[kyle-sexton]

Closes #12879

Summary

audit-instructions converted its token budget to bytes at 3.5 bytes per token, the figure for models before Claude 4.7. Models from 4.7 on produce about 30% more tokens for the same text, so a lane held more text than its budget. This re-pins the figure to 2.7 (3.5 / 1.3) and shows, with a sound negative control, that the change loses nothing.

Fix

• skills/audit-instructions/SKILL.md: the lane-sizing prose and the lane-runs.sh partition command use --bytes-per-token 2.7, with the glossary pointer, as-of 2026-11-03 and the existing recheck trigger.
• skills/audit-instructions/evals/evals.json: case 23's expected output names 2.7.
• A patch changelog fragment. CHANGELOG.md history is left as written.

Verification

Case ai-lane-budget-window (three regex graders: fraction 0.25, budget 50000, bytes per token between 2 and 3), run with claude plugin eval <copy> --ablation none --case ai-lane-budget-window --runs 3 -j 2 --model opus on the subscription login, HOME isolated, Claude Code 2.1.317. Each copy (before = origin/main, after = this branch, control = before with the budget paragraph and partition block deleted) had CHANGELOG.md and every eval file except this case removed; a grep of each copy for 3.5, 2.7 and per.token finds the figure only in the part under test.

Arm	Scores	run-validity
before (two passes)	0.67 x 6	VALID, VALID
after	1.00 x 3	VALID
control	0.00 x 3	VALID (--own-copy-search-warns)

No loss (1.00 against 0.67), and the control sits clearly below before. The control's own-copy Grep and Glob were denied, but its copy holds no lane-sizing value, so an allowed search would have found nothing.

• scripts/check-affected.sh --tests on the committed head: 14 passed, 2 skipped (no changed shell or Python).

Left out: the eval case itself, kept out of the PR as one-off measurement tooling.

Related

• docs(skills): ship the five eval-gated #6916 drift fixes after a no-loss measurement #11823: measured this change but could not ship it, because its control copy still carried 3.5 in CHANGELOG.md.
• docs(playbooks): fix the 53 drift findings from the held-files sweep #12106: routed the change to the eval-gated path.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MWmASLb8hq2u1wgYpFAbZt

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T18:55:27.073896Z	5966373	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review: 1 inline finding(s) on 5966373d5a16d77e92654810f2af9339d87cc9d3; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review reviewed b438c4c3101a5cabe5526c9665fb2179e12b7dbe: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Code review: PR #12906, incremental check since 5966373

What I reviewed. One file changed since the last review: plugins/harness-config/skills/audit-instructions/evals/evals.json. I read all of its change, which is one hunk. I also re-read the PR context, the settled threads and this lane's earlier findings.

The change. Case 23 gets a new expectation, "Passes --bytes-per-token 2.7 to lane-runs.sh partition", at evals.json:283. It matches the command the skill tells the agent to run at SKILL.md:275 (--bytes-per-token 2.7). It also matches the case's own expected_output at line 279. The JSON is still valid: the new string sits inside the existing array, and commas separate it from the strings around it.

Prior finding. The last round's advisory said that nothing in the repo checked the re-pinned figure. This commit fixes that, and the owner resolved the thread. Putting 3.5 back in SKILL.md would now fail this expectation of case 23. I raise nothing again. The owner decided to keep the ai-lane-budget-window measurement case out of the PR as one-off tooling, and that thread is settled.

Closing issue #12879.

• "The bytes-per-token figure matches its upstream source, with pointer, as-of date and recheck trigger." This is met, as found last round. An eval expectation now covers the figure.
• "A before/after/control measurement with no copy holding the old value shows no loss, recorded here." The PR description gives these results: before 0.67, after 1.00, control 0.00. They are the author's claim; I did not run them.

Embedded text. Nothing in the PR context or the thread text tells the lane what to do.

Spend. None: this changes no runs, models or schedules.

Round cap. One earlier round had findings (cap 3), so the cap does not apply.

No new findings.

[github-actions]

claude-security-review reviewed b438c4c3101a5cabe5526c9665fb2179e12b7dbe: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #12906 (incremental, 5966373 → b438c4c)

I read the whole incremental change, which is one hunk in one file. It has no security issues.

What changed. plugins/harness-config/skills/audit-instructions/evals/evals.json adds one expectation string to eval case 23: "Passes --bytes-per-token 2.7 to lane-runs.sh partition". It is grader text for the eval. Nothing runs it, and it adds no command, input source, token or credential handling.

What I checked.

• Trust controls and manifests. The file is not on the trusted paths. It touches none of the trusted-trigger check, the lane token or broker, the kill switch, a merge hold, an action under .github/actions/, or a plugin manifest. No manifest <field> lines apply.
• Instruction-surface lens. No standing instruction is deleted, narrowed or softened. The change only adds an expectation.
• PR context. It holds no embedded directives aimed at this lane.
• Prior findings. This lane's only earlier post is the round-1 summary, which had 0 findings, so nothing carries forward.

Spend (not a hold): none in this push. The earlier change to 2.7 bytes per token, reviewed at 5966373, splits audits into more lanes, which spends subscription or prepaid model usage but creates no billable charge.

critical-findings: 0