[melodic-automation-lanes]

Closes #12691

Summary

Opened by the work-resolve-issue lane. The run's own summary:

Rewrote the 28 passages the issue lists in 10 files under plugins/evals and plugins/source-control. Each passage drops the restated upstream value, keeps this repository's decision or rule in its own words, and points at the upstream section with an as-of date (2026-11-03) and an observable recheck trigger, per .claude/rules/skill-bodies-state-current-rules.md. Before writing each pointer I fetched its page in this run and confirmed the section covers the fact. Where the issue named no pointer (the GitHub MergeStateStatus enum and the git hooks text), I used the GraphQL pulls reference page and the githooks pre-commit and commit-msg entries. In case-authoring.md I cut the grader table's restated 'Passes when' column and replaced it with one Grader types record, which also replaces three older per-row records.

Not verified

• plugins/attribution/skills/audit/scripts/check-stamps.sh --trigger-less was not run: this lane can run only the named wrappers. I checked by hand instead, against the script's trigger regex (see verification). CI or a person should run it on the touched files.
• I could not confirm the GitHub MergeStateStatus anchor: WebFetch showed no ids or hrefs. orchestration.md uses ＃enum-mergestatestatus to match the existing freshness.md link to the same page. A person should check it on the live page.
• Anchors I took from heading text but could not see in the fetched output: https: //github.com/x-motemen/ghq＃commands, https: //jqlang.org/manual/＃invoking-jq, https: //jqlang.org/manual/＃format-strings-and-escaping, and the code.claude.com ＃limitations, ＃auto-fix-pull-requests, ＃available-data, ＃plu
• Not in the issue's rows and left unchanged: the generated options table's max_cost_usd description, which comes from plugins/evals/.claude-plugin/plugin.json and still says it bounds one invocation and stops mid-suite with partial results; and the text at plugins/source-control/skills/worktree/fixtu
• The tidy pass was skipped: the change is 12 files across 2 areas (plugins/evals, plugins/source-control), over the tidy cutoffs of 10 files and 1 area.
• The PR's CI runs the test suites and the CI-only checks (lychee-offline, editorconfig, purged-em-dashes, line-citations and others that check-affected lists as CI only). No test suite covers these markdown-only edits.
• This run did not commit: the lane's system prompt said to leave every change uncommitted for the runner to turn into a patch.

Fix

• plugins/evals/README.md: r160 drops the replay/two-arm/WITH-W/OUT description and points at How an eval run works; r161 drops the directory layout and the skill-creator incompatibility claim, keeps which commands write and check the suite, and points at Write a case manually; r162 drops the per-invo
• plugins/evals/skills/methodology/reference/eval-design.md: r167 drops the claim that thinking counts against max_tokens, keeps the headroom and format-in-the-prompt advice for a model whose thinking shares the limit, and adds a Pointer/As of/Recheck trigger record for extended-thinking＃budget-rules-
• plugins/evals/skills/plugin-eval/reference/case-authoring.md: r168 drops the default eval dir, the manifest key and the results location, and keeps a locatable-eval-dir checklist item pointing at Use a different eval directory; r169 drops the throwaway home/cwd/config and scaffold sandbox details an
• plugins/evals/skills/plugin-eval/reference/ci.md: r174 drops descriptions of delta omission, skippedPaidGraders and error, keeps the parser's rule that these are unscored, never zero, and adds a JSON result record; r175 drops the scoring claim about mixed ablation modes, keeps hold-the-mode-fixed, a
• plugins/evals/skills/plugin-eval/reference/reading-results.md: r176 drops the --json suppresses-the-table claim and keeps read-the-JSON-as-record, with pointers; r177 replaces the delta, run score and case score formulas and the pass rule with a pointer to How a case is scored.
• plugins/source-control/reference/worktree-root-convention.md: r445 drops the ghq list and dot-hiding parenthetical and points at the ghq README COMMANDS; r447 drops the libgit2/JGit/go-git support claims, keeps gitdir/i: for identity and hasconfig: for worktreeroot.*, and points at git-config Condit
• plugins/source-control/skills/babysit-prs/reference/orchestration.md: r451/r452 drop what mergeStateStatus integrates and the async-flap claim, keep the suppressible-arm and into-actionable decisions, and point at the MergeStateStatus enum; r453 drops 'a new Agent call always starts a fresh agent',
• plugins/source-control/skills/pull-request/reference/watch-handoff.md: r456 drops the plan-limit claim, keeps read-the-snapshot-first, and points at the cloud page's Limitations; r457 drops the list of cases with no rate_limits and points at statusline Available data; r458 drops the /autofix-pr clou
• plugins/source-control/skills/worktree/context/audit.md: r461 drops the claims about what record removal requires and which scope flags exist, keeps no-audit-recreates-paths and user-runs-the-remedy, cites the repo's own probe record for the cwd constraint (-s local still marked unmeasured), and poi
• plugins/source-control/skills/worktree/fixtures/README.md: r462 drops the CRLF and tsv-escaping descriptions, keeps the normalize-before-comparing rule, and points at jq Format strings and escaping and Invoking jq.
• .changes/evals/work-resolve-issue-issue-12691-41580959773-1-07483b7c.md: new patch changelog fragment for evals.
• .changes/source-control/work-resolve-issue-issue-12691-41580959773-1-0d813c87.md: new patch changelog fragment for source-control.

Verification

The runner ran each check from the base copy against 7ce9b79:

• scripts/check-changelog-fragments.sh --check: passed
• scripts/check-changed-skills.sh --merge-base: passed

The run reports:

• read https: //code.claude.com/docs/en/plugin-evals.md: has the sections How an eval run works, How a case is scored (run score, case score, threshold), Write a case manually, Use a different eval directory (plugin.json experimental.evals, --eval-dir), Mock MCP servers, Command options (--max-cost-us
• read https: //platform.claude.com/docs/en/build-with-claude/extended-thinking: Budget rules and tuning says thinking tokens count toward the max_tokens limit.
• read https: //github.com/x-motemen/ghq: README headings include COMMANDS (with a list entry), CONFIGURATION (ghq.root) and DIRECTORY STRUCTURES.
• read https: //git-scm.com/docs/git-config: has Conditional includes (＃_conditional_includes) and Variables (＃_variables); a second read at offset 380000 found the user.useConfigOnly, user.signingKey and url.<base>.insteadOf entries.
• read https: //docs.github.com/en/graphql/reference/enums: an index page with no MergeStateStatus section.
• read https: //docs.github.com/en/graphql/reference/pulls: has a 'MergeStateStatus - enum' heading listing BEHIND, BLOCKED, CLEAN, DIRTY, DRAFT, HAS_HOOKS, UNKNOWN, UNSTABLE.
• read https: //code.claude.com/docs/en/sub-agents.md: has a Resume subagents section (each invocation is a new instance; SendMessage resumes one).
• read https: //code.claude.com/docs/en/tools-reference.md: has a 'What persists between commands' section under Bash tool behavior (cd carry-over rules, subagents never carry it over).
• read https: //code.claude.com/docs/en/claude-code-on-the-web.md: has Auto-fix pull requests (/autofix-pr run on the PR's branch spawns a cloud session; auto-fix cannot react to base-branch conflicts) and Limitations (cloud sessions share rate limits).
• read https: //code.claude.com/docs/en/statusline.md: has Available data; rate_limits appears only for Pro/Max/Ultra subscribers or behind a spend-limit gateway, and only after the first API response.
• read https: //code.claude.com/docs/en/plugins/cli-reference.md: has a plugin uninstall section with -s/--scope (user, project, local) and --keep-data, and no path option.
• read https: //jqlang.org/manual/: has Format strings and escaping (tsv escapes backslashes) and a --binary option about CRLF on Windows.
• read https: //git-scm.com/docs/githooks: pre-commit (＃_pre_commit) is invoked by git commit and commit-msg (＃_commit_msg) by git commit and git merge; both can be bypassed with --no-verify.
• check-changelog-fragments: all 7 fragments valid (run before and after the review fixes).
• check-changed-skills: 5 skills checked, 0 failed; the warnings were already on the base (run before and after the review fixes).
• check-affected: 11 passed, 7 skipped, over 12 changed files (run before and after the review fixes).
• check-stamps.sh --trigger-less (hand check, script not runnable here): read its trigger regex (check-stamps.sh lines 451-462) and confirmed each of the 10 touched files has a 'recheck when …' clause or a 'Recheck trigger' label.
• fresh-context review subagent over the full diff: 15 findings. Applied 10: the max_tokens condition, the mock rule realigned with SKILL.md, the useConfigOnly reason in the template, the plumbing-is-not-a-bypass policy line, the jq normalize wording, '-s local is unmeasured' restored, the ci.md 'this
• grep of plugins/source-control and plugins/evals tests and scripts for the removed phrases and file names: no test asserts the changed text.
• The lane run: https://github.com/melodic-software/claude-code-plugins/actions/runs/41580959773

Left out: the items under Not verified.

Related

#12691

[github-actions]

claude-review reviewed 7ce9b7942b8b7e16d98e7248c683636ac1e93789: read 12 of 12 changed file(s); 0 finding(s), 0 as inline comments.

Code review: no findings

I read all 12 changed files in full. The change touches only documentation and changelog fragments: the 28 restated upstream passages listed in #12691 now hold this repository's own rule plus a pointer, an as-of date and a recheck trigger.

What I checked

• Closing issue docs: replace restated upstream facts with pointers in evals, source-control #12691, rows r160–r462. Every row's restated value is gone. Each row keeps its local decision and points at the section the issue names. For r451/r452 the issue had no pointer, so the PR uses the GraphQL pulls reference (#enum-mergestatestatus). For r454 it uses the githooks pre-commit and commit-msg entries.
• Rewritten text still matches the code it describes. In ci.md, the three "unscored, never zero" rules match the parser shown just above them (lines 63–80): the NO DELTA halt, and the NOT COMPARABLE halt on skippedPaidGraders or a non-null error.
• New internal references resolve:
  • The MCP row of plugin-eval/SKILL.md exists (line 161).
  • fixtures/README.md has the project-scope-reap-probe.sh section (line 187).
  • The worktree-root-convention.md template above the hazard keeps user.email out of the global file (line 102).
• Changelog fragments. Both touched plugins have one at bump: patch, which fits a docs-only change.
• .claude/rules/skill-bodies-state-current-rules.md applies to the plugins/*/skills/** files. Each new pointer record has a pointer, an as-of date and an observable recheck trigger.

Not verified by this lane

• Done-when: "The PR passes check-stamps.sh --trigger-less". The author only checked this by hand. I could not run the script either, so this item stays unconfirmed until CI or a person runs it.

• Upstream anchors. The author says they could not see these anchors in the fetched pages, and I have no network access to check them:

  • docs.github.com/.../pulls#enum-mergestatestatus
  • ghq#commands
  • jqlang.org/manual/#invoking-jq and #format-strings-and-escaping
  • several code.claude.com anchors

  A link check (lychee) or a person should confirm them.

• Author's verification. The PR says check-changelog-fragments and check-changed-skills passed. I did not rerun them.

Advisory, not counted (unchanged line): plugins/evals/skills/plugin-eval/reference/reading-results.md still says "under --ablation none no grader is excluded" (L338-L339). That is the same claim this PR removed from ci.md for r175. The issue does not list it, so it is out of scope here, but a later sweep could replace it with a pointer.

The PR context contains no embedded instructions aimed at the review lane. This is the first review round; the round cap is 3.

[github-actions]

claude-security-review reviewed 7ce9b7942b8b7e16d98e7248c683636ac1e93789: read 12 of 12 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #12720 (head 7ce9b79)

I found no security issues. I read every hunk of all 12 changed files. The change is markdown only: ten skill and reference docs under plugins/evals and plugins/source-control, plus two new changelog fragments. It changes no workflow, script, manifest, trusted-actor list or other trust control, and none of the changed files matches a listed trusted-path glob.

The diff edits skill and reference bodies, so I read every removed or reworded rule under the instruction-surface lens. I judged each one by what breaks if the rule is gone:

• case-authoring.md: the text no longer warns that context.scaffold_script and real MCP servers run "as you, outside the sandbox". The skill still enforces that warning where it matters:
  • plugins/evals/skills/plugin-eval/SKILL.md L161 (the MCP row this checklist now points to) and L242-243 ("read each such script first, since it runs as you outside the sandbox") still carry it.
  • L469 of the same file lists hooks, --scaffold scripts and real MCP servers as running outside the sandbox.
  • run-validity.py's check_scaffold still checks scaffold use.
  • This is not a finding.
• orchestration.md:
  • The Conflict-Worker Contract still forbids --no-verify and still uses the plumbing commit-tree sequence.
  • The Concurrency Guard still forbids starting a second worker in the same worktree.
  • The Worker Contract and the worker prompt template still require git -C <absolute path> and push-branch.sh on every call.
  • The reworded mergeStateStatus passages describe the same suppressible and directional routing; the code they describe is unchanged.
• watch-handoff.md: it still says the model never runs /autofix-pr and still requires the usage-snapshot check before any route. Step 1 still names the checkout to run it from.
• audit.md: each path still needs the user's individual confirmation, the user still runs the remedy, and no audit recreates a path.
• worktree-root-convention.md: it still says to use gitdir/i: for the identity layer and that identity includes must set more than user.email. The rewrite only swaps the restated client and key details for upstream pointers.
• README.md, eval-design.md, ci.md, reading-results.md, fixtures/README.md: these rewrites swap descriptions of upstream behaviour for pointers. No rule that guarded an action was removed.

I could not consult the protected-class list: docs/contracts/instruction-exception-register/README.md was not read in this run. I judged the removed text by its consequences instead, as above.

The PR description, including its "Not verified" items, contains no text aimed at this lane. I found no embedded instructions to report.

critical-findings: 0

[melodic-automation-lanes]

Unattended merge: native auto-merge leaves this pull request unarmed at head 7ce9b7942b8b7e16d98e7248c683636ac1e93789. The lanes clear this reason on their own; the next scheduled run judges it again.

pr-merge's gate refuses its verifier verdict (verify:missing)

[melodic-automation-lanes]

The unattended merge path armed native auto-merge at head 7ce9b7942b8b7e16d98e7248c683636ac1e93789.

[github-actions]

Post-merge mutation testing

• Range: 8a40f13..dfb24e7
• Merged pull request: #12720
• Outcome: reported

Killed 6, survived 1, timeout 0, no coverage 0, invalid 0, not run 0.
Covered-code score 86%; mutation score 86%.

File	Killed	Survived	Timeout	No coverage	Invalid	Not run
plugins/planning/surfaces/registry.mjs	4	1	0	0	0	0
plugins/wizard/skills/generate/template.sh	2	0	0	0	0	0

Surviving mutants

Location	Operator	Disposition	Cause
plugins/planning/surfaces/registry.mjs:56	ROR	productive	input-gap

The run's summary has the full report.