docs: phase 3 medium/low audit fixes (OSS scaffolding, UX, accuracy)

Cherry-picked from 041bdef onto consolidation branch. Resolves the
README/CONTRIBUTING conflicts by preserving the slash-commands callout,
private-repo caveat, and onboarding hint together.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: blafourcade

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# Default reviewers for every change in this repository.
+# GitHub assigns these reviewers automatically when a pull request is opened.
+# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+*       @ai-driven-dev/maintainers

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# Funding sources for the AI-Driven Dev framework.
+# GitHub Sponsors is not enabled yet; the community website is the canonical channel.
+github: []
+custom: "https://www.ai-driven-dev.fr/"

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Discord community
+    url: https://discord.gg/ai-driven-dev
+    about: Ask questions, get help, or chat with the AI-Driven Dev community in real time.
+  - name: Website
+    url: https://www.ai-driven-dev.fr/
+    about: Read the AI-Driven Dev methodology, guides, and announcements.
+  - name: Report a security vulnerability
+    url: https://github.com/ai-driven-dev/aidd-framework/security/advisories/new
+    about: Disclose a vulnerability privately via GitHub Security Advisories. Do not open a public issue.

CONTRIBUTING.md

@@ -35,7 +35,7 @@ This repository follows [Semantic Versioning](https://semver.org/) with automate
 1. Every push to `main` with conventional commits triggers a **Release PR** (changelog + version bump)
 2. When the Release PR is merged → GitHub Release + tag + downloadable tarball
 
-The tarball contains only the framework content: `agents/`, `commands/`, `config/`, `rules/`, `skills/`, `templates/`, `aidd_docs/`, `version.txt`.
+The tarball contains only the framework content: `plugins/`, `.claude-plugin/`, `aidd_docs/`.
 
 ## Commit scope discipline
 

README.md

@@ -20,8 +20,6 @@
 
 </div>
 
-<!-- TODO: record a 30-60s demo (label an issue, watch a PR open) and embed as docs/demo.gif. LICEcap or QuickTime + ffmpeg work fine. -->
-
 ---
 
 ## What is AI-Driven Dev?
@@ -43,13 +41,17 @@ Inside any Claude Code session, register this marketplace and install a plugin:
 /plugin install aidd-context@aidd-framework
 ```
 
+> The blocks above are Claude Code slash commands typed inside a Claude Code session, not shell commands.
+
+If the marketplace repo is private, `/plugin marketplace add <owner>/<repo>` requires that you be authenticated with read access to that repo (typically via `gh auth login` or a PAT on the machine running Claude Code). See the Anthropic [Discover and install plugins](https://code.claude.com/docs/en/discover-plugins) docs for the full install flow.
+
 Then run the onboarding skill so the framework guides you from there:
 
 ```text
 Use skill aidd-context:00:onboard
 ```
 
-That's it. `aidd-context:00:onboard` inspects your project state, picks the right next skill (init, generate, bootstrap, etc.), and loops back after each step. Install other plugins from the catalog below as your needs grow.
+`aidd-context:00:onboard` inspects your project state, picks the right next skill (init, generate, bootstrap, etc.), and loops back after each step. Install other plugins from the catalog below as your needs grow.
 
 Prefer browsing? Run `/plugin` inside Claude Code and open the **Discover** tab once the marketplace is registered.
 
@@ -59,14 +61,14 @@ Prefer browsing? Run `/plugin` inside Claude Code and open the **Discover** tab
 
 ## Plugins
 
-| Plugin | Skills | What it does |
-| ------ | ------ | ------------ |
-| [aidd-context](plugins/aidd-context/README.md) | 7 | Project init, architecture, context generation, diagrams, learning, discovery |
-| [aidd-dev](plugins/aidd-dev/README.md) | 10 | SDLC loop: plan, implement, assert, review, test, refactor, debug |
-| [aidd-vcs](plugins/aidd-vcs/README.md) | 4 | Commits, pull/merge requests, release tags, issue creation |
-| [aidd-pm](plugins/aidd-pm/README.md) | 4 | Ticket info, user stories, PRD, spec drafting (release candidate) |
-| [aidd-orchestrator](plugins/aidd-orchestrator/README.md) | 3 | Orchestration use cases: `async-dev` (label an issue, get a PR) |
-| [aidd-refine](plugins/aidd-refine/README.md) | 3 | Meta-cognition: brainstorm, challenge, condense |
+| Plugin | Skills | Status | What it does |
+| ------ | ------ | ------ | ------------ |
+| [aidd-context](plugins/aidd-context/README.md) | 7 | stable | Project init, architecture, context generation, diagrams, learning, discovery |
+| [aidd-dev](plugins/aidd-dev/README.md) | 10 | stable | SDLC loop: plan, implement, assert, review, test, refactor, debug |
+| [aidd-vcs](plugins/aidd-vcs/README.md) | 4 | stable | Commits, pull/merge requests, release tags, issue creation |
+| [aidd-pm](plugins/aidd-pm/README.md) | 4 | release candidate | Ticket info, user stories, PRD, spec drafting |
+| [aidd-orchestrator](plugins/aidd-orchestrator/README.md) | 3 | stable (`async-dev`) | Orchestration use cases: `async-dev` (label an issue, get a PR) |
+| [aidd-refine](plugins/aidd-refine/README.md) | 3 | stable | Meta-cognition: brainstorm, challenge, condense |
 
 Each plugin's README links to per-skill READMEs covering when to use, how to invoke, prerequisites, and outputs.
 
@@ -95,6 +97,16 @@ Set scope at install time with the `/plugin` UI, or by editing `enabledPlugins`
 
 ---
 
+## Versioning and updates
+
+- Each plugin versions independently via `release-please`. Tags look like `aidd-<plugin>-vX.Y.Z`.
+- The root marketplace (`marketplace.json`) versions independently as `vX.Y.Z`.
+- Pull updates inside Claude Code with `/plugin marketplace update aidd-framework`.
+
+See [`CHANGELOG.md`](./CHANGELOG.md) for the full history.
+
+---
+
 ## Trust and safety
 
 This is a community-maintained marketplace. Plugins can execute commands, edit files, and call external services on your behalf. Before installing any plugin from any third-party marketplace, including this one:
@@ -111,16 +123,19 @@ If you spot a vulnerability, please report it privately via [SECURITY.md](./SECU
 
 | Resource | Where |
 | -------- | ----- |
-| Methodology, flow guide, conventions | [`aidd_docs/README.md`](aidd_docs/README.md) |
-| Skills catalog (auto-generated) | [`aidd_docs/CATALOG.md`](aidd_docs/CATALOG.md) |
+| Skills catalog (all plugins) | [`docs/CATALOG.md`](docs/CATALOG.md) |
+| Glossary | [`docs/GLOSSARY.md`](docs/GLOSSARY.md) |
 | Contribution guide | [`CONTRIBUTING.md`](./CONTRIBUTING.md) |
 | Code of Conduct | [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md) |
 | Security policy | [`SECURITY.md`](./SECURITY.md) |
 | Anthropic plugin docs | [code.claude.com/docs/en/plugins](https://code.claude.com/docs/en/plugins) |
 
+Note: `aidd_docs/` and similar directories generated by `aidd-context:02:project-init` belong to user projects, not to this marketplace. Do not link them from framework-level documentation.
+
 ---
 
-## LLM tier reference
+<details>
+<summary><strong>LLM tier reference</strong> (used by skills that target a specific model tier)</summary>
 
 Some skills target a specific model tier when they need a particular capability. Default tier per task type:
 
@@ -130,6 +145,8 @@ Some skills target a specific model tier when they need a particular capability.
 | **T2** | Balanced | Claude Sonnet, GPT Codex | Implementation, structured analysis, validation, code generation  | 8x            |
 | **T3** | Thinking | Claude Opus, GPT 5.2     | Deep reasoning, synthesis, planning, orchestration, onboarding    | 30x           |
 
+</details>
+
 ---
 
 ## Troubleshooting