docs(work-items): de-slop instruction surfaces (0.39.23)

[kyle-sexton]

No linked issue

Summary

Refs #2891. Instruction-surface de-slop shard for the work-items plugin only. Other plugins stay on main.

Fix

Re-audited plugins/work-items/README.md and every plugins/work-items/**/SKILL.md under /ai-slop:audit fix semantics after later versions landed on the 0.39.13 shard. Instruction-surface prose is already em-dash-free. The generated options block stays ignore-fenced because scripts/sync-plugin-options-docs.py still emits em dashes from its shared template. Quoted claim/lease and triage protocol strings, fenced templates, and the required auto-invocation trigger (the spec changed — redo the tickets) keep their em dashes so skill-quality does not treat a rewrite as a dropped trigger. work-items 0.39.23. Adapter READMEs under tools/work-item-tracker/** and docs/SKILL-CHEAT-SHEET.md were not edited.

Verification

• Detector (rule-em-dash enabled, isolated config): 1 remaining rule-em-dash (the required decompose trigger phrase), 65 declined (generated-options fence plus fenced/inline-code protocol spans)
• CHECK_SKILL_SKIP_MARKDOWNLINT=1 bash scripts/check-changed-skills.sh origin/main: no changed skills
• python3 scripts/sync-plugin-options-docs.py --check up to date
• scripts/check-changelog-parity.sh --check-bump origin/main passes
• node scripts/generate-cheatsheet.mjs --check in sync

Related

Refs #2891

[claude]

Claude finished @kyle-sexton's task in 48s —— View job

---

Security review

• Gather context (PR diff, changed files)
• Apply skip gate / assess security-relevant surface
• Review changed files for vulnerabilities
• Post findings (or confirm no issues)

Skip gate: no security-relevant surface. This PR only bumps plugins/work-items/.claude-plugin/plugin.json version (0.39.22 → 0.39.23) and adds a corresponding CHANGELOG.md entry documenting an em-dash de-slop pass over the plugin's own instruction docs. Per the PR description, no SKILL.md/README.md prose actually changed this shard (already em-dash-free from an earlier pass) — the diff itself is just version metadata + changelog text.

No code, no GitHub Actions workflow, no permissions, no credential handling, no injection surface (command/SQL/path/template), and no authorization logic is touched. There is nothing here for a security review to evaluate.

No security issues found.

[github-actions]

Last security-reviewed head: 1e3bec48f98d435130469fe283a847c53dd4f230. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @kyle-sexton's task in 46s —— View job

---

Security review

• Gather context (PR diff, changed files)
• Invoke /review:security-review and follow its instructions
• Review changed files for vulnerabilities
• Post findings (or confirm no issues)

Skip gate: no security-relevant surface. Per gh pr diff 3302, this PR touches exactly two files:

• plugins/work-items/.claude-plugin/plugin.json — version bump 0.39.22 → 0.39.23 only.
• plugins/work-items/CHANGELOG.md — a corresponding changelog entry documenting an em-dash de-slop audit pass over the plugin's own instruction docs.

No SKILL.md/README.md prose is modified in this diff (the PR body confirms the pass found this shard already em-dash-free from an earlier iteration). There's no code, no GitHub Actions workflow, no permissions change, no credential/token handling, and no injection surface (command, SQL, path, template) touched — nothing here for a security review to evaluate.

This also matches skip-gate condition 3: the head SHA 1e3bec48f98d435130469fe283a847c53dd4f230 was already reviewed (see the prior bot comment on this PR), and this diff is identical to what was reviewed then.

No security issues found.

[claude]

Claude finished @kyle-sexton's task in 4m 39s —— View job

---

Code review (/review:code-review)

• Gather context (PR diff via git show, changed files)
• Apply skip gate
• Review changed files
• Post findings

Skip gate: trivial/automated change, no meaningful review surface. The diff is exactly two things:

1. plugins/work-items/.claude-plugin/plugin.json — version bump 0.39.22 → 0.39.23 (diff)
2. plugins/work-items/CHANGELOG.md — a new [0.39.23] entry documenting the re-audit (entry)

No SKILL.md, README.md, or any other instruction-surface prose actually changed in this shard — per the PR description, the work-items plugin's prose was already em-dash-free from an earlier pass (0.39.13), so this PR is a re-audit record, not a content edit. The changelog entry's version matches the plugin.json bump, and its listed em-dash exceptions (the the spec changed — redo the tickets trigger phrase, quoted claim/lease and triage protocol strings, fenced templates, the generated-options block) are consistent with the repo's own vendor-docs-are-not-style and de-slop conventions.

There is no code, logic, or prose change here for a correctness/maintainability review to evaluate.

No findings.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[kyle-sexton]

Lane claim: instance MELO-LAP-001-merge-202608231413 taking merge-lane ownership of this PR, pinned to head SHA 1e3bec48f98d435130469fe283a847c53dd4f230.

[kyle-sexton]

Lane release: instance MELO-LAP-001-merge-202608231413 done — PR merged via squash, merge commit c38c64732995e9cca59c53a902ee48c1379614df.