[kyle-sexton]

Refs: #6916

Summary

Fixes the eight wave 4 findings of the repo-mode /multi-agent:audit-defaults sweep, which cover plugins/context-guard, bugs, user-experience and guardrails plus .github/actions/resolve-config. Each edit adds a pointer, a reason or a qualifier. No step, default or dispatch changes.

Fix

file (at 8b297a13ce)	finding	disposition
plugins/context-guard/reference/reader-contract.md:469	stale: the subagent autoCompactWindow row says the field is "in the changelog only"	The row now points at sub-agents#set-the-auto-compact-window-for-one-subagent instead of the changelog. Dropped "in the changelog only" and the version; kept "not probed". The as-of line splits so this row reads 2026-10-31.
plugins/bugs/skills/scan/SKILL.md:167	stale: "A dispatch the harness rejects" misses that a blocked alias can be substituted	Kept the rule (report, never substitute). Added that the run metadata names the model asked for, not proof of the model that ran. What the harness does with a blocked alias stays behind the pointer, per review. Points at sub-agents#choose-a-model with an as-of date and recheck trigger.
plugins/bugs/skills/scan/SKILL.md:159	unpointed-judgment: the opus fallback has no reason	Labeled as this skill's stand-in for the fan-out guard in /multi-agent:route, which keeps a wide fan-out off the frontier tier. The model the alias then runs on is left to the harness, under the same pointer.
.github/actions/resolve-config/README.md:123	hardcoded-model-pin: fable is a valid alias, and the resolver maps it to opus	The exclusion is deliberate. resolve.mjs:684-692 says the frontier tier "never routes automatically", and pr-pipeline.schema.json:945 keeps best and fable out "until the owner sets a Fable allowance for the lanes". The README now says so and points at model-config#model-aliases.
.github/actions/resolve-config/README.md:172	copied-current: inherit writes no CLAUDE_CODE_SUBAGENT_MODEL	Added the sub-agents#choose-a-model pointer. It says upstream treats inherit as unset and that the variable is a default a spawn or a frontmatter model outranks.
plugins/user-experience/agents/evaluator.md:5	unpointed-judgment: model: opus	Added an inline # reason: comment labeling it this repository's choice, in the form review/agents/lane-verifier.md:5 uses.
plugins/user-experience/agents/evaluator.md:6	unpointed-judgment: effort: high	Added # reason: and a pointer to model-config#choose-an-effort-level with an as-of date and recheck trigger.
plugins/guardrails/README.md:95	stale: "Un-throttled Workflow fan-out" overstates it, since the runtime caps concurrent agents	Reworded to "no wave cap of its own" and pointed at workflows#behavior-and-limits. Applied the same wording to the config row at :1650 and to the matching userConfig description in plugin.json.

The bugs skill-body edits qualify and point; they cut no rule and change no step, so no eval evidence is owed (skill-criteria.md:200).

Verification

• Every quoted upstream line was re-read raw (fetch-docs.sh --max-age 0) on 2026-10-31 from sub-agents, workflows and model-config. All eight still held, so none was skipped.
• The fable exclusion was read in resolve.mjs and in the schema before the README was edited.
• scripts/check-affected.sh --tests on the committed head: 13 passed, 3 skipped over 10 changed files.
• Left out: claude plugin eval. No edit cuts or changes a skill's behavior.

Related

• Refs docs(multi-agent,session-flow): fix repo-mode audit pilot findings and schedule a full sweep #6916, the sweep issue. Models: docs(planning): anchor upstream pointers and label judgment #11627 and docs(performance): point the older Task tool name at its source #11671.

Remaining

• Re-run the 9 capped files in split areas, then the 139 files not yet sent, and post the final count comment on docs(multi-agent,session-flow): fix repo-mode audit pilot findings and schedule a full sweep #6916.
• ci-status green on this PR.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T20:50:08.930529Z	98b6072	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 98b6072b37

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-security-review reviewed 119ac456d80aa1a1ce5296a882b13df00d8cbd73: 0 finding(s), 0 as inline comments.

No security issues found in the 10 changed files, which are documentation and prose.

• Trusted path hit: .github/actions/resolve-config/README.md matches a trusted glob. I read its whole change. It only adds explanatory text and two upstream doc pointers. It changes no resolve.mjs logic, schema, token scope, kill-switch behavior or model-mapping code. The README says the existing fallback of non-listed models to opus is deliberate. Nothing is widened.
• Manifest: manifest description: pass. In plugins/guardrails/.claude-plugin/plugin.json only the workflow_resilience_check_enabled key's description changed. That is an inert field. The key's default stays false. No hooks, MCP servers, dependencies or other code-running fields changed.
• Instruction surfaces:
  • plugins/bugs/skills/scan/SKILL.md only adds qualifications and a pointer. The report-don't-substitute rule for a rejected dispatch is kept.
  • plugins/user-experience/agents/evaluator.md still sets tools: Read, Grep, Glob. Only inline # reason: comments were added to the model and effort frontmatter lines, which YAML reads as comments, so the values stay opus and high.
  • Nothing is deleted or softened, so I did not read the instruction exception register.
• Docs and changelog: The plugins/guardrails/README.md and plugins/context-guard/reference/reader-contract.md edits and the four .changes/*.md files are prose only.
• Spend: None of the changes alter turn limits, models, or schedules, and none can start a billable resource. No cost hold applies.
• PR context: The PR description contains no embedded instructions aimed at the review lane.

critical-findings: 0

[github-actions]

claude-review reviewed 119ac456d80aa1a1ce5296a882b13df00d8cbd73: 0 finding(s), 0 as inline comments.

No findings. This is a docs-only pull request: it adds pointers, reasons and qualifiers, and changes no step, default or dispatch.

What I checked

• fable exclusion (resolve-config/README.md). The new text matches resolve.mjs:686-687, which says the frontier tier "never routes automatically". It also matches the model and subagent-model descriptions in pr-pipeline.schema.json (lines 945 and 966), which keep best and fable out until the owner sets a Fable allowance. I did not confirm that the schema enum rejects them. I only read those two descriptions.
• Pointers. I did not open any upstream URL, so I can't confirm the quoted upstream behaviour. The README and bugs skill pointers come with an as-of date and a recheck trigger. The guardrails README row has them. The evaluator.md effort pointer has them too.
• bugs scan skill. The rule is unchanged (report, never substitute). The added text only qualifies it, so no eval evidence is owed.
• guardrails. The wording change in plugin.json matches the README config row and the guard-table row. The description is the only userConfig field touched, and its default (false) is unchanged.
• context-guard. The reader-contract row and its split as-of line agree (2026-10-31 for the subagent row).
• Change fragments. Each of the four edited plugins has a bump: patch fragment. That level fits a docs and description fix.

Manifest lines

• manifest userConfig.default: pass (no default changed, none removed)
• manifest userConfig.options: pass (none touched)
• manifest new field: pass (no new field)
• manifest version bump: pass (patch fragment fits a description and doc rewording)
• manifest description: pass (the only edit is the workflow_resilience_check_enabled description, which now says "no wave cap of its own")

Closing issues: none. The pull request says "Refs #6916", so it has no acceptance criteria to check.

Verification: the author's claim of check-affected.sh results (13 passed, 3 skipped) is author-claimed and I did not re-run it.

Spend: none. No lane, schedule or model change.