feat(claude-config): detect cross-surface instruction conflicts

[kyle-sexton]

No linked issue

Summary

The official memory docs mandate this review and name no mechanism that performs it:

Consistency: if two rules contradict each other, Claude may pick one arbitrarily. Review your
CLAUDE.md files, nested CLAUDE.md files in subdirectories, and .claude/rules/ periodically to
remove outdated or conflicting instructions.
— https://code.claude.com/docs/en/memory (fetched 2026-07-25)

This adds Phase B2 to claude-config's audit-instructions: a pairwise pass over two surfaces
that both claim authority over one behavior and disagree. Phase B fans out one lane per surface, so a
lane sees only one half of a pair. Phase A's and Phase B's contracts are unchanged; B2 consumes Phase
A's inventory and re-enumerates nothing.

A prior boundary document recorded a false negative — corrected here

An earlier boundary analysis concluded this repo had no incumbent conflict detector, and a
repo-wide search claim supported that. That conclusion was wrong, and this PR does not rely on it.
claude-memory's audit skill already ships a contradiction check. The corrected position was
re-verified first-hand against the tree before building:

• plugins/claude-memory/skills/audit/reference/criteria.md — check C6 Consistency, "Do any
  instructions contradict each other across CLAUDE.md, CLAUDE.local.md, and rules files?", grading a
  contradiction FAIL and redundancy WARN.
• plugins/claude-memory/skills/audit/context/audit.md — "Step 3: Cross-file consistency check
  (C6)", whose first instruction is "Compare CLAUDE.md sections against .claude/rules/ for
  contradictions". A live pairwise step, not a stray reference.
• plugins/claude-memory/skills/audit/SKILL.md — the determinism contract places C6 in the judgment
  tier.

Why three searches missed it: no skill advertises conflict detection. claude-memory:audit's
description sells "memory health" and never mentions contradiction, so C6 is reachable only by reading
the skill's reference file. That is itself a description-versus-body divergence — the exact finding
class this pass detects — and it ships as worked example 2 in the criteria.

Boundary against C6 — extend, never re-implement

Pair	Owner
Both halves in project CLAUDE.md / CLAUDE.local.md / .claude/rules/** / auto-memory	C6
At least one half outside that set	Phase B2

~/.claude/rules/ is ruled outside C6's population, settled from the files rather than assumed:
the audit's discovery step enumerates rules project-relative (find .claude/rules), and the plugin
resolves a user-level directory only for auto-memory under ~/.claude/projects/<slug>/, never for
rules. A user-global rule contradicting a project rule is therefore B2's.

Why a phase here, and not a sibling skill

Two reasons, neither of which is a duplicated-inventory argument — Phase A enumerates surface paths,
not contents, so a sibling would duplicate a cheap path walk, and that argument does not carry the
decision:

1. Listing budget. A sibling skill adds a whole name-plus-description entry to the model-invocable
   skill listing. That listing is already measured at ~83,270 characters against a 40,000-character
   budget at 1M context (8,000 at 200k), with 95 of 130 model-invocable skills already dropped to
   name-only. A new phase inside an existing skill adds zero listing entries; widening that
   skill's description costs a few words. Adding an entry to a listing already 2–10× over budget, in
   the effort convened to reduce instruction surface, would be self-defeating.
2. Semantic fit. audit-instructions already enumerates every surface a conflict can span — user
   and project CLAUDE.md, .claude/rules, skill bodies, agent definitions, prompt-type hooks,
   output styles. "These two instruction surfaces contradict each other" is an instruction-audit
   finding by construction.

claude-memory was considered and rejected as the home: its own scope table routes settings, hooks,
MCP, agents, and skills out to claude-config. Widening it into surfaces it explicitly hands off
would adopt a boundary the owning plugin already declined.

Precedence is cited, never invented

Where the docs state an order, the pass names the winner and its source. Where they are silent — user
vs project CLAUDE.md, skill body vs any CLAUDE.md, managed policy vs lower scopes — it reports the
pair unresolved. "Loads before" is load ordering, not override semantics; the same page says all
discovered files are "concatenated into context rather than overriding each other."

False positives are the failure mode

A report-only auditor that cries wolf is worse than none, so the criteria carry a 13-case
must-not-flag set, seven of them pinned executable. The sharpest live case is a mandate and a
prohibition on the same tool in one file, where the prohibition's own exception clause satisfies
the mandate — gates 3 and 4 both fail, and the pre-scan drops it.

Why no CI lane ships here

conflict-scan.sh derives entities by CamelCase shape rather than a hardcoded tool list. That is
recall over precision, not strictly better: proper nouns (GitHub, PowerShell, EventStorming)
match the same shape and account for 121 of the 169 rows a repo-wide run returns. 28% precision is
a good review queue and a bad gate — gates 2 and 5 carry the discrimination and both need a model.

This plugin is report-only regardless, so nothing landing here can block a merge. One conflict class
is gate-grade and is routed rather than built: the Type D split-brain check (an AGENTS.md that
is neither a symlink to CLAUDE.md nor @-imported by it is never loaded, per the memory page). This
repo currently fails it — AGENTS.md is a 1,261-byte regular file and CLAUDE.md carries zero @
imports — so shipping the gate here would red-wall main and its remediation is a separate operator
call. Recorded for #445's scripts/check-*.sh + .test.sh + ci.yml lane shape.

The inherited draft of the script spawned 3–4 subprocesses per entity mention and did not finish in
10 minutes over this repo's skill bodies. Classification and pairing now run in one awk pass
bucketed by entity: 2.4 seconds on the same corpus, same output contract.

Test plan

• scripts/conflict-scan.test.sh — 24/24 pass, including every pre-scan-decidable must-not-flag case.
• skill-quality:check audit-instructions — PASS, 0 errors, 0 warnings. The one line-count warning
  was fixed by trimming duplicated prose, not waived.
• shellcheck — clean on both scripts.
• markdownlint-cli2 — 0 errors across the changed markdown.
• Full CI green, including hygiene, plugin-gate, and ci-status. Two failures were fixed at the
  root: the new scripts needed the exec bit (100644 → 100755, matching their siblings), and the
  generated README catalog block needed regenerating after the plugin.json description change.
• All official-docs quotes re-fetched and confirmed verbatim this session.
• Nothing suppressed anywhere.

Related

• Report-only skill: no finding here blocks a merge.
• CI-gate backlog: automatable conformance checks surfaced by the #313 fleet audit #445 — the documented lane shape the Type D split-brain check should follow.
• check-skill.sh and docs/PLUGIN-PHILOSOPHY.md deliberately untouched (PR feat(skill-quality): fresh-eyes delegation doctrine + conformance gate (check 21) #1096 owns them).

[claude]

Claude finished @kyle-sexton's task in 5m 30s —— View job

---

Code Review

• Read CLAUDE.md / AGENTS.md guidelines
• Read changed files
• Review conflict-scan.sh
• Review conflict-scan.test.sh
• Review conflict-criteria.md
• Review SKILL.md
• Review plugin.json and CHANGELOG.md
• Synthesize findings

---

Overall

Solid addition. The single-awk-pass bucketing design is the right call for the scale problem described, the windowing approach correctly prevents the "distant prohibition" false positive class, the 24-case test suite pins every suppression rule with a concrete fixture, and the C6 boundary documentation is clear and accurate. The notes below are one portability gap, one asymmetry worth closing, and a few minor observations.

---

conflict-scan.sh

mapfile requires bash 4+ — the sharpest portability issue in the PR.

Line 115:

mapfile -t rows < <(

mapfile is a bash 4.0 builtin. macOS ships bash 3.2 as the default, and #!/usr/bin/env bash resolves to it. On 3.2, the user gets mapfile: command not found — the kind of opaque failure that wastes time. The Gotchas section in SKILL.md names Git Bash for Windows but says nothing about macOS. Either add a version gate to the script:

if (( BASH_VERSINFO[0] < 4 )); then
  echo "ERROR: bash 4+ required" >&2
  exit 2
fi

…or add a macOS note to the Gotchas section (alongside the Git Bash line) so operators know to brew install bash and invoke with the absolute path. Fix this →

awk check asymmetry.

Lines 73–76 guard on grep and exit 2. awk is equally required and equally not guaranteed (e.g. minimal container images), but there is no corresponding guard. The test suite already skips on missing awk (lines 48–51), so the harness covers it — but the script itself would fail with a less clear error. The instruction-scan.sh sibling may set a precedent here; a consistent guard would close the gap.

MANDATE_ERE includes ask and use — high recall, known tradeoff.

Line 98:

MANDATE_ERE='[^a-z](must|always|mandator(y|ily)|require[ds]?|shall|use|present|ask)[^a-z]'

use and ask are high-frequency words in instruction prose and will contribute to the proper-noun noise the PR already quantifies (121/169 rows). The CHANGELOG and criteria doc both acknowledge the recall-over-precision tradeoff, so this is noted rather than flagged — but the lane's first refinement step (entity triage) will need to be the primary noise filter.

Window arithmetic is correct. The prewindow/window split in classify (lines 152–156), the pad-offset accounting (ws + 1 because pad = " " tolower(line) " " shifts positions by one), and the end-of-string truncation behavior of awk's substr all check out.

lineno reset is safe. lineno = 0 is set after close(file) in the main awk rule (line 160). If getline returns -1 (unreadable file that passed the -f check in bash), the while loop exits early and lineno resets correctly for the next file. No bug.

---

conflict-scan.test.sh

Test count matches PR claim. Tallied 24 assertions across all 16 cases, consistent with the "24/24 pass" claim.

Must-not-flag coverage is the right priority. Cases 3–9 each pin a distinct suppression class with a concrete fixture. This is the correct test strategy for an advisory pre-scan — false positives are more damaging than false negatives.

Case 5 (trailing) checks absence but not completeness. Lines 101–102 assert that the output does not contain |AskUserQuestion|. Since the fixture file has only one entity, any unexpected match would be on that entity, so the assertion is effectively complete — but a companion assert_eq "..." 0 "$(bash "$SCRIPT" --count ...)" would make the intent explicit and catch an unexpected match on a differently-named entity if the fixture ever gains more content.

Case 16 (missing grep) is well-constructed. Using "$real_bash" with a stripped PATH cleanly isolates the test without interfering with the test harness itself.

---

conflict-criteria.md

C6 cross-reference resolves correctly. The relative path ../../../../claude-memory/skills/audit/reference/criteria.md navigates from plugins/claude-config/skills/audit-instructions/reference/ to plugins/claude-memory/skills/audit/reference/criteria.md, which exists. ✓

Precedence table is accurate and conservatively scoped. The "unresolved" entries for user CLAUDE.md vs project CLAUDE.md and skill body vs any CLAUDE.md are correct — the docs state concatenation, not override, and "loads before" is load ordering, not priority. Citing the lack of a winner rather than inferring one is the right posture.

Case 8 / deference clause is the right escape hatch. The handling (treat as resolved, use as remediation template for Type C) is consistent with the arbitration logic elsewhere.

---

SKILL.md

Phase B2 contract is clean. The placement (between Phase B and Phase C), the "consumes Phase A's inventory" note, the advisory pre-scan invocation pattern, and the "detect; do not adjudicate" instruction all fit the existing skill structure without breaking Phase A/B/C contracts.

conflicts scope is a useful composition primitive. Allows a scheduled hygiene routine to skip the full per-surface fan-out and pay only for Phase A + B2. The argument table in the Arguments section is updated correctly.

Windows Gotcha is the only mention of shell requirements. The macOS/bash 4+ gap noted above applies here as well.

---

plugin.json / CHANGELOG.md

• Version bump 0.9.2 → 0.10.0 is appropriate for a new phase and new scope argument.
• Description update correctly names "detects cross-surface instruction conflicts".
• CHANGELOG entry covers all shipped artifacts (B2, criteria doc, script, scope argument) and the claude-memory C6 boundary. The CI/precision rationale paragraph is a useful record for future maintainers.

---

Summary

One actionable gap (bash 4+ not enforced or documented for macOS), one asymmetry worth closing (missing awk guard to match the grep guard), and two observations (mandate token recall, trailing-prohibition test completeness). The core design — windowed polarity, single awk pass bucketed by entity, must-not-flag pinning — is sound, and the advisory contract is correctly honored throughout.

[claude]

Claude finished @kyle-sexton's task in 2m 53s —— View job

---

Security Review — PR #1343

• Load tools
• Fetch PR diff
• Read changed files
• Analyze for security vulnerabilities
• Post findings

---

Scope: conflict-scan.sh, conflict-scan.test.sh, SKILL.md, conflict-criteria.md, plugin.json, CHANGELOG.md

No CRITICAL or IMPORTANT findings. Two low-severity observations below.

---

SUGGESTION — Confidence: medium

Unvalidated env variable CONFLICT_SCAN_WINDOW silently collapses to a zero-width window

conflict-scan.sh L111

CONFLICT_SCAN_WINDOW is read without validation and forwarded to awk via -v w="$WINDOW_CHARS". AWK's -v interprets escape sequences in the value, and non-integer values (e.g. \n, abc, -1, an empty string set by accident in CI) cause awk's substr(pad, ws+1, ...) calls to treat w as 0. A zero-width window means no polarity tokens can appear near any entity match, and the scan returns zero candidate rows — complete false-negative suppression — with no error or warning emitted. The script is advisory and always exits 0, so there is no gate to trip; the failure mode is silent uselessness rather than code execution. But a CI environment or a .envrc that exports CONFLICT_SCAN_WINDOW with a non-numeric value would silently defeat the pre-scan.

Suggested guard (before the mapfile call):

[[ "$WINDOW_CHARS" =~ ^[1-9][0-9]*$ ]] || WINDOW_CHARS=60

---

SUGGESTION — Confidence: low

Filenames containing | produce structurally malformed output rows

conflict-scan.sh L176

The awk END block concatenates file paths directly into the output row:

print a[1] ":" a[2] "|" b[1] ":" b[2] "|" ent "|" flags

A path containing a literal | (valid on Linux/macOS) embeds an extra pipe, making the row's field count variable. The immediate consumer is a Claude model that can handle irregular structure, but any downstream tooling that parses the four-field format by splitting on | would misparse the row. No code execution is possible. Real-world risk is low since | in config file paths is unusual, but it would be worth noting the assumption in a comment or guarding it with a gsub(/\|/, "%7C", a[1]) normalization step.

---

Everything else checked and clean:

• No eval, no dynamic command construction from file content
• All $@ paths gate through [[ -f "$file" ]] before reaching awk's getline; no path traversal to unintended files
• ERE patterns are compile-time string literals; none are derived from scanned file content
• File content is read as data only — CamelCase entity extraction via awk pattern matching cannot produce awk code execution
• Scripts are advisory-only, always exit 0, never write or modify any file
• SKILL.md is explicitly report-only with no --fix path and no auto-apply mechanism
• ${CLAUDE_PLUGIN_DATA} is used (not a hardcoded ~/.claude/...) for report persistence
• mapfile reads from a process substitution (< <(...)), not from eval
• Test script uses mktemp -d with a proper EXIT trap for cleanup; PATH manipulation in Case 16 is correctly scoped to a subshell with the resolved real_bash path held before the scope change

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2b765c98f7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 3m 38s —— View job

---

Code Review — PR #1343

• Load tools
• Review latest commit diff (680bb57 — exec bit + README)
• Read all changed files
• Verify Codex review findings against source
• Synthesize and post findings

---

Latest commit (680bb57)

Correctly fixes the exec-bit gap and updates the generated catalog description. Both changes are mechanical and accurate — the description update correctly reflects the added conflicts scope and the new conflict-detection capability.

---

Codex finding verification

I read plugins/claude-memory/skills/audit/reference/criteria.md lines 107–116 to ground-truth the Codex comments before reporting on them.

Codex P2 · conflict-criteria.md:46 — Auto-memory routing gap — Confirmed valid.

C6's definition is explicit: "Do any instructions contradict each other across CLAUDE.md, CLAUDE.local.md, and rules files?" Auto-memory (MEMORY.md) is not listed. The routing table in conflict-criteria.md places a MEMORY.md-vs-CLAUDE.md pair in the C6 bucket, but C6 will not check it. Phase A also excludes auto-memory from the editable set. The result is that auto-memory contradictions with project CLAUDE.md or rules fall through both auditors.

Fix: remove auto-memory from the left-hand cell of the routing table. A pair where one half is MEMORY.md against a CLAUDE.md or rule is cross-layer by the same logic as ~/.claude/rules/ vs project rules — B2's territory.

Fix this →

Codex P2 · conflict-criteria.md:104 — Type D / Gate 1 contradiction — Confirmed valid.

Gate 1 requires "the two surfaces can be resident simultaneously." Type D states "only one is loaded." A pair that fails Gate 1 is explicitly removed from the finding set ("any gate failing removes it"). Type D therefore can never be a conflict finding under the criteria's own rules, yet it is listed alongside Types A–C in the conflict taxonomy. This creates contradictory instructions for the lane: either it false-flags non-co-resident pairs, or Type D is structurally unreachable.

Codex's suggestion is correct: Type D describes orphaned instruction drift — a real problem, but not a conflict in the sense the five gates define. It should either be reclassified under its own heading (outside the five-gate taxonomy) or removed entirely, with a pointer to the remediation route.

Fix this →

Codex P2 · conflict-scan.sh:128 — Postposed prohibitions misclassified as mandates — Valid limitation, intentional design.

The code checks prewindow ~ prohibit (text before the entity) and, only on failure, window ~ mandate (text around it). A prohibition that follows the entity — "WebFetch must not be used for documentation" — puts must not in the post-entity part of the window, so prewindow ~ prohibit fails and window ~ mandate picks up must (a mandate token), classifying the line as a MANDATE. Two MANDATE records for the same entity across two files yields no pair; the contradiction is silently missed.

The design comment ("a prohibition trailing the entity almost always governs a different object") is accurate for the specific prose pattern the test fixtures target, but does not cover the direct form Entity must not. A narrow post-window prohibition check — e.g. checking the immediately-post-entity text (not the full trailing window) against the prohibition ERE, so the wider trailing window still avoids the "via X… Do not gate" false positive — would close this class. That said, the scan is explicitly advisory and optimized for precision over recall; this is a known tradeoff, not an oversight. Worth noting for the lane's first refinement step.

---

Prior review items still open

The previous Claude review identified four items. The exec-bit commit does not address them; they remain outstanding:

1. mapfile requires bash 4+ (conflict-scan.sh:115) — macOS ships bash 3.2 as the default. A version gate or a Gotchas note is needed. Fix this →

2. Missing awk guard — awk is equally required as grep but has no command -v check. The test suite skips on missing awk (lines 48–51) but the script itself would produce an opaque failure. Fix this →

3. CONFLICT_SCAN_WINDOW unvalidated — a non-numeric value silently produces a zero-width window, causing the scan to return zero candidates with no error. One guard: [[ "$WINDOW_CHARS" =~ ^[1-9][0-9]*$ ]] || WINDOW_CHARS=60

4. Filenames with | produce malformed rows — low real-world risk, worth a comment if not a guard.

---

Summary

The exec-bit commit is clean. Two of the three Codex findings are confirmed valid issues in conflict-criteria.md — the auto-memory routing gap (MEMORY.md conflicts are routed to C6 which doesn't check them) and the Type D / Gate 1 contradiction (Type D is unreachable under the five-gate taxonomy). The postposed-prohibition case is a genuine false-negative class but aligns with the documented precision-over-recall tradeoff. The four prior review items remain open. None of these block the advisory function of the skill, but items 1 (auto-memory gap) and 2 (Type D contradiction) are documentation correctness issues worth fixing before merge.

[claude]

Claude finished @kyle-sexton's task in 3m 13s —— View job

---

Security Review — PR #1343

• Load tools
• Fetch PR diff
• Read changed files
• Analyze for security vulnerabilities
• Post findings

---

Scope: conflict-scan.sh, conflict-scan.test.sh, SKILL.md, conflict-criteria.md, plugin.json, CHANGELOG.md, README.md

Head SHA: 680bb57b760805cc0e6e95c8391a697c806655d9

No CRITICAL or IMPORTANT findings. Two low-severity observations below; both were already flagged by the prior automated review in the comments, so this review confirms them and adds analysis of any additional surfaces.

---

SUGGESTION — Confidence: medium

CONFLICT_SCAN_WINDOW with a non-numeric value silently produces zero candidates

conflict-scan.sh L111

CONFLICT_SCAN_WINDOW is forwarded to awk via -v w="$WINDOW_CHARS" without validation. AWK's -v applies escape-sequence expansion, and a non-numeric value (empty string, abc, -1, or an accidental CI export like \n) causes all substr() width arguments to evaluate to 0, shrinking the polarity window to nothing. The scan then exits 0 emitting "No conflict candidates found." — complete false-negative suppression with no diagnostic. Because this is an advisory tool that always exits 0, no gate trips and the silent failure goes unnoticed.

Suggested guard before the mapfile call:

[[ "$WINDOW_CHARS" =~ ^[1-9][0-9]*$ ]] || WINDOW_CHARS=60

---

SUGGESTION — Confidence: low

File paths containing | produce structurally malformed output rows

conflict-scan.sh L176

The awk END block concatenates raw file paths into the four-field |-delimited output:

print a[1] ":" a[2] "|" b[1] ":" b[2] "|" ent "|" flags

A path containing a literal | (valid on Linux/macOS) embeds an extra field delimiter. The entity field itself is safe — the CamelCase regex [A-Z][a-z]+([A-Z][a-z]*)+ matches only letters, so entity content cannot inject extra delimiters. Flags are hardcoded strings. The only injection point is the filename. The immediate consumer is a Claude model that handles irregular structure, and real-world risk is low since | in config file paths is unusual; however, any downstream tooling that splits on | would misparse such rows.

---

Everything else checked and clean:

• No eval, no system() call, no | getline from file content — file content is processed as pure data only
• ERE patterns are compile-time string literals; none are derived from scanned file content — no regex injection
• $@ paths are gated by [[ -f "$file" ]] before reaching awk's getline; awk then opens files directly, not via shell; no path traversal or command injection
• awk -v entpat/prohibit/mandate/exception/gated all receive hardcoded script literals, not user input
• POSIX awk -v escape-sequence expansion does not apply to the ERE pattern strings (none contain backslash sequences); only WINDOW_CHARS is user-supplied, and it's used as a number, not as a pattern
• mapfile -t rows < <(...) reads awk stdout; the process substitution executes no user-derived code
• printf '%s\n' "${rows[@]}" is safe for any array element contents
• sort -u receives awk's text output through a pipe; no injection surface
• Test script uses mktemp -d (mode 0700) with a proper EXIT trap; no world-readable temp files
• Case 16's PATH=... manipulation is correctly scoped to a subshell with real_bash captured before the scope change
• ${CLAUDE_PLUGIN_DATA} is used for report persistence (not a hardcoded ~/.claude/...)
• SKILL.md marks the pass as report-only with no --fix path and no auto-apply mechanism
• No network calls, no remote egress, no secrets handling in any changed file
• No GitHub Actions workflows changed

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 680bb57b76

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 5m 25s —— View job

---

Code Review — PR #1343 (head f125c59)

• Read CLAUDE.md guidelines
• Review latest commits diff (b8ce5d4 — seven findings, f125c59 — line budget)
• Read all changed files in current state
• Verify prior review findings against current source
• Synthesize and post findings

---

What landed in the two latest commits

b8ce5d4 addressed all seven findings flagged across the prior review rounds. Reading against the current file state, each fix is correctly applied:

• Auto-memory routing gap — conflict-criteria.md:50–56: routing table now correctly routes any pair with a ~/.claude/ side or auto-memory MEMORY.md to I12 rather than C6. The reasoning paragraph is accurate — C6's check text names only CLAUDE.md, CLAUDE.local.md, and rules files.

• Type D / Gate 1 contradiction — conflict-criteria.md:135–140: split-brain correctly reclassified as orphaned instruction drift, outside the five-gate conflict taxonomy. The conflict types are now A–C only.

• Residency table coverage — conflict-criteria.md:85–86: prompt-type hooks and output styles now have rows with explicit UNVERIFIED markers. Pairs involving them report as residency-unknown.

• Postposed prohibition — conflict-scan.sh:139: prewindow ~ prohibit || postwindow ~ prohibit. The sentence-break truncation at lines 172–173 correctly prevents the trailing-clause false positive (Case 18 pins it).

• Single-word backtick entity — conflict-scan.sh:97: ENTITY_ERE now includes `[A-Z][a-z]+`; backticks stripped from entity name so bare and backticked mentions pair together (Case 21).

• Opt-in conditional requirement — conflict-scan.sh:112–113: CONDITIONAL_ERE added; suppression now requires both gated AND conditional to match. Case 22 pins the distinction.

• Description-vs-body example — conflict-criteria.md:272–284: correctly reclassified as a calibration case for a near-miss the gates reject (gate 3 fails — a description that omits a capability prescribes no incompatible action).

Test count grew from 24 to 30; cases 17–22 cover the three scanner fixes plus their must-not-flag companions.

---

Issues still open after f125c59

1. SKILL.md line budget — f125c59 claim does not hold

The commit is titled "keep SKILL.md inside its line budget." The current file is 204 lines. check-skill.sh warns at LINE_SOFT_CAP=200 (line 134 of check-skill.sh, condition at line 427). A skill-quality:check run against the current tree will produce a line-count WARN, not a clean 0-warnings pass. The fix trimmed 2 lines (206 → 204); 4 more need to come out.

Fix this →

2. mapfile requires bash 4+ — still unaddressed

conflict-scan.sh:124:

mapfile -t rows < <(

mapfile is a bash 4.0 builtin. macOS ships bash 3.2 as the default, and #!/usr/bin/env bash resolves to it. On 3.2 the user gets mapfile: command not found — the kind of opaque failure that wastes time to diagnose. The SKILL.md Gotchas section (line 189) only mentions Windows/Git Bash with no macOS note.

Either add a version gate after the grep guard:

if (( BASH_VERSINFO[0] < 4 )); then
  echo "ERROR: bash 4+ required (macOS default is 3.2 — brew install bash)" >&2
  exit 2
fi

…or at minimum add a sentence to the Gotchas: "macOS ships bash 3.2 by default — install bash 5 via Homebrew and invoke with its absolute path."

Fix this →

3. Missing awk guard — still unaddressed

The test file at lines 48–51 correctly skips when awk is absent. The script itself has a command -v grep guard but no matching command -v awk check. awk is equally essential and equally absent on minimal container images. The asymmetry is confusing to anyone reading the guards in parallel.

Fix this →

4. CONFLICT_SCAN_WINDOW not validated — still unaddressed

conflict-scan.sh:120: WINDOW_CHARS="${CONFLICT_SCAN_WINDOW:-60}" — forwarded to awk via -v w="$WINDOW_CHARS" without validation. A non-numeric export (empty string, abc, or accidental CI value) causes all substr() width arguments to evaluate to 0, silently returning zero candidates with no error. The guard is a one-liner:

[[ "$WINDOW_CHARS" =~ ^[1-9][0-9]*$ ]] || WINDOW_CHARS=60

Fix this →

---

Low-severity (noted, not blocking)

Filenames with | — conflict-scan.sh:198: file paths are concatenated directly into |-delimited output. A path containing a literal | (valid on Linux/macOS) embeds an extra delimiter. The immediate consumer is a model that handles irregular structure, and such paths are rare in config file trees, so no change is blocking. A comment noting the assumption would prevent future confusion.

---

Summary

b8ce5d4 correctly resolves all seven flagged findings — the routing, taxonomy, residency coverage, and scanner correctness fixes all check out against the source. The test suite grew to 30 assertions and covers all three scanner fixes with both positive cases and their must-not-flag counterparts. Four prior findings remain unaddressed: the line-budget claim in f125c59 does not hold (204 lines, soft cap 200), and the bash 4+ portability gap, missing awk guard, and unvalidated window env var all carry over from the original review. Items 2–4 are one-to-three-liner fixes; item 1 needs 4 more lines trimmed from SKILL.md.

[claude]

Claude finished @kyle-sexton's task in 3m 11s —— View job

---

Security Review — PR #1343

• Read CLAUDE.md guidelines
• Fetch PR diff
• Read changed files (conflict-scan.sh, conflict-scan.test.sh, conflict-criteria.md, SKILL.md, plugin.json, CHANGELOG.md, README.md)
• Analyze for security vulnerabilities
• Post findings

---

Scope: 7 files changed across the 4 commits on this branch, HEAD f125c59813b63c1297bb4dadfdc2d87b7f44f834

No CRITICAL or IMPORTANT findings.

---

What was checked

Injection surfaces

• conflict-scan.sh passes six regex patterns to awk via -v. All six (entpat, prohibit, mandate, exception, gated, conditional) are compile-time string literals defined with single-quote heredocs — no user-supplied content enters them.
• WINDOW_CHARS (from CONFLICT_SCAN_WINDOW) is the only user-controlled value forwarded to awk. It is received via -v w="$WINDOW_CHARS", properly double-quoted against shell expansion. Within awk, w is used only in substr width arithmetic — it cannot inject awk code regardless of value.
• awk -v does apply C-style escape-sequence expansion to the value, but the only user-supplied -v argument is w, which is used as a number. An escape sequence there collapses to 0, producing the already-documented silent false-negative — not a code-execution surface.
• File content is processed by awk via getline line < file and matched against the hardcoded ERE patterns. It is never passed to system(), | cmd, or any awk code-execution primitive.
• printf '%s\n' "${rows[@]}" receives awk's stdout through an array; %s formatting suppresses interpretation.

Path handling

• Input paths come from $@, gated by [[ -f "$file" ]] && printf '%s\n' "$file" before reaching awk. This correctly accepts symlinks to regular files (by design — SKILL.md's scope includes installed plugin-cache content as read-only participants). The script never writes to any path.
• The only write path referenced is ${CLAUDE_PLUGIN_DATA}/audit-instructions/last-audit.md in SKILL.md — it uses the plugin data variable, not a hardcoded user path.

The b8ce5d4 scanner additions specifically reviewed:

• Backtick-stripped entity extraction: gsub(//, "", ent)` operates on an awk string; the stripped value is used only as an associative-array key. No code execution from entity content.
• postwindow / sentence-boundary truncation: match(post, /[.;!?]/) applies a hardcoded literal pattern to file content treated as data. Safe.
• CONDITIONAL_ERE added for opt-in suppression: hardcoded single-quoted literal, same analysis as the other ERE constants.

Test script (Case 16 PATH isolation)

real_bash=$(command -v bash) is captured before PATH="$empty_path_dir" scopes in. The subshell runs the real bash binary, not a PATH-resolved one. Correct.

GitHub Actions

No .github/workflows/ files changed in this PR.

Credentials / secrets / network

No network calls, no external API invocations, no credential handling, no secrets referenced in any changed file.

---

Two prior SUGGESTION-level observations confirmed still valid

Both were already reported in the earlier automated security reviews on this PR; I list them here for completeness, not as new findings.

1. CONFLICT_SCAN_WINDOW non-numeric value silently produces zero candidates (L120) — a CI export or .envrc that sets this to an empty string or non-number causes the window width to evaluate to 0 in awk, and the scan emits "No conflict candidates found." with exit 0. Because the script is advisory and always exits 0, no gate fires and the failure is silent. Not a code-execution surface; impact is a missed audit, not a security breach. Confidence: medium.

2. Filenames containing | produce structurally malformed output rows (L198) — the awk END block concatenates raw file paths into |-delimited output without sanitizing them. A path containing a literal | adds an extra field delimiter. The entity field and flags are safe (CamelCase regex and hardcoded strings, respectively). No code execution; risk is limited to downstream tooling that splits on |. Confidence: low.

No new security findings at this HEAD.

[claude]

Claude finished @kyle-sexton's task in 4m 10s —— View job

---

Code Review — PR #1343 (latest push)

• Read CLAUDE.md guidelines
• Review latest commit diff (b8ce5d4, f125c59, c3f606c)
• Read changed files
• Verify prior review findings against current source
• Synthesize and post findings

---

Summary

b8ce5d4 closes seven of the open review findings across conflict-scan.sh, conflict-criteria.md, and SKILL.md. f125c59 / c3f606c trim SKILL.md to fit the line budget. All seven are resolved correctly. Three items from earlier reviews remain open.

---

Resolved — confirmed against current source

1. Postposed prohibitions (conflict-scan.sh) — Fixed.
The new postwindow parameter passes post-entity text (from pad, already lowercased) to classify(). The caller truncates it at the first sentence-ending punctuation mark before passing it, so `WebFetch` must not be used classifies as a prohibition while a trailing clause past a . still does not. The mstart/mlen copy is essential here: match(post, /[.;!?]/) clobbers RSTART/RLENGTH, and the old code's loop advance would have used the wrong offsets. The copy lands before any subsequent match() call — correct.

Window offset accounting for postwindow: substr(pad, e + 2, w) — e is the absolute entity-end in line (1-indexed); pad = " " tolower(line) " " shifts by one, so e + 2 is the character immediately following the entity in pad. Correct.

Case 17 and 18 in the test suite pin both halves (catches / must-not-flag). ✓

2. Single-word tool identifiers (conflict-scan.sh) — Fixed.
ENTITY_ERE gains the `[A-Z][a-z]+` alternative. gsub(//, "", ent)` strips backticks so a backtick-wrapped and a bare CamelCase mention of the same tool share the same bucket key. Case 21 pins this pairing. Requiring backticks for single-word matches is the right discriminator — bare sentence-initial capitals (Case 20) are suppressed by the absence of backticks. ✓

3. Opt-in as subject vs. gated condition (conflict-scan.sh) — Fixed.
CONDITIONAL_ERE is added, and suppression now requires window ~ gated && window ~ conditional. "Never use `X` for opt-in prompts" matches GATED_ERE (the opt-in token) but not CONDITIONAL_ERE (no "only when", "unless", "requires", etc.), so it is classified as a prohibition — not suppressed. Case 22 pins this. ✓

4. Auto-memory routing gap (conflict-criteria.md) — Fixed.
The routing table now correctly reads "Anything else — including any pair with a ~/.claude/ side, and any pair involving auto-memory" belongs to I12. The justification (C6's check text names only "CLAUDE.md, CLAUDE.local.md, and rules files") is sourced correctly from the C6 criteria file. The old table's silent gap — routing MEMORY.md contradictions to C6, which never checks them — is closed. ✓

5. Type D / Gate 1 contradiction (conflict-criteria.md) — Fixed.
Split-brain is removed from the conflict type taxonomy and reclassified as "orphaned instruction drift — not a contradiction today, but the state a contradiction grows out of." The gate 1 / Type D contradiction (a co-residency gate failure means the pair can never be a finding, so Type D was unreachable) is resolved correctly. ✓

6. Residency table incomplete for inventoried surfaces (conflict-criteria.md) — Fixed.
The co-residency table now covers skill bundled reference//context/ files, agent definitions, skill fields in agent definitions, prompt-type hooks (UNVERIFIED), and output styles (UNVERIFIED). The UNVERIFIED entries are the right posture — the hooks and output-styles pages were not fetched, so reporting residency-unknown rather than guessing a load model is consistent with how the precedence table handles silent cases. Agent definitions co-loading with the full CLAUDE.md hierarchy is cited from the subagents "What loads at startup" page. ✓

7. Example 2 (same-file non-conflict) (conflict-criteria.md) — Fixed.
The example is reclassified as "a near-miss the gates correctly reject — description-versus-body divergence." The analysis is accurate: gate 3 fails because omitting a capability does not prescribe an action incompatible with performing it. Keeping it as a calibration case (an auditor that grades summary omissions as contradictions will bury real findings) is more useful than removing it. ✓

---

Still open

Three items from earlier reviews were not addressed in this push. None block the advisory function of the skill, but two of the three are operator-facing and worth closing before merge.

1. mapfile requires bash 4+ — not guarded or documented

conflict-scan.sh:124:

mapfile -t rows < <(

mapfile is a bash 4.0 builtin. macOS ships bash 3.2 by default; #!/usr/bin/env bash resolves to it. The Gotchas section in SKILL.md still names only Windows/Git Bash. An operator on macOS gets mapfile: command not found with no guidance. Either add a version gate (after the grep check):

if (( BASH_VERSINFO[0] < 4 )); then
  echo "ERROR: bash 4+ required (macOS ships 3.2 — install bash via Homebrew)" >&2
  exit 2
fi

…or add a macOS note to the Gotchas section alongside the Git Bash line. Fix this →

2. Missing awk guard

The script exits 2 when grep is absent (line 73–76) but has no matching command -v awk check. awk is equally required. The test suite already guards its own awk check (lines 48–51); the script itself would produce an opaque error from the pipe. Fix this →

3. CONFLICT_SCAN_WINDOW unvalidated (low severity)

conflict-scan.sh:120:

WINDOW_CHARS="${CONFLICT_SCAN_WINDOW:-60}"

A non-numeric value (empty string, abc, -1, or an accidental CI export like \n) causes awk's substr() width to evaluate to 0, shrinking the polarity window to nothing. The scan exits 0 reporting "No conflict candidates found" with no diagnostic — complete false-negative suppression. Suggested guard:

[[ "$WINDOW_CHARS" =~ ^[1-9][0-9]*$ ]] || WINDOW_CHARS=60

---

One minor observation

CONDITIONAL_ERE uses requires? (matching "require"/"requires") while MANDATE_ERE uses require[ds]? (also matching "required"). An instruction like "Use `X` when user_config.fetch is required" would match MANDATE_ERE (making it a mandate candidate) but not CONDITIONAL_ERE (failing the suppression check). This is a narrow edge case — "required" as a conditional gate marker is unusual phrasing — and the precision-first design documented in the PR accepts these kinds of gaps. Noted for the lane's first refinement step.

---

Overall

The seven targeted fixes are all correct and well-tested. The core logic additions — postwindow sentence truncation, backtick entity form, CONDITIONAL_ERE double-gate, C6 boundary redrawn on actual population — are mechanically sound. Items 1 and 2 above are the only gaps with operator-visible failure modes; item 3 is a silent false-negative risk worth a one-liner guard.
| Branch

[claude]

Claude finished @kyle-sexton's task in 2m 42s —— View job

---

Security Review — PR #1343 (HEAD c3f606c)

• Load tools
• Review PR diff
• Read changed files (conflict-scan.sh, conflict-scan.test.sh, conflict-criteria.md, SKILL.md, plugin.json, CHANGELOG.md)
• Analyze for security vulnerabilities
• Post findings

---

Scope: 7 changed files across 5 commits. HEAD c3f606ce7e782a986d2cd1813b7c9de257042608.

No CRITICAL or IMPORTANT findings.

---

What was checked — latest commits (b8ce5d4, f125c59, c3f606c)

New entity-matching logic (b8ce5d4)

ENTITY_ERE now includes `[A-Z][a-z]+` as a second alternative for backtick-wrapped single-word tools. The pattern is a compile-time shell string literal, passed to awk via -v entpat. Awk's -v applies C-escape-sequence expansion — backtick has no special meaning in that expansion set (\n, \t, \\, \", \a, \b, \f, \r). No injection surface.

gsub(//, "", ent)strips the backtick delimiters before using the entity as an associative-array key. After stripping, the entity string contains only[A-Za-z]characters — it is never passed tosystem(), | cmd`, or any awk execution primitive. Safe.

Dual-condition opt-in suppression (b8ce5d4)

GATED_ERE and CONDITIONAL_ERE are both compile-time constants. The two-condition check (window ~ gated && window ~ conditional) applies both against file content treated as data. No injection surface.

postwindow truncation (b8ce5d4)

post = substr(pad, e + 2, w)
if (match(post, /[.;!?]/)) post = substr(post, 1, RSTART - 1)

The regex /[.;!?]/ is a hardcoded literal; it is not derived from file content. The match() call applies it to post, a substring of the lowercased, space-padded line. No injection surface. Arithmetic (e + 2, RSTART - 1) operates on awk integers; no overflow concern.

New test cases 17–22 (b8ce5d4)

All use mktemp -d with the existing EXIT trap. Fixture content is heredoc-written. Case 16 PATH isolation (real_bash=$(command -v bash) captured before the stripped PATH) is unchanged and correct.

SKILL.md line-count fix (f125c59, c3f606c)

Prose edits only — removed duplicate sections to satisfy the line budget. No execution surface.

---

Two prior SUGGESTION-level findings — confirmed still open at HEAD

Both were reported in earlier automated reviews and remain unaddressed.

SUGGESTION — Confidence: medium

CONFLICT_SCAN_WINDOW with a non-numeric value silently produces zero candidates

conflict-scan.sh L120

WINDOW_CHARS="${CONFLICT_SCAN_WINDOW:-60}"

WINDOW_CHARS is forwarded to awk via -v w="$WINDOW_CHARS" without numeric validation. A non-integer value (empty string, abc, -1, a CI export like \n) causes every substr() width argument to evaluate to 0 in awk, shrinking the polarity window to nothing. The scan then exits 0 emitting "No conflict candidates found." — complete false-negative suppression with no diagnostic. The advisory-only / always-exit-0 contract means no gate fires and the silent failure goes unnoticed.

Suggested guard before the mapfile call:

[[ "$WINDOW_CHARS" =~ ^[1-9][0-9]*$ ]] || WINDOW_CHARS=60

Fix this →

---

SUGGESTION — Confidence: low

Filenames containing | produce structurally malformed output rows

conflict-scan.sh L198

print a[1] ":" a[2] "|" b[1] ":" b[2] "|" ent "|" flags

File paths are concatenated into the four-field |-delimited output without sanitization. The entity field is safe (the gsub(//, "", ent)strip plus the[A-Za-z]-only result of matching ENTITY_EREmeans no|can appear there); flags are hardcoded strings. A path containing a literal|— valid on Linux/macOS — embeds an extra delimiter. No code execution; risk is limited to downstream tooling that splits on|. Real-world exposure is low since |` in config file paths is unusual.

---

Confirmed clean

• No eval, no system(), no | getline from file content, no dynamic command construction
• All $@ paths gate through [[ -f "$file" ]] before reaching awk's getline; file content is processed as pure data
• All six ERE patterns (entpat, prohibit, mandate, exception, gated, conditional) are compile-time string literals; none derive from file content or user input
• mapfile -t rows < <(awk ... | sort -u) reads from a process substitution; no user-derived code is executed
• printf '%s\n' "${rows[@]}" is safe for any array element content
• Test script: mktemp -d with mode-0700 directory and EXIT trap; no world-readable temp files; Case 16 PATH isolation is correctly scoped
• No network calls, no credential handling, no secrets referenced in any changed file
• No .github/workflows/ files changed
• ${CLAUDE_PLUGIN_DATA} used for report persistence (not a hardcoded ~/.claude/... path)
• SKILL.md marks the pass report-only with no --fix path and no auto-apply mechanism

No new security findings at HEAD c3f606c.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c3f606ce7e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ee6d22c49c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 27d3101599

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Warning

Automated security review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/30179832046
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":2265,"total_cost_usd":0}

Re-running the job, or pushing a new commit, will retry the review.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/30179832035
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":1911,"total_cost_usd":0}

Re-running the job, or pushing a new commit, will retry the review.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f010dc8227

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude encountered an error after 3s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e0d5ecbed6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[chatgpt-codex-connector]

💡 Codex Review

claude-code-plugins/plugins/claude-config/skills/audit-instructions/SKILL.md

Line 89 in 604f905

(`~/.claude/projects/<project>/memory/`, owned by `claude-memory`), org-managed policy CLAUDE.md,

Resolve relocated auto-memory before conflict inventory

When CLAUDE_CONFIG_DIR is set, this hard-coded default path does not record the current project's auto-memory as a skipped surface. Phase B2 consumes Phase A's inventory, while I15 requires skipped surfaces to remain read-only conflict participants, so a contradiction involving the relocated MEMORY.md disappears from the audit even though the routing table retains auto-memory in I15; resolve the store beneath the configured root before recording it.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74f8cd7c2a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep nested project memory pairs in I15

When either half is a nested project CLAUDE.md or CLAUDE.local.md, this exclusion still routes the pair to C6 because nested files are also project-scope. Fresh evidence after the earlier routing fix is this remaining broad clause: reference/conflict-criteria.md:51-57 now limits C6 to root-level files because its discovery uses find . -maxdepth 1, so following this skill-level instruction still causes nested conflicts to be graded by neither pass.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Separate coordinated directives before classifying polarity

When opposite directives are coordinated with and rather than a listed contrastive, they still share polarity: Always use Readand never useBash for file inspection. classifies Read as prohibited because its trailing window contains never, so pairing it with Never use Read`` makes --count return 0. Fresh evidence beyond the resolved `but` case is this common `and never` form; recognize a coordinated new directive without treating every ordinary `and` as a boundary.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Document awk and sort in the setup remediation source

On a minimal environment missing awk or sort, setup now correctly reports a failure, but its apply action explicitly sources install guidance from the README Requirements section, which still says the bundled scripts require only jq and additionally curl; the explicit remediation list likewise covers only those two tools. Fresh evidence after the earlier setup-check fix is that consumers are now told about these failures without the promised platform remediation, so add the new prerequisites to the public Requirements and apply guidance.

Useful? React with 👍 / 👎.