fix(claude-config): audit-pass specifies 1,547 lines of runtime mechanism and ships no scripts, so the lease, the partial, and the resume path are prose only

[kyle-sexton]

audit-pass specifies sha256 state keys, sixty-second heartbeats, two-sided lease liveness,
compare-and-set owner_epoch fencing, append-only partials and a run manifest — across 1,547 lines of
SKILL.md plus ten reference/*.md — and ships no scripts at all. It is the only audit skill in
claude-config with no scripts/ directory. Three separately-observable defects are consequences of
that one gap: the lease the contract requires of every run was not written, the /doctor handoff's
--resume closure depends on a partial the run is most likely to skip, and Phase 3 declines to bound
the one cost dimension that actually blew up while naming a mitigation that is not implemented.

Two smaller placeholder-semantics defects ride along in the same skill: the {id} derivation the
report path depends on is still unstated, and the default target is expressed as a condition over a
placeholder the reader cannot evaluate — the exact shape the sibling audit-prompting-postures now
forbids in writing after #2250.

Rows

• F3 — plugins/claude-config/skills/audit-pass/ — 1,547 lines of machine-checkable contract across SKILL.md and ten reference/*.md, zero scripts, in a plugin whose four sibling audit skills all ship scripts/ with tests.
• F5 — SKILL.md:125 and reference/run-state-and-resumability.md:76-100 — the lease is specified in full (path, two-sided liveness window, released tombstone, owner_epoch compare-and-set) as prose with no executable, and the observed run wrote none.
• F12 — reference/report-location-and-schema.md:121 and SKILL.md:285 — Phase 4 marks the /doctor lane open, closable only by --resume; --resume reads the partial, not the report; no partial is written, so the report's instruction to the operator cannot work.
• F13 — SKILL.md:258-262 — Phase 3 bounds lane count, explicitly declines to bound intra-lane fan-out, and mitigates with "let incremental persistence carry the rest" — the mechanism F5 shows absent. The observed failure was intra-lane.
• F8 — reference/report-location-and-schema.md:19-23 — the {id} mangling rule is stated nowhere in the skill, and nothing records that ${CLAUDE_PLUGIN_DATA} is not in the Bash tool's environment, so a run cannot expand it from a shell. Fixed by ceaf013 (fix(claude-config): stop audit-pass asking the model to test a substituted placeholder #2403); see the verification note below.
• F9 — SKILL.md:42-43 — the default target is written as "${CLAUDE_PROJECT_DIR} when set, else git rev-parse --show-toplevel", a condition over a token the harness has already substituted before the reader sees it. Fixed by ceaf013 (fix(claude-config): stop audit-pass asking the model to test a substituted placeholder #2403); see the verification note below.

Evidence

F3 — the spec-to-implementation gap

wc -l over the skill at HEAD: SKILL.md 395 plus ten reference/*.md = 1,547 lines.
git ls-tree -d origin/main plugins/claude-config/skills/*/scripts returns audit,
audit-automation-gaps, audit-instructions, audit-permission-grants — audit-pass is the only
audit skill in the plugin with no scripts/ directory. For contrast,
plugins/claude-memory/skills/audit/scripts/ ships ten files, five with .test.sh siblings.

Scope this precisely. The "no scripts" fact is verifiable from the repository and was verified. The
consequence the originating item leans on — "the run wrote no lease, no partial, no manifest" — rests
on one observed run reported by the session that performed it and is not reproducible from the
repository.

Deferred shape, from the item and concurred with: scripts/resolve-run-paths.sh (plugin data dir plus
{id} mangling, state key across git/no-remote, the containment verdict report_path ⊆ target_root,
derived exclusion additions) and scripts/lease.sh (acquire/heartbeat/release/classify). Note
the ordering dependency: resolve-run-paths.sh would make the containment predicate that #2230 just
landed executable rather than prose, so it should follow the spec fixes rather than replace them.

F5 — the lease is specified and was not written

plugins/claude-config/skills/audit-pass/SKILL.md:125:

So every active run, read-only included, maintains a **lease**, and `--resume` reads it before it
reads the manifest.

reference/run-state-and-resumability.md:76-100 (§ "The lease — how --resume tells a live run from
an abandoned one") specifies the path, the contents (run id, pid, ISO-8601 start, a heartbeat_at
the run rewrites in place, an owner_epoch integer starting at 1), the two-sided liveness window, the
released tombstone, and the compare-and-set fencing — all prose, no executable.

Keep the attribution split the originating audit itself makes. The missing lease is
audit-pass's own defect. The concurrent writer being undetectable at its destination is a
different defect, owned by the unkeyed report paths filed separately in this batch. They must not be
retired by the same change.

F12 — the resume path depends on the artifact the run skips

reference/report-location-and-schema.md:121:

**Resume reads the partial, not the report**, so completion state is derivable from the artifact

SKILL.md:285: "open is an assembly terminator, not a completion. … --resume therefore re-runs
it, which for a delegated lane means re-prompting rather than re-scanning."

This is the one place the F3/F5 mechanism gap reaches the operator as a false instruction in the
report rather than as a missing internal, which is why it is worth its own row rather than being
folded into F3.

F13 — the disclaimed dimension is the one that blew up

SKILL.md:258-262:

**The lane count is bounded by the delegated interfaces, not chosen here** — one per scope value the
instruction catalog accepts, plus one for the memory layer — so it is a handful, and a per-run
dispatch ceiling would never bind. What is *not* bounded here is the fan-out inside a lane: the
delegated catalogs spawn their own subagents. So cap concurrency at 3–5 lanes and let incremental
persistence carry the rest — it is what degrades a blown session ceiling into a resumed run.

The reasoning in the passage is correct; the mitigation it names is the one F5 shows absent. The
observed failure was intra-lane (instruction-scan.sh exceeding a 120-second timeout over 39
surfaces). The scanner and its cost belong to audit-instructions; only the disclaimer and the
unimplemented mitigation are this skill's.

F8 — placement, environment, and derivation

grep -rn CLAUDE_PLUGIN_DATA plugins/claude-config/skills/audit-pass/ at HEAD. One of the three
original facts is now fixed by #2229/#2230: the token does appear in SKILL.md (:105, :393), and
reference/report-location-and-schema.md:19-23 now states the resolution and cites the source:

- The report goes under `${CLAUDE_PLUGIN_DATA}` at `runs/<state-key>/<run-id>/findings.json`, which
  survives plugin updates. **State its location precisely, because a whole target class turns on it:**
  that directory resolves to `~/.claude/plugins/data/{id}/`
  ([plugins reference](https://code.claude.com/docs/en/plugins-reference), verified 2026-08-11), and no
  documented setting relocates it.

Two facts remain unstated. (1) The {id} mangling rule — "the plugin identifier with characters
outside a-z, A-Z, 0-9, _, and - replaced by -" (plugins reference, fetched 2026-08-11) —
appears nowhere in the skill; a wrong derivation produces a report the next run cannot find, which is
also how --resume loses a partial. (2) Nothing records that ${CLAUDE_PLUGIN_DATA} is not in the
Bash tool's environment. Plugins reference, fetched 2026-08-11: "All three are exported as environment
variables to hook processes and to MCP and LSP server subprocesses." The Bash tool is none of those, so
the variable is not expandable from a run's shell.

Explicitly unconfirmed, and it should stay that way here: whether "skill content" substitution
extends to bundled reference/*.md loaded on demand via Read is not stated by the docs. #1568 owns
the empirical check; resolve it there rather than re-litigating it in this skill.

F9 — a condition over a token the reader never sees

plugins/claude-config/skills/audit-pass/SKILL.md:42-43, unchanged at HEAD:

- **`target`** — the git repository to audit. Default: `${CLAUDE_PROJECT_DIR}` when set, else
  `git rev-parse --show-toplevel`. Never the working directory — a run launched from a subdirectory

Plugins reference, fetched 2026-08-11: "Which fields substitute them inline depends on the plugin
component: | Skill and agent content | Anywhere the placeholder appears |". SKILL.md is unambiguously
skill content, so for this file the substitution premise is doc-confirmed and the "when set" test is
one the reader is asked to make about a token the harness has already resolved. (Note the cross-page
tension #1568 records — the skills page's own substitution table omits ${CLAUDE_PLUGIN_DATA} and
${CLAUDE_PLUGIN_ROOT} while listing ${CLAUDE_PROJECT_DIR} — so for ${CLAUDE_PROJECT_DIR}
specifically both pages agree it substitutes in skill content.)

This row is stronger at HEAD than when it was filed. #2250 landed the opposite instruction in a
sibling skill of the same plugin —
plugins/claude-config/skills/audit-prompting-postures/SKILL.md now says, in the block that derives
its report path:

Run those and use the result. Do **not** express the path as a condition over `${CLAUDE_PROJECT_DIR}`
"when set": that placeholder is substituted inline before this file reaches you, so the literal token
is never visible and the condition is not yours to evaluate. Derive the key from commands you actually
run.

Two skills in one plugin now contradict each other on the same placeholder. Cheap fix, unchanged from
the original suggestion: phrase the default in prose — "the project root Claude Code resolved for this
session; otherwise git rev-parse --show-toplevel".

Adjacent, deliberately not duplicated

• fix(claude-config): audit-pass eval suite grades the false containment premise as a pass condition #2228 / fix(claude-config): audit-pass claims CLAUDE_PLUGIN_DATA resolves outside any target repository — false by construction #2229 / fix(claude-config): audit-pass gates its report-path safety machinery on the --report-to flag, not on containment #2230 / fix(claude-config): audit-pass admits a non-git target its downstream contract cannot specify #2231 (closed) fixed the containment premise, the flag-gated exclusion machinery, the eval suite, and the non-git target gate. This issue is what they left standing.
• audit-pass: cross-epoch carry-forward, and audit-instructions needs a scope that suppresses the conflict pass #1430 (open) — cross-epoch carry-forward — declines to specify further mechanism in prose "against an artifact nobody has written", which is F3's observation from the other side. Cross-reference, not the same defect.
• audit-pass: four design/shipped contract contradictions in rerun-contract.md, plus PLAN.md phase drift #1940 (open) covers four design-doc-vs-shipped contradictions in rerun-contract.md; none of them is any row here.
• plugin-quality:audit asserts ${CLAUDE_PLUGIN_DATA} does not substitute in skill markdown; plugins-reference now says it does #1568 (open) owns the ${CLAUDE_*} substitution-scope question empirically; fix(architecture): improve's Gotcha asserts ${CLAUDE_PLUGIN_DATA} does not substitute in skill content — plugins-reference says it does #2207 is the same false-claim family in architecture:improve.
• F14 (name-based redirect refusal has no default-path twin) is not listed above: the ledger folds it into the containment fix that shipped as fix(claude-config): audit-pass gates its report-path safety machinery on the --report-to flag, not on containment #2230.
• F10 (--fix unreachable on a non-git target) is not listed above: fix(claude-config): audit-pass admits a non-git target its downstream contract cannot specify #2231 refuses non-git targets outright, which removes the conjunction it required.

Provenance

Severity: MED · Provenance: mixed, stated per row. F3 (structural half), F12, F13, F8, F9 are AUDITOR_VERIFIED. F5 is SELF_REPORTED — the non-write is a runtime observation by the session that ran the component, and nothing in the repository can confirm or refute it. F3's runtime half ("the run wrote no lease, no partial, no manifest") is single-observation and is marked as such above. Every file:line and quoted line was independently re-verified against HEAD by the validation pass.
Origin: handoff-inbox item 20260811-020411-claude-config-audit-pass-report-path-inside-scan-set
Ledger: .work/handoff-inbox-batch-4/ledgers/I8-audit-pass-report-path.md § F3, F5, F12, F13, F8, F9
Verified against repo HEAD 9b34a82a. Line anchors re-derived at that commit — SKILL.md grew from 353 to 395 lines under #2234, so every ledger anchor past line 57 has moved.

[kyle-sexton]

Re-verification at origin/main before wave 3 — every row still present, and F9 has a second instance

Anchors were taken at 9b34a82a; origin/main has since taken #2260, #2291 and #2301. Nothing has moved this skill. Commands run at origin/main, with output.

F9 — present, and the issue undercounts it by one

Cited instance, SKILL.md:42-43, verbatim and unchanged:

$ sed -n '42,44p' plugins/claude-config/skills/audit-pass/SKILL.md
- **`target`** — the git repository to audit. Default: `${CLAUDE_PROJECT_DIR}` when set, else
  `git rev-parse --show-toplevel`. Never the working directory — a run launched from a subdirectory
  must key and scan identically to one launched from the root.

A second instance, not filed, twenty-odd lines down — same shape, same file, inside the non-git refusal the row's sibling F10 depends on:

$ sed -n '65,67p' plugins/claude-config/skills/audit-pass/SKILL.md
  **Name the directory, not an empty string.** In the case this refusal is *for*, the default
  resolution above produces nothing: with no explicit `target` and no `${CLAUDE_PROJECT_DIR}`,
  `git rev-parse --show-toplevel` fails outside a repository and there is no resolved root to report.

"With no explicit target and no ${CLAUDE_PROJECT_DIR}" is the same unevaluable condition over a token the harness has already substituted. Fixing only :42-43 would leave the contradiction half-standing, so wave 3 rewrites both.

The prohibition this contradicts is live in the sibling skill and has just moved — it now sits at audit-prompting-postures/SKILL.md:105 (was :132), after #2335 migrated that skill onto the shared lib/state-key.sh:

$ grep -n 'when set' plugins/claude-config/skills/audit-prompting-postures/SKILL.md
105:"when set": that placeholder is substituted inline before this file reaches you, so the literal token

So at HEAD, two skills in one plugin still say opposite things about the same placeholder. This is drift this batch created (#2250 landed the prohibition without sweeping the sibling), which is why it is being fixed rather than documented.

F3 — present. audit-pass is still the only audit skill in the plugin with no scripts/

$ ls plugins/claude-config/skills/audit-pass/
evals  reference  SKILL.md

$ git ls-tree -d --name-only origin/main plugins/claude-config/skills/*/scripts
plugins/claude-config/skills/audit-automation-gaps/scripts
plugins/claude-config/skills/audit-instructions/scripts
plugins/claude-config/skills/audit-permission-grants/scripts
plugins/claude-config/skills/audit-permission-state/scripts
plugins/claude-config/skills/audit/scripts

Five siblings now, not four — #2260 added audit-permission-state/scripts and #2301 added check-hook-coverage.sh to audit/scripts. The contrast the row rests on has got sharper, not weaker.

F8 — present. The {id} mangling rule appears nowhere in the skill

$ grep -rc 'outside `a-z`' plugins/claude-config/skills/audit-pass/
(no file matches)

The half #2229/#2230 fixed stays fixed: reference/report-location-and-schema.md:19-23 does state the ~/.claude/plugins/data/{id}/ resolution and cite its source. What is still unstated is how {id} is derived, and that ${CLAUDE_PLUGIN_DATA} is not in the Bash tool's environment.

F11 — present. The schema still has no per-lane verification field

$ grep -n 'skipped' plugins/claude-config/skills/audit-pass/reference/report-location-and-schema.md
| `skipped` | every surface excluded, **with its reason** — a silent exclusion reads as coverage,
  and this section is what stops it |

inventory / mechanical / behavioral / suppressed / delegated / skipped, unchanged — nothing can express "this lane's verdicts were self-graded". The row's own observation stands: skipped exists because a silent exclusion reads as coverage, and the same argument applies to a silently-skipped verification.

F5, F12, F13 — unchanged at HEAD

SKILL.md:125 and reference/run-state-and-resumability.md:76-100 still specify the lease as prose with no executable; report-location-and-schema.md:121 and SKILL.md:285 still make --resume depend on a partial; SKILL.md:258-262 still declines to bound intra-lane fan-out while naming the mitigation F5 shows absent.

Scope note for wave 3

F3's build half is deferred, not silently dropped. The issue itself marks scripts/resolve-run-paths.sh and scripts/lease.sh as a "deferred shape", and F5's non-write is SELF_REPORTED — a runtime observation from one session that nothing in this repository can confirm or refute. Wave 3 implements the spec-side rows (F9 both instances, F8, F12, F13, and F11's schema field) and leaves F3/F5's executables to a follow-up, with that stated rather than ticked. Building a lease implementation on the strength of an unreproducible observation is the mistake this batch's re-verification discipline exists to prevent.

---

Verified at origin/main (post-#2301). Lane CC, handoff-inbox batch 4 — wave 3 is queued behind #2335, which bumps the same manifest.

[kyle-sexton]

F8 and F9 verified fixed at HEAD, ticked, not redone.

Both were shipped by ceaf0133 — fix(claude-config): stop audit-pass asking the model to test a
substituted placeholder (#2403). Verified two ways rather than taken on report:

$ git log --oneline -S "plugin identifier with characters outside" \
    -- plugins/claude-config/skills/audit-pass/reference/report-location-and-schema.md
ceaf0133 fix(claude-config): stop audit-pass asking the model to test a substituted placeholder (#2403)

$ git log --oneline -S "Do not express this as a condition over" \
    -- plugins/claude-config/skills/audit-pass/SKILL.md
ceaf0133 fix(claude-config): stop audit-pass asking the model to test a substituted placeholder (#2403)

and by reading the files at HEAD:

• F8 — reference/report-location-and-schema.md:25-29 now quotes the {id} mangling rule
  verbatim with the formatter@my-marketplace worked example, and :31-37 records that
  ${CLAUDE_PLUGIN_DATA} is exported only to hook processes and MCP/LSP subprocesses, so
  echo "$CLAUDE_PLUGIN_DATA" from a Bash call yields an empty string.
• F9 — SKILL.md:48-58 states the default in prose ("the project root Claude Code resolved for
  this session; where no such root is available, git rev-parse --show-toplevel") and adds the
  explicit prohibition on expressing it as a condition over ${CLAUDE_PROJECT_DIR} "when set",
  matching the sibling audit-prompting-postures rule from fix(claude-config): audit-prompting-postures report path has no project dimension, so any other root overwrites it #2250. The two skills no longer
  contradict each other.

---

The four live rows — F3, F5, F12, F13 — are addressed together in PR #2441, because they reduce
to one missing mechanism rather than three patches: skills/audit-pass/scripts/run-state.sh (paths,
lease acquire|heartbeat|release|classify, partial append) with run-state.test.sh and three
negative tests.

Two notes the PR makes at length and are worth carrying here:

1. F5's SELF_REPORTED leg is not asserted anywhere in the fix. Whether a particular past run
   wrote no lease is not reproducible from this repository. The whole basis for the change is the
   specification-versus-implementation gap, which is. The sharpest form of it: lib/state-key.sh's
   own header records the keying scheme as "audit-pass's, reused rather than reinvented" and
   cites this skill's §3 — and it was called by audit-instructions, audit-prompting-postures and
   claude-memory:audit, every skill except the one that specified it.
2. Two clauses were reduced rather than implemented, because a skill-driven run cannot keep them:
   the 60-second wall-clock heartbeat (no timer exists between tool calls) becomes boundary-driven
   refresh with the thresholds recorded in the lease, and §5's separate run manifest becomes the
   partial's own lane records — which is what §7 already required. Stale-lease adoption
   (owner_epoch compare-and-set) and §7 assembly remain unimplemented, and §3 and §7 now say so
   explicitly, so no reader takes them for mechanism.

[kyle-sexton]

Checkbox state, so the issue and PR #2441 do not disagree.

F8 and F9 are ticked above because they are fixed on main now — nothing pending. F3, F5, F12
and F13 are deliberately left unticked: they close when #2441 merges, and ticking them before that
would report a state main has not reached. #2441's Closes #2280 retires the issue on merge; its
body carries the same six-row table so neither surface is the only record.

One late finding worth recording here, because it is the batch's recurring class and it was caught
inside the fix for that class rather than after it. Making --stale-after an operator lever meant a
value of 0 would have been accepted, and a lease recording a zero staleness window satisfies the
staleness test the moment it is written — born abandoned, and adoptable by --resume out from under
the run that just wrote it. Refused rather than clamped, with an assertion; --skew-grace 0 stays
legal because "tolerate no forward clock jump" inverts nothing.