claude-config/audit-pass: non-git refusal narrative cites a state-key limitation that no longer exists — re-argue the gate over the four remaining reasons, or reconsider the refusal

[kyle-sexton]

Where this comes from

Flagged during the encapsulation-remediation session that produced PR #2703, and made more visible by that PR's state-key promotion (the <state-key> scheme's canonical definition moved to docs/conventions/plugin-data-report-keying/).

The drift

plugins/claude-config/skills/audit-pass/SKILL.md (the "gate enforces both halves" passage, ~line 92) justifies refusing non-git targets with five reasons a non-git directory "went quiet". The first is:

the state key (§3) has a no-remote fallback and no no-git one, and "canonicalized repo root" is undefined without a repository

That claim is stale: the shared plugins/claude-config/lib/state-key.sh has a nonrepo/ rung (identity="nonrepo/$(hash12 "$PWD")", with local/ for no-remote repos) — a non-git directory keys fine. The §3 reference now defers to the promoted convention, which documents the nonrepo/ rung explicitly, so the SKILL.md bullet contradicts the very definition it cites.

The design question (why this is not a one-line fix)

The passage's conclusion explicitly weighs "specifying all five branches" and rejects it because the last reason (suppression only persists through the tracked team layer, which cannot exist untracked) is a permanent capability loss. That reason — plus the HEAD-baseline, worktree-derivation, and git status assertions — still holds, so the refusal is probably still right; but the narrative's count and its lead bullet are wrong, and someone should decide deliberately:

1. Keep the refusal, fix the narrative — re-argue over the four remaining reasons, dropping the state-key bullet (cheapest; the conclusion likely survives unchanged since the suppression argument was already named as the decisive one), or
2. Reconsider the gate — with the state key no longer a blocker, evaluate whether a degraded non-git mode (no suppression persistence, no HEAD baseline, stated loudly) is worth having, which is a contract change to the skill.

Either way the passage should stop citing a limitation the executable does not have.

Related

PR #2703 (state-key promotion that surfaced this); docs/conventions/plugin-data-report-keying/ (now-canonical scheme definition including the nonrepo/ rung).