SEA-0.4-COMPLETE

## Summary DEP-2 deep audit of all hooks across both ecosystems. Validated existing `hooks-audit.md` against actual source code for all 6 Clawdbot gateway hooks and 13 Claude Code hook registrations. Original audit confirmed accurate. Added §8 (source code validation findings) and §9 (updated recommendations) with 8 code quality issues, 7 undocumented integrations, 4 state coordination risks, and 5 new recommendations. ## Changes - File: `hooks-audit.md` — updated with §8 (DEP-2 Source Code Validation) and §9 (Updated Recommendations). Added code quality issues table, undocumented integrations inventory, scale observations, state coordination risk matrix, Memory Guardian validation, and 5 new recommendations. ## RTD Verification - [x] Structure: `hooks-audit.md` updated in project directory (§8-§9 appended) - [x] Compilation: markdown, no code to compile - [x] Integration: all findings cross-referenced with actual source files in `[home-path]` and `[home-path]` - [x] Content: 8 code quality issues documented with severity; 7 undocumented integrations cataloged; 4 state coordination risks identified; Memory Guardian rules validated as PERFECT MATCH against CLAUDE.md and baselines.json - [x] User Journey: enhanced audit now answers both "can we safely add sea-router?" (yes) and "what needs fixing in existing hooks?" (8 issues, 5 recommendations) - [x] Deployment: committed with conventional commit ### Blocking Issues for SEA-Router: 1 - Gateway must emit `response:sent` event (not yet implemented) ### Non-Blocking Issues Found: 8 - 3 HIGH severity (legacy hooks — fetch polyfill, plaintext creds, shell injection) - 3 MEDIUM severity (context-injector model override bug, dangerous-skip-permissions, greedy JSON regex) - 2 LOW severity (hardcoded model ID, subprocess-per-message cost)