docs\operations\session-log.md:243:5. Updated `docs/legal/index.md` and `docs/legal/data-room-index.md` so they describe those repo records as metadata summaries rather than source-pending placeholder paths.
docs\operations\session-log.md:1114:  - `public/placeholder-cover.svg`
docs\operations\session-log.md:1267:  - ignoring placeholder markers inside fenced code blocks and inline backticks
docs\operations\archive\completed-work-2026-02-to-03.md:64:- [x] 2026-02-22 | P2 | docs | team | Fix MkDocs strict-mode build (ssot/atoms link warnings) | **DONE** — excluded ssot/**, cleanup/**, research/** from both mkdocs configs; added missing nav entries (COMPREHENSIVE_OVERVIEW, structural-enforcement, HANDOFF_STATE, TODO); both builds pass clean
docs\operations\archive\completed-work-2026-02-to-03.md:67:- [x] 2026-02-22 | P2 | infra | team | Remove `.morphism/metrics/metrics.json` pre-commit warning | **DONE** — pre-commit hook no longer references metrics.json; stale TODO
docs\operations\archive\completed-work-2026-02-to-03.md:104:- [x] 2026-03-01 | P2 | security | team | Snyk: triage 2C + 72H vulnerabilities in morphism-framework | **DONE** — original 2C+72H were against ARCHIVED morphism-framework repo (Docker image, old Python deps, SAST). Live morphism-systems/morphism scan: npm audit 0 vulns; Snyk dep scan 8/9 projects clean, 1 high (next@15.5.12 resource exhaustion, fix=next@16.x major upgrade); Snyk SAST 2 HIGH (credential in index_pinecone.py — tracked under rotate-tokens TODO), 24 MEDIUM (path traversal in CLI scripts via argv, open redirect in billing page, ReDoS in governance scripts — all low-risk internal tooling); pip-audit found 50+ vulns in global Python env (not repo-specific deps)
docs\operations\archive\completed-work-2026-02-to-03.md:135:- [x] 2026-03-02 | P2 | app | team | Policy/rule editor UI: author and simulate governance rules in browser | **DONE** — `governance/rules/page.tsx` with rules table, new rule form (severity/scope/constraint/pattern), simulate placeholder
docs\operations\archive\completed-work-2026-02-to-03.md:137:- [x] 2026-03-02 | P2 | app | team | Workspace/tenant management UI | **DONE** — `settings/workspace/page.tsx` with workspace info, governance preset selector (SMB/Enterprise), members list, API key placeholder
docs\operations\archive\2026-03-14-inventory-cleanup-plan.md:163:8 scripts have `TODO/DEPRECATED` markers in their source. Before each quarterly release, run:
docs\operations\archive\2026-03-14-inventory-cleanup-plan.md:166:grep -rn "DEPRECATED\|# TODO\|# FIXME" scripts/*.py | grep -v test | sort
docs\operations\archive\2026-03-14-inventory-cleanup-plan.md:360:grep -rn "DEPRECATED\|# TODO\|# FIXME" scripts/*.py | grep -v test
docs\migration_changelog.md:30:- 2026-03-21 00:58 America/Los_Angeles | codex | Tightened `drift_control_tower` into scoped enforcement (`--scope active|full`) with false-positive reduction (code-fence/inline-code placeholder handling, refined checklist logic, banner detection) and drove active-surface drift to zero findings; expanded `export_agent_intelligence.py` to include repo-native traces (`.morphism/changelogs`, prompts, handoff/deferred/workflow docs) and regenerated the canonical JSONL+summary dataset.
packages\cli\__tests__\commands.test.ts:448:        if (cmd === 'git' && args[1] === '--name-only') return 'AGENTS.md\ndocs/TODO.md\n'
docs\governance\audits\documentation-migration-matrix.md:44:| `docs/TODO.md` | `docs/operations/deferred-work.md` | derived | docs/platform maintainers | 2 | Moved 2026-03-10 |
docs\governance\audits\documentation-migration-matrix.md:111:2. Completed: move `HANDOFF.md`, `handoff-state.md`, `TODO.md`,
packages\sdk\src\client.ts:131: * TODO: This is where the pass/fail logic lives. The decision:
packages\mcp-server\src\sandbox\enforcer.ts:29:    .replace(/\*\*/g, '\0')                  // placeholder for **
apps\morphism\src\components\ui\input.tsx:4:  'w-full px-4 py-2.5 bg-surface border border-border rounded-lg text-sm text-text placeholder-muted2 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/50 focus-visible:border-accent transition-colors'
apps\morphism\src\components\organization-bootstrap.tsx:131:                placeholder={suggestedName}
apps\morphism\src\app\beta\page.tsx:45:            <Input type="text" name="firstName" required placeholder="Jane" />
apps\morphism\src\app\beta\page.tsx:49:            <Input type="text" name="lastName" required placeholder="Doe" />
apps\morphism\src\app\beta\page.tsx:55:          <Input type="email" name="email" required placeholder="jane@acme.com" />
apps\morphism\src\app\beta\page.tsx:60:          <Input type="text" name="company" required placeholder="Acme AI Labs" />
apps\morphism\src\app\beta\page.tsx:95:            placeholder="e.g., we need policy checks and proof across repos and CI before agent-generated changes ship."
apps\morphism\src\app\api\credentials\route.ts:101:    // TODO: This requires Clerk to store GitHub username during OAuth
apps\morphism\src\app\api\beta\route.ts:55:        org_id: '00000000-0000-0000-0000-000000000000', // placeholder
apps\morphism\src\app\(dashboard)\dashboard\skills\page.tsx:117:          placeholder="Search skills by name, category, or tenet…"
apps\morphism\src\app\(dashboard)\dashboard\skills\page.tsx:120:          className="w-full pl-10 pr-4 py-2.5 rounded-lg border border-border bg-surface text-text text-sm font-mono placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent"
apps\morphism\src\app\(dashboard)\dashboard\settings\workspace\page.tsx:40:              <Input value={name} onChange={(e) => setName(e.target.value)} placeholder="Workspace name" />
apps\morphism\src\app\(dashboard)\dashboard\settings\workspace\page.tsx:44:              <Input value={slug} onChange={(e) => setSlug(e.target.value)} placeholder="workspace-slug" />
apps\morphism\src\app\(dashboard)\dashboard\settings\workspace\page.tsx:51:                placeholder="Which repos, workflows, or teams does this workspace govern?"
apps\morphism\src\app\(dashboard)\dashboard\settings\feedback.tsx:85:            placeholder="Tell us what's on your mind..."
apps\morphism\src\app\(dashboard)\dashboard\settings\feedback.tsx:87:            className="w-full resize-none rounded-lg border border-border bg-bg px-3 py-2 text-sm text-text placeholder:text-muted2"
apps\morphism\src\app\(dashboard)\dashboard\settings\api-keys.tsx:129:              placeholder="e.g., CI/CD Pipeline"
apps\morphism\src\app\(dashboard)\dashboard\settings\api-keys.tsx:130:              className="flex-1 rounded-lg border border-border bg-bg px-3 py-2 text-sm text-text placeholder:text-muted2"
apps\morphism\src\app\(dashboard)\dashboard\governance\rules\page.tsx:73:              <Input value={form.rule_id} onChange={(e) => setForm({ ...form, rule_id: e.target.value })} placeholder="e.g. GOV-05" required />
apps\morphism\src\app\(dashboard)\dashboard\governance\rules\page.tsx:77:              <Input value={form.pattern} onChange={(e) => setForm({ ...form, pattern: e.target.value })} placeholder="**/*.md or ^SEC-.*" />
apps\morphism\src\app\(dashboard)\dashboard\governance\rules\page.tsx:102:              <Textarea value={form.description} onChange={(e) => setForm({ ...form, description: e.target.value })} placeholder="What does this rule enforce?" rows={2} required />
apps\morphism\src\app\(dashboard)\dashboard\agents\new\page.tsx:95:            placeholder="e.g. Backend Claude Code"
apps\morphism\src\app\(dashboard)\dashboard\agents\new\page.tsx:130:            placeholder="What does this agent do? (optional)"
scripts\docs_style_check.py:106:    "docs/TODO.md",
scripts\finalization_audit.py:281:    # 4b. TODO staleness
apps\morphism\src\__tests__\components.test.tsx:188:  it('shows loading placeholder ("...") before fetch resolves', async () => {
scripts\maturity_score.py:296:    """Max 10. Verify each package has a real test script (not 'echo' placeholder)."""
scripts\maturity_score.py:310:        # Real test script (not echo placeholder)
scripts\governance\drift_control_tower.py:72:    r"\b(TODO|TBD|FIXME|WIP|coming soon|lorem ipsum|insert [^\n]{0,40} here)\b",
scripts\governance\drift_control_tower.py:94:    "Every other handoff/TODO is archival.",
scripts\governance\drift_control_tower.py:226:            # Ignore tokens inside inline code spans (e.g. `TODO.md` path examples).
