Sync docs, audit artifacts, project notes, and VerdictTank proposal docs

- audit/phase-one + phase-two: security audit briefs, findings, credential-rotation plan, Docker-USER hardening scripts, rollback refs
- disaster-recovery/restore-test-log.md + backup-dr-audit-2026-08-10.md
- clients/ (modelortho SEO audit, ai-biz-dev competitive landscape), notes/ (tiktok strategy)
- projects/: front-desk-voice-agent, seo-visibility-checker product plan, hotnow-savannah HTML, resend-transactional-email, backup-dashboard-enhancements, code-review-graph, seo-ci-architecture
- proposals/verdicttank/: architecture v4.0, methodology, judge-pool review, consolidation reasoning, cross-check review
- docs/super-search/firecrawl-provider-strategy.md
- updates: CHANGELOG, model-chain, projects-master-readme, intelsight.io
- .gitignore: exclude nested standalone repos (seo-tool, venturebuilt)

projects/code-review-graph.md

@@ -0,0 +1,50 @@
+# Code-Review Graph (Structural Code Knowledge) — Future Project
+
+**Status:** Future Projects — Internal Tooling Adoption
+**Saved:** 2026-08-16
+**Category:** How Sho'Nuff & Germaine work (internal agent tooling)
+**Owner:** IT Pro Partner (Sho'Nuff)
+**Source:** https://github.com/rpmalouin/deepseek-harness (fork of deepseek-ai/deepseek-harness)
+
+---
+
+## What it is
+
+`deepseek-harness` (`dsh`) is DeepSeek AI's open-source agent harness: "everything is a plugin" on top of Cordis, a plugin framework. TypeScript/Node, MIT, developer preview.
+
+The `rpmalouin` fork layers three additions on top of stock upstream:
+1. `code-review-graph` — a knowledge graph of a repo's code communities wired into every coding-agent surface.
+2. OpenRouter LLM routing (headless one-shot tasks).
+3. Hermes/agent delegation — designed to be driven as a local coding sub-agent from Hermes.
+
+## Why it matters
+
+Today Sho'Nuff navigates Germaine's repos (itpp-infrastructure, homelab, scripts, project folders) via ripgrep + read_file. That is linear scanning: token-heavy, slow, and it misses callers and dependents that grep never surfaces.
+
+A structural code graph flips that: understand the code through its dependency graph first, then read the files you actually need.
+
+## What to adopt
+
+1. **code-review-graph pattern** — build a queryable structural graph per repo (code communities, callers, dependents, module boundaries). Query the graph before touching files. Start with itpp-infrastructure and homelab.
+2. **"Everything is a plugin" discipline** — tighten the skill system so each skill declares its effects (what it adds, what it can reverse), making per-task composition deliberate rather than implicit.
+
+## What NOT to adopt
+
+- **Do NOT swap Hermes for `dsh`.** Hermes already covers roughly 80% of the operating model:
+  - skills = the plugin system
+  - session history + memory = the session log / source of truth
+  - `delegate_task` = the headless one-shot contract
+  - toolset scoping = scoped tools per agent
+- **`dsh` as a 4th coding backend** (next to Codex, Claude Code, OpenCode) is marginal. Skip unless one of the three fails Germaine.
+
+## Reference notes
+
+- The fork's `FORK.md` documents the code-review-graph pattern and the OpenRouter routing overlay mechanism (the live patch file and keys are local-only, gitignored, and never shipped).
+- The `docs/architecture.md` describes the Cordis plugin tree, capability seams (Service Definition / Provider / Consumer), and the "model-visible means logged" session-log invariant.
+- The upstream is `deepseek-ai/deepseek-harness` (MIT); the fork is 4 commits ahead and adds only scaffolding, no upstream behavior changes.
+
+## Source
+
+- https://github.com/rpmalouin/deepseek-harness (fork of deepseek-ai/deepseek-harness)
+- Files reviewed: README, FORK.md, docs/architecture.md
+- Retrieved: 2026-08-16