docs: drop references to gitignored plan file

Author: petrsnd

.agents/schemas/evidence.schema.json

@@ -20,7 +20,7 @@
     },
     "protocol": {
       "type": "string",
-      "description": "Transport protocol of the target. SSH and HTTP only — telnet is out of scope for the agent skill system (see agent-skills-plan.md §2).",
+      "description": "Transport protocol of the target. SSH and HTTP only — telnet is out of scope for the agent skill system.",
       "enum": ["ssh", "http"]
     },
     "target": {
@@ -82,7 +82,7 @@
         },
         "probes": {
           "type": "array",
-          "description": "Ordered record of probes executed. Each entry is a single probe step. Read-only probes record observations; destructive probes additionally record the explicit per-probe consent given by the operator (see probe-safety contract in agent-skills-plan.md §5).",
+          "description": "Ordered record of probes executed. Each entry is a single probe step. Read-only probes record observations; destructive probes additionally record the explicit per-probe consent given by the operator (see the probe-safety contract in target-probing/SKILL.md).",
           "items": {
             "$ref": "#/definitions/probeRecord"
           }
@@ -203,7 +203,7 @@
     },
     "sshFindings": {
       "type": "object",
-      "description": "TODO: SSH-specific finding shapes. Locked down in Phase 3 once the target-probing SSH playbooks are authored against a real target. Fields below are the categories the playbook MUST cover (per agent-skills-plan.md §5); their internal shape is intentionally permissive in v0.",
+      "description": "SSH-specific finding shapes. Fields below are the categories the playbook MUST cover; their internal shape is intentionally permissive in v0 and will be tightened once more SSH targets have been probed.",
       "additionalProperties": false,
       "properties": {
         "shellPrompt": {
@@ -230,7 +230,7 @@
     },
     "httpFindings": {
       "type": "object",
-      "description": "TODO: HTTP-specific finding shapes. Locked down in Phase 3 once the target-probing HTTP playbooks are authored against a real target. Fields below are the categories the playbook MUST cover (per agent-skills-plan.md §5); their internal shape is intentionally permissive in v0.",
+      "description": "HTTP-specific finding shapes. Fields below are the categories the playbook MUST cover; their internal shape is intentionally permissive in v0 and will be tightened once more HTTP targets have been probed.",
       "additionalProperties": false,
       "properties": {
         "authScheme": {

.agents/skills/script-authoring/SKILL.md

@@ -29,7 +29,7 @@ Four pattern sub-recipes cover the supported transports:
 - [`http-api`](#http-api)
 - [`http-form-fill`](#http-form-fill)
 
-Telnet/TN3270 is out of scope (`agent-skills-plan.md` §2). The recipes below are starting points; pick one based on [`strategy-selection`](../strategy-selection/SKILL.md) output and adapt it.
+Telnet/TN3270 is out of scope for the agent skill system. The recipes below are starting points; pick one based on [`strategy-selection`](../strategy-selection/SKILL.md) output and adapt it.
 
 ## Modes
 
@@ -62,7 +62,7 @@ A green local schema check proves the JSON parses and conforms to the schema. It
 - `Send` / `Receive` ordering that drifts out of sync with the actual prompt.
 - Status messages emitted in the wrong order or at the wrong phase.
 
-Before declaring a draft "ready to import," cross-reference an analogous sample from `samples-index.md`. If a sample uses a construct your draft does not (e.g., a `Try`/`Catch` around `Disconnect`, a `Receive` flush of the login banner, a `Headers` block before `HttpAuth`), surface that divergence to the operator rather than silently omitting it. The `agent-skills-plan.md` §5 rule is explicit: *"if a sample uses a construct the draft doesn't, surface the divergence."*
+Before declaring a draft "ready to import," cross-reference an analogous sample from `samples-index.md`. If a sample uses a construct your draft does not (e.g., a `Try`/`Catch` around `Disconnect`, a `Receive` flush of the login banner, a `Headers` block before `HttpAuth`), surface that divergence to the operator rather than silently omitting it.
 
 ## Conventions all four patterns share
 

.agents/skills/target-probing/SKILL.md

@@ -18,7 +18,7 @@ Before running any probe, consult [`AGENTS.md`](../../../AGENTS.md) for the acti
 
 ## Scope
 
-Local-shell recon recipes against a live target with a service-account credential. SSH and HTTP only — telnet/TN3270 is out of scope (`agent-skills-plan.md` §2). Probing produces a structured **evidence artifact** that conforms to [`.agents/schemas/evidence.schema.json`](../../../.agents/schemas/evidence.schema.json) and is consumed by [`strategy-selection`](../strategy-selection/SKILL.md) and [`script-authoring`](../script-authoring/SKILL.md).
+Local-shell recon recipes against a live target with a service-account credential. SSH and HTTP only — telnet/TN3270 is out of scope for the agent skill system. Probing produces a structured **evidence artifact** that conforms to [`.agents/schemas/evidence.schema.json`](../../../.agents/schemas/evidence.schema.json) and is consumed by [`strategy-selection`](../strategy-selection/SKILL.md) and [`script-authoring`](../script-authoring/SKILL.md).
 
 This skill calls `ssh`, `curl`/`Invoke-WebRequest`, etc. directly from the operator's machine. It does **not** mediate probes through SPP.
 
@@ -29,7 +29,7 @@ This skill calls `ssh`, `curl`/`Invoke-WebRequest`, etc. directly from the opera
 
 ## Probe-safety contract (mandatory)
 
-All six items below are non-negotiable. They restate `agent-skills-plan.md` §5 in skill-local form so the agent enforces them at execution time, not just at planning time.
+All six items below are non-negotiable. The agent enforces them at execution time, not just at planning time.
 
 1. **Read-only by default.** Probes that only observe — banner grab, `WWW-Authenticate` header inspection, `whoami`, `id`, `uname`, GET on a documented API endpoint, login-form HTML inspection — run without per-probe confirmation.
 2. **Destructive probes that go beyond the service account require explicit per-probe operator opt-in.** Key install, account create/delete, sudo-that-mutates non-service-account state, POST/PUT/DELETE against undocumented endpoints — each is presented to the operator with a one-line *"what this will do, what could go wrong"* summary and proceeds only on explicit consent. Consent is **per probe, not per session**. Record the consent timestamp and the summary that was shown in the evidence artifact (`probeRecord.consent.grantedAt`, `probeRecord.consent.summaryShown` — see [`.agents/schemas/evidence.schema.json`](../../../.agents/schemas/evidence.schema.json) lines 173–188).

.agents/skills/task-log-analysis/SKILL.md

@@ -82,9 +82,9 @@ Do not paraphrase the messages; quote them verbatim. The catalog below matches o
 
 ## Failure-pattern catalog
 
-The catalog is [`docs/agent-reference/failure-patterns.md`](../../../docs/agent-reference/failure-patterns.md). Per [`agent-skills-plan.md`](../../../agent-skills-plan.md) §5 and §6 Phase F, it **ships empty**. Rows are added only from real extended task logs captured during the maiden voyage and subsequent runs; rows mined from prose guides or invented from memory are explicitly not acceptable.
+The catalog is [`docs/agent-reference/failure-patterns.md`](../../../docs/agent-reference/failure-patterns.md). It **ships empty by design**. Rows are added only from real extended task logs; rows mined from prose guides or invented from memory are explicitly not acceptable.
 
-When the catalog is empty (Phase 1 state), this skill falls back to the classification flow above and asks the operator for guidance on signatures it has not seen before. When it has rows, this skill matches the extracted signature substring against the `signature` column and surfaces the recommended fix; an exact-or-near match shortens the next iteration to a targeted change.
+When the catalog is empty, this skill falls back to the classification flow above and asks the operator for guidance on signatures it has not seen before. When it has rows, this skill matches the extracted signature substring against the `signature` column and surfaces the recommended fix; an exact-or-near match shortens the next iteration to a targeted change.
 
 If a real failure is observed that the catalog does not cover, the agent **proposes a new row** at the end of the loop — signature, phase, likely cause, recommended fix, first-observed date and target type — and asks the operator to confirm before adding it. Confirmation lives outside this skill (the row is added to `failure-patterns.md` by hand or in a follow-up commit).
 

AGENTS.md

@@ -7,7 +7,6 @@ This file is the agent orchestrator. Read it first.
 ## Project structure
 
 - `AGENTS.md` (this file) — orchestrator: workflows + routing table.
-- `agent-skills-plan.md` — master plan for the agent skill system.
 - `.agents/` — `skills/` (one subdirectory per capability skill, each with a `SKILL.md`), `schemas/evidence.schema.json` (probing-evidence contract), `prompts/` (per-phase implementation prompts), `CONVENTIONS.md`.
 - `schema/custom-platform-script.schema.json` — authoritative platform-script schema.
 - `samples/` — tested production-grade samples (ssh, http, telnet).

docs/agent-reference/README.md

@@ -4,7 +4,7 @@
 
 This directory holds machine-first reference material for the agent skill system. It is cited from `AGENTS.md` and from individual `SKILL.md` files under `.agents/skills/`.
 
-Human-facing documentation lives in `docs/concepts/`, `docs/guides/`, `docs/tutorials/`, `docs/reference/`, and `docs/quick-start/` and is not duplicated here. Per `agent-skills-plan.md` §5, agent-only content stays out of human-facing locations.
+Human-facing documentation lives in `docs/concepts/`, `docs/guides/`, `docs/tutorials/`, `docs/reference/`, and `docs/quick-start/` and is not duplicated here. Agent-only content stays out of human-facing locations.
 
 ## Files
 

docs/agent-reference/samples-index.md

@@ -17,7 +17,7 @@ CI runs the same script with `-CheckOnly` and fails the build if the committed c
 - **operations** — intersection of top-level keys with the canonical operation list from `schema/custom-platform-script.schema.json`. Imports and user-defined functions never appear here.
 - **OS-family** — intentionally blank. Phase 1 prefers blank over guessed values; revisit in a later phase if needed.
 - **file-path** and **README** — filesystem facts. `—` means the field could not be determined.
-- `samples/telnet/` is excluded — telnet is out of scope for the agent skill system (see `agent-skills-plan.md` §2). The samples remain in the repo for human reference.
+- `samples/telnet/` is excluded — telnet is out of scope for the agent skill system. The samples remain in the repo for human reference.
 
 ## Samples
 

docs/agent-reference/strategy-decision-tree.md

@@ -9,7 +9,7 @@ Backs the `strategy-selection` skill. Maps `(protocol, vendor docs, probe eviden
 - `http-api`
 - `http-form-fill`
 
-Telnet/TN3270 are out of scope for agent skills (see `agent-skills-plan.md` §2). The repository's human-facing telnet material remains under `samples/telnet/` and `docs/`.
+Telnet/TN3270 are out of scope for the agent skill system. The repository's human-facing telnet material remains under `samples/telnet/` and `docs/`.
 
 ## Source documents
 

tools/Build-SamplesIndex.ps1

@@ -6,8 +6,8 @@
 
 .DESCRIPTION
     Walks samples/ssh, samples/http, and templates/ (samples/telnet is
-    excluded from the agent-facing index per agent-skills-plan.md §2 —
-    telnet is out of scope for the agent skill system). For every JSON
+    excluded from the agent-facing index — telnet is out of scope for
+    the agent skill system). For every JSON
     file found, emits one row in the index with the columns:
 
         protocol | auth-scheme | operations | OS-family | file-path | README
@@ -286,7 +286,7 @@ CI runs the same script with `-CheckOnly` and fails the build if the committed c
 - **operations** — intersection of top-level keys with the canonical operation list from `schema/custom-platform-script.schema.json`. Imports and user-defined functions never appear here.
 - **OS-family** — intentionally blank. Phase 1 prefers blank over guessed values; revisit in a later phase if needed.
 - **file-path** and **README** — filesystem facts. `—` means the field could not be determined.
-- `samples/telnet/` is excluded — telnet is out of scope for the agent skill system (see `agent-skills-plan.md` §2). The samples remain in the repo for human reference.
+- `samples/telnet/` is excluded — telnet is out of scope for the agent skill system. The samples remain in the repo for human reference.
 
 ## Samples
 

tools/README.md

@@ -376,8 +376,7 @@ Connect-Safeguard -Appliance 192.168.117.15 -Insecure -DeviceCode
 
 * PowerShell 7.6.2
 * `safeguard-ps` 8.4.3 (minimum — enforced at script start; earlier versions lack `-ExtendedLogging` on `Invoke-SafeguardAssetSshHostKeyDiscovery`)
-* SPP appliance reachable at the time of authoring (Phase 2 of agent-skills
-  initiative; see `agent-skills-plan.md`).
+* SPP appliance reachable at the time of authoring.
 
 ### Cmdlet citations