern is used by `/modernize-harden`; writing both now
+   means the ignore set is complete from first contact). If the project is a
+   git repo, verify with `git check-ignore -q analysis/$1/SECRETS.local.md`
+   — do not write any findings until the check passes. If there is **no
+   git repo** (check for `.svn`/`.hg`/`CVS` too — a `.gitignore` protects
+   nothing under another VCS): refuse `--show-secrets` and write
+   `SECRETS.local.md` to `~/.modernize/$1/` instead of the project tree,
+   telling the user where it went and why.
+2. Write `SECRETS.local.md`: one row per credential — masked preview,
+   `file:line`, credential type, what it grants access to,
+   production/test guess, rotation recommendation. Only if the user passed
+   `--show-secrets`, add the raw value column here — this file only, never
+   ASSESSMENT.md.
+3. Masking applies to **every section of ASSESSMENT.md**, whichever agent
+   produced the finding — the Technical Debt section quotes hardcoded
+   config; those quotes follow the same masking rule as Security Findings.
+   The Security Findings section adds a one-line pointer:
+   "Credential inventory in SECRETS.local.md (gitignored; not for sharing)."
+
 Create `analysis/$1/ASSESSMENT.md` with these sections:
 - **Executive Summary** (3-4 sentences: what it is, how big, how risky, headline recommendation)
 - **System Inventory** (the scc table + tech fingerprint)
--- a/plugins/code-modernization/commands/modernize-brief.md
+++ b/plugins/code-modernization/commands/modernize-brief.md
@@ -8,10 +8,19 @@ single document a steering committee approves and engineering executes.

 Target stack: `$2` (if blank, recommend one based on the assessment findings).

-Read `analysis/$1/ASSESSMENT.md`, `analysis/$1/TOPOLOGY.html` (and the `.mmd`
-files alongside it), and `analysis/$1/BUSINESS_RULES.md` first. If any are
-missing, say so and stop — they come from `/modernize-assess`, `/modernize-map`,
-and `/modernize-extract-rules` respectively. Run those first.
+Read `analysis/$1/ASSESSMENT.md`, `analysis/$1/topology.json` (plus the
+`.mmd` files alongside it — do NOT read `TOPOLOGY.html`, it's an
+interactive viewer with the data minified inside), and
+`analysis/$1/BUSINESS_RULES.md` first. If any are missing, say so and
+stop — they come from `/modernize-assess`, `/modernize-map`, and
+`/modernize-extract-rules` respectively. Run those first.
+
+**Staleness check:** compare modification times. If any input is newer
+than an existing `MODERNIZATION_BRIEF.md`, the brief is being justifiably
+regenerated; but if an existing brief is newer than all inputs and the
+user re-ran this command anyway, ask what changed. Either way, note the
+input timestamps in the brief's header so reviewers can see what it was
+built from.

 ## The Brief

@@ -31,28 +40,38 @@ fewest-dependencies first. For each phase:
 - Scope (which legacy modules, which target services)
 - Entry criteria (what must be true to start)
 - Exit criteria (what tests/metrics prove it's done)
- Estimated effort (person-weeks, derived from COCOMO + complexity data)
+- Estimated effort (person-months, same unit as the assessment's COCOMO
+  figure — convert deliberately if you present weeks)
 - Risk level + top 2 risks + mitigation

 Render the phases as a Mermaid `gantt` chart.

-### 4. Behavior Contract
+### 4. Business Walkthroughs
+For each persona flow in `analysis/$1/topology.json` (`flows` — produced
+by `/modernize-map`), a short narrative table: persona, what happens in
+business language, which legacy modules implement it today, and which
+phase from §3 replaces each. This is the section non-technical approvers
+actually read — it connects "Phase 2" to "what happens when a customer
+files a claim". If topology.json has no flows, derive 2–3 walkthroughs
+from the entry points and say they need SME confirmation.
+
+### 5. Behavior Contract
 List the **P0 rules** from BUSINESS_RULES.md (the ones tagged `Priority: P0` —
 money, regulatory, data integrity) that MUST be proven equivalent before any
 phase ships. These become the regression suite. Flag any P0 rule with
 Confidence < High as a blocker requiring SME confirmation before its phase
 starts.

-### 5. Validation Strategy
+### 6. Validation Strategy
 State which combination applies: characterization tests, contract tests,
 parallel-run / dual-execution diff, property-based tests, manual UAT.
 Justify per phase.

-### 6. Open Questions
+### 7. Open Questions
 Anything requiring human/SME decision before Phase 1 starts. Each as a
 checkbox the approver must tick.

-### 7. Approval Block
+### 8. Approval Block
 ```
 Approved by: ________________  Date: __________
 Approval covers: Phase 1 only | Full plan
@@ -60,6 +79,7 @@ Approval covers: Phase 1 only | Full plan

 ## Present

-Enter **plan mode** and present a summary of the brief. Do NOT proceed to any
-transformation until the user explicitly approves. This gate is the
-human-in-the-loop control point.
+Present a summary of the brief and **stop — write nothing further until
+the user explicitly approves** (use plan mode if the session supports
+it). This gate is the human-in-the-loop control point; "no objection" is
+not approval.
--- a/plugins/code-modernization/commands/modernize-extract-rules.md
+++ b/plugins/code-modernization/commands/modernize-extract-rules.md
@@ -46,7 +46,7 @@ Merge the three result sets. Deduplicate. For each distinct rule, write a
  When  <trigger>
  Then  <outcome>
  [And  <additional outcome>]
-**Parameters:** <constants, rates, thresholds with their current values>
+**Parameters:** <constants, rates, thresholds with their current values — credentials masked: `<credential — masked, see file:line>`>
 **Edge cases handled:** <list>
 **Suspected defect:** <optional — legacy behavior that looks wrong; decide preserve-vs-fix during transform>
 **Confidence:** High | Medium | Low — <why; if < High, state the exact SME question>
--- a/plugins/code-modernization/commands/modernize-harden.md
+++ b/plugins/code-modernization/commands/modernize-harden.md
@@ -1,14 +1,42 @@
 ---
 description: Security vulnerability scan with a reviewable remediation patch — OWASP, CWE, CVE, secrets, injection
-argument-hint: <system-dir>
+argument-hint: <system-dir> [--show-secrets]
 ---

-Run a **security hardening pass** on `legacy/$1`: find vulnerabilities, rank
-them, and produce a reviewable patch for the critical ones.
+Run a **security hardening pass** on the legacy system: find
+vulnerabilities, rank them, and produce a reviewable patch for the
+critical ones. Parse arguments flag-independently: the system dir
+(referred to as `$1` below) is the first non-flag token in `$ARGUMENTS`;
+`--show-secrets` may appear anywhere.

 This command never edits `legacy/` — it writes findings and a proposed patch
 to `analysis/$1/`. The user reviews and applies (or not).

+## Step 0 — Secrets quarantine setup
+
+Findings files get shared, committed, and pasted into decks — discovered
+credential values must never land in them. Before any scanning:
+
+1. Ensure `analysis/.gitignore` exists and contains the lines
+   `SECRETS.local.md` and `*.local.patch`. Create the file or append the
+   missing lines.
+2. If the project is a git repo, verify with
+   `git check-ignore -q analysis/$1/SECRETS.local.md` — if that exits
+   non-zero, fix the ignore rule before proceeding. Do not write any
+   findings until this check passes.
+3. **If there is no git repo** (check for `.svn`/`.hg`/`CVS` too — a
+   `.gitignore` protects nothing under another VCS): refuse
+   `--show-secrets`, and write `SECRETS.local.md` and any `.local.patch`
+   file to `~/.modernize/$1/` instead of the project tree, telling the
+   user where they went and why.
+
+All secret values in every shareable artifact this command produces are
+**masked** (`AKIA****`, `password=****`) and cited by `file:line`. Raw
+values may appear in exactly two places, both gitignored: the
+`*.local.patch` remediation hunks (unavoidably — see Remediate) and, only
+with `--show-secrets`, `SECRETS.local.md`. Never in SECURITY_FINDINGS.md
+or patch commentary.
+
 ## Scan

 Spawn the **security-auditor** subagent:
@@ -20,7 +48,9 @@ hardcoded secrets, vulnerable dependency versions, missing input validation,
 path traversal. For each finding return: CWE ID, severity
 (Critical/High/Med/Low), file:line, one-sentence exploit scenario, and
 recommended fix. Run any available SAST tooling (npm audit, pip-audit,
-OWASP dependency-check) and include its raw output."
+OWASP dependency-check) and include its raw output. Mask every discovered
+credential value per your secret-handling rules — file:line plus a 2–4
+character masked preview, never the value itself."

 ## Triage

@@ -29,26 +59,50 @@ Write `analysis/$1/SECURITY_FINDINGS.md`:
 - Findings table sorted by severity
 - Dependency CVE table (package, installed version, CVE, fixed version)

+If any hardcoded credentials were found, also write
+`analysis/$1/SECRETS.local.md` (the gitignored quarantine file from Step 0):
+one row per credential — masked preview, `file:line`, credential type, what
+it appears to grant access to, production/test guess, and a rotation
+recommendation. With `--show-secrets`, append the raw value column here —
+this file only. SECURITY_FINDINGS.md gets a one-line pointer:
+"N hardcoded credentials found — inventory in SECRETS.local.md (gitignored;
+not for sharing)."
+
 ## Remediate

 For each **Critical** and **High** finding, draft a minimal, targeted fix.
-Do **not** edit `legacy/` — write all fixes as a single unified diff to
-`analysis/$1/security_remediation.patch`, with a comment line above each
-hunk citing the finding ID it addresses (`# SEC-001: parameterize the query`).
+Do **not** edit `legacy/` — write fixes as unified diffs with **paths
+relative to the project root** (`legacy/$1/...`), applied from the project
+root, with a comment line above each hunk citing the finding ID it
+addresses (`# SEC-001: parameterize the query`).
+
+**Credential findings split into two files.** A diff that removes a
+hardcoded secret necessarily contains the raw value on its `-` and
+context lines — that cannot go in the shareable patch:
+
+- `analysis/$1/security_remediation.patch` (shareable) — every
+  non-credential hunk, plus for each credential finding a comment-only
+  placeholder: `# SEC-NNN: credential remediation — hunk in
+  security_remediation.local.patch (gitignored; not for sharing)`.
+- `analysis/$1/security_remediation.local.patch` (gitignored in Step 0) —
+  the real, applyable hunks for credential findings only.

 Add a **Remediation Log** section to SECURITY_FINDINGS.md mapping each
-finding ID → one-line summary of the proposed fix and the patch hunk that
-implements it.
+finding ID → one-line summary of the proposed fix and which patch file
+carries the hunk.

 ## Verify

-Spawn the **security-auditor** again to **review the patch** against the
-original code:
+Spawn the **security-auditor** again to **review both patches** against
+the original code:

-"Review analysis/$1/security_remediation.patch against legacy/$1. For each
+"Review analysis/$1/security_remediation.patch and
+analysis/$1/security_remediation.local.patch against legacy/$1. For each
 hunk: does it fully remediate the cited finding? Does it introduce new
-vulnerabilities or change behavior beyond the fix? Return one verdict per
-hunk: RESOLVES / PARTIAL / INTRODUCES-RISK, with a one-line reason."
+vulnerabilities or change behavior beyond the fix? Confirm no raw
+credential values appear anywhere in the shareable patch. Return one
+verdict per hunk: RESOLVES / PARTIAL / INTRODUCES-RISK, with a one-line
+reason."

 Add a **Patch Review** section to SECURITY_FINDINGS.md with the verdicts.
 If any hunk is PARTIAL or INTRODUCES-RISK, revise the patch and re-review.
@@ -57,8 +111,12 @@ If any hunk is PARTIAL or INTRODUCES-RISK, revise the patch and re-review.

 Tell the user the artifacts are ready:
 - `analysis/$1/SECURITY_FINDINGS.md` — findings, remediation log, patch review
- `analysis/$1/security_remediation.patch` — review, then apply if appropriate
-  with `git -C legacy/$1 apply ../../analysis/$1/security_remediation.patch`
+- `analysis/$1/security_remediation.patch` — review, then apply **from the
+  project root**: `git apply analysis/$1/security_remediation.patch`
+  (if `legacy/$1` is a symlink, use `git apply --unsafe-paths` or apply
+  with `patch -p0` from the project root)
+- `analysis/$1/security_remediation.local.patch` — the credential fixes;
+  apply the same way, and rotate the affected credentials regardless
 - Re-run `/modernize-harden $1` after applying to confirm resolution

 Suggest: `glow -p analysis/$1/SECURITY_FINDINGS.md`
--- a/plugins/code-modernization/commands/modernize-map.md
+++ b/plugins/code-modernization/commands/modernize-map.md
@@ -55,50 +55,124 @@ re-run and audited. Have it write a machine-readable
 `analysis/$1/topology.json` and print a human summary. Run it; show the
 summary (cap at ~200 lines for very large estates).

-## Render
+`topology.json` must follow this schema — it feeds the interactive viewer:

-From the extracted data, generate **three Mermaid diagrams** and write them
-to `analysis/$1/TOPOLOGY.html` as a self-contained page that renders in any
-browser.
-
-The HTML page must use: dark `#1e1e1e` background, `#d4d4d4` text,
-`#cc785c` for `<h2>`/accents, `system-ui` font, all CSS **inline** (no
-external stylesheets). Load Mermaid from a CDN in `<head>`:
-
-```html
-<script type="module">
-  import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs';
-  mermaid.initialize({ startOnLoad: true, theme: 'dark' });
-</script>
+```json
+{
+  "system": "<display name>",
+  "root": {
+    "id": "sys", "name": "<system>", "kind": "system",
+    "children": [
+      { "id": "dom:<domain>", "name": "<Domain>", "kind": "domain",
+        "children": [
+          { "id": "<MODULE>", "name": "<MODULE>", "kind": "module",
+            "language": "cobol", "loc": 1234, "file": "src/MODULE.cbl" }
+        ] },
+      { "id": "dom:data", "name": "Data stores", "kind": "domain",
+        "children": [
+          { "id": "ds:<NAME>", "name": "<NAME>", "kind": "datastore" }
+        ] }
+    ]
+  },
+  "edges": [
+    { "source": "<id>", "target": "<id>", "kind": "call" }
+  ],
+  "entryPoints": ["<id>", "..."],
+  "deadEnds": ["<id>", "..."],
+  "observations": ["<architect observation>", "..."],
+  "flows": [
+    { "name": "<business flow>", "persona": "<who experiences it>",
+      "description": "<one sentence, plain language>",
+      "steps": [
+        { "label": "<business-language step>", "nodes": ["<id>", "<id>"] }
+      ] }
+  ]
+}
 ```

-Each diagram goes in a `<pre class="mermaid">...</pre>` block. Do **not**
-wrap diagrams in markdown ` ``` ` fences inside the HTML.
+- Group leaf modules under `domain` containers (use the domains from
+  `/modernize-assess` if available). Leaf kinds: `module`, `datastore`,
+  `job`, `screen`. `loc` drives circle size — include it for modules.
+- Edge kinds: `call` (direct), `dispatch` (dynamic/router), `read`,
+  `write`. Every edge endpoint must be a leaf id that exists in the tree.
+- `deadEnds`: the dead-end candidates from the extraction, rendered with
+  a dashed outline in the viewer. Apply the suppression rules above —
+  anything that could be the target of an unresolved dynamic call does
+  NOT belong here; record that uncertainty in `observations` instead.
+- **Datastore ids and names must be logical identifiers** — DD name,
+  dataset name, table/schema name, at most host:port. If the resolved
+  config value is a URL or DSN, strip userinfo and credential query
+  params before it goes anywhere in topology.json: the file gets
+  committed and the viewer displays names verbatim. Never copy raw
+  config values into `observations`.
+- `observations`: 3–7 architect observations — tight coupling clusters,
+  single points of failure, service-extraction candidates, data stores
+  with too many writers, dispatch targets the extraction could not
+  resolve.
+- `flows` is the **persona walkthrough** section — see below.

-1. **`graph TD` — Module call graph.** Cluster by domain (use `subgraph`).
-   Highlight entry points in a distinct style. Cap at ~40 nodes — if larger,
-   show domain-level with one expanded domain.
+## Persona flows

-2. **`graph LR` — Data lineage.** Programs → data stores.
-   Mark read vs write edges.
+Trace **2–4 end-to-end business flows**, each anchored to a persona —
+the people who experience the system, not the people who maintain it
+(e.g. for a benefits system: the claimant, the caseworker, the auditor;
+for billing: the customer, the billing operator). For each flow:

-3. **`flowchart TD` — Critical path.** Trace ONE end-to-end business flow
-   (e.g., "monthly billing run" or "process payment") through every program
-   and data store it touches, in execution order. If production telemetry is
-   available (see `/modernize-assess` Step 4), annotate each step with its
-   p50/p99 wall-clock.
+- `name` + one-sentence `description` in plain business language —
+  something a steering committee member relates to ("a claimant files a
+  weekly claim"), not a data-flow label ("CLM batch ingest").
+- `steps`: 3–8 steps, each with a business-language `label` and the
+  `nodes` (programs + data stores) that implement that step, in
+  execution order.

-Also export the three diagrams as standalone `.mmd` files for re-use:
-`analysis/$1/call-graph.mmd`, `analysis/$1/data-lineage.mmd`,
-`analysis/$1/critical-path.mmd`.
+This is the bridge between the technical map and non-technical
+stakeholders: the same diagram answers "which program does X" for
+engineers and "what happens when someone files a claim" for everyone else.

-## Annotate
+## Render

-Below each `<pre class="mermaid">` block in TOPOLOGY.html, add a `<ul>`
-with 3-5 **architect observations**: tight coupling clusters, single
-points of failure, candidates for service extraction, data stores
-touched by too many writers.
+`analysis/$1/TOPOLOGY.html` is an **interactive map**: a zoomable
+circle-pack of the whole system (domains as containers, modules sized by
+LOC) with dependency edges, search, per-node detail sidebar, edge-kind
+toggles, and a flow-walkthrough mode that plays each persona flow as a
+numbered path. Build it from the template that ships with this plugin —
+do not hand-write the viewer:
+
+```bash
+python3 - "${CLAUDE_PLUGIN_ROOT}/assets/topology-viewer.html" analysis/$1 <<'EOF'
+import json, sys
+tpl_path, out_dir = sys.argv[1], sys.argv[2]
+tpl = open(tpl_path).read()
+marker = "/*__TOPOLOGY_DATA__*/ null"
+assert marker in tpl, f"injection marker not found in {tpl_path}"
+data = json.dumps(json.load(open(f"{out_dir}/topology.json")))
+open(f"{out_dir}/TOPOLOGY.html", "w").write(
+    tpl.replace(marker, "/*__TOPOLOGY_DATA__*/ " + data))
+print(f"wrote {out_dir}/TOPOLOGY.html")
+EOF
+```
+
+The viewer is fully self-contained (the d3 subset it needs is inlined in
+the template) — it works offline and on air-gapped networks. If the
+`python3` invocation fails to find the template,
+`${CLAUDE_PLUGIN_ROOT}` was not substituted — report that rather than
+hand-writing a viewer.
+
+Mermaid stays for **small, exportable** diagrams. Generate standalone
+`.mmd` files for reuse in docs and PRs — but keep each under ~40 edges;
+collapse to domain level if the full graph is bigger (dense Mermaid
+becomes unreadable, which is exactly what the interactive map is for):
+
+- `analysis/$1/call-graph.mmd` — domain-level `graph TD`, entry points
+  highlighted
+- `analysis/$1/data-lineage.mmd` — `graph LR`, programs → data stores,
+  read vs write marked
+- `analysis/$1/critical-path.mmd` — `flowchart TD` of the primary flow
+  from `flows`, annotated with p50/p99 wall-clock if telemetry is
+  available (see `/modernize-assess` Step 4)

 ## Present

-Tell the user to open `analysis/$1/TOPOLOGY.html` in a browser.
+Tell the user to open `analysis/$1/TOPOLOGY.html` in a browser, and to
+try: search for a module, click it to see its connections, and pick a
+persona flow from the walkthrough dropdown.
--- a/plugins/code-modernization/commands/modernize-preflight.md
+++ b/plugins/code-modernization/commands/modernize-preflight.md
@@ -0,0 +1,98 @@
+---
+description: Environment readiness check — analysis tools, build toolchain, source completeness, telemetry access
+argument-hint: <system-dir> [target-stack]
+---
+
+Check whether this environment is ready to analyze — and eventually
+transform — `legacy/$1`, and tell the user exactly what to fix before the
+other commands run into it. Modernization sessions fail late and
+confusingly when this isn't done: assessment metrics silently degrade
+without analysis tools, characterization tests can't run without a build
+toolchain, and dependency maps come out wrong when half the source isn't
+in the tree.
+
+Run every check even when an early one fails — the point is one complete
+readiness report, not the first error.
+
+## Check 1 — Detect the stack
+
+Fingerprint `legacy/$1` from file extensions and manifests: languages,
+build system, deployment/config descriptors. This drives which checks
+below apply. Report what was detected and the rough file split.
+
+## Check 2 — Analysis tooling
+
+For each, check availability (`command -v`) and report version, what it's
+used for, and what degrades without it:
+
+| Tool | Used by | Without it |
+|---|---|---|
+| `scc` (or `cloc`) | assess | LOC/complexity fall back to `find`+`wc`; COCOMO estimate gets coarser |
+| `lizard` | assess --portfolio | complexity estimated from decision-keyword counts |
+| `glow` | all | markdown artifacts render as plain text |
+| `delta` | transform | side-by-side diffs fall back to `diff -y` |
+
+Include the platform's install one-liner for anything missing
+(`brew install scc`, `apt install cloc`, `pip install lizard`, …).
+
+## Check 3 — Build toolchain (smoke test, not just presence)
+
+Identify the compiler/interpreter for the detected legacy stack — e.g.
+GnuCOBOL (`cobc`) for COBOL, JDK + Maven/Gradle for Java, `cc`/`make` for
+C, `dotnet` for .NET. Then **prove it works on this codebase**: pick one
+representative source file and run a syntax-only compile
+(`cobc -fsyntax-only`, `javac`, `gcc -fsyntax-only`, …).
+
+A failed smoke test is the most valuable output of this command — report
+the actual error and diagnose it: missing copybook/include path, missing
+dialect flag (`-std=ibm` etc.), fixed vs free format, missing dependency
+jar. These are the errors that otherwise surface mid-`/modernize-transform`
+with much less context.
+
+If the user passed a `[target-stack]`, do the same for it: runtime,
+package manager, test framework (`mvn -v`, `npm -v`, `pytest --version`, …).
+
+## Check 4 — Source completeness
+
+The dependency map is only as good as what's in the tree. Check for the
+detected stack's equivalents of:
+
+- **Referenced-but-missing includes** — copybooks (`COPY X` with no
+  `X.cpy`), headers, imports that resolve nowhere. Count and list the top
+  missing names.
+- **Deployment/config descriptors** — JCL for batch COBOL, CICS CSD
+  definitions, `web.xml`/route configs, cron/scheduler definitions.
+  Without these, entry-point detection and the code↔storage join in
+  `/modernize-map` are guesswork.
+- **Data definitions** — DDL, schemas, copybook record layouts, ORM
+  mappings.
+- **Binary-only artifacts** — load modules, jars, DLLs with no matching
+  source. These become unmappable black boxes; flag them now.
+
+## Check 5 — Optional context
+
+- **Production telemetry** — is an observability/APM MCP server connected,
+  or are batch job logs / runtime exports available? (Enables the runtime
+  overlay in `/modernize-assess` Step 4 and timing annotations in
+  `/modernize-map`.)
+- **Version control history** — is `legacy/$1` under git with meaningful
+  history? (Change-frequency data sharpens risk ranking.)
+
+## Report
+
+Write `analysis/$1/PREFLIGHT.md`: a status table — one row per check,
+status ✅ / ⚠️ / ❌, what was found, and the fix for anything not green —
+followed by a **Ready / Ready-with-gaps / Not ready** verdict per command:
+
+- `assess` + `map` + `extract-rules` — need Checks 1–2 green-ish and
+  Check 4's missing-include count low
+- `brief` — needs only the three discovery artifacts; no tooling
+- `transform` + `reimagine` — additionally need Check 3 green for the
+  **target** stack. A red legacy toolchain downgrades these to
+  Ready-with-gaps, not Not-ready: equivalence testing falls back to
+  recorded traces / golden-master fixtures instead of dual execution
+  (common and expected for CICS/IMS code that has no local runtime)
+- `harden` — needs Check 2 plus any stack-specific SAST tooling found
+
+Print the table in the session too, and end with the single most
+important fix if anything is red.
--- a/plugins/code-modernization/commands/modernize-reimagine.md
+++ b/plugins/code-modernization/commands/modernize-reimagine.md
@@ -3,7 +3,11 @@ description: Multi-agent greenfield rebuild — extract specs from legacy, desig
 argument-hint: <system-dir> <target-vision>
 ---

-**Reimagine** `legacy/$1` as: $2
+The first token of `$ARGUMENTS` is the system dir (`$1`); **everything
+after it is the target vision** — it is usually multiple words, so do not
+truncate it to one token. Below, `<vision>` means that full remainder.
+
+**Reimagine** `legacy/$1` as: <vision>

 This is not a port — it's a rebuild from extracted intent. The legacy system
 becomes the *specification source*, not the structural template. This command
@@ -19,7 +23,8 @@ Spawn concurrently and show the user that all three are running:
 2. **legacy-analyst** — "Catalog every external interface of legacy/$1:
   inbound (screens, APIs, batch triggers, queues) and outbound (reports,
   files, downstream calls, DB writes). For each: name, direction, payload
-   shape, frequency/SLA if discernible."
+   shape, frequency/SLA if discernible. Mask any credential embedded in
+   endpoints or payload examples per your secret-handling rules."

 3. **legacy-analyst** — "Identify the core domain entities in legacy/$1 and
   their relationships. Return as an entity list + Mermaid erDiagram."
@@ -32,6 +37,9 @@ Collect results. Write `analysis/$1/AI_NATIVE_SPEC.md` containing:
 - **Non-functional requirements** inferred from legacy (batch windows, volumes)
 - **Behavior Contract** (the Given/When/Then rules — these are the acceptance tests)

+Credential values are masked everywhere in the spec; connection details
+appear as env-var placeholders (`${DATABASE_URL}`), never literals.
+
 ## Phase B — HITL checkpoint #1

 Present the spec summary. Ask the user **one focused question**: "Which of
@@ -40,20 +48,21 @@ should deliberately drop?" Wait for the answer. Record it in the spec.

 ## Phase C — Architecture (single agent, then critique)

-Design the target architecture for "$2":
+Design the target architecture for "<vision>":
 - Mermaid C4 Container diagram
 - Service boundaries with rationale (which rules/entities live where)
 - Technology choices with one-line justification each
 - Data migration approach from legacy stores

 Then spawn **architecture-critic**: "Review this proposed architecture for
-$2 against the spec in analysis/$1/AI_NATIVE_SPEC.md. Identify over-engineering,
+<vision> against the spec in analysis/$1/AI_NATIVE_SPEC.md. Identify over-engineering,
 missed requirements, scaling risks, and simpler alternatives." Incorporate
 the critique. Write the result to `analysis/$1/REIMAGINED_ARCHITECTURE.md`.

 ## Phase D — HITL checkpoint #2

-Enter plan mode. Present the architecture. Wait for approval.
+Present the architecture and **stop — scaffold nothing until the user
+explicitly approves** (use plan mode if the session supports it).

 ## Phase E — Parallel scaffolding

@@ -65,7 +74,9 @@ in parallel**:
 and AI_NATIVE_SPEC.md. Create: project skeleton, domain model, API stubs
 matching the interface contracts, and **executable acceptance tests** for every
 behavior-contract rule assigned to this service (mark unimplemented ones as
-expected-failure/skip with the rule ID). Write to modernized/$1-reimagined/<service-name>/."
+expected-failure/skip with the rule ID). No credential literal from legacy
+code becomes a test fixture or config default — use fake same-shape values
+and env-var placeholders. Write to modernized/$1-reimagined/<service-name>/."

 Show the agents' progress. When all complete, run the acceptance test suites
 and report: total tests, passing (scaffolded behavior), pending (rule IDs
@@ -77,7 +88,9 @@ Write `modernized/$1-reimagined/CLAUDE.md` — the persistent context file for
 the new system, containing: architecture summary, service responsibilities,
 where the spec lives, how to run tests, and the legacy→modern traceability
 map. This file IS the knowledge graph that future agents and engineers will
-load.
+load — and it gets committed: connection details and credentials appear
+only as env-var names with a pointer to where they're provisioned, never
+as values.

 Report: services scaffolded, acceptance tests defined, % behaviors with a
 home, location of all artifacts.
--- a/plugins/code-modernization/commands/modernize-status.md
+++ b/plugins/code-modernization/commands/modernize-status.md
@@ -0,0 +1,54 @@
+---
+description: Where am I in the modernization workflow — artifact inventory, staleness, secrets hygiene, next step
+argument-hint: <system-dir>
+---
+
+Report where the modernization of `$1` stands, in one screen. This is a
+read-only command — inspect, never modify.
+
+## 1 — Artifact inventory
+
+Check `analysis/$1/` and `modernized/$1*/` and build a table — one row per
+workflow stage, with the artifact's presence and modification time:
+
+| Stage | Artifacts |
+|---|---|
+| preflight | `PREFLIGHT.md` |
+| assess | `ASSESSMENT.md`, `ARCHITECTURE.mmd` |
+| map | `topology.json`, `TOPOLOGY.html`, `*.mmd`, `extract_topology.*` |
+| extract-rules | `BUSINESS_RULES.md`, `DATA_OBJECTS.md` |
+| brief | `MODERNIZATION_BRIEF.md` (note whether the approval block is signed) |
+| harden | `SECURITY_FINDINGS.md`, `security_remediation.patch` |
+| transform / reimagine | each `modernized/$1*/<module>/` dir — note test presence and whether `TRANSFORMATION_NOTES.md` exists |
+
+## 2 — Staleness
+
+Flag any artifact older than an upstream artifact it derives from:
+
+- `MODERNIZATION_BRIEF.md` older than `ASSESSMENT.md`, `topology.json`,
+  or `BUSINESS_RULES.md` → the brief no longer reflects discovery;
+  recommend re-running `/modernize-brief`.
+- `TOPOLOGY.html` older than `topology.json` → re-run the injection step
+  from `/modernize-map`.
+- Any `TRANSFORMATION_NOTES.md` older than `BUSINESS_RULES.md` → the
+  module may not implement the latest rule set; list which.
+
+## 3 — Secrets hygiene
+
+- Does `analysis/.gitignore` exist and cover `SECRETS.local.md` /
+  `*.local.patch`? (`git check-ignore` when in a git repo.)
+- If `SECRETS.local.md` exists: confirm it is NOT tracked
+  (`git ls-files --error-unmatch`, expect failure) and has never been
+  committed (`git log --all --oneline -- <path>`, expect empty). If
+  either check fails, say so prominently and recommend rotation plus
+  history scrubbing.
+
+## 4 — Verdict
+
+End with three lines:
+- **Where you are** — the furthest completed stage and roughly how much
+  of the system it covers (e.g. "mapped 100%, 2 of 14 modules
+  transformed").
+- **What's stale** — or "nothing".
+- **Next command** — the single most useful next step, with a one-line
+  reason.
--- a/plugins/code-modernization/commands/modernize-transform.md
+++ b/plugins/code-modernization/commands/modernize-transform.md
@@ -9,10 +9,37 @@ equivalence.
 This is a surgical, single-module transformation — one vertical slice of the
 strangler fig. Output goes to `modernized/$1/$2/`.

-## Step 0 — Plan (HITL gate)
+## Step 0a — Toolchain check (fail fast on target, adapt on legacy)
+
+Verify the build environment **before** planning, not when the tests
+first run:
+
+- **Target stack ($3) — required.** Runtime, package manager, and test
+  framework all respond (`java -version` + `mvn -v`, `node -v` + `npm -v`,
+  `python3 -V` + `pytest --version`, …). If any are missing, stop and
+  report what to install — the new code and its tests cannot run without
+  them, so a plan gate now would just defer the failure an hour. Suggest
+  `/modernize-preflight $1 $3` for the full readiness report.
+- **Legacy stack — advisory, never a blocker.** Try a syntax-only compile
+  of the module being transformed (e.g. `cobc -fsyntax-only`). Legacy
+  code often *cannot* build locally by nature, not by misconfiguration —
+  CICS/IMS programs have no local translator, and the real runtime may be
+  a mainframe you don't have. A failed or impossible legacy compile does
+  **not** stop the transform; it changes the equivalence strategy:
+  - dual-execution proof is off the table — characterization tests
+    assert against **recorded traces / golden-master fixtures** (real
+    production outputs, captured reports/screens, SME-confirmed
+    examples) instead of live legacy runs
+  - say so explicitly in the Step 0b plan and later in
+    TRANSFORMATION_NOTES.md ("equivalence is trace-based; legacy was not
+    executable in this environment"), so reviewers know the strength of
+    the proof they're approving
+
+## Step 0b — Plan (HITL gate)

 Read the source module and any business rules in `analysis/$1/BUSINESS_RULES.md`
-that reference it. Then **enter plan mode** and present:
+that reference it. Then present the plan and **stop — write no code until
+the user explicitly approves** (use plan mode if the session supports it):
 - Which source files are in scope
 - The target module structure (packages/classes/files you'll create)
 - Which business rules / behaviors this module implements
@@ -30,7 +57,9 @@ identify every observable behavior, and encode each as a test case with
 concrete input → expected output pairs derived from the legacy logic.
 Target framework: <appropriate for $3>. Write to
 `modernized/$1/$2/src/test/`. These tests define 'done' — the new code
-must pass all of them."
+must pass all of them. Follow your secret-handling rules: no credential
+literal from legacy code becomes a fixture; substitute fake same-shape
+values and read anything genuinely live from environment variables."

 Show the user the test file. Get a 👍 before proceeding.

@@ -68,6 +97,10 @@ Then show a visual diff of one representative behavior, legacy vs modern:
 ```bash
 delta --side-by-side <(sed -n '<lines>p' legacy/$1/<file>) modernized/$1/$2/src/main/<file>
 ```
+(Fall back to `diff -y --width=160` if `delta` isn't installed.) Never
+pick a credential-bearing line range for this diff, and mask any
+credential-like literal quoted in TRANSFORMATION_NOTES.md — the notes
+live in `modernized/` and get committed.

 ## Step 5 — Architecture review