Address PR review-toolkit findings

stub-patterns.md:
- Split return-nothing grep by language (nil→Go, null/undefined→TS/JS, None→Python)
- Fix pass$ regex to use word-boundary pattern (was matching bypass, overpass)
- Add test_ prefix to Python test file exclusion

self-audit.md:
- Align inline TODO grep with stub-patterns.md canonical list (add tsx/jsx/rb/PLACEHOLDER)
- Defer hardcoded secrets check to stub-patterns.md (was inconsistent: missing tsx, no test exclusion)

Author: 5uck1ess

commands/references/stub-patterns.md

@@ -16,13 +16,14 @@ grep -rn 'TODO\|FIXME\|HACK\|XXX\|PLACEHOLDER' \
 
 ```bash
 # Functions that return nothing useful — high false-positive rate.
-# Filter results manually: return nil/null/{}/[] is often legitimate.
+# Filter results manually: these returns are often legitimate.
 # Strongest signal when combined with TODO/FIXME nearby.
-grep -rn 'return nil\|return null\|return undefined' \
-  --include='*.go' --include='*.ts' --include='*.js' --include='*.py' . 2>/dev/null
+grep -rn 'return nil' --include='*.go' . 2>/dev/null
+grep -rn 'return null\|return undefined' --include='*.ts' --include='*.js' . 2>/dev/null
+grep -rn 'return None' --include='*.py' . 2>/dev/null
 
-# Python pass-only functions
-grep -rn 'pass$' --include='*.py' . 2>/dev/null
+# Python pass-only functions (indented pass on its own line)
+grep -rEn '^[[:space:]]+pass[[:space:]]*$' --include='*.py' . 2>/dev/null
 
 # Empty catch/error blocks (use grep -E for extended regex portability)
 grep -rEn 'catch[^{]*\{\s*\}' --include='*.ts' --include='*.tsx' --include='*.js' --include='*.jsx' . 2>/dev/null
@@ -46,7 +47,7 @@ grep -rn '\[TODO\]\|<TODO>\|{TODO}' \
 ```bash
 # Hardcoded IDs or secrets (not in test files)
 grep -rn 'api_key\s*=\s*"[^"]\+"\|password\s*=\s*"[^"]\+"' \
-  --include='*.go' --include='*.ts' --include='*.tsx' --include='*.py' . 2>/dev/null | grep -v '_test\.\|\.test\.\|\.spec\.'
+  --include='*.go' --include='*.ts' --include='*.tsx' --include='*.py' . 2>/dev/null | grep -v '_test\.\|\.test\.\|\.spec\.\|test_'
 
 # Hardcoded URLs (not config/const files)
 grep -rn 'http://localhost\|127\.0\.0\.1' \

commands/self-audit.md

@@ -75,9 +75,8 @@ Record: total coverage %, lowest-coverage packages, untested files.
 # Python: pip-audit or safety check
 # Rust: cargo audit
 
-# Hardcoded secrets
-grep -rn 'password\s*=\s*"[^"]*"' --include='*.go' --include='*.ts' --include='*.py' . 2>/dev/null | head -5
-grep -rn 'api_key\s*=\s*"[^"]*"' --include='*.go' --include='*.ts' --include='*.py' . 2>/dev/null | head -5
+# Hardcoded secrets — use the patterns from references/stub-patterns.md
+# "Hardcoded Values Where Dynamic Expected" section (excludes test files, includes .tsx)
 ```
 
 ### Stale Code
@@ -87,8 +86,10 @@ grep -rn 'api_key\s*=\s*"[^"]*"' --include='*.go' --include='*.ts' --include='*.
 # Unused dependencies
 # go mod tidy -diff (shows removable deps)
 # npm prune --dry-run
-# TODO/FIXME/HACK count
-grep -rn 'TODO\|FIXME\|HACK\|XXX' --include='*.go' --include='*.ts' --include='*.py' --include='*.rs' . 2>/dev/null | wc -l
+# TODO/FIXME/HACK count — matches stub-patterns.md canonical list
+grep -rn 'TODO\|FIXME\|HACK\|XXX\|PLACEHOLDER' \
+  --include='*.go' --include='*.ts' --include='*.tsx' --include='*.js' --include='*.jsx' \
+  --include='*.py' --include='*.rs' --include='*.rb' . 2>/dev/null | wc -l
 ```
 
 For deeper stub detection (empty implementations, placeholder text, hardcoded values, skipped tests), run the patterns from `references/stub-patterns.md`. Run unconditionally — a repo can have zero TODOs but still contain empty catch blocks, placeholder UI copy, or hardcoded localhost URLs.