fix(claude-config): audit Category B cannot retract a baseline deny finding an installed hook already covers

[kyle-sexton]

Defect

claude-config's audit skill, Category B, has no channel by which an installed, enabled plugin hook
retracts or downgrades a baseline deny finding. The category's two documented off-ramps are both keyed
on the consuming repo writing prose; neither is keyed on a hook that is actually installed and enabled.
A repo whose enforcement is hook-provided rather than deny-rule-provided therefore receives a manufactured
error-rated finding.

Evidence at HEAD (685dd381)

The requirement — plugins/claude-config/skills/audit/context/validation-categories.md:17-21:

- **Baseline permission patterns**: iterate the patterns in
  [required-permissions.md](../reference/required-permissions.md) — each pattern in
  `sensitive-file-deny` and `destructive-bash-deny` must appear in `settings.json` `permissions.deny`;

Rated error at plugins/claude-config/skills/audit/reference/audit-checklist.md:29:

| `destructive-bash-deny` | `permissions.deny` (Bash patterns) | error |

Off-ramp 1 — reference/required-permissions.md:138-142 keys on "its own rules files".
Off-ramp 2 — same file :157-160 keys on "the project's own documented hook conventions".

There is no third path: grep -rn "hook" across the whole skill (SKILL.md, context/, reference/,
templates/, evals/) returns no hooks.json read, no plugin-hook enumeration, and no coverage concept.

Sharpening found during verification: the delegation is pattern-scoped. Category B says "iterate the
patterns in required-permissions.md" and audit-checklist.md:21-24 says "assert presence per
sub-category" — neither names "Narrowing the baseline" or "Interaction with hook-based gates". The two
existing off-ramps are not in Category B's instruction path at all. A third off-ramp added to
required-permissions.md alone would inherit that same weak wiring, so the fix also needs a pointer line
in Category B.

Docs grounding

https://code.claude.com/docs/en/permissions.md (raw curl, fetched 2026-08-11), line 419: "A blocking
hook also takes precedence over allow rules. A hook that exits with code 2 stops the tool call before
permission rules are evaluated, so the block applies even when an allow rule would otherwise let the call
proceed." That is what makes the missing off-ramp a false positive rather than a stylistic gap. Line 415
confirms the skill's stated ordering is doc-correct — the defect is that the ordering is stated and never
wired to a check.

Grading

• Severity: HIGH — manufactures an error-rated finding on an ordinary config shape, and its output
  is consumed by a lane the skill labels judgment-free (see the sibling issue on procedures.md:49).
• Provenance: AUDITOR_VERIFIED (plugin-quality:auditor fresh-context subagent, re-reproduced
  independently against HEAD).
• Verdict: PRESENT_AT_HEAD.
• Originating inbox item: 20260810-225905-claude-config-audit-category-b-hook-blindness.md (ledger
  I2, row A1).

Ships with

Batch-4 reconciliation AD-13: A1 and A3 are one defect chain and ship as one change. A3 alone tells the
auditor to verify hook coverage the skill has no enumeration path for; A1 alone leaves SKILL.md:212-214
and procedures.md:49 asserting the opposite of the new off-ramp.