Decide the week-32 platform changes (auto-mode default Aug 14, zip-archive marketplace source, worktree isolation, PreToolUse hooks)

[kyle-sexton]

Problem

Week 32 (2026-08-03 → 07, v2.1.220 → v2.1.224) shipped changes that land after most of this repo's verification stamps, which cluster 2026-08-03/04/08. Each needs a decision; none is assessed yet.

Source: whats-new/2026-w32.

Items

• Auto mode becomes the default permission mode. "Starting August 14, auto mode is the default permission mode for new sessions on Pro, Max, and Team plans." Time-sensitive. Any doctrine, hook, or guardrail that assumes default mode should be checked before that date. Also relevant: the classifier calls auto mode makes no longer count toward usage limits.
• Zip-archive marketplace source. "Marketplaces can distribute a plugin as a zip archive with the new archive source, downloaded over HTTPS with an optional SHA-256 pin, so installs work without git or npm." A marketplace.json source type this repo's marketplace doctrine does not mention and scripts/validate-plugins.sh has never seen. Decide whether to document it, whether the SHA-256 pin should be required for anything this repo publishes, and whether the plugin-acceptance security review needs a clause for it.
• Worktree isolation extended. "Worktree isolation now blocks not only file edits but also Bash commands and git redirects that reach the main checkout, in every session type and in the session's subagents." Adjacent to the guardrails plugin's territory — check for now-redundant guards, and for any guard that assumed the narrower behavior.
• PreToolUse auto-allow hooks narrowed. "PreToolUse auto-allow hooks no longer bypass tool restrictions in Claude Code's internal side tasks such as summaries and compaction." Confirm no hook in this repo relied on the old behavior.
• /fork now uses its own worktree. "A session you copy with /fork now makes its code changes in a worktree of its own instead of the original session's checkout." Check the orchestration and worktree docs for statements that assumed the shared checkout.
• Plugin activation on install. "Plugins you install from /plugin activate in the current session when it's safe to do so; the install summary reports Plugin is now active. or tells you to run /reload-plugins." Affects install instructions in plugin READMEs that tell users to restart.
• /review is an alias of /code-review, and /code-review with no effort level reuses the last level typed. Check the review plugin's docs for stale command guidance.
• Ultraplan removed, including the /ultraplan command and the ultraplan keyword. One repo reference survives at docs/topics/context-engineering-claude-5/design/official-corroboration.md:355; it is inside a topic-design doc, i.e. a record of what was true when written, so probably leave it — confirm.
• The 200-subagent-per-session cap removal — already fixed in PR fix(session-flow,discipline): drop the per-session subagent cap that no longer exists, and record the doc-currency audit #2169, listed here for completeness of the week-32 sweep.

Method note

When verifying any of these, ask each page to state its own current rule rather than to confirm a sentence from this repo. A fetch summarizes through a small model, so "the page doesn't mention X" is a routine false negative, and a false negative read as drift means editing correct doctrine. Require a verbatim quote before classifying anything as drifted.

Also run gates the way CI runs them — base-ref form, against a committed tree. Two local runs passed vacuously during #2161 (--paths over a hand-filtered list; --check-bump before anything was committed).

Source

Gate doc-currency audit, PR #2169. Graduated from that PR's findings slice per the topic-docs Contract-tier prune rule.

[kyle-sexton]

Adding a verification item surfaced by review on #2169.

• Re-verify CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY ("Maximum number of read-only tools and subagents that can execute in parallel", documented default 10). It is cited in plugins/discipline/skills/sweep-all/SKILL.md from a 2026-07-29 read and has not been re-verified: two independent re-fetches of env-vars truncated before reaching that alphabetical range, and the sub-agents page's "Concurrent subagent limit" section names only the concurrency and depth limits, with no mention of it.

Its currency is open, not disproven — the truncated fetch returned ABSENT for CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS too, which is quoted verbatim on the sub-agents page, so ABSENT there means "not in the excerpt", not "not in the docs". Classifying it as removed on that evidence would be exactly the false-negative-read-as-drift failure this audit's method rule exists to prevent.

The claim is marked in-place as carried-forward-and-unverified rather than silently left looking fresh. Needs a fetch that reaches the full variable table — or a different route to the same row.