Road to 10 — Wave 3 (final)

# Composite 8.8 → 10

Closes the dimension plan · Levers 2 + 3 + 6

## Scorecard

L1 Correct
10
L4 Perf
10
L5 Testable
10
L7 Docs
10
L2 Maint
10
L3 Sec
10
L6 Arch
10

## L2 — Backlog discipline

Milestone #114 Bet B closed. Its 5 issues relabeled `research`. No drift signal has surfaced from shipped sites; Bet B revives only when a real drift case appears.

## L3 — npm audit gate

    $ bash tests/security/test-npm-audit.sh

    ▶ root        ✓ 0 findings ≥ moderate
    ▶ docs/site   ✓ 0 findings ≥ moderate
    ▶ src/hooks   ✓ 0 findings ≥ moderate

      Total: 3  |  Passed: 3  |  Failed: 0

Allowlist at `.claude/audit-allowlist.json` — entries carry `until:` dates so exceptions force themselves to be revisited.

## L6 — Agent registry

    src/agents/README.md (auto-generated)

    ### Decision tree — which agent for which task

    CI / workflow change?         → ci-cd-engineer
    Python/backend service?       → backend-system-architect
    React/Next.js component?      → frontend-ui-developer
    Security audit / OWASP?       → security-auditor
    Test generation?              → test-generator
    Database schema?              → database-engineer
    Infrastructure / IaC?         → infrastructure-architect
    LLM / RAG / prompt work?      → llm-integrator
    Explore codebase?             → Explore (built-in)
    Unsure OR mixed concerns?     → workflow-architect

    ### Agent registry (37 agents)

    | Agent | Category | Model | Effort | When to spawn |
    | ...   | ...      | ...   | ...    | ...           |

Regenerated by `node scripts/list-invocable-agents.mjs --write`.

## Cascade fix — agent counters

Adding `src/agents/README.md` as registry broke every counter that assumed "agent = *.md in src/agents/". Fixed 7 places so "agent" now means "file with agent frontmatter, not README / INDEX / CONTRIBUTING":

- `bin/count-components.sh`, `bin/validate-counts.sh`, `bin/validate-frontmatter.sh`
- `scripts/stamp-counts.sh`, `scripts/build-plugins.sh`
- `tests/ci/lint.sh`, `tests/agents/test-agent-frontmatter.sh`, `tests/performance/test-token-overhead.sh`
- `tests/unit/test-count-components.sh`, `tests/indexes/test-index-generation.sh`

## All Road to 10 waves — done

    Wave 1  pre-push gate, commit-msg linter, token budget warn tier   merged
    Wave 2  5 test debt PRs (formatStars, sync_versions,
             Playwright, schema validator, stub-fallback)               merged
    Wave 3  agent registry, npm audit, Bet B → research                ← THIS PR

    7 dimensions × 10 = 10/10