diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 55866ff02..62af76b20 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -13,7 +13,7 @@ docs/                              # repo-level documentation
 evals/                            # eval fixtures and harnesses (not shipped)
 ```
 
-Edit plugin components directly under `plugins/<plugin>/` (agents, skills, hooks, knowledge, templates, docs). See [`plugins/dev-team/CLAUDE.md`](plugins/dev-team/CLAUDE.md) for the orchestration pipeline.
+Edit plugin components directly under `plugins/<plugin>/` (agents, skills, hooks, knowledge, templates, docs). See [`plugins/dev-team/CLAUDE.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/CLAUDE.md) for the orchestration pipeline.
 
 ## Local development
 
@@ -104,4 +104,4 @@ The docs use three diagram formats, each for a distinct purpose — match the co
 
 ## Releasing
 
-Releases are managed by [release-please](https://github.com/googleapis/release-please): push [conventional commits](https://www.conventionalcommits.org/) to `main` and merge the release PR it opens. The full rules — the version-bump mapping, why every commit that lands on `main` must be conventional under rebase-merge, and how to recover a missed release with a `Release-As:` footer — are in [`CLAUDE.md`](CLAUDE.md#releasing).
+Releases are managed by [release-please](https://github.com/googleapis/release-please): push [conventional commits](https://www.conventionalcommits.org/) to `main` and merge the release PR it opens. The full rules — the version-bump mapping, why every commit that lands on `main` must be conventional under rebase-merge, and how to recover a missed release with a `Release-As:` footer — are in [`CLAUDE.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/CLAUDE.md#releasing).
diff --git a/GETTING-STARTED.md b/GETTING-STARTED.md
index da5583dff..02551fc6f 100644
--- a/GETTING-STARTED.md
+++ b/GETTING-STARTED.md
@@ -8,7 +8,7 @@ On this page:
 - [Key Concepts](#key-concepts)
 - [How to Use It](#how-to-use-it)
 - [Common Workflows](#common-workflows)
-- [Diagnostic & Audit Workflows](#diagnostic--audit-workflows)
+- [Diagnostic & Audit Workflows](#diagnostic-audit-workflows)
 - [Available Agents and Skills](#available-agents-and-skills)
 - [Rules to Know](#rules-to-know)
 
diff --git a/README.md b/README.md
index 95414cead..91a95e0b1 100644
--- a/README.md
+++ b/README.md
@@ -110,7 +110,7 @@ Every `git commit` is automatically gated by `/code-review`. A `PreToolUse` hook
 
 Developing, testing, or releasing the plugins? See **[CONTRIBUTING.md](CONTRIBUTING.md)** — local-dev setup (including live installs via symlinks), the `/agent-eval` and `/agent-audit` test commands, the security comparative-testing harness, how to add agents and skills, and the release process.
 
-**`/code-review` benchmark harness** ([`evals/code-review-benchmark/`](evals/code-review-benchmark/README.md)): checks out real, known-defect commits from Defects4J (Java) and BugsJS (JavaScript), runs `/code-review` against the buggy revision, and scores whether its findings actually cover the real defect — with a dedicated Missed Defects report. Adapters and scoring are unit-tested against real fetched dataset samples; a live sweep against the actual corpora requires a local Defects4J/BugsJS install (see the harness README for prerequisites and usage).
+**`/code-review` benchmark harness** ([`evals/code-review-benchmark/`](https://github.com/bdfinst/agentic-dev-team/blob/main/evals/code-review-benchmark/README.md)): checks out real, known-defect commits from Defects4J (Java) and BugsJS (JavaScript), runs `/code-review` against the buggy revision, and scores whether its findings actually cover the real defect — with a dedicated Missed Defects report. Adapters and scoring are unit-tested against real fetched dataset samples; a live sweep against the actual corpora requires a local Defects4J/BugsJS install (see the harness README for prerequisites and usage).
 
 ## Documentation
 
@@ -122,7 +122,7 @@ Start here:
 | --- | --- |
 | [Getting Started](GETTING-STARTED.md) | Install, the workflow, suggested skills, worked examples |
 | [Contributing](CONTRIBUTING.md) | Local development, testing, adding agents/skills, releasing |
-| [Plugin Development Guide](CLAUDE.md) | Project North Star, repo structure, working rules |
+| [Plugin Development Guide](https://github.com/bdfinst/agentic-dev-team/blob/main/CLAUDE.md) | Project North Star, repo structure, working rules |
 
 Per-plugin docs: **[dev-team](plugins/dev-team/README.md)** · **[security-assessment](plugins/security-assessment/README.md)** · **[marketplace-dev](plugins/marketplace-dev/README.md)** — each plugin's README is the entry point to its architecture, commands, and deeper guides.
 
diff --git a/docs/adr/0022-reject-delegation-only-sweep-dispatch.md b/docs/adr/0022-reject-delegation-only-sweep-dispatch.md
index a6f758ee8..07aaf37d4 100644
--- a/docs/adr/0022-reject-delegation-only-sweep-dispatch.md
+++ b/docs/adr/0022-reject-delegation-only-sweep-dispatch.md
@@ -23,7 +23,7 @@ The experiment ran on 2026-07-18: 3 arms (solo session / released plugin
 10.12.0 / treatment branch) × 3 task classes (one-file fix, 4-file feature
 slice, 26-file review sweep) × 5 interleaved reps, 45/45 runs completed at
 matched external acceptance checks. Evidence:
-[`reports/orchestration-benchmark-2026-07-18.md`](../../reports/orchestration-benchmark-2026-07-18.md)
+[`reports/orchestration-benchmark-2026-07-18.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/reports/orchestration-benchmark-2026-07-18.md)
 (raw per-run data alongside).
 
 Measured, per class (median cost per run; quality = acceptance passes):
diff --git a/docs/cloud-setup.md b/docs/cloud-setup.md
index 3aefd63b4..26165e684 100644
--- a/docs/cloud-setup.md
+++ b/docs/cloud-setup.md
@@ -53,11 +53,11 @@ fi
 exit 0
 ```
 
-[`.claude/cloud-setup.sh`](../.claude/cloud-setup.sh) is the actual work:
+[`.claude/cloud-setup.sh`](https://github.com/bdfinst/agentic-dev-team/blob/main/.claude/cloud-setup.sh) is the actual work:
 this repo's test/gate toolchain (`jq`, `shellcheck`, the Python dev deps, `gh`,
 `uv`, `mutmut`, `adr`), Node 24+ plus `npm ci` for the git hooks
 (`pre-commit`, `pre-push`, `commit-msg`), the plugin install/refresh, and a
-closing [`scripts/verify_toolchain.py`](../scripts/verify_toolchain.py) pass.
+closing [`scripts/verify_toolchain.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/verify_toolchain.py) pass.
 It **refreshes** the plugin (re-pulls the catalog and `plugin update`) rather
 than only installing — `plugin install` is a no-op once a version is cached, and
 the reused snapshot would otherwise pin the first version forever (see
@@ -82,7 +82,7 @@ The Setup script must `exit 0` even when provisioning went wrong, so it can only
 *report* a broken toolchain — it can never refuse to hand one over. Two things
 close that gap:
 
-- [`scripts/verify_toolchain.py`](../scripts/verify_toolchain.py) — runs every
+- [`scripts/verify_toolchain.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/verify_toolchain.py) — runs every
   tool instead of probing `PATH`, so an installed-but-unstartable tool fails
   instead of passing. The Setup script calls it at the end; run it yourself any
   time with `python3 scripts/verify_toolchain.py`.
@@ -128,7 +128,7 @@ The fix has three layers, all wired into `.claude/cloud-setup.sh` and the
   bfinster` and `claude plugin update dev-team@bfinster` on every invocation, and
   the SessionStart hook no longer no-ops when a version is already present.
 - **Enable marketplace auto-update.** Both call the plugin's own
-  [`skills/upgrade/scripts/enable_autoupdate.py`](../plugins/dev-team/skills/upgrade/scripts/enable_autoupdate.py)
+  [`skills/upgrade/scripts/enable_autoupdate.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/skills/upgrade/scripts/enable_autoupdate.py)
   (`--enable`), which sets `extraKnownMarketplaces.bfinster.autoUpdate: true` in
   the config `settings.json` — the same flag the `/plugin` UI and `/upgrade`
   toggle. This is the key lever: it makes the CLI re-pull and upgrade **at launch,
@@ -136,7 +136,7 @@ The fix has three layers, all wired into `.claude/cloud-setup.sh` and the
   rebuild. `/upgrade` runs the very same script (its `--check`/`--enable` modes),
   so there is one implementation of the flag, not two.
 - **Drift advisory.** Both also run the plugin's
-  [`skills/upgrade/scripts/check_version_drift.py`](../plugins/dev-team/skills/upgrade/scripts/check_version_drift.py),
+  [`skills/upgrade/scripts/check_version_drift.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/skills/upgrade/scripts/check_version_drift.py),
   which compares the installed version against the refreshed catalog and surfaces
   a "v{installed} → v{latest}; restart or run `/upgrade`" advisory. This is the
   safety net for the one case the refresh can't fix silently: a **restrictive
diff --git a/docs/cloud-startup-prompt.md b/docs/cloud-startup-prompt.md
index 1bd5eb9b1..f50286450 100644
--- a/docs/cloud-startup-prompt.md
+++ b/docs/cloud-startup-prompt.md
@@ -1,6 +1,6 @@
 # Cloud startup prompt
 
-The Setup script ([`.claude/cloud-setup.sh`](../.claude/cloud-setup.sh)) provisions
+The Setup script ([`.claude/cloud-setup.sh`](https://github.com/bdfinst/agentic-dev-team/blob/main/.claude/cloud-setup.sh)) provisions
 the machine. This is the other half: the **first message** to send in a fresh
 cloud session, so Claude confirms the environment is actually sound before it
 starts changing code.
@@ -78,14 +78,14 @@ or a `SessionStart` hook. Two caveats if you do:
 - A `SessionStart` hook runs *after* Claude boots, so it cannot fix the
   plugin-loading problem in step 3 — that one genuinely needs the Setup script.
 - Keep it fail-open and time-boxed, like the hooks already registered in
-  [`.claude/settings.json`](../.claude/settings.json). A verification step that
+  [`.claude/settings.json`](https://github.com/bdfinst/agentic-dev-team/blob/main/.claude/settings.json). A verification step that
   hangs session startup is worse than the drift it was guarding against.
 
 ## See also
 
 - [`cloud-setup.md`](cloud-setup.md) — the Setup script itself, plugin freshness,
   and the snapshot/caching behavior that pins stale plugin versions.
-- [`.claude/cloud-setup.sh`](../.claude/cloud-setup.sh) — what to paste into
+- [`.claude/cloud-setup.sh`](https://github.com/bdfinst/agentic-dev-team/blob/main/.claude/cloud-setup.sh) — what to paste into
   claude.ai/code → Environment → Setup script.
-- [`scripts/verify_toolchain.py`](../scripts/verify_toolchain.py) — the verifier,
+- [`scripts/verify_toolchain.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/verify_toolchain.py) — the verifier,
   runnable on its own at any time (`--quiet` for failures only, `--json` to script it).
diff --git a/docs/context-and-session-economy-playbook.md b/docs/context-and-session-economy-playbook.md
index 9c16bd5b2..5b558f400 100644
--- a/docs/context-and-session-economy-playbook.md
+++ b/docs/context-and-session-economy-playbook.md
@@ -20,11 +20,11 @@ answers on its own:
 
 | Question | Use |
 | --- | --- |
-| How much did *that run* cost? | [`/cost-report`](../plugins/dev-team/skills/cost-report/SKILL.md) |
-| How did *that run* go, step by step? | [`/run-report`](../plugins/dev-team/skills/run-report/SKILL.md) |
-| What should we change, based on recent sessions? | [`/session-review`](../plugins/dev-team/skills/session-review/SKILL.md) |
-| Which agents/routing have gone stale? | [`/harness-audit`](../plugins/dev-team/skills/harness-audit/SKILL.md) |
-| Which skills and agents are unused? | [`/artifact-lifecycle`](../plugins/dev-team/skills/artifact-lifecycle/SKILL.md) |
+| How much did *that run* cost? | [`/cost-report`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/skills/cost-report/SKILL.md) |
+| How did *that run* go, step by step? | [`/run-report`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/skills/run-report/SKILL.md) |
+| What should we change, based on recent sessions? | [`/session-review`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/skills/session-review/SKILL.md) |
+| Which agents/routing have gone stale? | [`/harness-audit`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/skills/harness-audit/SKILL.md) |
+| Which skills and agents are unused? | [`/artifact-lifecycle`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/skills/artifact-lifecycle/SKILL.md) |
 | Is the context ceiling in the right place *right now*? | [`context_ceiling_report.py`](context-ceiling-validation.md) |
 
 This playbook is the **longitudinal** layer over those: run them in a fixed
diff --git a/docs/context-ceiling-validation.md b/docs/context-ceiling-validation.md
index e45200ddb..65ec653f0 100644
--- a/docs/context-ceiling-validation.md
+++ b/docs/context-ceiling-validation.md
@@ -130,11 +130,11 @@ fail is worse than no gate* rule applied to the measurement itself.
 Every policy decision — which tools are gated, which skills are exempt, how a
 model maps to a window, how occupancy is summed, what counts as a sidechain
 row — is **imported** from
-[`plugins/dev-team/hooks/context_ceiling_guard.py`](../plugins/dev-team/hooks/context_ceiling_guard.py)
+[`plugins/dev-team/hooks/context_ceiling_guard.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/hooks/context_ceiling_guard.py)
 rather than restated. A validator that measured the ceiling even slightly
 differently from the guard would be validating a threshold nobody ships.
 
-[`tests/scripts/test_context_ceiling_report.py`](../tests/scripts/test_context_ceiling_report.py)
+[`tests/scripts/test_context_ceiling_report.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/tests/scripts/test_context_ceiling_report.py)
 additionally pins the report's occupancy walk against the hook's own
 `_measure_occupancy` on shared fixtures, in the same spirit as the hook
 suite's utilization-formula equality test.
diff --git a/docs/experiments/01-final-results.md b/docs/experiments/01-final-results.md
index 3a81e36fd..39fda0a7c 100644
--- a/docs/experiments/01-final-results.md
+++ b/docs/experiments/01-final-results.md
@@ -6,8 +6,8 @@
 **Design + prior results:** [`01-experiment-prompt-3sizes-3arms.md`](agentic-workflow-evidence/01-experiment-prompt-3sizes-3arms.md),
 `tdd-vs-test-after-experiment.md`,
 `tdd-vs-test-after-consolidated-report.md` (prior campaign; not migrated into this docs set)
-**Runner:** [`scripts/run_tdd_experiment.py`](../../scripts/run_tdd_experiment.py)
-**Analyzer:** [`scripts/analyze_tdd_experiment.py`](../../scripts/analyze_tdd_experiment.py)
+**Runner:** [`scripts/run_tdd_experiment.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/run_tdd_experiment.py)
+**Analyzer:** [`scripts/analyze_tdd_experiment.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/analyze_tdd_experiment.py)
 **Raw data:** [`agentic-workflow-evidence/data/3sizes-small-sonnet-2026-06-22.jsonl`](agentic-workflow-evidence/data/3sizes-small-sonnet-2026-06-22.jsonl) (small),
 [`agentic-workflow-evidence/data/tdd-largetask-sonnet-2026-06-21.json`](agentic-workflow-evidence/data/tdd-largetask-sonnet-2026-06-21.json) (medium, folded in),
 [`agentic-workflow-evidence/data/3sizes-large-sonnet-2026-06-22.jsonl`](agentic-workflow-evidence/data/3sizes-large-sonnet-2026-06-22.jsonl) (large),
diff --git a/docs/experiments/02-final-results.md b/docs/experiments/02-final-results.md
index 7e7c8d7db..6fe5aaa17 100644
--- a/docs/experiments/02-final-results.md
+++ b/docs/experiments/02-final-results.md
@@ -647,7 +647,7 @@ step is taken seriously.
 
 *Report generated by `claude-sonnet-4-6` in a remote Claude Code session.*  
 *Raw data: [`docs/experiments/agentic-workflow-evidence/data/`](agentic-workflow-evidence/data/)*  
-*Analysis script: [`scripts/analyze_tdd_pays.py`](../../scripts/analyze_tdd_pays.py)*
+*Analysis script: [`scripts/analyze_tdd_pays.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/analyze_tdd_pays.py)*
 
 ---
 
diff --git a/docs/experiments/05-final-results.md b/docs/experiments/05-final-results.md
index 596e8416a..709a729bb 100644
--- a/docs/experiments/05-final-results.md
+++ b/docs/experiments/05-final-results.md
@@ -9,8 +9,8 @@ refactor-cadence/workflow-matrix experiment line (experiments 01–05); see
 
 **Data:** [`agentic-workflow-evidence/data/refactor-workflow-matrix.jsonl`](agentic-workflow-evidence/data/refactor-workflow-matrix.jsonl)
 **Model:** `claude-sonnet-4-6` (held fixed across all arms)
-**Harness:** [`scripts/run_refactor_experiment.py`](../../scripts/run_refactor_experiment.py),
-orchestrated by [`scripts/run_workflow_matrix.py`](../../scripts/run_workflow_matrix.py)
+**Harness:** [`scripts/run_refactor_experiment.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/run_refactor_experiment.py),
+orchestrated by [`scripts/run_workflow_matrix.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/run_workflow_matrix.py)
 
 ---
 
diff --git a/docs/experiments/RECOMMENDATIONS.md b/docs/experiments/RECOMMENDATIONS.md
index b87dfba01..70b6ba1e9 100644
--- a/docs/experiments/RECOMMENDATIONS.md
+++ b/docs/experiments/RECOMMENDATIONS.md
@@ -113,7 +113,7 @@ against this repo's own tasks or harness (this harness's runs are
 clean-room `claude -p` dispatches with no plugin loaded either, so neither
 side of the comparison is controlled on agent configuration — the gap is
 the corpus and harness, not "our agents vs. theirs"). See
-[`../../plugins/dev-team/knowledge/test-cadence-tradeoffs.md`](../../plugins/dev-team/knowledge/test-cadence-tradeoffs.md)
+[`../../plugins/dev-team/knowledge/test-cadence-tradeoffs.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/knowledge/test-cadence-tradeoffs.md)
 for the decision rule and what a local replication would require before this
 recommendation changes.
 
diff --git a/docs/experiments/agentic-workflow-evidence/01-experiment-prompt-3sizes-3arms.md b/docs/experiments/agentic-workflow-evidence/01-experiment-prompt-3sizes-3arms.md
index 0467e36bd..fe93e2429 100644
--- a/docs/experiments/agentic-workflow-evidence/01-experiment-prompt-3sizes-3arms.md
+++ b/docs/experiments/agentic-workflow-evidence/01-experiment-prompt-3sizes-3arms.md
@@ -1,7 +1,7 @@
 # Experiment Prompt: Build-Pipeline vs. TDD vs. Non-TDD across Small / Medium / Large Tasks
 
 **Type:** Reusable experiment prompt (hand this whole file to Claude to execute)
-**Harness:** [`scripts/run_tdd_experiment.py`](../../../scripts/run_tdd_experiment.py)
+**Harness:** [`scripts/run_tdd_experiment.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/run_tdd_experiment.py)
 **Design + prior results:** `tdd-vs-test-after-experiment.md`,
 `tdd-vs-test-after-consolidated-report.md` (prior campaign; not migrated into this docs set)
 
diff --git a/docs/experiments/agentic-workflow-evidence/02-experiment-prompt-when-tdd-pays.md b/docs/experiments/agentic-workflow-evidence/02-experiment-prompt-when-tdd-pays.md
index 05e469b70..fc22d5ee7 100644
--- a/docs/experiments/agentic-workflow-evidence/02-experiment-prompt-when-tdd-pays.md
+++ b/docs/experiments/agentic-workflow-evidence/02-experiment-prompt-when-tdd-pays.md
@@ -1,7 +1,7 @@
 # Experiment Prompt: When Does TDD Actually Pay Off?
 
 **Type:** Reusable experiment prompt (hand this whole file to Claude to execute)
-**Harness:** [`scripts/run_tdd_experiment.py`](../../../scripts/run_tdd_experiment.py) — **must be extended** (see "Extend the harness")
+**Harness:** [`scripts/run_tdd_experiment.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/run_tdd_experiment.py) — **must be extended** (see "Extend the harness")
 **Motivation:** [`FAQ.md` Q1](../FAQ.md),
 [`01-final-results.md`](../01-final-results.md)
 **Prior run results:** [`02-final-results.md`](../02-final-results.md)
diff --git a/docs/experiments/agentic-workflow-evidence/04-experiment-prompt-refactor-granularity.md b/docs/experiments/agentic-workflow-evidence/04-experiment-prompt-refactor-granularity.md
index 4ce26d170..004fbd8ba 100644
--- a/docs/experiments/agentic-workflow-evidence/04-experiment-prompt-refactor-granularity.md
+++ b/docs/experiments/agentic-workflow-evidence/04-experiment-prompt-refactor-granularity.md
@@ -1,7 +1,7 @@
 # Experiment Prompt: Refactoring Granularity, the Test Safety Net, and Code/Test Authorship
 
 **Type:** Reusable experiment prompt (hand this whole file to Claude to execute)
-**Harness:** [`scripts/run_tdd_experiment.py`](../../../scripts/run_tdd_experiment.py) — **must be extended** (see "Extend the harness")
+**Harness:** [`scripts/run_tdd_experiment.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/run_tdd_experiment.py) — **must be extended** (see "Extend the harness")
 **Design + prior results:** [`02-final-results.md` § refactoring-cadence follow-up](../02-final-results.md#proposed-follow-up-refactoring-cadence-and-the-test-safety-net)
 
 This run resolves the open question from the *When Does TDD Pay Off?* study: the two
@@ -13,7 +13,7 @@ real **5%** difference from scatter, and it pulls apart the candidate mechanisms
 It judges every arm on three axes — **how modular and changeable the code is**, **how good
 the tests are**, and **what that quality cost** — and reports quality both raw and
 per-dollar, so the verdict names the efficient frontier rather than the most expensive arm.
-The three axes and their sensors are defined in [What we measure](#what-we-measure--three-axes-define-these-before-running).
+The three axes and their sensors are defined in [What we measure](#what-we-measure-three-axes-define-these-before-running).
 
 ---
 
diff --git a/docs/experiments/agentic-workflow-evidence/05-experiment-prompt-workflow-matrix.md b/docs/experiments/agentic-workflow-evidence/05-experiment-prompt-workflow-matrix.md
index 518b9f3d3..30b70ef74 100644
--- a/docs/experiments/agentic-workflow-evidence/05-experiment-prompt-workflow-matrix.md
+++ b/docs/experiments/agentic-workflow-evidence/05-experiment-prompt-workflow-matrix.md
@@ -1,7 +1,7 @@
 # Experiment Prompt: Which agentic workflow yields maintainable, well-tested code at minimum cost
 
 **Type:** Reusable experiment prompt (hand this whole file to Claude to execute)
-**Harness:** [`scripts/run_refactor_experiment.py`](../../../scripts/run_refactor_experiment.py)
+**Harness:** [`scripts/run_refactor_experiment.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/run_refactor_experiment.py)
 **Lineage:** the single, consolidated experiment for the refactor-cadence line. It supersedes
 the earlier granularity / larger-corpus designs (former prompts 06 and the cadence-larger
 prompt), fixes the variables they left open (refactoring on, specs clear), and re-scopes
@@ -169,7 +169,7 @@ variance before funding it. It is **not** part of the base run.
 2. **1-task cost pilot** on the new arms (`--task fare --arm all-tests-first-single --arm
    all-tests-first-split --trials 1`) to get real per-cell cost.
 3. **Campaign:** one command —
-   [`scripts/run_workflow_matrix.py`](../../../scripts/run_workflow_matrix.py). It runs the 7 arms
+   [`scripts/run_workflow_matrix.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/scripts/run_workflow_matrix.py). It runs the 7 arms
    × 4 tasks × 6 base trials, then **sequentially extends** only the arms whose cost-efficiency
    (quality-per-dollar) rank is still ambiguous, up to a 12-trial ceiling. Defaults to a **dry
    plan** (no dispatch); pass `--go` to run, `--analyze-only` to print the efficiency frontier
diff --git a/docs/experiments/test-cadence-validation-plan.md b/docs/experiments/test-cadence-validation-plan.md
index 2444519b1..37388dc83 100644
--- a/docs/experiments/test-cadence-validation-plan.md
+++ b/docs/experiments/test-cadence-validation-plan.md
@@ -5,7 +5,7 @@ batch-red-per-class finding, see issue #1702) against this repo's own
 Code-First Small Batches baseline, per
 [ADR 0017](../adr/0017-single-build-cadence-remove-classic-tdd-opt-in.md)'s
 reopening condition ("a new decision to make with new evidence"). See
-[`../../plugins/dev-team/knowledge/test-cadence-tradeoffs.md`](../../plugins/dev-team/knowledge/test-cadence-tradeoffs.md)
+[`../../plugins/dev-team/knowledge/test-cadence-tradeoffs.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/knowledge/test-cadence-tradeoffs.md)
 for the decision rule this runbook exists to satisfy — that knowledge file
 is what ships to consumers; this file is marketplace-repo development
 process and does not ship.
diff --git a/docs/marketplace-builder-plugin-playbook.md b/docs/marketplace-builder-plugin-playbook.md
index 5b0932576..80f022d74 100644
--- a/docs/marketplace-builder-plugin-playbook.md
+++ b/docs/marketplace-builder-plugin-playbook.md
@@ -15,15 +15,15 @@ build and test the plugin itself.
 
 > Scope: this is about building the **tool** (a marketplace-builder plugin), not a
 > single marketplace. For a one-off hardening pass on an existing marketplace, run
-> the hygiene sensor ([`tests/repo/test_shipped_script_refs.py`](../tests/repo/test_shipped_script_refs.py))
+> the hygiene sensor ([`tests/repo/test_shipped_script_refs.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/tests/repo/test_shipped_script_refs.py))
 > directly.
 
 **On this page:** [1. What this plugin produces](#1-what-this-plugin-produces) ·
 [2. Marketplace anatomy](#2-marketplace-anatomy-your-plugin-must-model) ·
-[3. Skills & commands](#3-skills--commands-the-plugin-should-provide) ·
+[3. Skills & commands](#3-skills-commands-the-plugin-should-provide) ·
 [4. The enforcement sensor](#4-the-enforcement-sensor-it-must-shipscaffold) ·
 [5. Invariants to bake in](#5-invariants-to-bake-into-every-generatedaudited-plugin) ·
-[6. Independent versioning + catalog sync](#6-independent-versioning--catalog-sync-automate-never-hand-edit) ·
+[6. Independent versioning + catalog sync](#6-independent-versioning-catalog-sync-automate-never-hand-edit) ·
 [7. Cross-plugin dependencies](#7-cross-plugin-dependencies-plugin-a-consumes-plugin-b-at-a-pinned-version) ·
 [8. Building the plugin itself](#8-building-the-plugin-itself-step-by-step) ·
 [9. Acceptance checklist](#9-acceptance-checklist-for-the-plugin-you-build)
@@ -149,9 +149,9 @@ Python — a new marketplace should start Python, not bash.) The four invariants
    `test_*.py`, `run-all*`, a `tests/` dir, …).
 
 A portable, parameterized implementation lives in the hygiene kit
-([`tests/repo/test_shipped_script_refs.py`](../tests/repo/test_shipped_script_refs.py),
+([`tests/repo/test_shipped_script_refs.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/tests/repo/test_shipped_script_refs.py),
 with the security-assessment variant at
-[`tests/repo/test_shipped_script_refs_security_assessment.py`](../tests/repo/test_shipped_script_refs_security_assessment.py));
+[`tests/repo/test_shipped_script_refs_security_assessment.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/tests/repo/test_shipped_script_refs_security_assessment.py));
 ship that as the plugin's reference template.
 
 ---
diff --git a/docs/using-plugin-skills-in-the-web-environment.md b/docs/using-plugin-skills-in-the-web-environment.md
index d5a229f3c..8889b0104 100644
--- a/docs/using-plugin-skills-in-the-web-environment.md
+++ b/docs/using-plugin-skills-in-the-web-environment.md
@@ -43,7 +43,7 @@ script). It installs the repo's toolchain **and** the `dev-team` plugin before
 Claude boots, so the plugin's ~86 skills (including `/ship`) are available in the
 session that starts.
 
-The body of [`.claude/cloud-setup.sh`](../.claude/cloud-setup.sh) is exactly that
+The body of [`.claude/cloud-setup.sh`](https://github.com/bdfinst/agentic-dev-team/blob/main/.claude/cloud-setup.sh) is exactly that
 script — it installs `jq`, `shellcheck`, the Python dev deps
 (`requirements-dev.txt`), `gh`, and then the plugin
 (`claude plugin marketplace add bdfinst/agentic-dev-team` +
@@ -77,7 +77,7 @@ tool surface from the surrounding Remote runtime. The two tell-tale symptoms:
   prompt" shape. This is upstream Remote-runtime tool-contract behavior, not
   anything this plugin defines or can wrap — but the skills that tell an agent
   to wait on a long-running job now carry that contract, in
-  [`plugins/dev-team/knowledge/long-run-waiting.md`](../plugins/dev-team/knowledge/long-run-waiting.md),
+  [`plugins/dev-team/knowledge/long-run-waiting.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/knowledge/long-run-waiting.md),
   so a backstop timer is not silently lost to a malformed arm call.
 
 This inheritance is an **upstream Claude Code / Remote-runtime behavior — it is
@@ -87,7 +87,7 @@ then, run benchmark harnesses locally.
 
 **Reusable workaround — the `/headless-run` skill.** When you must run a one-shot
 headless invocation (a harness case) with maximum isolation, use
-[`plugins/dev-team/skills/headless-run/SKILL.md`](../plugins/dev-team/skills/headless-run/SKILL.md).
+[`plugins/dev-team/skills/headless-run/SKILL.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/skills/headless-run/SKILL.md).
 Its helper (`skills/headless-run/scripts/isolated_dispatch.py`) mints a fresh
 `--session-id <uuid>`, a clean temp `HOME` + `CLAUDE_CONFIG_DIR`, and a **scrubbed
 env** (dropping inherited `CLAUDE_*` session/Remote vars), runs
diff --git a/mkdocs.yml b/mkdocs.yml
index 43e9301d1..7d98ada75 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -7,11 +7,13 @@ edit_uri: edit/main/
 docs_dir: _mkdocs_src
 site_dir: site
 
-# Surface nav/link problems during the build. MkDocs reserves `error` for a few
-# checks and rejects it for `nav.not_found`, so the hard gate against a nav entry
-# pointing at a missing file lives in the link-check workflow's nav-integrity
-# step; this block keeps the build's own diagnostics visible. Cross-tree body
-# links to files outside the assembled site (scripts/, sibling plugins) only warn.
+# Surface nav/link problems during the build. MkDocs's `validation:` block
+# only accepts warn/info/ignore per option (there is no per-option `error`
+# level in this MkDocs version — confirmed against the installed
+# mkdocs.config.defaults._LogLevel, which validates against exactly
+# {"warn", "info", "ignore"}); the hard gate against a nav entry pointing at
+# a missing file lives in the link-check workflow's nav-integrity step
+# instead. This block keeps the build's own diagnostics visible.
 validation:
   nav:
     not_found: warn
diff --git a/plugins/dev-team/docs/agent-architecture.md b/plugins/dev-team/docs/agent-architecture.md
index 5a4fe7d02..3d4200133 100644
--- a/plugins/dev-team/docs/agent-architecture.md
+++ b/plugins/dev-team/docs/agent-architecture.md
@@ -211,4 +211,4 @@ Agents append to `.claude/memory/decisions.md` when making non-obvious decisions
 
 ## Performance Targets
 
-Two metrics are instrumented today: token budgets (measured by `scripts/measure_tokens.py`) and per-agent detection accuracy (measured by `/agent-eval` against `evals/expected/*.json`). Other goals — efficiency gains, hallucination rate, extraction accuracy, first-pass acceptance — are aspirational and have **no sensor in this repo**, so no numeric target is published until an instrument exists. See the *Claims discipline* section of [`CLAUDE.md`](../CLAUDE.md) for the full instrumented-vs-aspirational breakdown.
+Two metrics are instrumented today: token budgets (measured by `scripts/measure_tokens.py`) and per-agent detection accuracy (measured by `/agent-eval` against `evals/expected/*.json`). Other goals — efficiency gains, hallucination rate, extraction accuracy, first-pass acceptance — are aspirational and have **no sensor in this repo**, so no numeric target is published until an instrument exists. See the *Claims discipline* section of [`CLAUDE.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/CLAUDE.md) for the full instrumented-vs-aspirational breakdown.
diff --git a/plugins/dev-team/docs/agent_info.md b/plugins/dev-team/docs/agent_info.md
index 40b5a083c..a300e44b6 100644
--- a/plugins/dev-team/docs/agent_info.md
+++ b/plugins/dev-team/docs/agent_info.md
@@ -172,7 +172,7 @@ Custom agents extend the team with knowledge specific to your project — your d
 
 ## Install or Update the Plugin
 
-The standard install path is `claude plugin install dev-team@bfinster` — see the [repository README](../../../README.md#installation) for the full procedure, including how to update to a newer version. Copying agent files by hand is not supported: the Orchestrator routes by marketplace registry, not by file scan.
+The standard install path is `claude plugin install dev-team@bfinster` — see the [repository README](../../../README.md#getting-started) for the full procedure, including how to update to a newer version. Copying agent files by hand is not supported: the Orchestrator routes by marketplace registry, not by file scan.
 
 To contribute a custom agent back upstream:
 
diff --git a/plugins/dev-team/docs/concurrent-use.md b/plugins/dev-team/docs/concurrent-use.md
index 23c196be7..7344a099b 100644
--- a/plugins/dev-team/docs/concurrent-use.md
+++ b/plugins/dev-team/docs/concurrent-use.md
@@ -35,7 +35,7 @@ for the standard one-checkout-per-person workflow.
 Two background agents, two terminals in the same directory, or a human and an
 agent in the same checkout share **one** `.git/index` and **one** set of local
 state files. That is where collisions occur (reproduced in
-[`../../../tests/repo/test_multiplayer_collision.py`](../../../tests/repo/test_multiplayer_collision.py),
+[`../../../tests/repo/test_multiplayer_collision.py`](https://github.com/bdfinst/agentic-dev-team/blob/main/tests/repo/test_multiplayer_collision.py),
 characterized in issue #109):
 the shared `.pr-review-passed` gets overwritten (false blocks) and the staged
 set interleaves.
diff --git a/plugins/dev-team/docs/developer-notes.md b/plugins/dev-team/docs/developer-notes.md
index 774d80a30..32e36dee1 100644
--- a/plugins/dev-team/docs/developer-notes.md
+++ b/plugins/dev-team/docs/developer-notes.md
@@ -21,7 +21,7 @@ topic.
 | Running evals | [`eval-running-guide.md`](eval-running-guide.md) | The operational procedure for eval runs and variance batches. |
 | Eval upkeep | [`eval-maintenance.md`](eval-maintenance.md) | Grading rules, the calibration trap, and corpus discipline. |
 | Adapter & ruleset lifecycle | [`static-analysis-integration/maintenance.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/skills/static-analysis-integration/maintenance.md) | Ownership, drift detection, and deprecation for shipped adapters and rulesets. |
-| Adding agents, skills, or hooks | [root `CLAUDE.md`](../../../CLAUDE.md) § "Adding agents, skills, or hooks" | Where each artifact type lives and the structural audit to run afterwards. |
+| Adding agents, skills, or hooks | [root `CLAUDE.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/CLAUDE.md) § "Adding agents, skills, or hooks" | Where each artifact type lives and the structural audit to run afterwards. |
 | Code knowledge graphs | [`codegraph-vs-graphify.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/dev-team/knowledge/codegraph-vs-graphify.md) | When to use CodeGraph vs Graphify, how `/project-init` installs each, and the CLAUDE.md-preservation guard. |
 | Script conventions | [ADR 0014](../../../docs/adr/0014-python-for-cross-os-scripts.md), [ADR 0015](../../../docs/adr/0015-bash-removal-complete.md), [ADR 0031](../../../docs/adr/0031-raise-shipped-python-floor-to-3-10.md) | Why every shipped script is Python 3.10+ stdlib-only, the completed bash removal, and the floor's move off EOL 3.8. |
 
diff --git a/plugins/dev-team/docs/telemetry-ci-access.md b/plugins/dev-team/docs/telemetry-ci-access.md
index c87ce3555..fbfa6a46f 100644
--- a/plugins/dev-team/docs/telemetry-ci-access.md
+++ b/plugins/dev-team/docs/telemetry-ci-access.md
@@ -54,7 +54,7 @@ holds both halves where they belong.
 ### 4. Consume it in the workflow
 
 This wiring is **already in place** — see the `cost-regression` job in
-[`.github/workflows/plugin-tests.yml`](../../../.github/workflows/plugin-tests.yml).
+[`.github/workflows/plugin-tests.yml`](https://github.com/bdfinst/agentic-dev-team/blob/main/.github/workflows/plugin-tests.yml).
 The job loads the key, clones the data repo read-only, builds a per-session cost
 series from the digests, and runs the regression check against it. The
 credential steps are gated so fork PRs and Dependabot PRs (neither of which get
diff --git a/plugins/dev-team/docs/triage-workflow.md b/plugins/dev-team/docs/triage-workflow.md
index 57bc0766a..ab349b5f5 100644
--- a/plugins/dev-team/docs/triage-workflow.md
+++ b/plugins/dev-team/docs/triage-workflow.md
@@ -11,7 +11,7 @@ connects them.
 > document is a reader-friendly walkthrough; where it and a skill spec
 > disagree, the spec wins.
 
-**On this page**: [Lifecycle at a glance](#the-lifecycle-at-a-glance) · [1. Intake](#1-intake--when-to-reach-for-triage) · [2. Investigation](#2-investigation--root-cause-before-recording) · [3. The triage record](#3-the-triage-record) · [4. Review-corrections flow](#4-the-review-corrections-flow) · [5. `/apply-fixes` flow](#5-the-apply-fixes-flow) · [6. Ownership of leftover corrections](#6-ownership-of-leftover-corrections) · [7. A worked example](#7-a-worked-example)
+**On this page**: [Lifecycle at a glance](#the-lifecycle-at-a-glance) · [1. Intake](#1-intake-when-to-reach-for-triage) · [2. Investigation](#2-investigation-root-cause-before-recording) · [3. The triage record](#3-the-triage-record) · [4. Review-corrections flow](#4-the-review-corrections-flow) · [5. `/apply-fixes` flow](#5-the-apply-fixes-flow) · [6. Ownership of leftover corrections](#6-ownership-of-leftover-corrections) · [7. A worked example](#7-a-worked-example)
 
 ## The lifecycle at a glance
 
diff --git a/plugins/marketplace-dev/docs/agent_info.md b/plugins/marketplace-dev/docs/agent_info.md
index e1222878b..b6f7d9773 100644
--- a/plugins/marketplace-dev/docs/agent_info.md
+++ b/plugins/marketplace-dev/docs/agent_info.md
@@ -8,7 +8,7 @@ directly user-invocable.
 
 | Agent | File | Purpose | Invocation |
 | --- | --- | --- | --- |
-| plugin-best-practices-review | [`plugin-best-practices-review.md`](../agents/plugin-best-practices-review.md) | Structural findings for any plugin — agent type appropriateness (markdown vs script), frontmatter compliance, eval-coverage presence, and body line-count budgets. Read-only; JSON output. Does not evaluate detection-logic quality. | Dispatched by the `plugin-audit` skill |
+| plugin-best-practices-review | [`plugin-best-practices-review.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/marketplace-dev/agents/plugin-best-practices-review.md) | Structural findings for any plugin — agent type appropriateness (markdown vs script), frontmatter compliance, eval-coverage presence, and body line-count budgets. Read-only; JSON output. Does not evaluate detection-logic quality. | Dispatched by the `plugin-audit` skill |
 
 The markdown-vs-script judgment this agent applies is the decision matrix in
 [`agent-type-decision-rules.md`](../knowledge/agent-type-decision-rules.md)
diff --git a/plugins/security-assessment/docs/agent_info.md b/plugins/security-assessment/docs/agent_info.md
index 1d0110333..3c4891b30 100644
--- a/plugins/security-assessment/docs/agent_info.md
+++ b/plugins/security-assessment/docs/agent_info.md
@@ -3,22 +3,22 @@
 Agents in `security-assessment` are all **judgment agents** — they are never invoked directly by
 the user, but are dispatched by the plugin's orchestrating commands during assessment phases.
 
-For how these agents sequence into the pipeline, see [Workflows](workflows.md) and the authoritative phase graph in [`security-assessment-pipeline/SKILL.md`](../skills/security-assessment-pipeline/SKILL.md).
+For how these agents sequence into the pipeline, see [Workflows](workflows.md) and the authoritative phase graph in [`security-assessment-pipeline/SKILL.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/skills/security-assessment-pipeline/SKILL.md).
 
 ## Judgment Agents
 
 | Agent | File | Purpose | Invocation |
 | --- | --- | --- | --- |
-| authorization-logic-review | [`authorization-logic-review.md`](../agents/authorization-logic-review.md) | Top-down authorization review. Maps the access-control model (RBAC/ABAC/ACL/tenancy), then verifies enforcement at every layer. | Dispatched by `/security-assessment` Phase 1b |
-| business-logic-domain-review | [`business-logic-domain-review.md`](../agents/business-logic-domain-review.md) | Business-logic review for ML/fraud services. Detects fail-open, score manipulation, and other domain-specific anti-patterns. | Dispatched by `/security-assessment` Phase 1b |
-| compliance-edge-annotator | [`compliance-edge-annotator.md`](../agents/compliance-edge-annotator.md) | Edge annotator for compliance findings whose pattern row has `llm_review_trigger=true`. Refines pattern-table citations; never invents new findings. | Dispatched by `compliance-mapping` skill |
-| cross-repo-synthesizer | [`cross-repo-synthesizer.md`](../agents/cross-repo-synthesizer.md) | Synthesizes attack-chain narratives from multi-repo RECON + shared-cred matches + service-comm diagram. Produces named attack chains. | Dispatched by `/cross-repo-analysis` |
-| deep-code-reasoning | [`deep-code-reasoning.md`](../agents/deep-code-reasoning.md) | Context-aware vulnerability detection beyond static patterns. RECON-scoped freeform reasoning about IDOR, confused deputy, TOCTOU, privilege escalation, and similar classes. | Dispatched by `/security-assessment` Phase 1b |
-| exec-report-generator | [`exec-report-generator.md`](../agents/exec-report-generator.md) | Synthesizes the publication-ready executive report from upstream artifacts. Emits a 7-section per-repo report plus cross-repo summary for multi-target runs. | Dispatched by `/security-assessment` Phase 5 and `/cross-repo-analysis` |
-| fp-reduction | [`fp-reduction.md`](../agents/fp-reduction.md) | Applies the six-stage FP-reduction rubric to a unified-finding stream, producing a disposition register with confidence field. | Dispatched by `false-positive-reduction` skill (Phase 2) |
-| recon-driven-scan | [`recon-driven-scan.md`](../agents/recon-driven-scan.md) | Bridges RECON narrative risk claims to file:line evidence. Emits findings only when the source actually exhibits the described pattern. | Dispatched by `/security-assessment` Phase 1b |
-| redteam-evasion-analyzer | [`redteam-evasion-analyzer.md`](../agents/redteam-evasion-analyzer.md) | Interprets probe 05 (evasion) alongside probe 03 (sensitivity) and probe 04 (boundaries). Rates adversarial realism and explains evasion mechanisms. | Dispatched by `/redteam-model` Phase 4 (parallel with other analyzers) |
-| redteam-extraction-analyzer | [`redteam-extraction-analyzer.md`](../agents/redteam-extraction-analyzer.md) | Interprets probe 07 (model extraction) alongside probe 03 (sensitivity). Translates R² into extraction fidelity and extracts decision-rule signatures. | Dispatched by `/redteam-model` Phase 4 (parallel with other analyzers) |
-| redteam-recon-analyzer | [`redteam-recon-analyzer.md`](../agents/redteam-recon-analyzer.md) | Interprets probe 01 (API recon). Severity-rates info leaks, identifies the framework, and recommends a feature-discovery strategy for subsequent probes. | Dispatched by `/redteam-model` Phase 4 (parallel with other analyzers) |
-| redteam-report-generator | [`redteam-report-generator.md`](../agents/redteam-report-generator.md) | Refines the red-team `adversarial-report.md` into an executive document. Assigns RED/AMBER/GREEN rating and produces remediation with effort estimates. | Dispatched by `/redteam-model` Phase 5 |
-| tool-finding-narrative-annotator | [`tool-finding-narrative-annotator.md`](../agents/tool-finding-narrative-annotator.md) | Weaves findings into four narrative domains (PII flow, ML edge cases, messaging auth, crypto). Produces prose for the executive report. | Dispatched by `security-assessment-pipeline` Phase 3 |
+| authorization-logic-review | [`authorization-logic-review.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/authorization-logic-review.md) | Top-down authorization review. Maps the access-control model (RBAC/ABAC/ACL/tenancy), then verifies enforcement at every layer. | Dispatched by `/security-assessment` Phase 1b |
+| business-logic-domain-review | [`business-logic-domain-review.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/business-logic-domain-review.md) | Business-logic review for ML/fraud services. Detects fail-open, score manipulation, and other domain-specific anti-patterns. | Dispatched by `/security-assessment` Phase 1b |
+| compliance-edge-annotator | [`compliance-edge-annotator.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/compliance-edge-annotator.md) | Edge annotator for compliance findings whose pattern row has `llm_review_trigger=true`. Refines pattern-table citations; never invents new findings. | Dispatched by `compliance-mapping` skill |
+| cross-repo-synthesizer | [`cross-repo-synthesizer.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/cross-repo-synthesizer.md) | Synthesizes attack-chain narratives from multi-repo RECON + shared-cred matches + service-comm diagram. Produces named attack chains. | Dispatched by `/cross-repo-analysis` |
+| deep-code-reasoning | [`deep-code-reasoning.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/deep-code-reasoning.md) | Context-aware vulnerability detection beyond static patterns. RECON-scoped freeform reasoning about IDOR, confused deputy, TOCTOU, privilege escalation, and similar classes. | Dispatched by `/security-assessment` Phase 1b |
+| exec-report-generator | [`exec-report-generator.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/exec-report-generator.md) | Synthesizes the publication-ready executive report from upstream artifacts. Emits a 7-section per-repo report plus cross-repo summary for multi-target runs. | Dispatched by `/security-assessment` Phase 5 and `/cross-repo-analysis` |
+| fp-reduction | [`fp-reduction.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/fp-reduction.md) | Applies the six-stage FP-reduction rubric to a unified-finding stream, producing a disposition register with confidence field. | Dispatched by `false-positive-reduction` skill (Phase 2) |
+| recon-driven-scan | [`recon-driven-scan.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/recon-driven-scan.md) | Bridges RECON narrative risk claims to file:line evidence. Emits findings only when the source actually exhibits the described pattern. | Dispatched by `/security-assessment` Phase 1b |
+| redteam-evasion-analyzer | [`redteam-evasion-analyzer.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/redteam-evasion-analyzer.md) | Interprets probe 05 (evasion) alongside probe 03 (sensitivity) and probe 04 (boundaries). Rates adversarial realism and explains evasion mechanisms. | Dispatched by `/redteam-model` Phase 4 (parallel with other analyzers) |
+| redteam-extraction-analyzer | [`redteam-extraction-analyzer.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/redteam-extraction-analyzer.md) | Interprets probe 07 (model extraction) alongside probe 03 (sensitivity). Translates R² into extraction fidelity and extracts decision-rule signatures. | Dispatched by `/redteam-model` Phase 4 (parallel with other analyzers) |
+| redteam-recon-analyzer | [`redteam-recon-analyzer.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/redteam-recon-analyzer.md) | Interprets probe 01 (API recon). Severity-rates info leaks, identifies the framework, and recommends a feature-discovery strategy for subsequent probes. | Dispatched by `/redteam-model` Phase 4 (parallel with other analyzers) |
+| redteam-report-generator | [`redteam-report-generator.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/redteam-report-generator.md) | Refines the red-team `adversarial-report.md` into an executive document. Assigns RED/AMBER/GREEN rating and produces remediation with effort estimates. | Dispatched by `/redteam-model` Phase 5 |
+| tool-finding-narrative-annotator | [`tool-finding-narrative-annotator.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/agents/tool-finding-narrative-annotator.md) | Weaves findings into four narrative domains (PII flow, ML edge cases, messaging auth, crypto). Produces prose for the executive report. | Dispatched by `security-assessment-pipeline` Phase 3 |
diff --git a/plugins/security-assessment/docs/comparative-testing.md b/plugins/security-assessment/docs/comparative-testing.md
index e72a008de..ba4910135 100644
--- a/plugins/security-assessment/docs/comparative-testing.md
+++ b/plugins/security-assessment/docs/comparative-testing.md
@@ -37,7 +37,7 @@ test is roughly the conjunction of all of these passing.
 
 | Reference agent | Our counterpart | Unit test |
 |---|---|---|
-| `scan-00-codebase-recon.md` | `plugins/dev-team/agents/codebase-recon.md` | ✅ [`codebase-recon-equivalence.md`](../../../evals/comparative/unit-tests/codebase-recon-equivalence.md) |
+| `scan-00-codebase-recon.md` | `plugins/dev-team/agents/codebase-recon.md` | ✅ [`codebase-recon-equivalence.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/evals/comparative/unit-tests/codebase-recon-equivalence.md) |
 | `scan-01-secrets-credentials.md` | `gitleaks` + `entropy-check.py` + `semgrep.secrets` | TBD — `secrets-equivalence.md` |
 | `scan-02-auth-authorization.md` | `agents/security-review.md` | TBD |
 | `scan-03-business-logic-fraud.md` | `plugins/security-assessment/agents/business-logic-domain-review.md` + `knowledge/semgrep-rules/fraud-domain.yaml` | TBD |
diff --git a/plugins/security-assessment/docs/user-guide-security-assessment.md b/plugins/security-assessment/docs/user-guide-security-assessment.md
index 221cde213..3a6a5fa06 100644
--- a/plugins/security-assessment/docs/user-guide-security-assessment.md
+++ b/plugins/security-assessment/docs/user-guide-security-assessment.md
@@ -7,7 +7,7 @@ Running a security assessment against a target repository. Two paths:
 
 Both produce output in the same layout under `memory/` (or a directory you choose) and score against the comparative-testing harness at `evals/comparative/score.py`. Path B auto-detects the `claude` CLI and runs the same LLM judgment phases when it is available; when it isn't (or with `--no-llm`), Path B degrades to deterministic-only output.
 
-**On this page:** [Tool install matrix](#tool-install-matrix) · [Path A — install the plugin](#path-a--install-the-plugin) · [Path B — local script](#path-b--local-script) · [Scoring a run](#scoring-a-run) · [Troubleshooting](#troubleshooting) · [Quick reference card](#quick-reference-card)
+**On this page:** [Tool install matrix](#tool-install-matrix) · [Path A — install the plugin](#path-a-install-the-plugin) · [Path B — local script](#path-b-local-script) · [Scoring a run](#scoring-a-run) · [Troubleshooting](#troubleshooting) · [Quick reference card](#quick-reference-card)
 
 ---
 
diff --git a/plugins/security-assessment/docs/workflows.md b/plugins/security-assessment/docs/workflows.md
index a207f6bd9..5d3fab2af 100644
--- a/plugins/security-assessment/docs/workflows.md
+++ b/plugins/security-assessment/docs/workflows.md
@@ -6,7 +6,7 @@ The `security-assessment` plugin provides two **orchestrator** commands that seq
 
 ## `/security-assessment`
 
-**File:** [`commands/security-assessment.md`](../commands/security-assessment.md)
+**File:** [`commands/security-assessment.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/commands/security-assessment.md)
 **Role:** orchestrator.
 **Use when:** running a full security audit against one or more target repos — at a release gate, on a milestone, or before publishing a security report.
 
@@ -30,7 +30,7 @@ The `security-assessment` plugin provides two **orchestrator** commands that seq
 
 ## `/cross-repo-analysis`
 
-**File:** [`commands/cross-repo-analysis.md`](../commands/cross-repo-analysis.md)
+**File:** [`commands/cross-repo-analysis.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/commands/cross-repo-analysis.md)
 **Role:** orchestrator.
 **Use when:** analysing shared credentials and service-communication patterns across two or more related repos — microservices suites, platform + tenant repos, monorepo split components.
 
@@ -46,9 +46,9 @@ The `security-assessment` plugin provides two **orchestrator** commands that seq
 
 ## `/redteam-model`
 
-**File:** [`commands/redteam-model.md`](../commands/redteam-model.md)
+**File:** [`commands/redteam-model.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/commands/redteam-model.md)
 **Role:** adversarial pipeline.
-**Use when:** probing a self-owned model endpoint for safety and extraction vulnerabilities. Public targets require a signed `authorization.md` artifact — see [`knowledge/redteam-authorization.md`](../knowledge/redteam-authorization.md).
+**Use when:** probing a self-owned model endpoint for safety and extraction vulnerabilities. Public targets require a signed `authorization.md` artifact — see [`knowledge/redteam-authorization.md`](https://github.com/bdfinst/agentic-dev-team/blob/main/plugins/security-assessment/knowledge/redteam-authorization.md).
 
 Eight probes (in `harness/redteam/probes/`) run in sequence: