SEA-0.4-COMPLETE

SEA-0.4-COMPLETE

## Summary
DEP-2 deep audit of all hooks across both ecosystems. Validated existing `hooks-audit.md` against actual source code for all 6 Clawdbot gateway hooks and 13 Claude Code hook registrations. Original audit confirmed accurate. Added §8 (source code validation findings) and §9 (updated recommendations) with 8 code quality issues, 7 undocumented integrations, 4 state coordination risks, and 5 new recommendations.

## Changes
- File: `hooks-audit.md` — updated with §8 (DEP-2 Source Code Validation) and §9 (Updated Recommendations). Added code quality issues table, undocumented integrations inventory, scale observations, state coordination risk matrix, Memory Guardian validation, and 5 new recommendations.

## RTD Verification
- [x] Structure: `hooks-audit.md` updated in project directory (§8-§9 appended)
- [x] Compilation: markdown, no code to compile
- [x] Integration: all findings cross-referenced with actual source files in `[home-path]` and `[home-path]`
- [x] Content: 8 code quality issues documented with severity; 7 undocumented integrations cataloged; 4 state coordination risks identified; Memory Guardian rules validated as PERFECT MATCH against CLAUDE.md and baselines.json
- [x] User Journey: enhanced audit now answers both "can we safely add sea-router?" (yes) and "what needs fixing in existing hooks?" (8 issues, 5 recommendations)
- [x] Deployment: committed with conventional commit

## Cross-Pollination
N/A — no cross-track dependencies

Key Findings

### Blocking Issues for SEA-Router: 1
- Gateway must emit `response:sent` event (not yet implemented)

### Non-Blocking Issues Found: 8
- 3 HIGH severity (legacy hooks — fetch polyfill, plaintext creds, shell injection)
- 3 MEDIUM severity (context-injector model override bug, dangerous-skip-permissions, greedy JSON regex)
- 2 LOW severity (hardcoded model ID, subprocess-per-message cost)

### Memory Guardian: VERIFIED
- CLAUDE.md ↔ baselines.json ↔ guardian.py: all protection rules match exactly

### Verdict
Proceed with SEA-router implementation. No blocking conflicts. One gateway prerequisite (`response:sent` event emission).