[kyle-sexton]

Refs: #6916

Summary

Wave 5 findings from the #6916 drift sweep in the autonomy plugin (wave D, 3 findings). Each was re-read at main b0e26671d3, and its upstream quote was re-read raw on 2026-11-01.

Fix

• reference/routines.md dynamic workflow row: each run is session-scoped, and the script can be composed for the task or saved in the project or a plugin.
• README.md: "a shell hook" is now "a command hook". It says the /goal evaluator runs as a prompt-based Stop hook, and points at goal#how-evaluation-works and hooks-guide#prompt-based-hooks.
• No pointer was added inside reference/. scripts/validate-plugin-contracts.mjs:428-442 keeps autonomy's reference contracts free of vendor names, so the goal row's pointer is carried by the README instead.
• Patch fragment for autonomy.

Verification

• scripts/check-affected.sh --tests on the committed head: 13 passed, 3 skipped.

Remaining on #6916

This pull request delivers one plugin's share of wave 5. Still open on the issue:

• 44 files not yet swept: plugins/harness-config (8), plugins/plugin-quality (4), plugins/playbooks (30) and plugins/mutation-testing (2). They wait until the concise rewrites in flight in those plugins merge, so the sweep reads the new lines.
• Wave 5's other pull requests: docs(discovery): point drifted upstream claims at their sections #11771, docs: point repository docs and lane prompts at current upstream sections #11772, docs(docs-hygiene): correct audit-derivability's subagent-loading claims #11774, docs(review): narrow the opus pin rationale and add upstream pointers #11775, docs(knowledge): narrow drifted upstream claims and drop a model pin #11776, docs(autonomy): point the routines terms and stop gate at upstream sections #11777, docs(harness-ops): date and point three drifted upstream claims #11783, docs(songwriting): qualify object-writing's model and cost claims #11784, docs(code-tidying): label batch-simplify routing fallbacks as local choices #11785, docs(instruction-placement): align MS-13 cells with the re-pinned quote #11786, docs(session-flow): point depth-limit and task-list claims upstream #11790.
• Edits that would change what a skill does, held for eval evidence and to be filed as one slice under docs(multi-agent,session-flow): fix repo-mode audit pilot findings and schedule a full sweep #6916: discovery:setup's fork-default report, docs-hygiene:audit-derivability's spot-test agent, a write-for-agents cut, and the two planning:draft-goal-condition cuts.
• The final sweep count comment on docs(multi-agent,session-flow): fix repo-mode audit pilot findings and schedule a full sweep #6916.

Related

• docs(multi-agent,session-flow): fix repo-mode audit pilot findings and schedule a full sweep #6916

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T01:34:06.702285Z	e13d699	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed aedf150f9f8f5dcaa013699e380d63accdcd91be: read 3 of 3 changed file(s); 0 finding(s), 0 as inline comments.

Security review: no security issues found

I read every hunk of all 3 changed files in .claude-lane/pr.diff:

• .changes/autonomy/docs-6916-w5-autonomy-pointers-a4c81f3e.md: a new patch changelog fragment.
• plugins/autonomy/README.md: in the Stop-hook section, "a shell hook" becomes "a command hook". The new text also says the /goal evaluator runs as a prompt-based Stop hook and links two upstream docs sections.
• plugins/autonomy/reference/routines.md: the description in the dynamic workflow row of the terms table is reworded.

Scope checks

• Trusted paths: none of the changed files match a TRUSTED PATHS: glob.
• Trust controls: nothing changes in the trusted-trigger check, the token broker or the lane token, the kill switch, merge holds or any .github/actions/ action.
• Instruction surfaces: no rule is deleted, narrowed or softened. The README edit makes the description of how the lane-stop gate signals completion more precise. The sentinel-token and marker-file mechanics, and the rule that a marker is consumed after one stop, are unchanged. The routines.md edit rewords a definition and does not change what any skill or hook allows or blocks.
• Plugin manifests: no plugin.json or marketplace.json changed, so there are no manifest lines to report.
• Embedded text: the PR context contains no directive aimed at the review lane.

The change is documentation only, with no security-relevant surface, so skip-gate item 2 applies.

critical-findings: 0

[github-actions]

claude-review reviewed aedf150f9f8f5dcaa013699e380d63accdcd91be: read 3 of 3 changed file(s); 0 finding(s), 0 as inline comments.

Code review: no findings

This PR changes documentation only, in 3 files, and I read every hunk:

• plugins/autonomy/reference/routines.md: the dynamic workflow row now says each run lives inside one session, and that the script can be composed for the task or saved in the project or a plugin and reused. The row's family column still reads session-scoped, which agrees with the new wording. No vendor names were added inside reference/, which matches the constraint the PR description gives. The .claude/rules/cost-claims.md rule matches this path, but the row makes no cost or usage claim, so there is nothing to check against it.
• plugins/autonomy/README.md: the wording moves from "shell hook" to "command hook". It says the /goal evaluator runs as a prompt-based Stop hook, and the two upstream pointers carry an as-of date and a recheck trigger. The sentence still reads correctly into the colon that follows it.
• .changes/autonomy/...md: a bump: patch fragment under ### Fixed that describes both edits. A patch bump fits a docs-only correction.

Closing issue: none. The PR says Refs: #6916 and closes no issue, so there are no acceptance criteria to check.

Manifests: no plugin.json or marketplace.json changed.

Verification: I ran nothing; this lane has no shell. The test result in the PR description (scripts/check-affected.sh --tests: 13 passed, 3 skipped) is the author's claim and I did not verify it.

Embedded text: none found in the PR context.

[github-actions]

The pr-verify verifier failed head e13d699b55ceded6b93156b3862822d14d831f15. What it wrote, as data:

What it wrote (21 lines)

Summary: PR #11777 refs #6916, the repo-wide audit-defaults drift sweep. The doc edits for the
  autonomy plugin's wave-5 findings look sound, and every suite that covers the changed files passed
  (test-node and test-python were skipped because these markdown files aren't in their scope). It
  fails one partial-delivery rule: a `Refs:` pull request's body must say what work is left on the
  issue, and this body names the part it delivers but never says what remains.
- PR body: #6916 is open, and this PR delivers only part of it (autonomy wave D, 3 findings), but
  the body has no Remaining section. Add one that names what is left, as #6916's latest host-run
  comment lists it: the other unswept files (including the 9 capped files to re-run), the wave-4
  findings still unfixed, the per-plugin fix PRs still to ship, and the final count comment. Also
  say that this PR does not close #6916.
- PR body: the 3 findings are not recorded in any trusted comment on #6916, which lists results only
  through wave 4. The diff covers two edits, and the third finding (the `goal` row pointer) is
  handled through the README because of the vendor-name rule in reference contracts. Add a short
  list of all three findings, each with its disposition, so a reviewer can check them against the
  comment that records the sweep count.
- plugins/autonomy/reference/routines.md:62: the new `dynamic workflow` row wording reads correctly
  and stays session-scoped. No problem found.
- plugins/autonomy/README.md:138: changes 'shell hook' to 'command hook' and adds pointers to
  goal#how-evaluation-works and hooks-guide#prompt-based-hooks, with an as-of date and a recheck
  trigger. This fits the sweep's pointer rules.
- .changes/autonomy/docs-6916-w5-autonomy-pointers-a4c81f3e.md: the patch fragment matches the diff.

This pull request leaves the merge queue, and ci-status holds it out while it carries pr-verify-failed. A pr-verify pass at a new commit removes the label.