[kyle-sexton]

Refs: #11823

Summary

Ships one of the three #12106 behavior changes routed to #11823's eval-gated path: audit-instructions no longer treats a delegation throttle on an opus-4-8 audit target as inert. The other two are recorded on #11823 and left out: the per-message effort carve-out already points at the live anchor, and the bytes-per-token re-pin could not be measured (follow-up #12879).

Fix

• reference/criteria.md (instance I8): on opus-4-8 the throttle instance is unattested, with no finding and no endorsement; opus-5 keeps the inert arm. The Source bullet no longer cites Opus 4.8 as counter-basis. Pointers to the Opus 5 and Opus 4.8 prompting guides' #controlling-subagent-spawning sections, as of 2026-11-03, with a recheck trigger.
• New eval case plugins/harness-config/evals/ai-throttle-target-scope/ with three deterministic graders (fable-5 flag, opus-5 endorse, opus-4-8 neither) and samples for each.
• Changelog fragment.

Verification

claude plugin eval on the subscription login, Opus, --ablation none, 3 runs per arm, all VALID per run-validity.py:

Arm	Score
Before (origin/main skill)	0.67 ×3 (repeated in a second round: 0.67 ×3)
After	1.00 ×3
Negative control (worked instance deleted)	0.33 ×3

The control sits 0.34 below before, past the 0.15 bar in rewrite-a-plugin.md. The noise report could not call a case drop with one case, so the decision rests on per-run scores. No kept trace read a path under evals/. validate-cases.py: no FAIL; check-changed-skills.sh --merge-base and check-changelog-fragments.sh --check pass; gitleaks clean. Cost 6.93 USD list across 33 runs.

Related

• docs(skills): ship the five eval-gated #6916 drift fixes after a no-loss measurement #11823, docs(playbooks): fix the 53 drift findings from the held-files sweep #12106, fix(harness-config): re-pin audit-instructions' bytes-per-token estimate with a measurable control #12879

🤖 Generated with Claude Code

https://claude.ai/code/session_015te8Cqhc6ANUKyPoYQrPgN

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T19:53:43.668573Z	43b3d61	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 43b3d6135b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-review reviewed 04a2001a0b26ffe63a6fd89dd7b1a4a783fbb5c1: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Code review (incremental since 43b3d61): no findings

I read the whole change in the one file this push touched: plugins/harness-config/skills/audit-instructions/reference/criteria.md.

What changed. The opus-4-8 arm of the I8 delegation-throttle example no longer gives the Opus 4.8 guide's spawning advice as the reason. It now reads "the instance does not fire, and we do not endorse the throttle either". That decision is unchanged. The link to the Opus 4.8 guide's "Controlling subagent spawning" section, with its as-of date and recheck trigger, is still in the Source bullet (criteria.md#L485-L488). This applies the fix the owner accepted on the settled thread at this line. That thread is marked lines changed since resolution: no, and I am not raising it again. The paragraph still reads correctly after the edit (criteria.md#L466-L474).

Eval case. Searching for the removed clause, I found it only in the eval case's prompt.md (prompt.md#L2). That file is still "the Opus 4.8 guide's same-named section steers toward more spawning, not a cap" and still names criteria.md as its source. It is outside this push and the rule behind the settled thread covers skills/**, not evals/, so I am not counting it as a finding. The graders do not match this clause (the owner said so on the thread, and the earlier round's grader check agrees), so it does not change the eval's outcome.

Verification. I verified nothing by running it. I checked the edit by reading it.

Prompt-injection check. The PR context, settled-threads and prior-findings files contain no text that tries to instruct this review. Prior findings: none in this file, 0 of 3 rounds used.

[github-actions]

claude-security-review reviewed 04a2001a0b26ffe63a6fd89dd7b1a4a783fbb5c1: read 1 of 1 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #12926 (incremental since 43b3d61)

I found no security issues.

What I reviewed: I read all of the incremental change (1 of 1 listed file) in .claude-lane/incremental.diff. It is a single hunk in plugins/harness-config/skills/audit-instructions/reference/criteria.md (instance I8). The hunk deletes the clause "because the Opus 4.8 guide's section of that name steers toward more spawning, not a cap" from the opus-4-8 arm. That clause was only the stated rationale, so what the arm decides is unchanged: on an opus-4-8 target the instance still does not fire, and the audit still does not endorse the throttle.

Instruction-surface lens: the deleted text explains a rule; it is not the rule. The audit catalog still forbids and recommends exactly what it did before. No guard, permission, hook, gate, token or credential handling is touched. I did not consult the protected-class list in the instruction exception register; I judged this by consequence. Nothing breaks when the clause is gone.

Trust controls / manifests: the changed file matches no trusted-path glob and touches no trust control, merge hold, kill switch, token scope or plugin manifest. No manifest lines apply.

Embedded text: none in the PR context.

Prior findings: the prior round had no findings, so nothing is restated.

critical-findings: 0