docs: correct nine false statements in the sweep record, and fix three citations no reader could resolve - #3480
Conversation
…x three citations its derivation could not see A seventh review round audited dd6c11f (#3477) and e7e3a36 (#3478). Their adjudications hold: the twelve citations are keep-correct, the eight L4 Group 2 rows really were already closed, the dometrain note does not over-claim. Nine surrounding statements are wrong, and one of them installed a rule describing an event that did not happen. The worst: both specs and #3478's message call 6c7a103 (#3380) "the same commit that wrote the roster", and the roster's own closure stamp said its summary sentence "was never true". git log --diff-filter=A on docs-hygiene-sweep-unapplied-remediations.md returns 3fbe978 (#3362), git blame puts the sentence and the whole L4 section on 3fbe978, and #3380's only hunks in that file are in "Status at the stamp", L2, L6 and L7 -- never L4. #3362 wrote the sentence while all 34 rows were open, so it went stale rather than starting false. The rule drawn from the false version -- "a record that fixes findings and updates its own summary in the same commit must update the summary" -- is replaced by the near-inverse the evidence supports: a commit that closes findings inventoried in a record it did not author still owes that record's summary an update. The second derivation claimed "52 tokens, 0 clause 3 failures" over every citation token in the plugin-level reference/, context/ and agents/ trees. A third expression -- every skills/ path token ending in a real file extension, resolved against the base its form implies -- returns 119 tokens and 3 failures, each the exact defect class ADR 0018's correction 1 names. The first derivation's regex requires a (reference|context|actions|evals|templates)/ tail and all three end in SKILL.md, so both prior passes were blind the same way; reporting them as independent overstated the evidence. One sits 65 lines above V-sc-01 in a file a pass had verified. All three are rewritten to ${CLAUDE_PLUGIN_ROOT}/skills/<s>/…, the form each file already uses elsewhere; re-running the third expression returns 0 failures. V-review-13 and V-review-14 closed in #3468 (c66f26c), which rewrote all three native-references sites to slash invocations, not in #3475, which touched only that convention's CHANGELOG. Fixed in both specs. Four claims live only in merged messages, which cannot be edited, so they are corrected in the spec where a reader following the refs meets them. #3477's subject says "a fired security re-trigger" while the note it adds correctly says the condition cannot be settled by reading the page. Its :943 re-anchoring credit is false: the hunk is @@ -944,0 +945,7 @@, a pure insertion that does not move 943 -- good practice, wrong justification. Its "which the note says" is false about the note. And "every one of #3468's fixes wrote a CHANGELOG entry" is false: PLUGIN-PHILOSOPHY.md and pre-pr-ordering/README.md got fixes with no entry, and pre-pr-ordering ships no CHANGELOG at all. Two precision fixes: the twelve name their replacing invocation in a later sentence of the same bullet, not the same sentence, and detector-findings :57 names none; the nine cover eight distinct targets, not eleven, which is the count across all twelve. And the absolute that the fetched-contract problem "cannot occur" for intra-plugin citations is softened, with the counter-instance named: work-items' work/SKILL.md:208 sends a reader to fetch source-control's config-resolution.md, for whom ${CLAUDE_PLUGIN_ROOT} resolves to work-items. The roster's inventory rows are untouched, per its own decay rule; only the attribution about the roster is corrected. Three plugins bumped for their own diffs. Refs #3478, refs #3477, refs #3475, refs #3468, refs #3380, refs #3362. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UmrZGdp1dgbZuPCy7tcRJo
|
Claude finished @kyle-sexton's task in 41s —— View job Security review —
|
|
Claude finished @kyle-sexton's task in 4m 19s —— View job Code review complete
No blocking or high-confidence findings. This PR is documentation-only (two What I independently verified (ran the commands myself, didn't just trust the PR body):
What I could not verify, and am flagging as author-claimed only (per this lane's rule not to restate the author's own verification as independently confirmed):
Neither gap points to anything wrong in the diff — they're disclosed here because this PR is specifically about correcting unverified claims, so the honest thing is to be explicit about which parts of it I could and couldn't check myself in this environment. |
|
Last security-reviewed head: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7402956c92
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Claude has reviewed this PR 3 times. The lane skips further automatic reviews after 5; deleting this comment resets the count. |
…anchor the fetching plugin redefines
`reference/config-resolution.md` is fetched by `work-items`'s `work` skill over
raw.githubusercontent.com. For that reader `${CLAUDE_PLUGIN_ROOT}` denotes the
`work-items` installation, so the anchored form this change first shipped named a
`babysit-prs` skill that does not exist there. The sentence is the doc's address
for the autonomy obligation, which is the case ADR 0018's amendment routes to the
public invocation. It now reads `/source-control:babysit-prs`, the form the same
file already uses in two other places.
The sweep record's own paragraph had established the cross-boundary fetch and then
concluded "the remedy is still form rather than routing". That inference was wrong
and is corrected in place: the anchored form is unfollowable for the fetched reader
too, so clause 3 alone can force the invocation. The blanket claim that a reopened
Group 2 row would take the path form "and nothing else" is qualified the same way,
and the unchecked question is named rather than assumed.
Found by review before merge.
|
Claude finished @kyle-sexton's task in 2m 27s —— View job Code review complete
No blocking or high-confidence findings. This PR is documentation-only, and everything I independently checked held up. Codex's P2 finding is already resolved. The second commit ( What I independently verified (ran the checks myself, not relayed from the PR body):
One thing I looked at but am not flagging. Scope note. Per this lane's rule, the PR body's own "Verification" section (test-suite exit codes, the F3 119-token re-derivation) is author-claimed and not restated here as independently confirmed — I checked the load-bearing citation and attribution claims myself where the repo state let me (see above), consistent with what the prior security review and code-review passes on this PR already found. |
…he citations its derivation could not see A fresh-context verifier reproduced the F3 derivation independently (119 tokens, 3 failures pre-fix, 0 post-fix, same three sites) and found three new false statements in the round that produced it. - "#3380 closed 32 of 34 rows in three plugins' files" is refuted by `git show --stat 6c7a103`: the rows span a `.claude/rules/` file, `docs/PLUGIN-PHILOSOPHY.md`, four convention READMEs and several plugins' trees, and the majority are not plugin files at all. - The `config-cascade` sentences were pinned at `:13-14` and `:11-13`; the quoted forms are on 12, 13 and 14 and the assertion runs 14 to 16. A line pin written into the file whose own decay rule says the check is the text. Both re-anchored on text rather than corrected. - "names no invocation at all" is contradicted by the bullet's own text, which names two. It names no invocation as the replacement, which is the claim the ruling actually rests on. The claim that both earlier derivations shared one blind spot is downgraded to what the evidence supports: derivation 1's expression is recorded and does have it, derivation 2's was never written down. An unrecorded expression cannot be audited, only believed, and that is the defect worth carrying forward. The verifier also found three citations the third derivation could not see, because it was `skills/`-scoped and these name no skill. They sit three lines above V-disc-04 through V-disc-06, which this sweep closed: a pass corrected the citations below them and left these standing. Fixed to the anchored form, which is right here because the file is not fetched across the plugin boundary.
|
Claude finished @kyle-sexton's task in 2m 58s —— View job Code review complete
No blocking or high-confidence findings. This is a documentation-only PR (spec-record prose plus three plugin What I independently verified for the new commit (
What I could not verify (same limitation prior passes on this PR disclosed): this is still a shallow clone — Scope note. Per this lane's rule, the PR body's own "Verification" section (gate exit codes) is author-claimed, not restated here as independently confirmed — I don't have permission to run |
|
Claude finished @kyle-sexton's task in 41s —— View job Security review —
|
2 participants
No linked issue
Summary
An eighth review round audited the two most recently merged commits of this sweep,
dd6c11fe(#3477) ande7e3a368(#3478), and found nine false statements in their records. Their central claims survived: the twelve citations really are keep-correct, the eight roster rows really were already closed, the security note really does not over-claim. The surrounding record is what was wrong, in ways that mislead the next pass rather than the current one.Then a fresh-context verifier found three more false statements in the correction itself, and two reviewers found a wrong remedy and three more broken citations. All are fixed here. Three commits, each one correcting the one before it.
Fix
The correction that mattered most: a rule drawn from an event that did not happen
Two merged records asserted that
6c7a1032(#3380) wrote the L4 remediation roster and fixed 32 of its 34 rows in the same commit. From that, a generalizable rule was installed: a record that fixes findings and updates its own summary in the same commit must update the summary.The premise is false in both halves.
git log --diff-filter=Aon the file3fbe9789(#3362)git show 6c7a1032 --unified=0The summary sentence was written by #3362 while all 34 rows were open. It went stale; it did not start false. The rule the evidence supports is close to the inverse: a commit that closes findings inventoried in a record it did not author still owes that record's summary an update.
Six citations no reader could resolve
A prior record claimed "52 tokens, 0 clause 3 failures" over the plugin-level non-skill trees. A third derivation found 119 tokens with 3 failures; the verifier then found three more the third derivation could not see.
source-control/reference/config-resolution.mdskills/babysit-prs/SKILL.md/source-control:babysit-prswork-items/reference/permission-preflight.mdskills/work/SKILL.md${CLAUDE_PLUGIN_ROOT}/skills/work/SKILL.mdsongwriting/context/.../lyric-melodic-roadmaps.mdskills/meter-prosody/SKILL.md${CLAUDE_PLUGIN_ROOT}/skills/meter-prosody/SKILL.mddiscovery/reference/topic-docs.md×3agents/{explorer,researcher,intent-tracer}.md${CLAUDE_PLUGIN_ROOT}/agents/…Why the derivations kept missing them. The first two required a
(reference|context|…)/tail, and the threeSKILL.mdfailures have none. The third wasskills/-scoped, and thediscoverythree name no skill. Each expression was blind to exactly the rows the next one found. Thediscoverythree are the sharpest case: they sit three lines aboveV-disc-04throughV-disc-06, which this sweep closed — a pass corrected the citations below them and left them standing, because its expression could not see them.The class is "a path whose implied base is the plugin root while its real base is the citing file's directory". Nothing in that definition mentions skills, and a fourth derivation is owed and recorded as owed.
The first remedy was wrong, and review caught it
All were first fixed to the
${CLAUDE_PLUGIN_ROOT}form. Forconfig-resolution.mdthat is still broken, for a reason this PR's own record had established and then failed to apply to itself:work-items'sworkskill fetches that file overraw.githubusercontent.com, so for that reader the variable denotes thework-itemsinstallation and the anchor named a skill that does not exist there. It now uses the public invocation, which the same file already uses in two other places.The spec paragraph had concluded "the remedy is still form rather than routing". True of the bare form, false of the choice it justified. The commit corrects the inference, not just the line. Every later citation fix in this PR applies the resulting test: check who fetches the file before choosing the remedy.
permission-preflight.md,lyric-melodic-roadmaps.mdandtopic-docs.mdare each read only inside their own plugin, so the anchored form is correct for all four of those rows.Three false statements the correction introduced
Found by the fresh-context verifier, each re-checked before fixing:
git show --stat 6c7a1032refutes it. The rows span a.claude/rules/file,docs/PLUGIN-PHILOSOPHY.md, four convention READMEs and several plugins' trees; most are not plugin files.config-cascade(:13-14,:11-13) that are wrong — the quotes are on 12/13/14 and the assertion runs 14-16 — and that are line pins written into the file whose own decay rule says the check is the text, never the line number. Re-anchored on text rather than renumbered.A fourth claim, that both earlier derivations shared one blind spot, is downgraded to what the evidence supports: derivation 1's expression is recorded and does have it; derivation 2's was never written down. An unrecorded expression cannot be audited, only believed — the defect worth carrying forward.
The other six original corrections
V-review-13/14were closed byc66f26ce(fix: close the extract-ssot sweep's open remainder, including a fail-closed gate that failed open #3468);02e1d8b0(fix(docs): write down the test ADR 0018 was applied under, and close five wrong keeps #3475) touched only that convention's CHANGELOG.dd6c11fe's hunk is@@ -944,0 +945,7 @@— a pure insertion after 944 cannot move a pin at 943.Verification
Re-derived here, not relayed. Every load-bearing attribution claim was checked against the command that would refute it:
--diff-filter=Areturns3fbe9789;6c7a1032's hunk offsets miss the L4 range;c66f26cechangednative-references/README.mdwhile02e1d8b0changed only its CHANGELOG;dd6c11fe's hunk is the pure insertion. Theconfig-cascadeline numbers, thedetector-findingsbullet text, the6c7a1032file spread, theraw.githubusercontent.comfetch, the existence ofplugins/source-control/skills/babysit-prs/, its manifest name, and theplugins/discovery/agents/layout were each read directly before anything was written about them.The fresh-context verifier reproduced F3 independently. Built from the opposite direction, its expression returns 119 tokens, 3 failures pre-fix, 0 post-fix — the same three sites at the same lines. Delta zero on both counts. That was the highest-risk claim in the change and it is no longer author-only.
Gates on the final head, real exit codes:
Limits, stated. Every automated reviewer on this PR runs on a shallow clone and none could verify the
6c7a1032/3fbe9789/c66f26ceclaims for itself; those rest on commands run here against full history, and are reported as such rather than as independent confirmation.git rev-parseconfirms3fbe9789and3fbe97898are the same commit, which one reviewer raised and could not settle.Version bumps and CHANGELOG entries:
discovery0.16.17,source-control0.55.30,work-items0.39.39,songwriting1.4.18. The roster's inventory rows are untouched, per its own decay rule.Related
Refs #3478, refs #3477, refs #3476, refs #3475, refs #3474, refs #3469, refs #3468, refs #3462, refs #3460.