docs: phase 3 medium/low audit fixes (OSS scaffolding, UX, accuracy)

Third and final pass of the multi-specialist audit. Three parallel agents
covered OSS scaffolding, documentation accuracy, and user-navigation UX.
All findings consolidated below.

OSS scaffolding
- .github/FUNDING.yml: custom -> ai-driven-dev.fr.
- .github/CODEOWNERS: default mapping `*` -> @ai-driven-dev/maintainers.
- .github/ISSUE_TEMPLATE/config.yml: blank_issues_enabled=false, three
  contact_links (Discord, Website, Security Advisories).
- CODE_OF_CONDUCT.md: enforcement contact updated to conduct@ai-driven-dev.fr.
- SECURITY.md: added security@ai-driven-dev.fr fallback and PGP-on-request
  note alongside Security Advisories.
- README.md: 'Maintained by the AI-Driven Dev community' next to founder line.
- CONTRIBUTING.md: new 'CI and external actions' section recommending
  SHA-pinned `uses:` entries and Dependabot.

Documentation accuracy
- references/auth-modes.md: rewritten to describe the local poll script
  auth (gh CLI session vs env var) instead of the stale auth.source schema.
- references/local-mode-scheduling.md: launchd plist now ships the XML
  declaration and DOCTYPE; added 'Rate limits and quotas' section covering
  GitHub REST budget and Anthropic plan/API spend.
- README.md: Quick start fence kept as `text` but accompanied by a one-line
  note that the blocks are slash commands, not shell. Private-repo caveat
  added next to the install block. Demo-gif TODO comment removed.
- CONTRIBUTING.md: tarball content list updated to the plugin-era layout
  (plugins/, .claude-plugin/, aidd_docs/); version.txt reference dropped.
- plugins/aidd-context/CATALOG.md: clarified as a per-plugin index, with
  a pointer to the framework-wide catalog.
- docs/CATALOG.md: new framework-wide skills catalog generated from
  SKILL.md frontmatter (relocated out of aidd_docs/, which is plugin
  territory and unstable for marketplace-level docs).
- docs/GLOSSARY.md: new glossary covering 15 terms (skill, action,
  router-based skill, SDLC capability, use case, bracket ID, run id,
  audit JSON, lifecycle label, working lock, marketplace, plugin, hook,
  agent, rule). Cross-linked from the root README.
- README.md Documentation table: links repointed at docs/ and a note added
  that aidd_docs/ is project-scoped, generated by aidd-context:02:project-init.

User-navigation UX
- Maturity line added on every plugin README (Status: stable / release
  candidate / stable for the active use case + roadmap).
- Quick-start pointer added on every plugin README; routes to the
  best-fit first skill (00:onboard for aidd-context, 00:sdlc for
  aidd-dev, 01:commit for aidd-vcs, 01:setup-async-dev for orchestrator,
  01:brainstorm for refine, 01:ticket-info for aidd-pm).
- Root README: new 'Versioning and updates' section above Trust and
  safety; new Status column in the Plugins table; LLM tier reference
  collapsed into a <details> block.
- aidd-vcs README: one-line typical-flow hint at the top.
- 6 plugin READMEs and 27 skill READMEs now carry a breadcrumb
  navigation line (root <- plugin <- skill).
- CONTRIBUTING.md and aidd_docs cross-links pulled back; aidd_docs is
  generated by plugins and is not a stable framework-doc surface.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: blafourcade

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# Default reviewers for every change in this repository.
+# GitHub assigns these reviewers automatically when a pull request is opened.
+# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+*       @ai-driven-dev/maintainers

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# Funding sources for the AI-Driven Dev framework.
+# GitHub Sponsors is not enabled yet; the community website is the canonical channel.
+github: []
+custom: "https://www.ai-driven-dev.fr/"

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Discord community
+    url: https://discord.gg/ai-driven-dev
+    about: Ask questions, get help, or chat with the AI-Driven Dev community in real time.
+  - name: Website
+    url: https://www.ai-driven-dev.fr/
+    about: Read the AI-Driven Dev methodology, guides, and announcements.
+  - name: Report a security vulnerability
+    url: https://github.com/ai-driven-dev/aidd-framework/security/advisories/new
+    about: Disclose a vulnerability privately via GitHub Security Advisories. Do not open a public issue.

CONTRIBUTING.md

@@ -1,5 +1,6 @@
 # Contribution Guide - AIDD Framework
 
+
 This guide explains how to contribute to the AIDD framework — the source of truth for agents, commands, rules, skills, and templates.
 
 > **Roles and repository access**: see the [main CONTRIBUTING](https://github.com/ai-driven-dev/aidd/blob/main/CONTRIBUTING.md).
@@ -35,7 +36,7 @@ This repository follows [Semantic Versioning](https://semver.org/) with automate
 1. Every push to `main` with conventional commits triggers a **Release PR** (changelog + version bump)
 2. When the Release PR is merged → GitHub Release + tag + downloadable tarball
 
-The tarball contains only the framework content: `agents/`, `commands/`, `config/`, `rules/`, `skills/`, `templates/`, `aidd_docs/`, `version.txt`.
+The tarball contains only the framework content: `plugins/`, `.claude-plugin/`, `aidd_docs/`.
 
 ## Commit scope discipline
 

README.md

@@ -20,8 +20,6 @@
 
 </div>
 
-<!-- TODO: record a 30-60s demo (label an issue, watch a PR open) and embed as docs/demo.gif. LICEcap or QuickTime + ffmpeg work fine. -->
-
 ---
 
 ## What is AI-Driven Dev?
@@ -43,6 +41,10 @@ Inside any Claude Code session, register this marketplace and install a plugin:
 /plugin install aidd-dev@aidd-framework
 ```
 
+> The blocks above are Claude Code slash commands typed inside a Claude Code session, not shell commands.
+
+If the marketplace repo is private, `/plugin marketplace add <owner>/<repo>` requires that you be authenticated with read access to that repo (typically via `gh auth login` or a PAT on the machine running Claude Code). See the Anthropic [Discover and install plugins](https://code.claude.com/docs/en/discover-plugins) docs for the full install flow.
+
 That's it. The first command registers `aidd-framework` as a marketplace; the second installs the `aidd-dev` plugin from it. Repeat the `install` line for any other plugin from the catalog below.
 
 Prefer browsing? Run `/plugin` inside Claude Code and open the **Discover** tab once the marketplace is registered.
@@ -53,14 +55,14 @@ Prefer browsing? Run `/plugin` inside Claude Code and open the **Discover** tab
 
 ## Plugins
 
-| Plugin | Skills | What it does |
-| ------ | ------ | ------------ |
-| [aidd-context](plugins/aidd-context/README.md) | 7 | Project init, architecture, context generation, diagrams, learning, discovery |
-| [aidd-dev](plugins/aidd-dev/README.md) | 10 | SDLC loop: plan, implement, assert, review, test, refactor, debug |
-| [aidd-vcs](plugins/aidd-vcs/README.md) | 4 | Commits, pull/merge requests, release tags, issue creation |
-| [aidd-pm](plugins/aidd-pm/README.md) | 4 | Ticket info, user stories, PRD, spec drafting (release candidate) |
-| [aidd-orchestrator](plugins/aidd-orchestrator/README.md) | 3 | Orchestration use cases: `async-dev` (label an issue, get a PR) |
-| [aidd-refine](plugins/aidd-refine/README.md) | 3 | Meta-cognition: brainstorm, challenge, condense |
+| Plugin | Skills | Status | What it does |
+| ------ | ------ | ------ | ------------ |
+| [aidd-context](plugins/aidd-context/README.md) | 7 | stable | Project init, architecture, context generation, diagrams, learning, discovery |
+| [aidd-dev](plugins/aidd-dev/README.md) | 10 | stable | SDLC loop: plan, implement, assert, review, test, refactor, debug |
+| [aidd-vcs](plugins/aidd-vcs/README.md) | 4 | stable | Commits, pull/merge requests, release tags, issue creation |
+| [aidd-pm](plugins/aidd-pm/README.md) | 4 | release candidate | Ticket info, user stories, PRD, spec drafting |
+| [aidd-orchestrator](plugins/aidd-orchestrator/README.md) | 3 | stable (`async-dev`) | Orchestration use cases: `async-dev` (label an issue, get a PR) |
+| [aidd-refine](plugins/aidd-refine/README.md) | 3 | stable | Meta-cognition: brainstorm, challenge, condense |
 
 Each plugin's README links to per-skill READMEs covering when to use, how to invoke, prerequisites, and outputs.
 
@@ -89,6 +91,16 @@ Set scope at install time with the `/plugin` UI, or by editing `enabledPlugins`
 
 ---
 
+## Versioning and updates
+
+- Each plugin versions independently via `release-please`. Tags look like `aidd-<plugin>-vX.Y.Z`.
+- The root marketplace (`marketplace.json`) versions independently as `vX.Y.Z`.
+- Pull updates inside Claude Code with `/plugin marketplace update aidd-framework`.
+
+See [`CHANGELOG.md`](./CHANGELOG.md) for the full history.
+
+---
+
 ## Trust and safety
 
 This is a community-maintained marketplace. Plugins can execute commands, edit files, and call external services on your behalf. Before installing any plugin from any third-party marketplace, including this one:
@@ -105,16 +117,19 @@ If you spot a vulnerability, please report it privately via [SECURITY.md](./SECU
 
 | Resource | Where |
 | -------- | ----- |
-| Methodology, flow guide, conventions | [`aidd_docs/README.md`](aidd_docs/README.md) |
-| Skills catalog (auto-generated) | [`aidd_docs/CATALOG.md`](aidd_docs/CATALOG.md) |
+| Skills catalog (all plugins) | [`docs/CATALOG.md`](docs/CATALOG.md) |
+| Glossary | [`docs/GLOSSARY.md`](docs/GLOSSARY.md) |
 | Contribution guide | [`CONTRIBUTING.md`](./CONTRIBUTING.md) |
 | Code of Conduct | [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md) |
 | Security policy | [`SECURITY.md`](./SECURITY.md) |
 | Anthropic plugin docs | [code.claude.com/docs/en/plugins](https://code.claude.com/docs/en/plugins) |
 
+Note: `aidd_docs/` and similar directories generated by `aidd-context:02:project-init` belong to user projects, not to this marketplace. Do not link them from framework-level documentation.
+
 ---
 
-## LLM tier reference
+<details>
+<summary><strong>LLM tier reference</strong> (used by skills that target a specific model tier)</summary>
 
 Some skills target a specific model tier when they need a particular capability. Default tier per task type:
 
@@ -124,6 +139,8 @@ Some skills target a specific model tier when they need a particular capability.
 | **T2** | Balanced | Claude Sonnet, GPT Codex | Implementation, structured analysis, validation, code generation  | 8x            |
 | **T3** | Thinking | Claude Opus, GPT 5.2     | Deep reasoning, synthesis, planning, orchestration, onboarding    | 30x           |
 
+</details>
+
 ---
 
 ## Troubleshooting